2
$\begingroup$

I have been reading Fast Secure Two-Party ECDSA Signing by Lindell, and I see that in key generating and signing (pages 9-10, especially visible from Figure 1), only the first party performs a commitment, whereas both parties perform a proof-of-knowledge. I have seen this paradigm also in different two party protocols. Though, I do not quite understand why both parties need to provide zero-knowledge proofs, but only the first party needs to provide a commitment? What's the reason for this?

$\endgroup$
1
$\begingroup$

There is no simple answer in general to this question. In this specific setting, the zero-knowledge proof is needed to extract the discrete log of the value sent by the party and this is needed in the proof. In some other two-party protocols, this isn't needed. So, there's no general answer.

$\endgroup$
  • $\begingroup$ I see. So, basically it's due to the proof. And I guess why just one party uses a commitment is while you use a fair coin tossing? $\endgroup$ – tinker Oct 17 '18 at 18:22
  • 2
    $\begingroup$ Yes. In order to get a coin tossing type of effect we need the commitment, and in order to extract the discrete logs we use the ZKPOK proofs. $\endgroup$ – Yehuda Lindell Oct 17 '18 at 18:31
  • $\begingroup$ Btw, how does it affect security if just one party re-uses its k. What I mean is that assume party A and B sign a message, where party A has k_A, and party B has k_B. Then, party B signs a different message with party C, where B again uses the same randomness it used, so it uses k_B again, and party C of course has its own randomness k_C. So, I assume observing (r_{AB}, s_{AB}) and (r_{BC}, s_{BC}), one cannot break security, right? $\endgroup$ – tinker Oct 18 '18 at 12:28
  • 1
    $\begingroup$ If one party reuses its randomness, I am assuming that this is the corrupted party. So, the randomness of the honest party results in a completely fresh random value and so all is fine. $\endgroup$ – Yehuda Lindell Oct 18 '18 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.