3 ms·
Recovery for ECDSA is a well known technique but it makes verification much slower and makes batch verification impossible. It also doesn't really result in a
by nullc 2y ago
Recovery for ECDSA is a well known technique but it makes verification much slower and makes batch verification impossible. It also doesn't really result in a size reduction in most cases where a key must already be communicated somehow.
It also depends on the message hash not depending on the public key, which prevents the signature from being a proof of knowledge of the private key (you can just pick a random message and random signature and it will be valid for some random pubkey which you don't know the private key for)... this can result in security vulnerabilities though the requirements for it to do so are a bit contrived (but I seem to recall finding some examples previously).
Implementations also potentially infringe a specific known patent -- one that appears to have just been transferred to a patent troll. So recovery users, hold on to your pants!
- lxgr 2y agoInteresting, hasn't ECDSA been around way too long for possible patents to still be a concern (due to either being expired or prior art long predating their filing date)?
- nullc 2y agoIt's specific to ECDSA recovery, where instead of using a pubkey and message to validate a signature you use a signature and message to recover the pubkey, so the age of ECDSA isn't particularly relevant in and of itself.
- lxgr 2y agoHuh, interesting! I somehow assumed that that fact would be obvious enough to implementers for there to be prior art. Do you have any more details?
- nullc 2y ago> obvious enough to implementers for there to be prior art. Do you have any more details? I haven't made any comment in this thread on its validity. :) US8788 827B2