Score:1

# BLS Rogue attack: how does e(x^b, y)=e(x, y^b)?

In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $$m$$ knowing only the victims public keys.

After some juggling math around, everything is clear but the middle equality. What allows one to assert that $$e(g_1, H_0(m)^b) = e(g_1^b, H_0(m))$$?

My algebra is far from the strongest, but I don't seem to recall any property of linear combinations that would allow you to assert such a strong equality. Any help? Thanks.

That is due to the fundamental properties of bilinear pairings, as used in the BLS signature scheme. See e.g. [this answer](https://crypto.stackexchange.com/questions/99761/properties-of-the-bilinear-pairing-groups)
@Morrolan I was expecting you to write an answer to this. Now cast for a dupe!
@kelalaka ah no, indeed my intention had been to consider this as a duplicate - I saw little point in writing an answer which is a copy of one I've written before. :)
@Morrolan maybe a little update to your answer about the attack will make it clear. Like: this property is missed and BLS had rogue attack
Super helpful @Morrolan, thanks for pointing me in the right direction! Indeed this is a duplicate and I have marked it as such, hopefully useful for google to redirect more people there.
I sit in a Tesla and translated this thread with Ai: