Let Alice has private key $R_1$ and known to Bob public key $P_1$. She generates signature for some message $M$ and shows it to Bob.

Could Bob generate signature for the same message $M$, but for different key-pair, exactly $R_2$ and $P_2$, such as

$R_1+R_2=N$, where N is order.


  • $\begingroup$ I think your question is missing some point. As $R_2$ and $P_2$ are a valid key pair, of course you can generate any signature. $\endgroup$ – user27950 May 5 '18 at 15:16
  • $\begingroup$ @Cryptostase $R_2$ (required for usual signing) is known only by Alice (but not Bob). The question is: could Bob from $P_2$ (as $-P_1$), $M$ and Signature($M$, $P_1$) generate Signature($M$, $P_2$)? $\endgroup$ – Karl Wagner May 5 '18 at 18:27
  • $\begingroup$ This seems unlikely—the task is, given $(r, s)$ with $$r \equiv x([H(m) s^{-1}]B + [r s^{-1}]A) \pmod p,$$ to find $(r', s')$ such that $$r' \equiv x([H(m) s'^{-1}]B - [r' s'^{-1}]A) \pmod p,$$ which doesn't leave much room for possible values of $r'$ and $s'$ without knowing the secret scalar $a$ for which $A = [a]B$—but the standard notions of signature security don't rule it out, because even in the multi-user setting they say nothing about related keys. How do you find yourself in this scenario? What would the consequences of such a signature be for your application and why? $\endgroup$ – Squeamish Ossifrage May 7 '18 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.