Skip to content

Commit

Permalink
strawman patch for cfrg#38
Browse files Browse the repository at this point in the history
  • Loading branch information
Antonio Sanso committed Jun 3, 2021
1 parent e2aa452 commit fa5ed69
Showing 1 changed file with 19 additions and 12 deletions.
31 changes: 19 additions & 12 deletions draft-irtf-cfrg-bls-signature.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -753,7 +753,7 @@ Procedure:
## CoreAggregateVerify

The CoreAggregateVerify algorithm checks an aggregated signature
over several (PK, message) pairs.
over several (PK, message) pairs. This function first aggregates public keys of the same message.

~~~
result = CoreAggregateVerify((PK_1, ..., PK_n),
Expand All @@ -771,17 +771,24 @@ Outputs:
Precondition: n >= 1, otherwise return INVALID.
Procedure:
1. R = signature_to_point(signature)
2. If R is INVALID, return INVALID
3. If signature_subgroup_check(R) is INVALID, return INVALID
4. C1 = 1 (the identity element in GT)
5. for i in 1, ..., n:
6. If KeyValidate(PK_i) is INVALID, return INVALID
7. xP = pubkey_to_point(PK_i)
8. Q = hash_to_point(message_i)
9. C1 = C1 * pairing(Q, xP)
10. C2 = pairing(R, P)
11. If C1 == C2, return VALID, else return INVALID
1 compute the l distinct messages m_1, m_l
2. Aggregate the public keys of the same message to l sets of public keys QK_1_1, ...,QK_1_m, QK_2_1,..., QK_2_p, ..., QK_l_1,...,QK_l_q
3. R = signature_to_point(signature)
4. If R is INVALID, return INVALID

This comment has been minimized.

Sign in to view

Copy link
@veorq

veorq Jun 4, 2021

Does INVALID cover the case of a point to infinity? Don't think so, shouldn't it?

This comment has been minimized.

Sign in to view

Copy link
@asanso

asanso Jun 4, 2021

Owner

@veorq as you can see this comes directly from the spec, i did not really changed this part

This comment has been minimized.

Sign in to view

Copy link
@zhenfeizhang

zhenfeizhang Jun 7, 2021

Does INVALID cover the case of a point to infinity? Don't think so,

Agreed.

signature_to_point is a wrapper of octets_to_point(ostr)

returns the point P corresponding to the canonical representation ostr, or INVALID if ostr is not a valid output of point_to_octets. This operation is also known as deserialization.

So INVALID will be returned if the deserialization fails.
A point to infinity, if encoded correctly, is not a deserialization fail.

shouldn't it?

Good question. I think we should do it because it is cheap.
OTOH, IIRC, a signature of infinity point will fail since KeyValidate here during CoreVerify does rule out the keys that can validate signatures at the infinity point, so it is fine to not do it.
5. If signature_subgroup_check(R) is INVALID, return INVALID
6. C1 = 1 (the identity element in GT)
7. for i in 1, ..., l:
8. aggregate = pubkey_to_point(QK_i_1)
for j in 2,...,len(QK_i):
9. next = pubkey_to_point(PK_j_k)
10. aggregate = aggregate + next
11. RK_i = point_to_pubkey(aggregate)
12. If KeyValidate(RK_i) is INVALID, return INVALID

This comment has been minimized.

Sign in to view

Copy link
@veorq

veorq Jun 4, 2021

This looks inefficient, as we do 1) point_to_pubkey() and 2) a pubkey_to_point() with the result in KeyValidate(), so we could directly save two conversions.
13. xP = pubkey_to_point(RK_i)
14. Q = hash_to_point(m_i)

This comment has been minimized.

Sign in to view

Copy link
@veorq

veorq Jun 4, 2021

Do we need to validate this point as well?

This comment has been minimized.

Sign in to view

Copy link
@asanso

asanso Jun 4, 2021

Owner

@veorq same here I did not change this part

This comment has been minimized.

Sign in to view

Copy link
@zhenfeizhang

zhenfeizhang Jun 7, 2021 

hash_to_point, a function whose interface is described in (#definitions). When the signature variant is minimal-signature-size, this function MUST output a point in G1. When the signature variant is minimal-pubkey size, this function MUST output a point in G2. For security, this function MUST be either a random oracle encoding or a nonuniform encoding, as defined in [@I-D.irtf-cfrg-hash-to-curve].

It is assumed that hash_to_point already produces a group element rather than a curve element.
15. C1 = C1 * pairing(Q, xP)
16. C2 = pairing(R, P)
17. If C1 == C2, return VALID, else return INVALID
~~~

# BLS Signatures {#schemes}
Expand Down

0 comments on commit fa5ed69

Please sign in to comment.