Subject: Re: Recipient-verifiable messages

From: [email-masked]
Date: Mon, 15 Apr 2002 10:31:33 -0500

From: John Dlugosz

I just noticed this in a book I'm reading.  Section 4.3 in "Applied
Cryptography, 2nd ed." by Bruce Schneier is on this exact subject.

--John

---

From: "Hal Finney" <[email-masked]>
Date: Mon, 15 Apr 2002 09:44:25 -0700

> Cryptography, 2nd ed." by Bruce Schneier is on this exact subject.

Actually 4.3 is on Chaum's undeniable signatures, which are not quite the
same as what we are talking about.  An undeniable signature requires the
aid of the signer to verify the signature.  If Alice sends an undeniable
signature to Bob, he has to then run a protocol with Alice in order to
determine if the signature is good or not.  We would not want that with
PGP, as we don't assume a bidirectional channel exists between signer
and verifier.

Somewhat closer is section 4.4, the designated confirmer signature, also
by Chaum.  I seem to recall that this is what he presented to us at the
meeting in the PGP offices several years ago.  But I don't see that this
achieves the goal either.  It is basically like an undeniable signature,
where a third party is able to replace the signer as the verifier.
So Alice could sign a message and send it to Bob, and he could only
verify it with Carol's assistance.

Maybe the idea was to use the designated confirmer signature, but to
make the designated confirmer in this case be Bob himself?  Then he
could verify the signature all by himself, but no one else could verify
it without his help.  Hmmm, that doesn't seem quite right, because Alice
really doesn't want Bob to be able to verifiably show her signature to
a third party, and this use of the designated confirmer signature seems
to allow that.  So I'm not sure any more exactly what his idea was.

Anyway, both undeniable and designated confirmer signatures are patented
by Chaum, so they would probably not be suitable for use in a protocol
like OpenPGP.

Hal

---

From: [email-masked]
Date: Mon, 15 Apr 2002 13:42:43 -0500

From: John Dlugosz

In most cases, I think you can build anything out of anything else (if you
allow more round-trips), so a few primitives are all you need.  OpenPGP
provides public key encryption and ordinary signatures, as well as symetric
encryption and HMAC.  Those can be used as part of a protocol to do just
about anything.

A higher standard would say "here is how you use OpenPGP to do email" etc.
and specify such a protocol.  So, I don't think it is necessary to add any
new stuff to PGP, just to use what we have in some new way.

--John