I want to implement partially blind signature, and I looked at Zheng Gong's scheme. (Title: Efficient Partially Blind Signature Scheme with Provable Security)

In the scheme, there is a initialization phase. Signer S selects two large prime numbers p and q (length of p = 1024, q = 160), which satisfied q|p-1. Then chosses a generator g (element of Zp), and g^q = 1 mod p.

I wonder how can I find "quickly" the two primes that satisfy the condition (q|p-1) and the generator g that satisfy g^q = 1 (mod p).

Thank you

  • 2
    $\begingroup$ DSA has the same / similar requirements, which will help you finding standards / implementations for this $\endgroup$ – SEJPM Nov 14 '16 at 12:07
  • 1
    $\begingroup$ For example take a look at Diffie-Hellman. It uses safe-primes $kq+1$ so $q|(p-1)$ then choose a generator that satisfies $1 \equiv g^{q} \pmod{p}$ $\endgroup$ – kub0x Nov 14 '16 at 12:50
  • $\begingroup$ BTW: the paper is 10 years old, and these security parameters are now considered insufficient. I would recommend p=2048 and q=256. $\endgroup$ – poncho Nov 14 '16 at 15:44
  • $\begingroup$ FIPS 186-4 A.1 and A.2 (PDF) has the specifications you need / want using the sizes poncho recommended. $\endgroup$ – SEJPM Nov 14 '16 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.