question about use-case of ct/pt from sample code

[handshake-org]

question about use-case of ct/pt from sample code

[chjj]

So, there's actually 3 parties involved here: the challenger, the signer, and the verifier. The challenger has access to the signer's RSA public key, but they want to ensure that the verifier does not. This is a problem because the verifier obviously needs something to verify the signature against.

The challenger generates a random scalar s which is used to commit to the modulus n of the signer's regular RSA pubkey ((g^n * h^s) mod m where m is a public RSA modulus with an unknown factorization). That commitment is C1 and is published publicly so the verifier has access to it. The trick here is that C1 does not reveal n. The challenger then encrypts this scalar and "sends" it to the signer ("send" may not be the right word, see below).

This scheme assumes that the signer trusts the challenger to retain the privacy of their RSA modulus.

The main benefit here (aside from privacy on the verification side) is that this scheme is non-interactive and requires no back-and-forth between the challenger and signer. The challenger can generate this encrypted scalar and post it somewhere for the signer to find later.

edit: Also a note about encryption -- the goo.encrypt function will "inflate" the ciphertext by a random factor to avoid leaking the size of the signer's RSA modulus (this is important if the encrypted payload is posted publicly). All ciphertexts produced by goo.encrypt are constant size. Other than that, it's standard RSA-OAEP encryption.

[citypw]

This does make more sense. Thanks for the explanation.