3
$\begingroup$

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection.

There is a party B want to use this system to create a signature over some data. This signature can then be used to prove to a party C that A created the signature over the data. Party C of has access to the trusted public key belonging to the key pair of A.

Rules:

  • there is one static public / private key pair for A
  • no other operations are allowed on the private key of A
  • party B need to supply a public key to A to perform (EC)DH, but this may in fact be any data
  • the public key offered by B to system A does get validated according to the (EC)DH scheme used
  • any signature scheme is acceptable, as long as the signature can be verified by party C
  • the secret key is generated using a KDF over the generated shared secret

Is it possible to generate a signature over data with this kind of system? If not, can you offer some kind of prove that it is not possible? If so, what would such a signature scheme look like?

If it is not possible, what if the key derivation part was left out and the shared secret could be used for any operation?

Improve this question
$\endgroup$
6
  • $\begingroup$ Well, if ‘performing ECDH’ means ‘computing scalar multiplication on a curve given an arbitrary base point and an arbitrary scalar’, and you also have access to a secret scalar, then it's relatively easy, but that's kind of vacuous. Can't quite do Ed25519 using X25519 because X25519 doesn't distinguish sign, but you can do something close in a quotient modulo sign—qDSA. $\endgroup$
    – Squeamish Ossifrage
    Oct 17, 2019 at 22:02
  • $\begingroup$ qDSA seems to require a hash over part of the private key (?) Additional operations with the private key are of course forbidden as well (heck you could just perform ECDSA if that wasn't the case). $\endgroup$
    – Maarten Bodewes ♦
    Oct 17, 2019 at 22:10
  • $\begingroup$ If you all you have is $[n]B$ and an oracle for $P \mapsto H([n]P)$, where $n$ is the secret scalar and $B$ is the standard base point, then there's almost certainly no signature scheme you can derive from that. Probably same even if the oracle is $P \mapsto [n]P$. $\endgroup$
    – Squeamish Ossifrage
    Oct 17, 2019 at 22:28
  • $\begingroup$ What if $[n]$ is set to be hash over the data? Then the public key is a direct derivation of the hash over the data, and the secret can be used to show that the correct input was used. Would that fly? $\endgroup$
    – Maarten Bodewes ♦
    Nov 26, 2019 at 20:22
  • $\begingroup$ I don't understand. What is the secret? What is the signature equation? $\endgroup$
    – Squeamish Ossifrage
    Nov 26, 2019 at 22:04

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.