Citation Context

...gnature to a verifiably encrypted signature. The same applies to unencrypted aggregate signatures. ffl An adjudicator's private key can be shared amongst n parties using k-of-n threshold cryptography =-=[11, 10]-=-, so that k parties are needed to adjudicate a verifiably encrypted signature. ffl A message-signature pair in the co-GDH signature scheme is of the same form as an identityprivate-key pair in the Bon...

Citation Context

...e. Thus it is in general beneficial to distribute the security tasks as much as possible. A natural approach for distributing trust in multicast security centers is to use threshold cryptography [9], =-=[13]-=- and proactive security [7] techniques to replace a single center with a distributed service with no single point of failure. This is an interesting topic for future research. Performance. Performance...

Citation Context

... sites. Unfortunately, to use the shared key one must reconstruct it at a single location. Thus, secret sharing is inappropriate for our purposes. Instead, we use techniques of Threshold Cryptography =-=[9]-=- to distribute an application's private key among several share servers so that the key can be used without ever reconstructing it. Our system is designed to be easy to embed into existing application...

Citation Context

... a strongly unforgeable system. We then applied this transformation to a specific system. Surprisingly, our signature system does not seem to naturally extend to give an efficient threshold signature =-=[13]-=-. In fact, the only known efficient strongly unforgeable threshold signatures (in the standard model) appear to be the unique signatures of Lysyanskaya [19] and Dodis [11]. Thresholdizing these signat...

Citation Context

...uses the recent identity based encryption system of Boneh and Boyen and the chosen ciphertext secure construction of Canetti, Halevi, and Katz. 1 Introduction A threshold public key encryption system =-=[14, 16, 13, 19]-=- is a public key system where the private key is distributed among n decryption servers so that at least k servers are needed for decryption. In a threshold encryption system an entity, called the com...

Citation Context

...erate tokens. The SEM architecture is based on a variant of RSA which we call Mediated RSA (mRSA). The main idea is to split each RSA private key into two parts using simple 2-out-of-2 threshold RSA [=-=Gemmel 1997-=-; Boyd 1989]. One part is given to a client and the other is given to a SEM. If the client and its SEM cooperate, they employ their respective half-keys in a way that is functionally equivalent to (an...

Citation Context

...ur network and computational problems to the trusted agent. The key evolving paradigm adds to the array of mechanisms of protecting secrets, such as distributed, threshold, and proactive cryptography =-=[7, 10, 14, 17, 2-=-3]. A key evolving paradigm is z-resilient if one cannot decrypt the ciphertext hj; ci even he gets the private keys SK j1 ; SK j2 ; : : : ; SK jz of z time periods, for j 6= j l ; 1 l z. If the dec...

Citation Context

...eraction with the third party. 4.2 Threshold Signatures Boldyreva shows [22] that BLS signatures give rise to a robust t-out-of-n threshold signature scheme through standard secret sharing techniques =-=[84, 62, 60]-=-. In a threshold signature scheme, there are n parties where each possesses a share of a private key. Each party can use its share of the private key to produce a share of a signature on some message ...

Citation Context

...oducing a single point of failure. The technique described above of sharing the secret key such that it can be used without reconstruction at a single location is known as Threshold Cryptography. See =-=[9]-=- for a succinct survey of these ideas and nontrivial problems associated with them. An important question left out of the above discussion is key generation. Who generates the RSA modulus N and the sh...