[CFRG] Re: Pairing-Friendly Curves: Open Questions Before Draft Update

["Bellebaum, Thomas" <[e-mail]>]

// Including the blind signatures authors here. May I ask you to please confirm this attack or point out the error?

> For blind signatures:
> 
> - The commitment C is validated to not be Identity_G1 in octets_to_commitment_with_proof, line 6. There is no subgroup check, which may or may not be an oversight. There is an implicit subgroup check provided by the associated proof (which asserts that the prover knows how to generate C through the set of generators), but if we go for this logic then there is no need to perform a subgroup check for all three of Abar, Bbar and D above...

Actually, no. I think there is a bug. The cofactor h for BLS12-381 G1 is less than 2^64 according to
https://www.rfc-editor.org/rfc/rfc9380.html#name-bls12-381-g1

By taking any point of order at most h (except for the identity) as "commitment" and setting s^ = m^_i = 0 for all i, the verifier will basically check that

cp == calculate_blind_challenge(commitment, commitment * (-cp), blind_generators, api_id)

The prover exploits that as follows:
Pick x at random and set Cbar <- commitment * x. and cp = calculate_blind_challenge(commitment, Cbar, blind_generators, api_id).
Now check that Cbar == commitment * -cp, which is true with probability roughly 1/order_of_commitment assuming calculate_blind_challenge is a random function. Repeat if this is not the case.

Now (0,...,0,cv) is a valid proof for "commitment", and the signer would accept a non-subgroup point for signing.

-- TBB