Skip to main content
added 280 characters in body
Source Link
poncho
  • 150.6k
  • 11
  • 230
  • 369

Are there other public key systems that do not have this property?

A more cogent question might be "are there any public key systems other than RSA that does have this property?"

In particular, I'm calling "this property" the idea that you can swap the public and private keys and remain secure (which you can do with RSA, as long as you select large public and private keys, and you eschew the CRT optimization on the private key side).

I'm familiar with a number of proposed public key systems, and nothing comes to mind:

  • Other factoring-based systems: Rabin-Miller and Pallier - nope; although Rabin does come close, but with a fixed public exponent of 2, it can't really be used as a private exponent (and it's not quite reversible either).

  • Discrete log; nope. They (in my experience) have a private key as an integer $e$ and a public key as the value $g^e$ (or $eG$, if you're using a group with additive notation). Given that you can compute the public key from the private one, you can't swap them and remain secure.

  • Lattice based systems; nope. They internally have more variants than the discrete log problems, however in general, the private key is some secret sauce that makes solving the lattice problem easy (at least in the cases that the system cares about), hence you can't swap them.

  • Code based systems; nope. The private key is the secret sauce to make the error correction problem easy, hence you can't swap them.

  • Multivariate systems; nope. The private key is the secret sauce to make solving the multivariate equations easy, hence you can't swap them.

  • Isogeny based systems; nope. The private key in this case is a subgroup of the elliptic curve, while the public key is the isogenous elliptic curve that the isogeny maps the curve into (while mapping the subgroup to the neutral element). Again, it doesn't make any sense to swap them.

  • Hash based signatures; nope. In this case, the public key is a hash, while the private key is the series of values that are hashed together (generally in a big tree structure) to ultimately form the hash. It makes no sense to swap the public and private keys.

I can't think of any other public key systems that haven't been broken...

Are there other public key systems that do not have this property?

A more cogent question might be "are there any public key systems other than RSA that does have this property?"

I'm familiar with a number of proposed public key systems, and nothing comes to mind:

  • Other factoring-based systems: Rabin-Miller and Pallier - nope; although Rabin does come close, but with a fixed public exponent of 2, it can't really be used as a private exponent (and it's not quite reversible either).

  • Discrete log; nope. They (in my experience) have a private key as an integer $e$ and a public key as the value $g^e$ (or $eG$, if you're using a group with additive notation). Given that you can compute the public key from the private one, you can't swap them.

  • Lattice based systems; nope. They internally have more variants than the discrete log problems, however in general, the private key is some secret sauce that makes solving the lattice problem easy (at least in the cases that the system cares about), hence you can't swap them.

  • Code based systems; nope. The private key is the secret sauce to make the error correction problem easy, hence you can't swap them.

  • Multivariate systems; nope. The private key is the secret sauce to make solving the multivariate equations easy, hence you can't swap them.

  • Isogeny based systems; nope. The private key in this case is a subgroup of the elliptic curve, while the public key is the isogenous elliptic curve that the isogeny maps the curve into (while mapping the subgroup to the neutral element). Again, it doesn't make any sense to swap them.

  • Hash based signatures; nope. In this case, the public key is a hash, while the private key is the series of values that are hashed together (generally in a big tree structure) to ultimately form the hash. It makes no sense to swap the public and private keys.

I can't think of any other public key systems that haven't been broken...

Are there other public key systems that do not have this property?

A more cogent question might be "are there any public key systems other than RSA that does have this property?"

In particular, I'm calling "this property" the idea that you can swap the public and private keys and remain secure (which you can do with RSA, as long as you select large public and private keys, and you eschew the CRT optimization on the private key side).

I'm familiar with a number of proposed public key systems, and nothing comes to mind:

  • Other factoring-based systems: Rabin-Miller and Pallier - nope; although Rabin does come close, but with a fixed public exponent of 2, it can't really be used as a private exponent (and it's not quite reversible either).

  • Discrete log; nope. They (in my experience) have a private key as an integer $e$ and a public key as the value $g^e$ (or $eG$, if you're using a group with additive notation). Given that you can compute the public key from the private one, you can't swap them and remain secure.

  • Lattice based systems; nope. They internally have more variants than the discrete log problems, however in general, the private key is some secret sauce that makes solving the lattice problem easy (at least in the cases that the system cares about), hence you can't swap them.

  • Code based systems; nope. The private key is the secret sauce to make the error correction problem easy, hence you can't swap them.

  • Multivariate systems; nope. The private key is the secret sauce to make solving the multivariate equations easy, hence you can't swap them.

  • Isogeny based systems; nope. The private key in this case is a subgroup of the elliptic curve, while the public key is the isogenous elliptic curve that the isogeny maps the curve into (while mapping the subgroup to the neutral element). Again, it doesn't make any sense to swap them.

  • Hash based signatures; nope. In this case, the public key is a hash, while the private key is the series of values that are hashed together (generally in a big tree structure) to ultimately form the hash. It makes no sense to swap the public and private keys.

I can't think of any other public key systems that haven't been broken...

Source Link
poncho
  • 150.6k
  • 11
  • 230
  • 369

Are there other public key systems that do not have this property?

A more cogent question might be "are there any public key systems other than RSA that does have this property?"

I'm familiar with a number of proposed public key systems, and nothing comes to mind:

  • Other factoring-based systems: Rabin-Miller and Pallier - nope; although Rabin does come close, but with a fixed public exponent of 2, it can't really be used as a private exponent (and it's not quite reversible either).

  • Discrete log; nope. They (in my experience) have a private key as an integer $e$ and a public key as the value $g^e$ (or $eG$, if you're using a group with additive notation). Given that you can compute the public key from the private one, you can't swap them.

  • Lattice based systems; nope. They internally have more variants than the discrete log problems, however in general, the private key is some secret sauce that makes solving the lattice problem easy (at least in the cases that the system cares about), hence you can't swap them.

  • Code based systems; nope. The private key is the secret sauce to make the error correction problem easy, hence you can't swap them.

  • Multivariate systems; nope. The private key is the secret sauce to make solving the multivariate equations easy, hence you can't swap them.

  • Isogeny based systems; nope. The private key in this case is a subgroup of the elliptic curve, while the public key is the isogenous elliptic curve that the isogeny maps the curve into (while mapping the subgroup to the neutral element). Again, it doesn't make any sense to swap them.

  • Hash based signatures; nope. In this case, the public key is a hash, while the private key is the series of values that are hashed together (generally in a big tree structure) to ultimately form the hash. It makes no sense to swap the public and private keys.

I can't think of any other public key systems that haven't been broken...