22.5 Signatures

22.5.1 BLS Signatures

Alice wants to sign a document m. In earlier chapters, we have seen how to do this with RSA and ElGamal signatures. The BLS method, due to Boneh, Lynn, and Schacham, uses pairings.

We use a supersingular elliptic curve E0 and point P0,  as in Section 22.1. To set up the signature scheme, we’ll need a public hash function H that maps arbitrary length binary strings to multiples of P0. A little care is needed in defining H,  since no one should be able, given a binary string b,  to find k with H(b)=kP0. See Exercise 7.

To set up the system, Alice chooses, once and for all, a secret integer a and computes KAlice=aP0,  which is made public.

Alice’s signature for the message m is S=aH(m),  which is a point on ...

Get Introduction to Cryptography with Coding Theory, 3rd Edition now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.