Re: [Cfrg] BLS - proofs of possession may not be enough?

[Jeff Burdges <[e-mail]>]

I’d still characterise sum_i sk_i = 0 as an unusual DGK that changes the properties of the signature similarly to any other DKG does.  In particular, any proof-of-possesion security proof should show this does not impact other signers under normal threat models.

As we discussed, there are threat models with non-standard interactions between signatures in which sum_i sk_i = 0 does facilitate attacks, namely when a signer waits for other signers and can be punished for signing too early.  I’ll note however that BLS cannot achieve security for that signer anyways because the earlier signers can subtract their signatures even without any relationship among the secret keys.

> On 17 Nov 2019, at 14:12, Kobi Gurkan <[e-mail]> wrote:
> It seems that delinearization, as described in https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html, is strictly stronger than proofs of possession in terms of security - as this attack does not effect protocols that use them.

I suspect it’s strictly stronger but actually nobody proved this.  An approach for showing that delinearization is stronger than proof-of-possesion might be working in some composability framework, but this gets delicate because classically these handle state poorly.

Jeff