IETF Logo Mail Archive

Re: [CFRG] Call for adoption for draft-wood-cfrg-rsa-blind-signatures

"Riad S. Wahby" <rsw@jfet.org> Wed, 28 April 2021 12:33 UTC

Return-Path: <rswatjfet.org@gmail.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A3C63A28BC for <cfrg@ietfa.amsl.com>; Wed, 28 Apr 2021 05:33:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.4
X-Spam-Level:
X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JnaVlwZ3yBXE for <cfrg@ietfa.amsl.com>; Wed, 28 Apr 2021 05:33:07 -0700 (PDT)
Received: from mail-qv1-f51.google.com (mail-qv1-f51.google.com [209.85.219.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF5CD3A28BB for <cfrg@irtf.org>; Wed, 28 Apr 2021 05:33:06 -0700 (PDT)
Received: by mail-qv1-f51.google.com with SMTP id a30so3881709qvb.12 for <cfrg@irtf.org>; Wed, 28 Apr 2021 05:33:06 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=a63Sc8tzKwMAAwdMLqFByCx2Ph25vHg0bp2yp05X0vg=; b=DrQTPHGlNLrrjO2jTtT8CdomKrD0NqD6QXrRPQmwGuQiGGKf5J7yLbUZ5FsDD+5sRL jMu7bcSUApLHmElMmunqta9qGymsD7Tu61FzGtUQdhKIQy/7Nskwx2UxDdkAzGDCI3Tv LyjqHHLLAGgsUOLLCmCQCG6YdWPBvjLr43xemmXhgmzq+09FjONfbi5o47gt7A+/gD9j tpXmWfTAdE3s58SL81VmZRDvz+DoL8D+PdBZzoUMvysP1+2rFRx1QDL8UaueoqqwTTks dQLhd5RbwEAyp5AxfqUnN3d2RJNv+o0Iy0R3dYqoXrPwv4762l2IJAa9BfzEmhdko5Og y7AA==
X-Gm-Message-State: AOAM532J0Mw4hDJ/7pEtPbAMlv+528Eh56XyjJuwth+Ymy6DgtZLl9eh d4Ym9TvjpX37ADg2n5nt+0g=
X-Google-Smtp-Source: ABdhPJxarlP+yznsH+KYMl2pqbZ0sswJZX21scLkZG7briBWFEytUz8Tj2w1vox3Geb9+NsbTnnvjg==
X-Received: by 2002:a05:6214:1467:: with SMTP id c7mr29020551qvy.7.1619613185299; Wed, 28 Apr 2021 05:33:05 -0700 (PDT)
Received: from localhost (mobile-166-170-222-227.mycingular.net. [166.170.222.227]) by smtp.gmail.com with ESMTPSA id q2sm5034635qkj.63.2021.04.28.05.33.04 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Wed, 28 Apr 2021 05:33:04 -0700 (PDT)
Date: Wed, 28 Apr 2021 08:33:03 -0400
From: "Riad S. Wahby" <rsw@jfet.org>
To: Jeff Burdges <burdges@gnunet.org>
Cc: "Stanislav V. Smyshlyaev" <smyshsv@gmail.com>, CFRG <cfrg@irtf.org>, Taler <taler@gnu.org>
Message-ID: <20210428123303.efzpnhpqkcmg7op3@muon>
References: <CAMr0u6njjMkmmAhFg3t+0EJOuh=q4towqi4j=hk9-russTbXDA@mail.gmail.com> <74CC6D18-B7B0-4FF8-A227-463434C250C9@gnunet.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <74CC6D18-B7B0-4FF8-A227-463434C250C9@gnunet.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/illD-Im8V85VlcsopjMyxS-K0l8>
Subject: Re: [CFRG] Call for adoption for draft-wood-cfrg-rsa-blind-signatures
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Apr 2021 12:33:11 -0000

Jeff Burdges <burdges@gnunet.org> wrote:
> We need a strong clarification that blinding factors should be
> rejection sampled from the RSA group, meaning same bit width
> and rejection if they exceed the modulus.  I’ve some GCD test
> in GNU Taler’s code but that’s unnecessary since n - phi(n) = pq
> - (p-1)(q-1) = p + q -1 << n.

As an alternative to rejection sampling, why not sample log2(n)+128
bits, interpret as an integer, and reduce mod n? That gives a result
statistically close to uniform mod n without a loop.

Or log2(n)+256 bits, if that feels better :)

Agreed that the GCD test is superfluous. The chance of getting a "bad"
value is morally equivalent to the chance of guessing a factor of n.

Cheers,

-=rsw

v2.23.0 | Report a Bug | By Email