Math & Engineering

xn--2-umb.com · 1,918 words · saved by 1 readers

Previously I wrote about several elliptic curve signature schemes. I did not cover pairing based ones. These allow for some great aggregation schemes. so let's cover those now. Let H S :I→S be a hash function mapping some input set I to the output set S. A superscript like H ′ is used to indicate two domain separated hash functions. Securely generating elliptic curve points from binary noise is challenging. The naive solution of multiplying by a generator is not secure, since the discrete logarithm is known. The BLS paper introduced the first solution: repeatedly trying x coordinates until a valid curve point is found. This method is generic but not constant time. Constant time methods exists but are curve specific. Let G 1 , G 2 , G 3 be elliptic curve groups with the same scalar field F, generators G 1 , G 2 , G 3 and a pairing e:G 1 ×G 2 →G 3 . A pairing is a function that satisfies e(a⋅A,b⋅B)=a⋅b⋅e(A,B) and is not the trivial solution e(-,

\gdef\F{\mathbb{F}} \gdef\p#1{({#1})} \gdef\abs#1{\lvert{#1}\rvert} \gdef\set#1{\mathcal{#1}} \gdef\setb#1#2{\{{#1} \mid {#2}\}} \gdef\dummyarg{\operatorname{-}} \gdef\e{\mathrm{e}} \gdef\g{\mathrm{g}} BLS Signatures \gdef\F{\mathbb{F}} \gdef\G{\mathbb{G}} \gdef\g{\mathrm{G}} \gdef\h{\mathtt{H}} \gdef\e{\mathrm{e}} Previously I wrote about several elliptic curve signature schemes . I did not cover pairing based ones. These allow for some great aggregation schemes. so let's cover those now. Background Hash to curve Let \h_{\mathcal S} : \mathcal I → \mathcal S be a hash function mapping some in

Math & Engineering

related reading