co-CDH on BLS12-381

In plain words

The puzzle that makes BLS signatures impossible to forge.

The idea: BLS signing is "multiply the message's curve point by your secret number". A pairing lets anyone confirm that the signature and your public key used the same secret, without revealing it. co-CDH is the bet that, without the secret, nobody can produce that multiplied point for a new message, even after seeing many signed ones.

Why it matters: Protects every validator vote.

The details

A Diffie-Hellman-style assumption across BLS12-381's two curve groups: given a public key and a hashed message, nobody can produce the matching signature without the private key^[1].

It is what makes BLS signatures unforgeable, and so it secures every validator signature (KE)^{[2, 3]}.

Rests on

If any of these breaks, this breaks too.

Key exchange / public-key encryption exist
Discrete log on pairing curves
One-way functions exist (needed by everything in the computational box)

If it falls

If this breaks, these break with it.

BLS signatures

Everything that falls with it (7 boxes)

About the tags

KE: This assumption gives key exchange on its own, so it needs more than one-way functions and falls if public-key encryption is impossible.

References

Dan Boneh, Ben Lynn and Hovav Shacham. Short Signatures from the Weil Pairing. Journal of Cryptology, 2004. doi:10.1007/s00145-004-0314-9
Ethereum consensus-specs authors. Phase 0: The Beacon Chain (consensus-specs). ethereum/consensus-specs, 2020. github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md
Dan Boneh, Sergey Gorbunov, Riad S. Wahby et al. BLS Signatures (Internet-Draft draft-irtf-cfrg-bls-signature). IRTF CFRG, 2022. datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature