discussions on rogue key attacks

[zhenfeizhang]

See Dan's post on the attack and potential defenses.

Summary of defense mechanisms:

• proof of possession: before the signatures under the public key can be used in aggregation, the signer has to provide proof of possession of the secret key. e.g. the signer can provide a signature of the public key under the secret key.
• always sign different messages: by including into the message that needs to be signed with a public key.
• Use BLS+ variant.

The current draft does not enforce any of above methods.

To discuss:

• whether to add some/all the defense mechanisms in the draft
  • a related question: what are the best use cases for each method
• if there is a reason (not) to mandate a mechanism

We're considering various use-cases for use in:

• PKI
• Blockchain transactions
• Multisig applications