Score:2

Add a non-signer to an already-signed message

cn flag
deb

This is a follow-up to the first comment of this answer.

A message is signed with the private key of $A$, $s_A$. We know $p_B$, the public key of $B$, but not $s_B$, their private key. Is it possible, using neither secret key, to create a ring signature that has $A$ as the signer and $B$ as a non-signer?

I've quickly run through the math behind ring signatures (and understood half of it), and it looks like the operation is not possible without $s_A$ or $s_B$ —but I'm hoping cryptography will once again surprise me about that!


So, the real question appears to be: Can a message be signed by a ring, not knowing $s_A$ but being in possession of that same message signed with $s_A$?

Score:2
es flag

This is not possible, unfortunately, at least with a standard ring signature construction.

Ring signatures are verified by checking that a ring of commitments exist, where each commitment depends on the commitment from the previous entry in the ring.

This creates a "time travel" problem for the person trying to create the ring signature. This is because when creating the first entry, they can't know in advance what entry will precede it in the ring.

Knowing the private key for one of the public keys will allow them to make up a random commitment for the first entry they create for their new ring signature. They can then later on join the ring together by forcing the last entry they create in the ring to produce the exact commitment that their first entry in the ring was expecting to see.

Unfortunately, once they "join" the ring when constructing it, they have committed to a specific list of public keys occurring in a specific order within the ring. It is therefore not possible for any outsider to add in additional possible public keys as members of the ring, unless they know the private key corresponding to one of those public keys.

Even if the existing (non-ring) signature were of exactly the right type (e.g. a Schnorr signature to be grafted into a Schnorr-based ring signature), that non-ring signature would not have been created for the correct "challenge". That challenge can only be known once all public keys to be included in the ring are known.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.