On 2010-03-22 11:22 PM, Sergio Lerner wrote:
Commutativity is a beautiful and powerful property. See "On the power
of Commutativity in Cryptography" by Adi Shamir.
Semantic security is great and has given a new provable sense of
security, but commutative building blocks can be combined to build the
strangest protocols without going into deep mathematics, are better
suited for teaching crypto and for high-level protocol design. They
are like the "Lego" blocks of cryptography!
Now I'm working on an new untraceable e-cash protocol which has some
additional properties. And I'm searching for a secure commutable
signing primitive.
The most powerful primitive, from which all manner of weird and
wonderful protocols can be concocted, are gap diffie helman groups.
Read Alexandra Boldyreva "Threshold Signatures, Multisignatures, and
Blind Signatures based on Gap-Diffie-Helman Group Signatures.
I am not sure what you want to do with commutativity, but suppose that
you want a coin that needs to be signed by two parties in either order
to be valid.
Suppose we consider call the operation that combines two points on an
elliptic curve to be generate a third point multiplication and division,
so that we use the familiar notation of exponentiation, thereby
describing elliptic point crypto systems in the same notation as prime
number crypto systems (a notation I think confusing, but everyone else
uses it)
Suppose everyone uses the same Gap Diffie Helman group, and the same
generator g.
A valid unblinded coin is the pair {u, (u^(b*c)}, yielding a valid DDH
tuple {g, g^(b*c), u, u^(b*c)}, where u is some special format (not a
random number)
Repeating in slightly different words. A valid unblinded coin is a coin
that with the joint public key of Bob and Carol yields a valid DDH
tuple, in which the third element of the tuple has some special form.
Edward wants Bob and Carol to give him a blinded coin. He already knows
some other valid coin, {w, w^(b*c)). He generates a point u that
satifies the special properties for a valid coin, and a random number
x. He asks Bob and Carol to sign u*(w^(-x)), giving him a blinded coin,
which he unblinds.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majord...@metzdowd.com
