On 2010-03-22 11:22 PM, Sergio Lerner wrote:

Commutativity is a beautiful and powerful property. See "On the powerof Commutativity in Cryptography" by Adi Shamir.Semantic security is great and has given a new provable sense ofsecurity, but commutative building blocks can be combined to build thestrangest protocols without going into deep mathematics, are bettersuited for teaching crypto and for high-level protocol design. Theyare like the "Lego" blocks of cryptography!Now I'm working on an new untraceable e-cash protocol which has someadditional properties. And I'm searching for a secure commutablesigning primitive.

`The most powerful primitive, from which all manner of weird and`

`wonderful protocols can be concocted, are gap diffie helman groups.`

`Read Alexandra Boldyreva "Threshold Signatures, Multisignatures, and`

`Blind Signatures based on Gap-Diffie-Helman Group Signatures.`

`I am not sure what you want to do with commutativity, but suppose that`

`you want a coin that needs to be signed by two parties in either order`

`to be valid.`

`Suppose we consider call the operation that combines two points on an`

`elliptic curve to be generate a third point multiplication and division,`

`so that we use the familiar notation of exponentiation, thereby`

`describing elliptic point crypto systems in the same notation as prime`

`number crypto systems (a notation I think confusing, but everyone else`

`uses it)`

`Suppose everyone uses the same Gap Diffie Helman group, and the same`

`generator g.`

`A valid unblinded coin is the pair {u, (u^(b*c)}, yielding a valid DDH`

`tuple {g, g^(b*c), u, u^(b*c)}, where u is some special format (not a`

`random number)`

`Repeating in slightly different words. A valid unblinded coin is a coin`

`that with the joint public key of Bob and Carol yields a valid DDH`

`tuple, in which the third element of the tuple has some special form.`

`Edward wants Bob and Carol to give him a blinded coin. He already knows`

`some other valid coin, {w, w^(b*c)). He generates a point u that`

`satifies the special properties for a valid coin, and a random number`

`x. He asks Bob and Carol to sign u*(w^(-x)), giving him a blinded coin,`

`which he unblinds.`

--------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majord...@metzdowd.com