Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection.
There is a party B want to use this system to create a signature over some data. This signature can then be used to prove to a party C that A created the signature over the data. Party C of has access to the trusted public key belonging to the key pair of A.
- there is one static public / private key pair for A
- no other operations are allowed on the private key of A
- party B need to supply a public key to A to perform (EC)DH, but this may in fact be any data
- the public key offered by B to system A does get validated according to the (EC)DH scheme used
- any signature scheme is acceptable, as long as the signature can be verified by party C
- the secret key is generated using a KDF over the generated shared secret
Is it possible to generate a signature over data with this kind of system? If not, can you offer some kind of prove that it is not possible? If so, what would such a signature scheme look like?
If it is not possible, what if the key derivation part was left out and the shared secret could be used for any operation?