<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> You should be able to even better than this. If you have keys A = G^a B = G^b You can choose an ephemeral r = PRF(a,b,m) R = G^r and set c = H1(R,A,B,m) d = H2(R,A,B,m) and output R, s = r + ca + db. This can be verified because G^s = R * A^c * B^d ... right? Cheers, -- Mike <div class="moz-cite-prefix">On 11/08/2015 05:42 PM, Jeff Burdges wrote: </div> <blockquote cite="mid:1447033364.4087.168.camel@gnunet.org" type="cite"> <pre wrap=""> Appears I failed to CC the list, but Ben resolved this. On Mon, 2015-11-09 at 11:17 +1100, Ben Harris wrote: </pre> <blockquote type="cite"> <pre wrap="">On 9 Nov 2015 10:46 am, "Jeff Burdges" <a class="moz-txt-link-rfc2396E" href="mailto:burdges@gnunet.org"><burdges@gnunet.org></a> wrote: </pre> <blockquote type="cite"> <pre wrap=""> My friend Joe asked me about optimizing a pair of Ed25519 </pre> </blockquote> <pre wrap="">signatures on </pre> <blockquote type="cite"> <pre wrap="">the same message with both a long-term session key x and a short </pre> </blockquote> <pre wrap="">-term </pre> <blockquote type="cite"> <pre wrap="">session key y. (R_y,S_y,S_x) that takes only 96 bytes instead of the 128 bytes of doing two separate signatures. </pre> </blockquote> <pre wrap="">Could you just send the short term key as an implicit (EQCV) issued by the long term which is only 32 bytes? Then the message signed by the session key is an additional 64 bytes giving your 96 byte total. </pre> </blockquote> <pre wrap=""> Yes, I believe that works well for his use case. Actually it's simpler than ECQV since Alice controls both keys. Thank you! Jeff </pre> <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Curves mailing list <a class="moz-txt-link-abbreviated" href="mailto:Curves@moderncrypto.org">Curves@moderncrypto.org</a> <a class="moz-txt-link-freetext" href="https://moderncrypto.org/mailman/listinfo/curves">https://moderncrypto.org/mailman/listinfo/curves</a> </pre> </blockquote> </body> </html>