Hacker News Reader

Comment by thadt | Hacker News Reader

> the point of signatures is to show that something belongs to you

Which is exactly the point. Since a signing public key is (somehow) tied to an identity, then being able to recover a public key from signatures means that if you can read signatures then you can know who is sending messages.

Consider a scenario: I send my girlfriend secret encrypted messages in the middle of the night that look like this: [encrypted message | ECDSA signature]. My messages are a secret, and my girlfriend can know that they are definitely from me. But my wife captures a bunch of messages and uses Sophie's handy decoder ring to see that - oh hey - it's me sending those messages!

There were a few mistakes made in this scenario - one of which was some protocol designer leaving a vulnerable signature on the outside of the encrypted message, leaking the sender's identity to anyone that can see the message.

View on HN

Sounds like the problem here is using the wrong tool for the job. Signatures are designed to prove who sent the message. If you want to hide who sent the message, you need something else. In your example, you would take an extra step of encrypting the message with your girlfriend’s public key so only she can decrypt it and then verify it came from you.

Well, the problem could be that you are taking a less useful definition of the purpose of a signature.

Definition 1 (yours): given a message and a signature, you can derive the signing key and prove whether that key signed the message.

Definition 2 (sophie's): given a message and a putative signing identity, you can prove whether the given ID signed the message.

Since you are always free to include identity with the message, the second definition has a strictly greater scope of application.

Okay, but suppose the signature wasn't reversible, you can still just run the signature against your public key to check. The nature of a signature is that it can be easily identified as originating from you.

Strictly speaking, as normally used, the nature of a signature is that given a message, a public key and a signature, you can determine whether that public key produced that signature for that message. The public key is an input.

For some algorithms, as Sophie described, the public key is a redundant input.

But it is reasonable to use the more strict definition and ask when the public key is redundant.

For many current applications, the input is really a message, a signature and the identity of the sender. You are expected to look up the public key with the identity in a global table and follow a chain of signatures back to one of a few trusted roots. In such applications, the public key is obviously apparent in the message itself, but there are many applications where you would like some measure of anonymity. In those cases, all you get is a proof that SOME valid key signed the message in question, but you can't know WHICH key.

Yes, but the public key does not actually, contrary to its name, have to be known to the entire world.

As the article shows, in many signature primitives it's necessary to assume it is (or at least visible to everybody able to view plaintext message-signature pairs signed by the corresponding private key), but primitives that don't have this property might be usable as native (and by extension more efficient) designated verifier signature schemes.

Reply on news.ycombinator.com