Need a signature scheme where signer signs with one secret key out of a set of signing keys, but verification can be done using just one verification key.

  • 1
    $\begingroup$ What's the problem you're trying to solve? RSA obviously allows this (there are many, actually, an infinite number of private exponents for any specific public exponent/modulus). Alternatively, we have a trivial solution where we take any signature system, and append extra data to the signing key (which is ignored when performing the actual signature operation). I doubt either of these will meet your requirements; so, what are they? $\endgroup$
    – poncho
    Commented Jul 27, 2017 at 14:06
  • $\begingroup$ meta.stackexchange.com/a/233676/232555 ​ ​ $\endgroup$
    – user991
    Commented Jul 27, 2017 at 17:59
  • $\begingroup$ hash-based signature scheme. Merkle tree combine with one of those one time signature scheme. maybe ? $\endgroup$ Commented Jul 28, 2017 at 2:45

1 Answer 1


Maybe you're looking for certificates. A certificate is a formal signed statement of authority for a user's public key to sign documents. A certificate is signed by a party called a certification authority whose public key a verifier knows. A user transmits a message, her certificate, and a signature under the user's private key. The verifier, knowing only the CA's public key, verifies the certificate with the CA's public key, extracts the enclosed user public key, and verifies the signature with the user public key. This can be built out of any vanilla signature scheme.

Maybe you're looking for group signatures. A group of users, and a group manager, gather together to generate keys and publish a public key for the group. Any member of the group can sign messages on behalf of the group, verified by the group's public key. The verifier does not ordinarily learn which member signed it, only that someone in the group did, but the group manager can deanonymize signers. There are a few more security properties; see the article for details and references. This requires fancy crypto.

Maybe you're looking for multisignatures or collective signatures. A collective of users gather together to generate keys and publish a public key for the collective. The collective, or some sufficiently large subset, must all agree to sign any particular message before they can produce a signature that a verifier can verify with the collective's public key. In an answer to another question yesterday I sketched a simple collective signature scheme out of Ed25519.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.