Re: [Cfrg] Internet-Draft: Collective Edwards-Curve Digital Signature Algorithm

["Slamanig, Daniel" <[e-mail]>]

Hi again,


For instance, a malicious A^* could just take some key from A,
say A_j, and compute and publish A^*=a^*A_j.

sry, there is a typo. Should be A^*=a^*P+A_j assuming A_j=a_jP.

Cheers,
Daniel

 then given a collective
signature (R,s,Z) where A_j participated, the signer can update s to s^*
= s+a^*c as well as Z^* to exclude A_j and include A^* (as Z is not
committed in the signature generation) and the signature (R,s^*,Z^*)
will be a valid signature that certifies that A^* participated in
signing - although he didn't.

If Z is committed as proposed above and it is checked during the
verification, then this should no longer work. One could also adapt the
hash c=H(R||pk_ch||CH(Z'||A)||S) to include a chameleon hash to
CH(Z||A'), where A' is the real set of signers that participated in the
signature generation and is adapted before finalizing the signature when
known as above.

I hope that what I proposed is not just complete nonsense :) Also it
produces quite a bit of an overhead. There may also be easier ways to
avoid the issues.

Some editorial issues: the message to be signed is sometimes called a
satement S and later then message msg. S could be confusing as part of
the signature is s and your semantic is that scalars are lowercase and
points are uppercase. Also in 4.2 "Signature Generation" steps 2 and 3
are confusing as I guess that in the protocol all the signer compute
their own [r_i]B values and R=\sum R_i instead of R=[r]B which would
mean that they would send their r_i's (hope they will not do so).

Also I find it somewhat confusing that the bitmask Z identifies the
non-signers with a bit set to 1. Why not identifying the signers with a
bit set to 1?

Cheers,
Daniel


[1] Hugo Krawczyk, Tal Rabin: Chameleon Signatures. NDSS 2000

On 01.07.2017 23:58, Philipp Jovanovic wrote:
> Hi CFRG,
>
> Here’s a first version of an Internet-Draft on “Collective Edwards-Curve Digital Signature Algorithms” based on Ed25519 and Ed448: https://datatracker.ietf.org/doc/draft-ford-cfrg-cosi/
>
> We plan to give a short presentation on that topic at the next CFRG meeting in Prague.
>
> Any feedback is more than welcome. Thanks!
>
> All the best,
> Philipp
>
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>


--
Dr. Daniel Slamanig
Institute for Applied Information Processing and Communications
Graz University of Technology
Inffeldgasse 16a, 8010 Graz, Austria.
Phone: [phone]
http://www.iaik.tugraz.at

_______________________________________________
Cfrg mailing list
[e-mail]
https://www.irtf.org/mailman/listinfo/cfrg