# Derive anonymous dsa key-pair from two certificate authorities

Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a child of ca1 and ca2 but not which of the keys, that have been originally issued by the ca's has been used? Thus anonymized signature?

ca1 = certificate authority 1
ca2 = certificate authority 2
cert1 = public certificate of ca1
cert2 = public certificate of c2
privkey1 = private key issued by ca1
privkey2 = private key issued by ca2
privkey = getprivkey(privkey1, privkey2) = private key derived from ca1 & ca2
datasig = signature of data package - signed with privkey
dsaproof = digital signature algorithm proof function


Is the following possible?

True = dsaproof(datasig, cert1)
True = dsaproof(datasig, cert2)

• So would you write down equations you'd like to verify? – Vadym Fedyukovych Jul 4 '18 at 11:37
• not private keys are associated with CAs but public keys. – user27950 Jul 5 '18 at 5:01
• @VadymFedyukovych I dont have an equation but instead wanted to find out, if there is the possibility to do so. – Techradar Jul 5 '18 at 11:49
• @Cryptostase True, but in order to create a new key-pair which is related to two other key-pairs I need to use private keys, otherwise anyone could generate children based on public keys. And further, the signature of the new key-pair should then prove that the key-pair is inherited from ca1 and ca2. Does that make sense? – Techradar Jul 5 '18 at 11:50
• I don’t understand why the CA should be anonymized in the first place. – user27950 Jul 5 '18 at 12:23