Timeline for Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 19, 2021 at 0:07 | vote | accept | cryptobeginner | ||
| Feb 18, 2021 at 9:53 | comment | added | Yehuda Lindell | It doesn't make sense to say of the form $x\cdot G$ versus $x\cdot G + x'\cdot G'$ since all values are of the form $x\cdot G$ for some $x$. The question is one of knowledge, and yes, signatures of this form that are ZK proofs can actually guarantee knowledge. | |
| Feb 18, 2021 at 9:34 | comment | added | cryptobeginner | Thank you -- I am curious: Given the value $P$ in the group, it is hard to find the value $x$ such that $P = x \cdot G$, right? The context is: I saw this being used to ensure that the public key is of form: $P = x \cdot G$ not say $P= x \cdot G + x' \cdot G'$, where the attacker fixes, $x, x', G'$. This strikes me as wrong intuitively, but I don't seem to find a way to generate the values $(s,e)$ to give a valid signature for this new the public key $x \cdot G + x' \cdot G'$. | |
| Feb 18, 2021 at 6:54 | history | answered | Yehuda Lindell | CC BY-SA 4.0 |