2
$\begingroup$

In Elliptic Curve Cryptography (ECC) assuming user A has a private public key pair of $S$, $P$ accordingly with generator point $G$ which as we know is: $$P=S*G$$ Assuming that user A wants to generate multiple key pairs deterministically to manage them easier and there is a user B who should be involved in the process to reduce single point of failure. Each time user A wants to generate a new key pair he needs to ask user B to provide him some secret so that user A can generate the new private key.
There are two requirements for the whole scenario:

  1. User B should not be able to generate any of the user A's private key at any point.
  2. User A and B can generate future public keys without even knowing their corresponding private keys.

The second part can be done easily if we have only one users: $$S_{i} = S_{i-1}+X$$ then: $$P_{i} = P_{i-1}+X*G$$ So anyone who knows $X*G$ now can generate the next public key. So in the scenario that was mentioned, user B by giving part of $X$ should help user A to construct the next private key but then they cant know what the next public key will be since they both need to generate X and until then they cant generate $X*G$.
So the question is how we can make this work if user A needs some secrets from user B to construct the key pairs? (I assume we might need something similar to shamir secret sharing at some point)

| improve this question | |
$\endgroup$
  • $\begingroup$ With point 2 you say that "User A and B can generate future public keys". I understand from your explanation below that that they may cooperate to do this? Because I don't understand how A and B can create public keys without exchanging X... $\endgroup$ – Maarten Bodewes♦ Apr 23 '15 at 17:31
  • $\begingroup$ @MaartenBodewes $X$ as far i can think of can either be a pre determined value between A and B or it can be hash of $P$ concatenated with $i$ which generates different X each time but omly cam be calculated by A and B who knows $P$. So they can drterministically generate X together. But if it is this way then A can generate X himself without relying on B. How can this be improved in a way that A requires to get something from B every time to generate X while X*G can be calculate by both of them without A knowing X $\endgroup$ – abeikverdi Apr 24 '15 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.