# Security of the server's private key

In some papers, server generates keys for users as follows: $$sk_i=msk+H(ID_i)v_i\ (mod \ p)$$ where $msk=$ the secret key of server

$v_i$ is randomly selected from $Z_p$ for i-th user , $p$ is a prime number

$ID_i=$ the identity of i-th user

$sk_i=$ the secret key for i-thuser

$H$ is the hash function

If there is a user who knows more than one secret key, does that key generation scheme prevent to reveal the value of $msk$ from users.

How to prove the security?

I have forgotten paper references. Sorry for that.

• Can we assume that $v$ and $p$ are generated once for the server? Please explain how they are used in the protocol. You've specified the algorithm, which is great, but I'm missing the context and time factor. – Maarten Bodewes Jan 24 '17 at 8:27
• @MaartenBodewes. $v$ is uniformly randomly selected for each users. Therefore, we can assume $v_i$ for i-th user. $p$ is generated once for the server. – poethathatr Jan 24 '17 at 10:12
• Do the users learn their $v_i$ directly at any point or are they just being given their $sk_i$? – SEJPM Jan 24 '17 at 12:10
• @SEJPM. No, server gives $v_iP$ and $sk_i$ to user. Users do not learn $v_i$ directly. – poethathatr Jan 25 '17 at 1:48

Write $w_i=H(ID_i)v_i$. The value $H(ID_i)$ is some fixed public value, so we can kind of forget about it. That is, if $v_i$ is uniformly random, then so is $w_i$.
Now the key is generated as $sk_i=msk+w_i\pmod{p}$. Since $w_i$ is uniformly random, this is simply a generalisation of the one-time pad. In other words, $sk_i$ reveals no information whatsoever about $msk$. Therefore however many times you repeat this, the user will still learn nothing about $msk$.
• This is a good answer considering the information about the problem that is given and assuming that when the user gets $v_iP$ the $v_i$ is protected by DLOG. – Elias Jan 25 '17 at 17:43