[Cfrg] BLS - proofs of possession may not be enough?

[Kobi Gurkan <[e-mail]>]

Hello all,

I stumbled upon a property of BLS-based protocols which use proofs of possession which seems to break an expected behaviour of aggregated BLS signatures.

In a nutshell, a malicious signer might register multiple keys, together with proofs of possession, that sum up to zero and therefore claim they participated in a signature while they haven't.

I have a small write-up about it here: https://www.overleaf.com/read/kgjyvjzktcdv <https://www.overleaf.com/read/kgjyvjzktcdv>

It seems that delinearization, as described in https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html <https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html>, is strictly stronger than proofs of possession in terms of security - as this attack does not effect protocols that use them.

To be clear - it's not a rogue public key attack nor a forgery. It breaks the expectation that if I receive a signature such that the aggregated of some public keys verifies it, then I know that this signature was the result of an aggregation of individual signatures by each of the signers corresponding to those public keys.

Would appreciate your opinion on it and whether we should reflect this in the IETF BLS signature document, so that protocols wouldn’t be vulnerable to it.

Best,
Kobi