Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} \bmod p$, where $r_1, r_2$ are uniformly random values and $p$ is a prime number. Both send their values ($a$, $b$) and the corresponding signatures ($s_1$, $s_2$) to an untrusted server.

At some time, they want to ask the server to calculate $a+b$ and sends the result along with the combined signature, $(r_1 * r_2 * g^{a+b})^{d_2}$ to Bob. So Alice needs to transform her signature to be compatible with Bob's signature, and this allows the server to combine two signatures correctly. Alice can pass the $r_1$ onto Bob to verify the combined signature.

How can this transformation be done?

It should be secure against the server for many iterations, so Alice or/and Bob should be able to interact with different clients and do the same operation and transformation again.

Only Bob needs to be able to verify the signature, this does not need to depend solely on public values. The signature could be a MAC.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.