The following is a method that could possibly allow the prover to reveal messages for which they don't have a signature, taking advantage of the Fiat–Shamir challenge not containing the revealed messages. Let the prover with a signature (A, e, s)
on messages msg_1
, msg_2
and msg_3
, creating an spk revealing only msg_1
. Going through the spkGen process the prover will calculate
C2_prover = D*(-r3~) +H0 * (s~) + H_2 * m~_2 + H_3 * m~_3
The proof value will be,
spk = (Abar, A’, D, c, e^, r2^, r3^, s^, m^_2, m^_3)
From the verification process we know that if T = P1 + H_1 * msg_1
then
#EQ1: T*c + D * (-r3^) + H0*s^ + H_2 * m^_2 + H_3 * m^_3 = C2_prover
Let the prover now calculate the following,
c’ = c ^ -1 mod q
msg_adv = m^_2 * c'
and instead of revealing spk, they send spk2
,
spk2 = (Abar, A’, D, c, e^, r2^, r3^, s^, m^_3)
with revealed messages msg_1
and msg_adv
.
The verifier receiving spk2
and msg_1
, msg_adv
will calculate C1_verifier
, C2_verifier
and check the pairing equality. Note that since Abar, A’, D, c, e^, r2^
remain the same between spk
and spk2
, C1_prover = C1_verifier
and e(A', PK) = e(Abar, P2)
. To calculate C2_verifier
the verifier will first calculate T2
as,
T2 = P1 + H_1 * msg_1 + H_2 * msg_adv = P1 + H_1 * msg_1 + H_2 * (m^_2 * c')
From that the verifier will calculate,
C2_verifier = T2*c + D * (-r3^) + H0*s^ + H_3 * m^_3 =
= D * (-r3^) + H0*s^ + (P1 + H_1 * msg_1) * c + H_2 * (m^_2 * c' * c) H_3 * m^_3 =
= D * (-r3^) + H0*s^ + T * c + H_2 * m^_2 + H_3 * m^_3 = C2_prover
The last equality follows from #EQ1. As a result, the verification will succeed for msg_1
and msg_adv
.
Obviously, this should not be possible, since this proves knowledge of a signature that the prover doesn't have (which contains msg_adv
). If I'm correct on the above, most likely the only issue is with the Fiat–Shamir heuristic. Note that if the protocol was interactive, that method will not work, since the prover would have to "commit" to the messages prior of getting the challenge c
. Hence we should also pass the revealed messages to the hash of the challenge during spkGen and spkVerify, to "commit" them before the challenge is created.