In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $m$ knowing only the victims public keys.
Reading about the maths behind it, this justification is done:
After some juggling math around, everything is clear but the middle equality. What allows one to assert that $e(g_1, H_0(m)^b) = e(g_1^b, H_0(m))$?
My algebra is far from the strongest, but I don't seem to recall any property of linear combinations that would allow you to assert such a strong equality. Any help? Thanks.
