DLOG ⇒ BLS signatures

Algebraic group model · FKL18 · security loss: tight

Statement

In the algebraic group model, with the hash-to-group function modeled as a random oracle, EUF-CMA security of BLS signatures reduces tightly to DLOG: every algebraic forger yields a DLOG solver with essentially the same running time and advantage up to a constant factor — FKL18.

Notes

• Outside the algebraic group model, BLS signatures are EUF-CMA secure in the random oracle model under co-CDH, with a non-tight reduction (co-CDH ⇒ DS) — BLS01; no proof from DLOG is known there.