[tor-dev] Fwd: New HS protocol

[Robert Ransom]

Note that this scheme is not quite safe to implement with Ed25519 or
other DSA-like signature schemes as described; the base point needs to
be multiplied by the same number as the public-key group element.


---------- Forwarded message ----------
From: Robert Ransom <rransom.8774 at gmail.com>
Date: Wed, 19 Jan 2011 08:42:40 -0800
Subject: New HS protocol
To: Kadianakis George <desnacked at gmail.com>
Cc: [redacted], [redacted], tor-assistants at torproject.org

I wrote up the following new HS protocol on 2011-01-13, but haven't
sent it out anywhere publicly visible yet.


The only system I have come up with to hide a hidserv's identity key
from the directory servers requires that the hidserv use a discrete-log
cryptosystem for its identity key, and that the HS address contain
enough of the identity key that a client can compute a scalar multiple
of the identity key.  (For example, the identity key can be a point on
an elliptic curve in Weierstrass form, and the HS address can be the
point's x coordinate.)

The system designer chooses a group, an element P of prime order p in
that group, and a publicly computable one-way function h mapping
bitstrings to integers in the interval [1, p-1].

The HS chooses a secret key n and computes its public key nP; its
descriptor index in time period t can be computed by any party which
knows its public key as h(t | nP)*nP, but only the HS will know the
discrete logarithm h(t | nP)*n of the descriptor index with base P.
The HS can therefore compute an ECDSA signature, for example, which the
directory server can verify using the descriptor index as a public key.


Robert Ransom