Timeline for The security of one-time digital signatures from a solution to a diophantine equations
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 2, 2022 at 13:43 | comment | added | Chris Wuthrich | I am not saying it is too easy, just easier. The "diophantine" problem never enters. You could do this instead, with the same level of security (I believe): Pick an element in $P\in \mathbb{P}^n(k[T])$ for a finite field $k$. Pick a fibred variety $X\to \mathbb{P}^1$ such that $P$ is a section. The hash $H$ has values $t$ in $\mathbb{P}^1$ and your signature is $P_t\in X_t(k)$ where $X_t$ is the fibre above $t$. Again faking it is finding a point in $X_t(k)$ and your initial pick $P$ provides one for all $t$. Using it too often will reveal it, etc. | |
| Dec 2, 2022 at 13:18 | comment | added | Joseph Van Name | @ChrisWuthrich. Can you elaborate on why the NP-complete problem of finding an $F_p$-rational point on a variety should be too easy to make a secure one-time digital signature algorithm? | |
| Dec 1, 2022 at 16:31 | history | edited | Joseph Van Name | CC BY-SA 4.0 |
added 933 characters in body
|
| Dec 1, 2022 at 0:02 | comment | added | Joseph Van Name | @MaxAlekseyev Great. Then I can cross post in a few days if this question remains open. | |
| Nov 30, 2022 at 22:47 | comment | added | Max Alekseyev | This question seems to be better suited for crypto.stackexchange.com | |
| Nov 30, 2022 at 22:21 | comment | added | Chris Wuthrich | I don't understand. To fake a signature I would only need to find a $\mathbb{F}_p$-rational point on a variety. That is much easier than solving a diophantine equation. | |
| Nov 30, 2022 at 21:50 | history | asked | Joseph Van Name | CC BY-SA 4.0 |