# Asymmetric code signing also tied to a device

I have an asymmetric key pair. The public key is stored in many targets. Is there a way to take that private key K, derive a new private key K' with a known value x, sign the code, and then each target can take the same value x and derive a public key that pairs with K' and verify the code?

I want to authenticate code for only a specific device, but only have the ability to store a common public key in many targets. So the known value x would be some kind of hardware serial number.

• Do you have hardware serial numbers or something along those lines available? – SEJPM Aug 7 '17 at 18:32
• Do you just want to make sure device y rejects an update for device x? If so, can you just put the device id in the signature, and have each device check (a) whether the signature is valid, and (b) whether the signed device id matches its own device id? – Squeamish Ossifrage Aug 7 '17 at 20:16
• Does your ​ "K' with a" ​ mean "K' using a" or ​ "K' and a" ? ​ ​ ​ ​ – user991 Aug 7 '17 at 21:18

## 1 Answer

This is sometimes called a hierarchical signature scheme or a blinded signature scheme. Examples of the idea are being considered or adopted in Tor for next-generation onion services, in Bitcoin BIP32 for cheap many-address single-private-key wallets, and possibly by the IETF for standardization. There was a good summary discussion with references on the CFRG mailing list a few months ago. But the idea is not currently standardized, and implementations aren't littering the roads like implementations of ordinary signature schemes are.

$\newcommand{\Z}{\mathbb{Z}}$The basic idea of an elliptic-curve signature scheme using an order-$\ell$ group of $k$-rational points of an elliptic curve $E$ is that a private key is a secret scalar $a \in \Z/\ell\Z$, a public key is the curve point $A = [a]P$ where $P$ is a standard $k$-rational order-$\ell$ base point, and a signature is some point and scalar that satisfies some verification equation involving $A$.

Typical examples in this design space are ECDSA, for an archaic slow error-prone one, and EdDSA, for a modern fast safe one. They can both be adapted to hierarchical/blinded schemes.

The basic idea of an elliptic-curve hierarchical/blinded signature scheme is to ‘tweak’ the public key and private key in the same way by another scalar $t \in \Z/\ell\Z$. The derived private key is the scalar $a_t \equiv t a \pmod \ell$, and the derived public key is the curve point $A_t = [t]A = [t a]P = [a_t]P$. The signature verification equation is the same as in the underlying signature scheme. Anyone who knows the tweak and the original public key can verify signatures using the derived public key; anyone who doesn't know the tweak can't tell a derived public key from any other curve point.

A devil lurks in the details like Sean Spicer in the bushes: you may need to pay attention to cofactors, malleability of signatures and public keys, etc.—that's why some people want the IETF to standardize a hierarchical signature scheme for the internet, so that individual application developers need not learn the hard way about covfefe or other similar pitfalls of novel developments in public-key cryptography.