1
$\begingroup$

I want to implement proxy re-signature on elliptic curve.

I've been thinking about ideas like the one below, but are there any problems?

Key Generate:

  • $a = $ alice's secret key
  • $aG$ = alice's public key
  • $b = $ bob's secret key
  • $bG = $bob's secret key
  • $rk_{ab} = aP * b^{-1} = a/bG$

First Sign:

  • $Pm$ is hashed point
  • $k = $ random
  • $r = ka^{-1}$
  • $z = e(G, G)$
  • $s = z^kPm$

Resign:

  • $r' = rk_{ab} * r = a/bP * ka^{-1} = k*1/b*G$
  • $s' = s$

Verification:

  • $t = e(bG, r) = e(G, G)^k = z^k$
  • Check $tPm == s'$
$\endgroup$
2
  • $\begingroup$ Reviewing full scheme design is off-topic for this site. But you may break down specific components of the formula, and assumptions to make it on-topic. And the best way to get this started, I think, would be to annotate each step of your scheme with comments that explains what they achieves, both mathematically and security-wise/logically. $\endgroup$
    – DannyNiu
    Commented Feb 16, 2023 at 5:16
  • $\begingroup$ e(aG, r) = z^k, So Anyone can generate a new signature via z^k . $\endgroup$
    – user212942
    Commented Mar 8, 2023 at 3:30

0

Browse other questions tagged or ask your own question.