Timeline for Chaum-Pedersen protocol adapted to elliptic curves
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 30, 2023 at 7:49 | vote | accept | gagiuntoli | ||
| Mar 30, 2023 at 6:25 | answer | added | knaccc | timeline score: 0 | |
| Mar 30, 2023 at 6:22 | comment | added | gagiuntoli | Thanks for that; it is crystal clear and makes full sense! | |
| Mar 30, 2023 at 6:15 | comment | added | knaccc | In additive notation, exponentiation becomes multiplication, and multiplication becomes addition. So it would be $s*G+c*Y_1$. The two operations are scalar multiplication (a point added to itself many times), and point addition. | |
| Mar 30, 2023 at 6:08 | history | edited | gagiuntoli | CC BY-SA 4.0 |
added 454 characters in body
|
| Mar 30, 2023 at 6:04 | comment | added | gagiuntoli |
Thank you, I miss that in the verification process; there is this: g^s * y1^c. This would be like a product of points; as far as I know, point multiplication is not defined. What is the equivalent operation there?
|
|
| Mar 29, 2023 at 23:39 | comment | added | Myria | You'd need to choose the generator point $g$ carefully so that it has order $q$. Unlike what you'd do in this protocol for the multiplicative group, with elliptic curves you might as well have $q$ as close as possible to the number of points--you wouldn't choose $q$ to be quite a bit smaller than $p$. Also, you might to take care with invalid curve point attacks and subgroup confinement attacks. | |
| Mar 29, 2023 at 20:33 | comment | added | Daniel S | Yes it would. Similarly for any cyclic group in which the discrete logarithm is hard. | |
| S Mar 29, 2023 at 20:29 | review | First questions | |||
| Mar 30, 2023 at 7:09 | |||||
| S Mar 29, 2023 at 20:29 | history | asked | gagiuntoli | CC BY-SA 4.0 |