1
$\begingroup$

Is there a signing scheme relying on a secret key $s_k$ and public key $p_k$ for which we can find a one way function $h$ such that we can efficiently calculate the public key associated with $h(s_k)$ from $p_k$.

For instance, with the ElGamal signing scheme, we'd be looking for a one way function $h$ such that for all $g$ and $s$ in $\mathbb{Z}/p\mathbb{Z}$ we can efficiently compute $g^{h(s)}$ from $g$ and $g^s$.

Alternatively, being able to verify that a given value is indeed the public key associated with the hash of the secret key would be enough.

(The goal is to get some kind of non interactive forward secrecy with certain properties.)

$\endgroup$
1
$\begingroup$

Sure. ​ Let (Gen,Sign,Ver) be any signature scheme, and let h be any pseudorandom generator from {0,1}k to {0,1}k+L. ​ (Since h is a pseudorandom generator, h is one-way.)

Gen' takes k+L random bits as input and outputs [those bits as the private key] and
[the public key resulting from running Gen on the last L of those bits] as the public key.
Sign' outputs the result of running Sign on [the message and
[the private key resulting from running Gen on the last L bits of the (k+L)-bit private key]].

(Gen',Sign',Ver) is a signature scheme such that "we can efficiently calculate
the public key associated with $h(s_k)$" without even needing $s_k$'s public key.


That makes me think you're actually after something stronger.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.