Subject: Re: [Cfrg] request for comments: ZSS Short Signature Scheme for SS and BN Curves

From: Kohei Kasamatsu <[email-masked]>
Date: Thu, 25 Jul 2013 18:37:42 +0900

Dear L. Hitt

I have a comment.

The security of ZSS-signature depends on k+1 Exponent Problem.
The problem more efficiently can be computed by cheon algorithm [1,2] 
than Pollard's method. (cheon algorithm is not probabilistic polynomial 
time algorithm) Hence I think that it is needed that you analyze 
security against the algorithm.

[1] J.H. Cheon, Security Analysis of the Strong Diffie-Hellman Problem, 
EUROCRYPT 2006, LNCS 4004, pp. 1-11, Springer, 2006
[2] Y. Sakemi, G. Hanaoka, T. Izu, M. Takenaka, and M. Yasuda, “Solving 
a discrete logarithm problem with auxiliary input on a 160-bit elliptic 
curve”, PKC 2012, LNCS 7293 pp. 595-608, Springer, 2012.

Best regards,
Kohei Kasamatsu

(2013/03/23 2:27), Laura Hitt wrote:
> <my apologies if this was sent twice, I saw strange behavior on my end, so thought I'd try again.>
>
> I have recently submitted (as an Individual) two I-Ds and would greatly appreciate any comments you are able to offer.  They pertain to the ZSS short signature scheme from bilinear pairings on supersingular elliptic curves and on Barreto-Naerhig elliptic curves.
>
> http://www.ietf.org/internet-drafts/draft-irtf-cfrg-zss-00.txt
> http://www.ietf.org/internet-drafts/draft-irtf-cfrg-zssbn-00.txt
>
> Thank you!
> Laura Hitt
>
>
>
>
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Kohei Kasamatsu

NTT Software Corporation
E-mail: [email-masked]