1
$\begingroup$

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key.

However, in some contexts, specially identity based games, I would imagine the key used for verification should remain secret. Say anonymous credentials and some challenge response constructions.

My question is the following:

  • Should I always call the key used for verification "public key" even on those settings?

  • Is it ok to call it verification key on those settings instead?

  • I have seen some recent work, for example, on multivariate, lattice based and post quantum stuff in general, call it more and more verification key. They then assume is public, is it something that is coming to fore or there is a difference of meaning between the 2 terms?

$\endgroup$
2
$\begingroup$

Should I always call the key used for verification "public key" even on those settings?

Usually it is a public key, or at least it is called that in the key pair generation procedure of the cryptosystem that is used. Public key is in that case a more generic term - it may not be decided for what the key will be used after all. Similarly, cryptographic API's will often have a specific class that performs the key pair generation, so in that case the more generic term "public key" is likely to be used.

Is it ok to call it verification key on those settings instead?

Sure, and I've seen many cases where the shorthand SK and VK are used for "Signature generation Key" (or just "Signing Key") and "Verification Key". I'd probably prefer it because it is more precise; I guess there is no judge out there that decides these things for us.

Beware that SK is also often used for "Secret Key" which is kinda-OK, because private / signing keys are of course secret by definition.

I have seen more work say on multivariate, lattice based and post quantum in general stuff call it more and more verification key they assume is public, is it something that is coming to fore or there is a difference of meaning between the 2 terms?

Yes, it is about usage. Many things are still based on RSA where you can also use a public key for encryption. In that case calling it a verification key doesn't make sense. I think that for signature generation / verification specific keys the term "verification key" makes perfect sense, especially if in that scheme the key is not public.


As an aside: beware that in many schemes it is possible to derive the public key from data such as signatures. There is nothing in the definition of signature generation that prevents that. Moreover, for many schemes you can directly calculate the public key from the private key, so you cannot swap the terms whenever you like to do so.

In short, don't assume that you can keep the verification key a (shared) secret; you'll need proof for that.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.