New answers tagged threshold-cryptography
0
From what I understand, you want to share a secret to B in such a way that every single member of B is required to reconstruct the secret. In that case just use a threshold secret sharing scheme where the threshold is the number of players in B. This ensures that no subset of players in B can reconstruct the secret.
I’m not convinced you need encryption here ...
4
would using S = r + H(A, M) be a secure variant?
Actually, it would become trivial to generate a signature for an abitrary message with just the public key.
The verification check would be:
$$2^h s G = 2^h R + 2^h H(A, M) A$$
where $h$ is the curve cofactor, $G$ is the curve generator, $A$ is the public key, $M$ is the message and $(R, s)$ is the signature.
...
6
This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question:
$S = r + a H(A, M)$
Removing $a$ from the computation would be terrible.
The first issue that comes to mind is malleability, on top of collision resistance.
The signature process for EdDSA ...
Top 50 recent answers are included
