BLS Rogue attack: how does e(x^b, y)=e(x, y^b)?

joaquinlpereyra

10/10/23, 3:31 PM

In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $m$ knowing only the victims public keys.

Reading about the maths behind it, this justification is done:

After some juggling math around, everything is clear but the middle equality. What allows one to assert that $e(g_1, H_0(m)^b) = e(g_1^b, H_0(m))$?

My algebra is far from the strongest, but I don't seem to recall any property of linear combinations that would allow you to assert such a strong equality. Any help? Thanks.

0 + 5

bls-signature

Morrolan

10/10/23, 4:08 PM

That is due to the fundamental properties of bilinear pairings, as used in the BLS signature scheme. See e.g. [this answer](https://crypto.stackexchange.com/questions/99761/properties-of-the-bilinear-pairing-groups)

kelalaka

10/10/23, 10:16 PM

@Morrolan I was expecting you to write an answer to this. Now cast for a dupe!

Morrolan

10/11/23, 11:12 AM

@kelalaka ah no, indeed my intention had been to consider this as a duplicate - I saw little point in writing an answer which is a copy of one I've written before. :)

kelalaka

10/11/23, 11:14 AM

@Morrolan maybe a little update to your answer about the attack will make it clear. Like: this property is missed and BLS had rogue attack

joaquinlpereyra

10/11/23, 5:41 PM

Super helpful @Morrolan, thanks for pointing me in the right direction! Indeed this is a duplicate and I have marked it as such, hopefully useful for google to redirect more people there.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: BLS Rogue attack: how does e(x^b, y)=e(x, y^b)?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.