up vote 1 down vote favorite

Using Schnorr signatures, one could devise a system where a single public key can represent multiple signers. Do signature schemes like that represent crypto systems usable for encryption?

In that case, could you say that a signature scheme and an encryption scheme represent the same thing?

share|improve this question
  • 4
    I do not understand the question. In a signature system, if a single public key can represent multiple signers, then any of these signers can sign for the others, isn't it? Then in what sense do the signers have multiple keys? What makes Schnorr signatures suitable for such a system ? And if we call such signature scheme an encryption cryptosystem, what's the equivalent of the deciphered plaintext output? – fgrieu Sep 23 at 19:52
  • 1
    I've reformatted your question because I found that the question in the title is significantly different from the one in the body (so I put both in the body); please check if no significant info has been lost or if the question doesn't state what was intended. – Maarten Bodewes Sep 24 at 13:55
up vote 5 down vote accepted

In that case, could you say that a signature scheme and an encryption scheme represent the same thing?

I don't see how. With a signature scheme, the public operation can return just a single bit (either "the signature verified" or "it didn't"). It's not at all clear how you could efficiently use a function that returns a single bit as a part of an encryption operation.

Now, there are certainly cryptographical primitives - such as modular exponentiation within RSA - that can be used as a primitive within either a public key encryption or a signature scheme; however there are also signature schemes that cannot be used to do encryption, and so generically, the two classes of schemes cannot be identical.

share|improve this answer
  • Note that I've changed the question somewhat to correct the problem that the title had a different question than the body. I changed your answer accordingly and added the RSA example. I guess that the first section of your answer, answers the initial question stated in the title, so that should be OK. – Maarten Bodewes Sep 24 at 13:59
  • Thank you, Poncho. Would the same apply to Zero-Knowledge Proof systems?In other words, are the underlying cryptographical primitives of a ZKP scheme more similar to that of a signature scheme (rather than an encryption system)? In a way, ZKP protocols are devised to return "the proof verified" or "it didn't," but I have seen papers assume "unbreakable encryption" when describing the assumptions in the ZKP scheme. – Raz Lemniscate Sep 24 at 18:17
up vote -3 down vote

I think the current public/private key systems have many parallels with encryption/decryption functions.

For example, the generator point (which relies on the underlying curve) is the shared key, upon which all private keys are calculated with - in order to compute/derive the corresponding public keys (not including hashing/pre-address formatting).

So if one wanted to encrypt some plain-text message of a length less than the length of the key, it could easily be done with the private key as the one-time pad (OTP) to xor a message for example, and then at some point in the future decrypt that same ciphertext message by xor'ing it again with the original private key (then discard that address/key-pair, as the OTP shouldn't be reused). [Just to be clear I am not implying this is how private keys should be used from a public/private key-pair, but just pointing out that a private key "could" be used to encrypt, and not just to "sign" to prove ownership.]

However, to send that ciphertext to someone else, would require their knowledge of the original private key if they wanted to decrypt it. For longer messages, some key stretching function could also work for keys that aren't long enough, although caution would be needed that the method doesn't leak anything information about the key.

share|improve this answer
  • 1
    This is so wrong; public/private key systems never assume that the sender and the receiver initially share a secret – poncho Sep 23 at 23:29
  • That's not what I said nor implied. I said that if a private key from a public/private key pair was used to xor a message to "encrypt" it, then sending the encrypted message would be useless unless the recipient had the shared key. I wasn't referring to the use of a Diffie-Hellman style exchange, but rather to the encryption-related question being asked here. – Steven Hatzakis Sep 24 at 7:40
  • 1
    So, you're saying that a signature scheme can be used as an encryption scheme, by this logic: 1) we ignore what the signature scheme actually does, 2) we take the keys, and 3) use them in a completely different algorithm. – poncho Sep 24 at 13:02
  • There is some merit in the idea: you can use a private key to create a symmetric key and encrypt with that. Of course, all the parties that need to encrypt/decrypt would be holding the same private key and can therefore sign as well. At that time you might as well use a MAC instead of a signature algorithm - which is a major issue with the idea. The other issue, and this is possibly more damning, is that the question was to use a signature scheme for encryption, not just the private key. So this post doesn't answer the question in my opinion. – Maarten Bodewes Sep 24 at 13:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.