3 ms·
You don't need any such "ceremony" for this sort of protocol, no trusted setup is required at all: you can use a hash function to select random group elements.
by nullc 8y ago
You don't need any such "ceremony" for this sort of protocol, no trusted setup is required at all: you can use a hash function to select random group elements.
All thats required is that that the dlog between the respective group elements is unknown, they don't need special properties other than that.
This makes it unlike the trusted setup of things like zcash (as mentioned in the grandparent post) which cannot be simply initialized randomly.
- rocqua 8y agoI don't know anything about how elliptic curve points are represented in memory, so I thought using a hash-function is difficult. If that's not the case, then there is no problem. Using hashes as 'nothing up your sleeve' numbers.
- nullc 8y agoThere are fairly straight forward options for this sort of thing... the simplest of which is you hash onto the field and check if the result is on the curve by applying the curve equation (which it will be with probability 1/2). If it is, you are done, if not increment the hash input and repeat until done. There are fancier ways to hash onto curves that can give nearly uniform points in constant time, but they're curve specific... and for parameter generation you don't need constant time.