Multi-signatures in the plain public-key model ⇒ Multi-signatures in the KOSK model

Fully-black-box reduction · standard model · folklore · security loss: none

Statement

A multi-signature scheme unforgeable in the plain public-key model is unforgeable in the knowledge-of-secret-key model, with the same advantage — folklore.

Sketch

A plain-model adversary runs the KOSK forger, answers each registration $\rho$ itself by computing $\mathsf{KeyGen}(\mathsf{pp};\rho )$ and recording the key, forwards the signing sessions on registered key multisets, and outputs the forgery.