Q3b (yet another question)

Q3b (yet another question)

Etay Livne (guest) 24 Mar 2019 19:13

The question seems to suggest that pk must keep increasing in size. However, it is unclear to me why this solution doesn't work:
Before sending message t, generate sk_(t+1), pk_(t+1). Instead of signing just m_t, sign (m_t, pk_(t+1)). This way, the verifier can tell that pk_(t+1) really came from the same person who signed m_t. Now, use pk_(t+1) and sk_(t+1) to sign (m_(t+1), pk_(t+2)) and so on. This way the size of pk remains constant and we can sign as many messages as we want!

Is there something in the settings of the question that I'm missing? Or perhaps some reason that the above algorithm doesn't work?

Thanks!

Re: Q3b (yet another question)

eliadtsf 25 Mar 2019 07:45

So you signed (m_t,pk_{t+1}). That's fine. But where is this signature stored? If you don't store it in a public place that anyone can see (like the PK), then how a verifier that sees the (t+1)'th signature can trust pk_{t+1} for validation?