On Key Substitution Attacks against Aggregate Signatures and Multi-Signatures

When we use signature schemes in practice, we sometimes should consider security beyond unforgeability. This paper considers security against key substitution attacks of multi-signer signatures (i.e., aggregate signatures and multi-signatures). Intuitively, this security property ensures that no malicious party can claim the ownership of a signature created by honest signers. We investigate security against key substitution attacks of a wide range of aggregate signature schemes and multi-signature schemes: the Boneh-Gentry-Lynn-Shacham aggregate signature scheme, the sequential aggregate signature scheme by Lysyanskaya et al., the multi-signature scheme by Bellare and Neven, and MuSig2. Furthermore, if the scheme does not provide security against key substitution attacks, then we modify the scheme to become secure against the attacks.