Alice wants to sign a document In earlier chapters, we have seen how to do this with RSA and ElGamal signatures. The BLS method, due to Boneh, Lynn, and Schacham, uses pairings.
We use a supersingular elliptic curve and point as in Section 22.1. To set up the signature scheme, we’ll need a public hash function that maps arbitrary length binary strings to multiples of A little care is needed in defining since no one should be able, given a binary string to find with See Exercise 7.
To set up the system, Alice chooses, once and for all, a secret integer and computes which is made public.
Alice’s signature for the message is which is a point on ...