1
$\begingroup$

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the private key itself?

For example, I have a private key (which is a large random 256-bit number) and I generate one public key on the secp256r1 curve and another public key on the secp256k1 curve, how do I provide the two keys to a third party and prove to them that these two public keys are generated from the same private key? Is there some kind of zero-knowledge proof or some algorithm that can accomplish that? Thanks.

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ Caution: I goes against standard cryptographic practice (and rule: one usage, one key) to use the same private key directly multiplying the base point on two curves (as considered). I would not be too surprised if it turned out to ease recovering the private key, at least for some curves. If one wants to limit the private key size, there are simple and safe options, like computing at least one of the two multipliers by a Key Derivation Function (but that makes it hopeless to perform what's asked). $\endgroup$
    – fgrieu ♦
    Commented Oct 12, 2018 at 6:56
  • 1
    $\begingroup$ crypto.stackexchange.com/questions/54660/… $\endgroup$
    – kelalaka
    Commented Oct 12, 2018 at 7:35
  • 1
    $\begingroup$ @fgrieu: I didn't retract, not sure what happened. $\endgroup$
    – Changyu Dong
    Commented Oct 12, 2018 at 15:10
  • $\begingroup$ @Changyu Dong: I understand now; you raised a flag for closing, but have not yet the reputation to cast a close vote. The count shown is accurate. $\endgroup$
    – fgrieu ♦
    Commented Oct 12, 2018 at 15:25

0

Reset to default

Browse other questions tagged or ask your own question.