Subject: [Cfrg] Adoption call for draft-boneh-bls-signature

From: "Paterson Kenneth" <[email-masked]>
Date: Fri, 26 Apr 2019 08:09:31 +0000

Dear CFRG,

(This is the second of two adoption calls today.)

This email starts a 2-week adoption call for:

https://tools.ietf.org/html/draft-boneh-bls-signature-00
BLS Signature Scheme

Please give your views on whether this document should be adopted as a CFRG draft, and if so, whether you'd be willing to help work on it/review it.

Thanks,

Kenny (for the chairs)

---

From: Benjamin Beurdouche <[email-masked]>
Date: Fri, 26 Apr 2019 19:48:35 +0200

Dear Kenny, Dear all,

I’d like to support the adoption of this draft.

B.

> On Apr 26, 2019, at 10:09 AM, Paterson Kenneth <[email-masked]> wrote:
> 
> Dear CFRG,
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Russ Housley <[email-masked]>
Date: Fri, 26 Apr 2019 17:03:04 -0400

I support adoption.

I find the Verify-Aggregated capability interesting, especially the variant where the same message is signed by multiple parties, and the aggregate signature can be checked in one go:

       Verify-Aggregated(PK_1, ..., PK_n, msg, sigma)

If this work is adopted, I will review.

Russ

> On Apr 26, 2019, at 4:09 AM, Paterson Kenneth <[email-masked]> wrote:
> 
> Dear CFRG,
>

---

From: Tony Arcieri <[email-masked]>
Date: Sun, 28 Apr 2019 23:14:46 +0200

I support the adoption of this draft.

On Fri, Apr 26, 2019 at 10:11 AM Paterson Kenneth <
[email-masked]> wrote:

> Please give your views on whether this document should be adopted as a
> CFRG draft, and if so, whether you'd be willing to help work on it/review
> it.
>
> Thanks,
>
> Kenny (for the chairs)
>
>

-- 
Tony Arcieri

---

From: John Mattsson <[email-masked]>
Date: Mon, 29 Apr 2019 16:38:03 +0000

I support adoption.

John

-----Original Message-----
From: Cfrg <[email-masked]> on behalf of Russ Housley <[email-masked]>
Date: Friday, 26 April 2019 at 23:03
To: Paterson Kenneth <[email-masked]>
Cc: IRTF CFRG <[email-masked]>
Subject: Re: [Cfrg] Adoption call for draft-boneh-bls-signature

    I support adoption.

    
    
    Russ

    _______________________________________________
    Cfrg mailing list
    [email-masked]
    https://protect2.fireeye.com/url?k=22859f6d-7e0c4541-2285dff6-0cc47ad93da2-26a432020ca31da8&u=https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Aaron Zauner (azet)" <[email-masked]>
Date: Mon, 29 Apr 2019 18:46:26 +0200

Hi,

> On 26.04.2019, at 10:09, Paterson Kenneth <[email-masked]> wrote:
> 
> Dear CFRG,
> 

I support the adoption of the draft as a CFRG document. I'm pressed for time at the moment but may get to review/comment on it in the future.

All the best,
Aaron

---

From: Dan Brown <[email-masked]>
Date: Mon, 29 Apr 2019 18:16:50 +0000

> -----Original Message (abbreviated) -----
> From: Cfrg <[email-masked]> On Behalf Of Paterson Kenneth
> 

I support adoption, but with some minor reservations.

1. A clear-as-possible problem statement is needed. What problem does BLS
solve? How does it add value compared to alternatives?  At the moment, it is
a little unclear to me (see below), but maybe more reading will help me.

2. Aggregation is a feature that does not hold for conventional signatures
(RSA, [E[Cd]]DSA).  Therefore, one has to sure that applications of
signatures do not somehow rely on the non-aggregation feature.   For
example, can I defeat proof-of-possession (PoP) by making an aggregate
signature for an aggregate public key (surreptitiously), without actually
knowing the private key?  If so, then how is this bad?  How advantageous to
me is a small aggregate signature if I need to check the revocation online
for each signer in the set?  In what sense is an aggregate signature
non-repudiable, etc. (and if not at all, then can some non-signature
authentication technology be used instead)? Some conventional signatures
allow batch verification, how much value does aggregation add over batch
verification?

3.  A similar level certification chain compression might be possible using
implicit certificates, which uses more conventional ECC.  If correct, then
two questions are reasonable.  Does BLS adds any extra value in certificate
compression compared to implicit certifcates? Is certificate compression is
important enough for CFRG to adopt implicit certificates?

4. Curves with pairings introduce new assumptions upon which security
relies, and thus new risks.  It is extremely difficult to compare these
risks to the added value of BLS, but such a comparison should be attempted,
at least by making both the upside and downside as clear as possible.

5. A catastrophe affecting most of EC and DL groups is possible, though very
unlikely by now.  Even less likely, is that pairing-base curves are the sole
survivors of such a catastrophe.  The best mitigation against such a
catastrophe seems to be multiple-defense, e.g. RSA+E[Cd]DSA+BLS+[and perhaps
XMSS/LMS] ... signature.  This is costly, but some implementations can
support it, so I would support this application of BLS (and other
pairing-base crypto).

6. An estimate the cost/benefit of using BLS in light of the quantum
computer threat is important here.  (This was discussed a little on another
CFRG thread on a pairing curves draft.)

---

From: Gerardo Di Giacomo <[email-masked]>
Date: Tue, 30 Apr 2019 01:51:06 +0000

Gerardo Di Giacomo

From: Cfrg <[email-masked]> on behalf of Tony Arcieri <[email-masked]>
Date: Sunday, April 28, 2019 at 2:15 PM
To: Paterson Kenneth <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [Cfrg] Adoption call for draft-boneh-bls-signature

On Fri, Apr 26, 2019 at 10:11 AM Paterson Kenneth <[email-masked]<mailto:[email-masked]>> wrote:
 Dear CFRG,

https://tools.ietf.org/html/draft-boneh-bls-signature-00<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dboneh-2Dbls-2Dsignature-2D00&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=GIepR9z8-ZaJVGguJ5xifg&m=h9zt_GJ2O-PRIJPqTYQyBgN_Y0O1-foVSWmviTovOvY&s=VDFDDfacsVvaDg74WgGYyc4W-e_A3ymupC4gUky2S40&e=>
BLS Signature Scheme

Thanks,

Kenny (for the chairs)

_______________________________________________
Cfrg mailing list
[email-masked]<mailto:[email-masked]>
https://www.irtf.org/mailman/listinfo/cfrg<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_cfrg&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=GIepR9z8-ZaJVGguJ5xifg&m=h9zt_GJ2O-PRIJPqTYQyBgN_Y0O1-foVSWmviTovOvY&s=i3c0brH1M-Un2tFfiOV4Prkt5g5KI7JaNIMz_OqbBl8&e=>

--
Tony Arcieri

---

From: Marek Jankowski <[email-masked]>
Date: Mon, 29 Apr 2019 00:28:50 +0200

I also support the adoption of this draft. If needed, once adopted I will
review it and may be able to produce testvectors.

Marek.

On Tue, Apr 30, 2019 at 3:51 AM Gerardo Di Giacomo <[email-masked]> wrote:

> *From: *Cfrg <[email-masked]> on behalf of Tony Arcieri <
> [email-masked]>
> *Date: *Sunday, April 28, 2019 at 2:15 PM
> *To: *Paterson Kenneth <[email-masked]>
> *Cc: *"[email-masked]" <[email-masked]>
> *Subject: *Re: [Cfrg] Adoption call for draft-boneh-bls-signature
>
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dboneh-2Dbls-2Dsignature-2D00&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=GIepR9z8-ZaJVGguJ5xifg&m=h9zt_GJ2O-PRIJPqTYQyBgN_Y0O1-foVSWmviTovOvY&s=VDFDDfacsVvaDg74WgGYyc4W-e_A3ymupC4gUky2S40&e=>
> BLS Signature Scheme
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.irtf.org_mailman_listinfo_cfrg&d=DwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=GIepR9z8-ZaJVGguJ5xifg&m=h9zt_GJ2O-PRIJPqTYQyBgN_Y0O1-foVSWmviTovOvY&s=i3c0brH1M-Un2tFfiOV4Prkt5g5KI7JaNIMz_OqbBl8&e=>
>
>
>
>
> --
>
> Tony Arcieri