1
$\begingroup$

I'm looking for a method for a scenario with following requirements:

At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific person, so that they can't get answers to their broadcasts.

Every member has a public address "Apub, Bpub, .." (max ~100 bytes) which was derived from a private secret "Apriv, Bpriv, .."

  • A signs a message with Bpub and broadcasts it to the network.
  • B broadcasts a request (based on his Bpriv/Bpub without revealing these 2 keys) to validate, that the message from A belongs to him

Is C able to validate the request from B, without knowing Bpriv/Bpub and therefore not knowing his identity?

A shouldn't be able to proof, that the message was signed for himself without knowing Bpriv.

Are there existing code examples for this, which are free to use and free from patents?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

First, before I answer your questions: Money rewards are not forbidden, as far as I know, but that's not how it goes here. Feel free to check out the according question on crypto-meta.

I think, there are few conceptual misunderstandings in your scenario.

First, a signature scheme uses the private key (also called signing key) to sign messages, and it uses the public key (aka verification key) to verify, that a signature matches to a given message (under consideration of this verification key).

Then, you also want to use the public key as address set a limit of ~800 bit, which is a bad idea, because common schemes based on RSA or Schnorr groups (like ElGamal signatures, DSA, etc.) are recommended to be larger (1240 bit at least).

And then, your scenario is quite weird, or maybe you used the wrong expressions. But if A broadcasts a message, he can not sign this message for B (signing requires the private key). If you meant "encrypt the message with the public key $B_{pub}$", it would make sense, but why would B send a request if this message was meant for him?And why would C not know the public key of B, if this was also used as address?

Maybe you should clarify your scenario, because right know I tend to the answer "no, it's not possible".

Improve this answer
$\endgroup$
1
  • $\begingroup$ thanks for the answer. to clarify my scenario. it's about an e-coin system like bitcoin. i used the signing as a synonym here, not the actual signing that we know. what i want to achieve is, that A sends coins to B. but i have to make sure that only B can spend the coins. The message from A could be encrypted with Bpub, but B would have to release his pub key and sign the message to proof that only he can decrypt the message from A. But i want to keep it anonymous, that B doesn't have to show his identity when sending coins like in ZeroCoin $\endgroup$
    – 5andr0
    Commented Feb 18, 2014 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.