Re: [CFRG] I-D Action: draft-irtf-cfrg-rsa-blind-signatures-02.txt

[Christopher Wood <[e-mail]>]

Oops -- I meant to -list to keep the thread focused. Sorry about that!

On Mon, Aug 30, 2021, at 6:29 AM, Christopher Wood wrote:
> (-list)
> 
> On Mon, Aug 30, 2021, at 3:17 AM, Jeff Burdges wrote:
> > 
> > I wonder if the underlying RSA scheme should be called roughly RSA-PDH 
> > or something, where PHD = partial domain hash, because the security 
> > does not come via the same argument as in PSS.
> 
> Can you please elaborate on this? PSS _is_ the encoding scheme used in 
> this draft, so I don't see why we'd change the name of the encoding 
> scheme here. 
> 
> Thanks,
> Chris
> 
> > > On 30 Aug 2021, at 05:00, Chelsea Komlo <[e-mail]> wrote:
> > > Section 5.1.1
> > > 
> > > "The blinding factor r must be randomly chosen from a uniform distribution. This is typically done via rejection sampling."
> > > 
> > > Is this not implied by the function random_integer_uniform?
> > 
> > In principle yes, but their desire to use PSS as a “partial domain 
> > hash” worried some of us that people would reuse the PSS “hasher” for 
> > the blinding factor, which instantly breaks the anonymity.  We’ve 
> > enough cases in elliptic curves where being full domain does not mater, 
> > ala ECDSA, that people do fuck this up in blind RSA.  I suggested 
> > finding more specific language for this reason.  
> > 
> > Jeff
> > 
> > 
> > _______________________________________________
> > CFRG mailing list
> > [e-mail]
> > https://www.irtf.org/mailman/listinfo/cfrg
> > 
>