{
  "algorithm": "BLS",
  "schema": "bls_sig_verify_schema.json",
  "numberOfTests": 26,
  "header": [
    "Test vectors for BLS signature verification using the",
    "min-pk variant (public keys in G1, signatures in G2)",
    "with the Proof of Possession scheme (POP DST).",
    "See draft-irtf-cfrg-bls-signature-06."
  ],
  "notes": {
    "EmptyMessage": {
      "bugType": "EDGE_CASE",
      "description": "The message is empty. Valid BLS signatures support empty messages."
    },
    "FieldBoundary": {
      "bugType": "EDGE_CASE",
      "description": "The x-coordinate is near the field modulus, exercising boundary arithmetic.",
      "effect": "Implementations with carry propagation bugs may mishandle values near the modulus."
    },
    "IdentityPoint": {
      "bugType": "EDGE_CASE",
      "description": "The signature or public key is the identity (point at infinity).",
      "effect": "The identity point as a signature or key is always invalid per the BLS spec."
    },
    "InvalidEncoding": {
      "bugType": "AUTH_BYPASS",
      "description": "The serialized point has an invalid encoding.",
      "effect": "Accepting invalid encodings may enable various attacks."
    },
    "InvalidFlags": {
      "bugType": "AUTH_BYPASS",
      "description": "The serialized point has valid coordinates but incorrect flag bits.",
      "effect": "Accepting points with wrong flags can bypass validation or produce incorrect points."
    },
    "InvalidSignature": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature is not a valid point or does not verify.",
      "effect": "Accepting such signatures allows forgery."
    },
    "LargeMessage": {
      "bugType": "EDGE_CASE",
      "description": "The message is large. Ensures hash-to-curve handles arbitrary length input."
    },
    "NotInSubgroup": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature point is on the curve but not in the prime-order subgroup.",
      "effect": "Accepting points not in the subgroup enables rogue-key and other attacks.",
      "links": [
        "https://eprint.iacr.org/2021/323"
      ]
    },
    "NotOnCurve": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature point is not on the curve.",
      "effect": "Accepting points not on the curve can lead to forgery or subgroup attacks."
    },
    "SignatureMalleability": {
      "bugType": "SIGNATURE_MALLEABILITY",
      "description": "A modified signature that is mathematically related to a valid one.",
      "effect": "Signature malleability can break protocols that assume signature uniqueness."
    },
    "TruncatedSignature": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature has been truncated.",
      "effect": "Accepting truncated signatures likely means signatures can be forged."
    },
    "Valid": {
      "bugType": "BASIC",
      "description": "The test vector contains a valid BLS signature."
    },
    "WrongDST": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature was produced with a different domain separation tag.",
      "effect": "Accepting signatures with wrong DST enables cross-protocol attacks.",
      "links": [
        "https://datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature/"
      ]
    },
    "WrongKey": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature was computed with a different key.",
      "effect": "Accepting such signatures means authentication is broken."
    },
    "WrongMessage": {
      "bugType": "AUTH_BYPASS",
      "description": "The signature was computed over a different message.",
      "effect": "Accepting such signatures means message integrity is broken."
    }
  },
  "testGroups": [
    {
      "type": "BlsSigVerify",
      "source": {
        "name": "github/trailofbits/bls",
        "version": "0.1"
      },
      "ciphersuite": "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_",
      "publicKey": {
        "pk": "8f62f546d9ace47b11df8d0cf2911ff7cff8d3c247a6a46a6b37cd42c5c19785f0ae24477a6b261b047b20b2993ebac4",
        "group": "G1",
        "keySize": 48
      },
      "tests": [
        {
          "tcId": 1,
          "comment": "valid POP-scheme signature #1",
          "msg": "810c3298362cdfa76d0f618d2c3443e6670a0dd4384cb3983782047f7b86e3b5",
          "sig": "a6bfda26f1f60ecfa65e9a57ae4bef304305be0bb3eca352c80032932a15928c0ac3abf7b676fefd0ca2a9af231f189c0f612e0fb494da9d6bbbb10984616c91e59b1f8850f3975e1e603d9bd10e0b2c47705bf4da99a7e17ad3d344aa3e27c5",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 2,
          "comment": "valid POP-scheme signature #2",
          "msg": "e383b40bb784f366cb0a3811b4cd91b6bc237332f5ed3e2a26b11cd4dfef8403",
          "sig": "a1eedf60cc7155526dc8ab6536263ab19d02d8bc8b2ad9826e8805aa99ee5383ec6587bb2857f271e31251ab5d4c167c11dfd66020e3a66323b879bfcb5af29d24ac831db7cacb383b2bd9943382eb9ea0c14ab32936b635fa5bda56046ebe65",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 3,
          "comment": "valid POP-scheme signature #3",
          "msg": "61a205b34191722cda38361fce229b2643158b052b099686168e1f6c1899a574",
          "sig": "abf8d6c045b3bf848714ce650428051e42f1c2495ade7639159a8b49cbed91cc2ab982b73045d329085e0793df6ee23d0b12495b8282f005947c4f90b7e9bf14a2699f5a6b2b4d6a4b7ea0ea6f72c146b559a25cb3caf1f9642de25ff7d8dc6c",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 4,
          "comment": "valid POP-scheme signature #4",
          "msg": "5aba82ac51804c6f0b8cb43295e322c3aac8fb9fb75bda8d61b128ff260d66b1",
          "sig": "a84c7a65806fd0f62c039f0b4f751cd73c0b4b29fdbf3dd8a045296c8b667c3304feda945bf1c04727bf172db059d3790db89bc8dbe9be6534c34edc3a62b3fb6e528976c7824a0420d8bf6227577901547c232554df6d973b4327c0046b334c",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 5,
          "comment": "valid POP-scheme signature #5",
          "msg": "bc09c93d06da9a0e8548c32a8f2c84f1d6aaa7c790905d5bb884055ba300a571",
          "sig": "aff12777cc8adf3d010b66cbdccf504587d29f1daca4885292bd69d3bc865f9fdf5ebfdc69c9e5a1659e7900f87fb20d0c0a137400ae66dd7226c5bb5285416ea8a86b496d7ebefa08a4e812a10a5515d238e70779d0a7a51cac091fcf3a7599",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 6,
          "comment": "valid POP-scheme signature on empty message",
          "msg": "",
          "sig": "90d7cf6fb5506e43d0982e0ccd1d51e6245785cd90c25dae748981fe18eb7f066e54bbb91ea1c85ed3e3732229568f361429a9842f2fdf4d2db8ca2602e869e882ac3aca4ff43db09be997de5c969a3e34a8011385eb3a7e6b7a1d09050e9ad3",
          "result": "valid",
          "flags": [
            "Valid",
            "EmptyMessage"
          ]
        },
        {
          "tcId": 7,
          "comment": "signature from Basic scheme, verified under POP scheme",
          "msg": "47776e8527239ab0662e22398230ef32805ae1abe4f7276f1953a91ac1a322d6",
          "sig": "81b38e45131516c072fac9aedb9c128195979666688b2e8c85fc92868a53685cc256c702b49ff0888de5bc51b5836fc9075b39f0f42a8bd8c4273c15da193b4e96c6195aef69421c5d9caa2b5bad6fb0374a6123bbfa043bf65e40fae7dd6b2d",
          "result": "invalid",
          "flags": [
            "WrongDST"
          ]
        },
        {
          "tcId": 8,
          "comment": "identity point as POP-scheme signature",
          "msg": "47776e8527239ab0662e22398230ef32805ae1abe4f7276f1953a91ac1a322d6",
          "sig": "c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
          "result": "invalid",
          "flags": [
            "IdentityPoint"
          ]
        },
        {
          "tcId": 9,
          "comment": "POP-scheme signature with wrong key",
          "msg": "47776e8527239ab0662e22398230ef32805ae1abe4f7276f1953a91ac1a322d6",
          "sig": "a80c0d2ff6c982268d2b8e4512ef29d8a595415d4ba0a2dbaf2efbaeb240003381c1eff88fa590ecc861ca124680281114eca7d77614e94df8a192cdbdbc8279d66f20134d9e8f06848219d6b137296d8806c351f2d2ab54144ce12fd4c74025",
          "result": "invalid",
          "flags": [
            "WrongKey"
          ]
        },
        {
          "tcId": 10,
          "comment": "valid POP sig on 1-byte message",
          "msg": "09",
          "sig": "9449dc1faf1c9caf2201e1313022364bef6ecbb9766b6e37fc7bc551024855e0d59d2a7076679c5ee97315618dfc3a6d02c7626f0fbf0ce8d8ce01ff95c84d546d701af197b75370d372686facf80048ab6e3fd40ec357ff434ecb6de55f523e",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 11,
          "comment": "valid POP sig on 2-byte message",
          "msg": "04a6",
          "sig": "8cb953a82c040f890e1f472c17756a36732f620249d842168f51b343034158ff85cded9f23c074e5dae4ce817aebe7a1004c5cabf250c7f518568fb7988c6ea395328be4686ac428196cd993b31d9b542ef621428558b89322c98e28c5d12f08",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 12,
          "comment": "valid POP sig on 8-byte message",
          "msg": "ce135beff2b669e7",
          "sig": "b192fac7817dd68950cd782206e39ba3dd980e5d19312145d97a4306b23401df54e3d804115bc7d34369df12ef72d62a0aa31543cd88f89521105322ca6e063b63e0dce8487f3d22cf22107a59afb3cbff8a23497df2bf43c678198f69585e25",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 13,
          "comment": "valid POP sig on 64-byte message",
          "msg": "86ac086bf0a30985dc40292c6332ab27f362963564927d6aa4b62527adbe3eb19fadc57d779251a808d7ec873e29efebae494110afb217a47a2ade8a9c30eb36",
          "sig": "a00ab419a5d70ccfbb520a5f2bed129231dd5e47047ece37d019814c0b78bb300d69f8b37c9ae6f02dfe0471985647300ceedd45c83452d9b1342b0b16a7f0af30b852a34349144dbdc43337385470552a3cb4116ee145987662e8539801be56",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 14,
          "comment": "valid POP sig on 256-byte message",
          "msg": "0dc401f0cc2906a03da896b47b531423249610039cc39c712884fba9a9b26c051ad5e2bd36e5057ca2b81c43b880f294f135c989b600d6b0b3c949e3064b8daa95c9f88046322bef81a334ebbbdded825ec2292f10a718e12548b5d5a2138453c16914273852d50cc8ed421331d0fedfddc78a5300164cabfc90cc46955b10a7afc626595f2ce73eac59e0493503252132ddc8e871bf8c0822e89b6913057b665f0dc861d6f40d86e37f5dc6c16f37634626e8c311ce067d9f684b9c57cfdbe887b7d032e654eb0de1e7fbcc424ff81b79921e51856f5a94a649b6d8a2e182ef167bce3acd32b23e793918d66209de1f48c3283bd573f9e8aececb38dde5fa0b",
          "sig": "8f96c2eda060fdce13700f047b43be5e5f0b6733bb8643aad0dbd9e55e2fde9e10ba806a8c04b43d5543cfba168f7ed009534fc329b84729cb0c36f81c47260f13df131b2cce30c661b9405a97e152d6a337248a19fc9f73c1d4619132fd7015",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 15,
          "comment": "valid POP sig on 1024-byte message",
          "msg": "33bf854d76e3dcf5bd3eb7f92231990066806561b870a932592221a5d33c03dac879aad883db5f912e238c1476e61794d7d09b533f43179eb3ce98c4b1c7e27fc12679b0f1c10daae9ff7ce21b894f0d261badad64c9e737a706969bb6c615fe372c53dfec331a4ad71386dffb542f5833b1ee1789db58894e595f6fed69071dadff62b09716a251d70526525d237b7dc0486b9bb31aae93902da54f54c1b758b715ff8b933abb2bbf7ec229cac42e7a8c6d747a1de0be4a8dbe196b4c093262f273aada99bb76ce0e30c5a655dcd4378c885d41795dc270340482ab337172319eaa8250d2e05105799e7126f2f58a9cb0b99ea532c91b154f17729cb722482f50fa60c07c71651d2d72ce88df79c57cf8f91d51567b8aab09182da9af8c191fac6fec5604c2f58673824e85d87f63f73d5eaf0e6a01460347544a39d3b598b7429d4e12e690eb20759f56d6eda0b390c802362862086588d5c88a191307bf5cd1270c7ad76b6924df3dba12eecbe93a95472fefa388a543ced3bd309268594a2d156e25fc8e58fa426b9d18f0e0fef953768919b16dc6551a21e92d9debce1047b9c9b2cedf092f37c518612d4244161ae0451033ab1be0737453653c4e18efe4a095accdf3ed8737cfd14b3c4ae90f297cc7abf1e567725fdb775a02668484fdb3e1bd6d609b6fca144eb7af5992a40e6692f4105ee873ed1407842c6d5beaaa791b7499404fff94adde340bef858f5539bd728e83ee0586780f2657bb624c34c92c03a642886c9204e56ff9a7a892b2cac071c65e569ccf2a5bf1665a6e7a720b997d411d40bf3c602aad42b1d4e17a6ad92385df799aef41d833bbe8ace7504e4fad0c3efe22c68dc1ac4aac0725dd3788c4ea819dc34701e38e4ff2a5b2b33f20b3cb031ad4675be73316aafd311bc869ae69142c0bc9da2f4fdfd360bf1fcd267bdabf17b055960404b7edf8f52bf4662e7cb516b035ce60cf2843417b426dc032434ef6f3f3fa544fb96ca74ba0d3b81e88267c3be0963fbfb44368960f8c2d5ec293363e78862ed47e7de344cc694e95d71cf42c9c6f64a37967b149ba0ef2262ecb8aa7f1b03ed1495ae8e8581ef43955588adcbdae182a3e3e5178020013572e0452fd354c1f64032cf2eed4920aa56069b2bd7014b019e16cd8463d351b92511763d03a40514de6f1f61f3311b0cc465d328fd6affde2d08be124dbdb2a5695ebfda60cbec9b8ad8064a4e16d9fa62996e9073bf336713963ccb394c98d8c87e00711469586bb0db3e9e210634e8ab511066228b294bae8ae613fcf69db503e5534a2ab1fb11cf0936329c156f589833f47ed78dfaf170b7649ca1c376f3e99e6daf6eef0e14f9a127dd6c2725d64bae891c5c6b02ae6b713b7d5610ff8b5ade021bfa67eae30a0b33cbc0c98a5decb88e8516061b4ccc04d8e2a",
          "sig": "a3d089c27b88bd7036ba1fb84fb9ae59fc2f7b6ac43aedac0f8209a11aa467d100c8b4652da210b33a81fe8a8f98c6e207bdea6f96f222139a0f4be5c5e96dfed179884dc556dd40ec89266b566b100b78c07dd4b636275ac9bc5850e00373d0",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 16,
          "comment": "valid POP sig on all-zero 32-byte message",
          "msg": "0000000000000000000000000000000000000000000000000000000000000000",
          "sig": "a403c889825acdd5e3b55a6e1de7dd8073c27cf24b3200223f5f2a003da32a28658951b87578baabe2a8df0d2bd87ed5068c75532c663c9f55fa48a9933b5160b7ed71f8000f57d0296b3f2e868f5888d5b200bebd430d0ef522e6d22fafa52e",
          "result": "valid",
          "flags": [
            "Valid"
          ]
        },
        {
          "tcId": 17,
          "comment": "negated POP-scheme signature (flipped sign bit)",
          "msg": "fd961b1c74e14c2bf1b5d192e6bd7dcc2a001e25d24aacfe1c45157b20614acc",
          "sig": "8a29197e6247865eff470a67096c9320ded4ddf0799d333020e5aa6d0b5ebec970aab337e6a0b94ede18f39f04ff1928125db3c3978e6c41504cddc774b704fa810028541e89961dd65d3731bb98b0b7c2f8d0e915a14b6d16af94dc3edc39e0",
          "result": "invalid",
          "flags": [
            "SignatureMalleability"
          ]
        },
        {
          "tcId": 18,
          "comment": "truncated POP-scheme signature",
          "msg": "89edcbc22c42dfc1ac8ff95575274e7bf5c9ac043d9577b1d8ada721cb87b0f0",
          "sig": "a1d9ae5bb436809dcd8ed3afee3873d150920ab9a140a9939b3e5a2f8342611a2bf4a289af4a271a8f8b3c00f1d8ba06",
          "result": "invalid",
          "flags": [
            "TruncatedSignature"
          ]
        },
        {
          "tcId": 19,
          "comment": "POP: G2 signature not on the twist curve",
          "msg": "47776e8527239ab0662e22398230ef32805ae1abe4f7276f1953a91ac1a322d6",
          "sig": "800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
          "result": "invalid",
          "flags": [
            "NotOnCurve"
          ]
        },
        {
          "tcId": 20,
          "comment": "POP: G2 signature on curve but wrong subgroup",
          "msg": "47776e8527239ab0662e22398230ef32805ae1abe4f7276f1953a91ac1a322d6",
          "sig": "800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002",
          "result": "invalid",
          "flags": [
            "NotInSubgroup"
          ]
        },
        {
          "tcId": 21,
          "comment": "POP sig with compression flag cleared",
          "msg": "a1b54f7806fcd87cd2bfcc5f727310e7add0292cf0398a51e441c57ebb42dba1",
          "sig": "36774f429179d2c9494f2310f8dc1f7780b2356ef624e102c3c358c11e95c1f7a3999d66ce42a7b19b641aa5959d06d01625e2922f1b2eb68a019cb37ed9f3118f8298ff845e3b2a4d775a2cfc966be8495e7d39436d1041f50bb1ab54b3a64a",
          "result": "invalid",
          "flags": [
            "InvalidFlags"
          ]
        },
        {
          "tcId": 22,
          "comment": "POP sig with infinity flag set on non-identity",
          "msg": "984e854a0c965dc73cb4e309d1551a375e994db8d983f1831e1ce421730fcd99",
          "sig": "e9edad8d8540c654110cede090af12904fc7b8ae8ada27f43eb42039df60758296d8b519feb2b81a7cf424704adb903a0341ced3c9f6e9b4cdb2ad45b18d580a923c54c04748683ab225cc32cd080e72fd1ee016c41a748413518f0bd33f73e2",
          "result": "invalid",
          "flags": [
            "InvalidFlags"
          ]
        },
        {
          "tcId": 23,
          "comment": "signature from AUG scheme, verified under POP scheme",
          "msg": "6e0d7146e8b1027c0c20633019e1f67e7e543a54ebdd7cd73ba186ec157c2d5c",
          "sig": "abec48a6e00c76725d53d4fea4b2be12e7fdf6b484cbf3d38ae6e1b418a0be0844c4bc0ae56aa7b469dab7481a5ce33c1846fe5c71ef49d467703aae244fbe1da615462905a466108f3301c70fc0566c6413c99e39646d52343da8a4da930cf2",
          "result": "invalid",
          "flags": [
            "WrongDST"
          ]
        },
        {
          "tcId": 24,
          "comment": "POP sig with bit flip at byte 1",
          "msg": "eeaae090a8f5d142c2525fd76cbd90dca9a88d612fb7ef23e383536d059c7ab4",
          "sig": "8d7a6016413326e5fe6a2775e6e893d03e05e249f66353a8f37af622d4f966a8aaf0465bfe5fe53d3a0193f79199d5ae1797d2d74965b0ca05b02efa39900ffacb9cfd3ea1482a3041b4eba80094adf410c4c004ed6800cd6e4f477c6731a4ca",
          "result": "invalid",
          "flags": [
            "InvalidSignature"
          ]
        },
        {
          "tcId": 25,
          "comment": "POP sig with bit flip at byte 48",
          "msg": "eeaae090a8f5d142c2525fd76cbd90dca9a88d612fb7ef23e383536d059c7ab4",
          "sig": "8d7b6016413326e5fe6a2775e6e893d03e05e249f66353a8f37af622d4f966a8aaf0465bfe5fe53d3a0193f79199d5ae1697d2d74965b0ca05b02efa39900ffacb9cfd3ea1482a3041b4eba80094adf410c4c004ed6800cd6e4f477c6731a4ca",
          "result": "invalid",
          "flags": [
            "InvalidSignature"
          ]
        },
        {
          "tcId": 26,
          "comment": "POP sig with bit flip at byte 95",
          "msg": "eeaae090a8f5d142c2525fd76cbd90dca9a88d612fb7ef23e383536d059c7ab4",
          "sig": "8d7b6016413326e5fe6a2775e6e893d03e05e249f66353a8f37af622d4f966a8aaf0465bfe5fe53d3a0193f79199d5ae1797d2d74965b0ca05b02efa39900ffacb9cfd3ea1482a3041b4eba80094adf410c4c004ed6800cd6e4f477c6731a4cb",
          "result": "invalid",
          "flags": [
            "InvalidSignature"
          ]
        }
      ]
    }
  ]
}
