3 ms·
If all that's needed is a public key without known private key (i.e. some element Ga with a unknown) then a simple ceremony is possible. Anyone who wants gets
by rocqua 8y ago
If all that's needed is a public key without known private key (i.e. some element Ga with a unknown) then a simple ceremony is possible.
Anyone who wants gets to submit a value H_i = G a_i.
With a proof that H lies in the correct subgroup.
Then the final value can bu the sum of all H_i s. The final private key would be the sum of all a_i s. If even one of those private keys is unkown, the final value is also unknown.
- nullc 8y agoYou don't need any such "ceremony" for this sort of protocol, no trusted setup is required at all: you can use a hash function to select random group elements. All thats required is that that the dlog between the respective group elements is unknown, they don't need special properties other than that. This makes it unlike the trusted setup of things like zcash (as mentioned in the grandparent post) which cannot be simply initialized randomly.
- rocqua 8y agoI don't know anything about how elliptic curve points are represented in memory, so I thought using a hash-function is difficult. If that's not the case, then there is no problem. Using hashes as 'nothing up your sleeve' numbers.
- nullc 8y agoThere are fairly straight forward options for this sort of thing... the simplest of which is you hash onto the field and check if the result is on the curve by applying the curve equation (which it will be with probability 1/2). If it is, you are done, if not increment the hash input and repeat until done. There are fancier ways to hash onto curves that can give nearly uniform points in constant time, but they're curve specific... and for parameter generation you don't need constant time.