I want to implement proxy re-signature on elliptic curve.
I've been thinking about ideas like the one below, but are there any problems?
Key Generate:
- $a = $ alice's secret key
- $aG$ = alice's public key
- $b = $ bob's secret key
- $bG = $bob's secret key
- $rk_{ab} = aP * b^{-1} = a/bG$
First Sign:
- $Pm$ is hashed point
- $k = $ random
- $r = ka^{-1}$
- $z = e(G, G)$
- $s = z^kPm$
Resign:
- $r' = rk_{ab} * r = a/bP * ka^{-1} = k*1/b*G$
- $s' = s$
Verification:
- $t = e(bG, r) = e(G, G)^k = z^k$
- Check $tPm == s'$