Chih-Cheng | BLS Signatures | 2019-03-27

Yeah right so I have a note and some snippets there so if you forget something you can look look it up back so epically POS six so because recently always a little bit we are moving the POS api's for the training Phoenix - crying - Hawaii 3 3 it's our photography library in Python so I I have spent some time to read the POS signature and related of theory and so today we we can like introduce it really really slow and and I don't want to introduce the heavy detail of pairing function but let's get a really really high level overview of all these features Steamworks so vos actually stand for two things most of time we are talking about the four mainland and Johnson signature skin in 2003 and but it also pays on a cryptic curve that is called Pareto Linscott so this this curve gives us some parameters of field i prime field we are going to use and a critic equations define so so what we need to know is the video monitors is to power it states 381 days and if you are adding some not for a time right if we have f7 that means the album in EPS only has zero one two three four five six and if you are adding my six five six the next well you have two minus seven again to get bite that's in the zero to six so activities are really on the real member this survey by now and this curve is if I ask you to ask you to it's a complex context member of animal feel so you can see so with this curve defined there's a subgroup called g1 and another circle called G 2 so it's integer its integer so you can please if you have a if you have this note please drag it to the right to make sure is that it's an integer okay and so we also have a another general energy to generate if you raise g2 to power of rewriting G 252 and for if you magnify it two two three four five and if you can generate all the elements in the big ginger poop so if you have a note please track the coordinate and see here this is a complex number so here you have a imaginary part and real part here so okay so so this is the this is we'll use it later any questions so far okay okay so yeah so it maps from TV to group admin intuitive group and a Cartesian prana with admin in G 1 and Method 2 the GT which is a property called by linearity the binary means [Music] but this is this has some feet health and yeah when I said wait he we multiply he ignites this a integer and he is a human is a coordinate if so when I say I want to will defy the point multiply like a point e times to entitle this point and if I want to recall this point I need to family wants and to itself again so what okay I need that expected her picture all right so when you're adding up all cyclists who when an E and Q the result is this point and if you you know ending if you are going into an equal magnitude so that's that's what multiplication so so and outside operation at you so okay then we can talk about us the signature so we first need a hash function that met your message in a teacher you need to find you need to sign and verify things right and poverty and poverty so process we have activities generated so you choose to abandon onward is a member of 0 to 2 minus 1 and then so is it keep this a secret or anyone else know and then you make a genuine actually 1 to 2 alpha power so you have this public key H so to sign a message you just rest hash of the message to half a power so this is the signature so it's very simple if comparing to the ECB s J if you know how to do the kind of complicated but signing in POS you just raised raised the hash of message to have a power and to verify so the proof is simple because the left-hand side of the pairing of signature and G 1 it is when you single send verification works alright anywhere okay so let me show you some code here so in Python we have element in G 1 and G 1 G 1 is a real number for the net wide so you have a exporter and y coordinate we can compress the y coordinate into one piece so because of exponent a and y coordinate it has a 391 piece actually we come in with the whole pipes also you need rehab 384 cleats to store the 381 is and then the next step let's refer them to 48 bytes but the Cornell accent why each thanks for the advice but we can we don't need the y-coordinate we just need what fit on a white coordinate and put it in the rest of three-fifths of the x coordinate so we can compress the element in Gy in original x coordinate y coordinate each thanks for the advice and now become a compressed coronary only have 48 bytes so the public in here only have 48 right this is equivalent to the red one so in a code base we use this type - so okay so public is for the advice and the signature is M and in G - so it's a complex number the X for the name you have a real part and imaginary part each X 48 bytes and so let's see you have next order and y-coordinate but you can also come press the y coordinate so you only have an x coordinate but it takes like 96 bytes right that means let me sign something then in sign something so so so - so let's as 4py ECC import POS no much [Music] so let's say we have a private key that's it's a number one two three and then let's have a public key so use the private to public key okay you get a public key here so it's a it's a 48 bytes public key then let's say we have a message yes we have a 32 bytes message hash and we can find this message with your public key and you need at oh man this domain can help you versioning your your signature scheme like you can auto lenders to be a vice guys like divides like on a message oh sorry sorry I have to use the private key sighing yeah Parvati alright so this is the signature 96 bytes right so to do an aggregation we TCPS a you have T like your poverty as 32 by 32 by 32 bytes if you have excuse me 32 times 3 but you can you know as you can compress it into just one clarify so here is another code example to show how to sign a aggregated nature and happy trees right yeah okay so the aggregation is curved adding remember the signature is born g2 so you have a so so here's here's a gnome attack to this this signature scheme the attack so nice to find a message that an evil pop-pop can generate a grouchy we look like this and fancy design of message to so actually it's paprika Solar Probe prophase eg is here the Baptist every faction that I think they all signed the same message we can check we require by latest to prove they have the private key to their poverty when then it has their ether in one contract so a bad neighbor cannot just pop up from nowhere and join a lovely face oh I also cites this message so yeah but if you if dude if you don't have this if you don't have this poverty's you can use also use the 2008 version of a POS signature it's it's more a little bit more Hawk overhead but it can prevent about the Rakhi attack okay so what are the properties of PRS signature so it it's relatively if you know you know considered pairing the pair invention part it had the pairing button is the most costly operation in the you know verification but besides that everything everything is simple and also yes another important property is it's deterministic you don't need many members in ECDSA so I have italic mentioning the burdens talk it's the NXT birthday the Lakers can try different random numbers and to to sign the message that that favors the stators so if you you have these different deterministic properties you don't have to worry about finding the probability of the signature then sir profit is fine restaurant inertia and aggregation signature friendly and also the most important is it no matter how much keys and signature you have you can always every get it into sense signature in one signature and one public key so you can save a lot of sites they have size and only overhead is when you have an additional poverty and signature you might need one thing to indicate okay like you have millions of incubators you'll need one plea to say okay who who who in these 1 million vehicles find financing so you need one signal for sign and also if when you have a digital 1p you need to you need one curve addition our petition in the function so that that's how it caught yeah yes yes yes yes yes so so like I am indicating the one number validator number 1 3 & 5 signing the signature and some pins to indicate that this time so you know if you've already stored all the public keys in your computer you know you know me today you don't need those when they don't send you the public again you just need Fitz to indicate by side yes maybe so forget someone mentioned in Berlin he says you can just subscribe those who didn't sign so you need if if like you have many materials like we require to sort of vendetta sign so you can you can just keep track of who's not sign so you don't need a lot of things not it's not always one turn out to start but a minimum you need so so currently a professor temple a team are working on a draft to standardize the POS signature scheme so like besides all the this curve parameter needs to be standardized also how you compress coordinates because the signer and very bio needs to know how to decompress your your your your coordinates and also also maybe the domain so there are a bunch of things to standardize so here is a draft so yeah so this is we can inspect there's a standard in in a future also we are working on an optimization in our Python library library I just show you it's a little bit slow yeah we are working on how to make it faster so that's all if you are new to be a signature but you want to like start reading it I recommend the mathematical formula here but notice that when you are reading those documents they are using because if attractive and have different definition in G 1 and G 2 maybe they swap or something I used to do and you want sometimes actually you can switch switch key and signature because G 1 and G 2 G 1 in this in this node G 1 is real number it is a small and faster and the T 2 is a complex number so you can mention of notification and all of your operation are relatively slower so we use public key 41 and 42 when you can swap swap them determine depending on your application what's your performance bottleneck so ya hit track of those those groups doing a lot more technical detail now it is doesn't research off maybe a little bit how that tip and then operatives and money or you can listen to this like 30 minutes a talk with her again just in talking for life yeah questions yes so yeah it's a bang bang black magic I haven't dived into the radical so it have a it has an expensive operation of leader group and also it has very expensive operation called final exponentiation so that that's one way to optimize the performance in there [Music] yes yes now that reefs also the result of pairing is is not not important that the pairing the output of herring is in 1940 the 96th line is the signature right that's the hash hash your message to the group true and raise to power of alpha yeah pairing pairing only bet to check the signature is actually active now that how I mentioned we we don't really need that output so the actual implementation in here is actually let me show you the yeah so so what if we - this part and check it is ending its knowing I'm the inverse of this identity the dark painting is pairing and next decisional so we have a three three kind of problems one is institutional baby have no problem when I give you to powera and to Harvey and the determine whether a number is cheap our ad and another problem is called computational diffie-hellman problem is when I give you a to power a and G power P you can compute G power ad and even color is the discrete logarithm so you have a PDS here here here and here and pairing banks the pH here at EDX is here but thanks to the metal tools we already hard so you can you still have a spike TV in your path you can do many amazing stop between do any of our questions thank you