Subject: Re: Recipient-verifiable messages, was: forwarding an encrypted PGP message is useless

From: [email-masked]
Date: Thu, 11 Apr 2002 17:01:57 -0500

From: John Dlugosz

Beautiful.

A split isn't necessary, though.  Just make a key and have the private part
known to both.

"vedaal" <[email-masked]>@mail.imc.org on 04-11-2002 03:43:56 PM

Sent by:  [email-masked]

To:   <[email-masked]>
cc:
Subject:  Re: Recipient-verifiable messages, was: forwarding an encrypted
      PGP message is useless

----- Original Message -----
From: "Hal Finney" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, April 11, 2002 11:45 AM
Subject: Recipient-verifiable messages, was: forwarding an encrypted PGP
message is useless
...

> I proposed a different method, which basic idea is expressed in a paper
> by Rivest, Shamir and Tauman, "How to Leak a Secret", available from
> http://theory.lcs.mit.edu:80/~rivest/publications.html.  This paper shows
> how to produce a signature which can be verified to be from a specific
> list of keys, but you can't tell which key on the list made the
signature.
> It is very simple and efficient for RSA keys.  I think extensions are
> possible for discrete log keys, but the paper doesn't cover that.
>
> For the recipient-verifiable signature, Alice would create one of these
> multiple-signer signatures based on exactly two keys, Bob's and hers.
> Anyone can verify that the resulting message has been signed by Alice or
> Bob, but there is no way to tell which.  Alice then sends the message
> to Bob.  He knows that he didn't sign it, so it must have been Alice.
> But if he shows it to someone else, all they can see is that either
> Bob or Alice signed it, so Bob could have created a signature like this
> for any message he wanted.  Again there is no way for Bob to show the
> message convincingly to a third party, and Alice is protected.
...
> Unfortunately I think that adding a new flavor of signature would tend
> to create confusion among users who at best barely understand public
> key cryptography.  The new kind of signature would have very different
> security properties and usage scenarios, so it would add additional
> complexity for people to deal with.
...

no new signature type is needed.
this can be done now with a split key setup, for either an RSA or DH key:

Alice or Bob produces a new key  'Alice&Bob'

the share is set for 1, and the 'Alice&Bob' key is split with a share to
Alice's key, and a share to Bob's key,

either Alice or Bob can now sign with the 'Alice&Bob' key, without anyone
being able to detect whether it was Alice or Bob,
and  it will verify as a good signature from the 'Alice&Bob' key.

the 'Alice&Bob' split key can be imported into gnupg and the signatures
verified,
but gnupg cannot (yet) rejoin, sign or decrypt with a split shared system

if this is worthwhile/necessary, perhaps it could be considered for
addition
to the gnupg system.

hth,
vedaal

---

From: [email-masked]
Date: Thu, 11 Apr 2002 17:10:47 -0500

From: John Dlugosz

Vedaal writes, "no new signature type is needed.
this can be done now with a split key setup, for either an RSA or DH key:"

I think this would work without the split feature.  For example, when I
enter into a conspiracy with Bob, I make a new signing key for the purpose.
Send Bob the key including the private half (export it, and note the
passphrase in the message).  Encrypt that TO Bob and send it to him, and
also post it somewhere in public so Bob can't say he never got it.

---

From: "Hal Finney" <[email-masked]>
Date: Wed, 17 Apr 2002 19:26:26 -0700

A correction: I wrote:
> If we introduce these non-transferable signatures (good name btw) then
> there is more possibility for confusion.  It's completely different from
> a regular signature; for one thing, Alice doesn't even have to type her
> passphrase, because her signature key is not used when she creates this
> kind of "signature"!  Imagine the paranoia that would trigger on the PGP
> user lists.  In general it's going to increase the explanatory burden
> for people who want to understand what the software is doing.

Sorry, I was confused when I wrote this.  Of course, Alice does have
to use her passphrase and private key, as she signs the encrypted key
block.  But I still think that the unique security properties of this
kind of signature would have to be explained, so that people can make
knowledgeable judgements about the security they are getting.

Hal