Suppose A and B communicates where A makes B some payments by sending signatures as the following,

$$ \sigma_1 \leftarrow Sign(v_1, sk_A), \sigma_2 \leftarrow Sign(v_2, sk_A), \dots \sigma_n\leftarrow Sign(v_n, sk_A).$$

That is, A has made B $n$ payments where he paid $v_1$ in payment 1, $v_2$ in payment 2 and so on.

Let's say B wants to collect his money from a bank by sending these signatures as proof. Can he generate a single signature such as $\sigma_{agg} \leftarrow Sign(\sum_i v_i, sk_A)$ out of the individual signatures that he has?

The goal is to hide the number of transactions as well as the payment amount in each from the bank in this case.

  • $\begingroup$ What would the security be here exactly? The functionality you describe seems somewhat problematic, since I could just sum up the same signature $\sigma \gets Sign(v,sk_A)$ $k$ times to receive $k\cdot v$. More generally, such a functionality would mean that given a valid signature of $1$ I can forge valid signatures for any value. $\endgroup$
    – Maeher
    Commented Jul 13, 2020 at 9:23
  • $\begingroup$ @Maeher Well ideally, we should prevent double-spending attacks and creation of money out of thin air. B should not able to collect more than the sum of individual payments. I don't know whether this is possible at this point. $\endgroup$
    – SpiderRico
    Commented Jul 13, 2020 at 9:25
  • $\begingroup$ That would imply being able to identify the constituent signatures. I.e. let $\sigma_1,\sigma_2,\sigma_3$ be signatures and let $\sigma_{i,j}$ be the aggregate of $\sigma_i$ and $\sigma_j$. We would need to be able to notice that $\sigma_{1,2}$ and $\sigma_{2,3}$ have one aggregated signature in common. However, this property probably allows us to identify individual aggregated transactions. But it's hard to tell without a formal definition of what you want. $\endgroup$
    – Maeher
    Commented Jul 13, 2020 at 9:33
  • $\begingroup$ @Maeher Yeah I agree, it's not very clear to me at this time too. I was just entertaining this notion to see if something can come out of it. Wanted to check if something similar already exists in the literature by asking it in here. $\endgroup$
    – SpiderRico
    Commented Jul 13, 2020 at 10:08


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.