Imagine someone knows a set of $n$ ECC public keys $\mathcal R = \{K_1, K_2, ... K_n\}$ but they don't know the corresponding private keys $k_1$, $k_2$ ... $k_n$. They wish to create a public key $sG$ such that anyone with a private key $k_i$ belonging to a $K_i \in \mathcal R$ can retrieve/calculate $s$. This scheme should create $sG$ such that not even the executer of the scheme can retrieve $s$. Is this possible without having to interact with the private key holders?

  • $\begingroup$ This question cannot be interpreted without the following typo being fixed: "No one else should be able to retrieve s not even the generator of sG." $\endgroup$ – Adrian Self Jun 10 at 0:00
  • $\begingroup$ yes, I agree and took the liberty of fixing it. @philogy let us know if that is a problem $\endgroup$ – kodlu Jun 10 at 12:04
  • $\begingroup$ which typo? I honestly don't know what you mean but thanks for fixing it anyway $\endgroup$ – philogy Jun 10 at 12:24
  • $\begingroup$ What are the requirements on the private keys? As it stands I could simply have $k_1 = \dots, k_n$? $\endgroup$ – Cryptonaut Jun 11 at 13:25
  • $\begingroup$ No the private keys are all different I'm afraid, otherwise it would be too easy $\endgroup$ – philogy Jun 11 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.