1
$\begingroup$

please let me know if there's any digital signature scheme for the following problem. Thanks in advance!

  • I want to have a token that's somehow signed (or granted) by multiple 3rd parties for a certain document. The token then can be used to access resources managed by the parties.
  • 3rd parties just need to use their private keys to validate the token

I find the Wiki article about Multisignature, but really I don't know how to apply it into my case.

$\endgroup$
0
$\begingroup$

Generate the token as a random number. Have each of the parties sign the token independently. Each will provide one signature on the token. Concatenate all the signatures into a big string. That string can then be sent when resources are requested. Each party can verify that its own signature exists in the string.

$\endgroup$
  • $\begingroup$ So I think we should have a map between public keys and associated signatures in the tokens, right? If there are many parties, wow, the tokens will be really really big strings. $\endgroup$ – anhldbk Jan 11 '17 at 6:58
  • 1
    $\begingroup$ If you don't mind the third parties keeping state, then during a request for resources the requester can send the token and the third party can store the token persistently. Then when the resource needs to be consumed, the token is transmitted again and the provider checks to see if the resources were previously requested. This solves the large token issue. $\endgroup$ – dionyziz Jan 11 '17 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.