Timeline for Is it safe to use same private key in two or more EC signature algorithms?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 25, 2018 at 18:11 | vote | accept | warchantua | ||
| Jan 14, 2018 at 15:21 | history | edited | Yehuda Lindell | CC BY-SA 3.0 |
added 243 characters in body
|
| Jan 14, 2018 at 15:16 | comment | added | Yehuda Lindell | Oh, I'm sorry. I didn't notice the different curves. You are right. This could be very problematic. | |
| Jan 14, 2018 at 11:57 | comment | added | CodesInChaos | My doubts are related to the key generation part, and not the signature part. I don't find it obvious that publishing public-keys computed over different curves but sharing the private scalar is reducible to the DL being hard in all groups. | |
| Jan 14, 2018 at 5:38 | comment | added | Yehuda Lindell | The security argument should hold because the entire Schnorr part can be simulated as zero knowledge (in the ROM) and so it doesn't matter what the other signature does. However, I will never say that I'm sure of something until a full proof has been written. | |
| Jan 13, 2018 at 20:18 | comment | added | CodesInChaos | I'm not sure if your security argument actually holds, considering the OP intends to use different curves. (Though it is likely stills secure in practice) | |
| Jan 13, 2018 at 19:48 | history | answered | Yehuda Lindell | CC BY-SA 3.0 |