New answers tagged

0

Proposition: the signature consists of the message $M$ and a standard signature $S$ of $M$ as an appendix, e.g. $S$ is per Ed25519. This allows to verify any subset of $M$ (by checking the subset of $M$ against the full $M$, and the full $M$ against it's signature $S$). This proposal reveals $M$, but that's unavoidable: if one can verify any subset of $M$, ...


2

We can easily see that the signature must be at least as large as the message. Otherwise, it would be impossible to verify any arbitrary single bit. Signing a message with n bits must necessarily must involve a signature that can validate n unrelated 1 bit message subsets. However, if we assume Bob and Mallory are given copies of the message, there may be ...


Top 50 recent answers are included