2
$\begingroup$

I am building an application in which I need to sign a message without revealing my entire identity.

To do so, I just compute a zk proof with the following purpose:

  • prove I own the secret key sk associated with a public key pk (that matches some properties, e.g. $pk \in Authorized\_keys$)
  • sign a message with $sig = H(sk|msg)$

with $H$ a hash function.

  1. Is it safe ?

  2. Should I use a more advance construction (such as $sig = H(sk \oplus opad, H(sk \oplus ipad$, msg)) to build a HMAC) ?

Improve this question
$\endgroup$
4
  • 2
    $\begingroup$ Are you trying to design a ring signature? $\endgroup$
    – Daniel S
    Commented Dec 19, 2023 at 14:18
  • 1
    $\begingroup$ I am trying to design something close to a group signature. But even if my approach is not the right one, it would be helpful to understand why it does not work $\endgroup$
    – Makubu
    Commented Dec 19, 2023 at 15:39
  • $\begingroup$ What you are saying seems to describe attribute based signature. You can google it. For the specific case of $pk \in Authorized_keys$, it is called Ring-Signatures. You do not need to reinvent the wheel. I am pretty sure, they would be more efficient than generating ZK-Proofs on hashes $\endgroup$
    – Manish Adhikari
    Commented Dec 20, 2023 at 6:06
  • $\begingroup$ I am using such a structure because I want another property, which is the following: If I sign a message, the signature is deterministic, so that if someone else in the authorized keys tries to sign the same message, the signature will be different from mine. Given two signatures and the same message, I want to be able to tell if they come from the same person or not, which is not guaranteed by the ring signature from my understanding (but I might be wrong) $\endgroup$
    – Makubu
    Commented Dec 20, 2023 at 10:07

1 Answer 1

Reset to default
0
$\begingroup$

Unless there are severe performance restrictions it would always be safer to use HMAC or even a KDF such as HKDF(-extract). Note that e.g. SHA-2 is not secure for length extension attacks in case the hash is used as a keyed PRF. This is especially important if a message is being signed.

If you go for a KDF it might be a good idea to include an $\mathit{Info}$ field that specifies the use case (i.e. a label "zk_proof_of_possession" in ASCII). It could be that a salt and/or a message sequence number may increase security, but that's hard to know without understanding the full protocol.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Thanks for the answer, so the protocol I described can in deed be considered as a signature protocol ? $\endgroup$
    – Makubu
    Commented Dec 20, 2023 at 10:55
  • $\begingroup$ Well, it is a MAC as you cannot use $\mathit{pk}$ to verify, right? Sometimes MAC's are considered "symmetric signatures". Note that I didn't go into the ZK-proof part at all, maybe that's required and in that case somebody should come by and pinch me for getting it wrong... $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 20, 2023 at 13:16
  • $\begingroup$ No you can't but in this case I want to use the ZKP to: (1) prove that the MAC is correct and corresponds to a certain private key. (2) Ensure some properties associated with this private key, e.g. if I prove in the same ZKP that sk corresponds to a known public key pk, then could it be considered as a signature protocol ? $\endgroup$
    – Makubu
    Commented Dec 20, 2023 at 15:04
  • 1
    $\begingroup$ A digital signature is publicly verifiable. Since your scheme is not publicly verifiable, it cannot be considered a signature protocol. $\endgroup$
    – Geoffroy Couteau
    Commented Sep 14 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.