Subset-Optimized BLS Multi-signature with Key Aggregation
摘要
We propose a variant of the original Boneh, Drijvers, and Neven (Asiacrypt’18) BLS multi-signature aggregation scheme, which is best suited to applications where the full set of potential signers is fixed and known and any subset I of this group can create a multi-signature over a message m. This setup is very common in proof-of-stake blockchains where if you assume a total of 3f validators, a \(2f+1\) majority can sign transactions and/or blocks and is secure against rogue-key attacks without requiring a proof of key possession mechanism. In our scheme, instead of randomizing the aggregated signatures, we have a one-time randomization phase of the public keys: each public key is replaced by a sticky randomized version (for which each participant can still compute the derived private key). The main benefit compared to the original Boneh et al. approach is that since our randomization process happens only once and not per signature we can have significant savings during aggregation and verification without requiring a proof of possession. Specifically, for a subset I of t signers, we save t exponentiations in \(\mathbb {G}_2\) at aggregation and t exponentiations in \(\mathbb {G}_1\) at verification or vice versa, depending on which BLS mode we prefer: minPK (public keys in \(\mathbb {G}_1\) ) or minSig (signatures in \(\mathbb {G}_1\) ). Interestingly, our security proof requires a significant departure from the co-CDH based proof of Boneh et al. When n (size of the universal set of signers) is small, we prove our protocol secure in the Algebraic Group and Random Oracle models based on the hardness of the Discrete Log problem. For larger n, our proof also requires the Random Modular Subset Sum (RMSS) problem.