Subject: [Cfrg] ECDSA_CFRG: retraction of a theorem

From: Dan Brown <[email-masked]>
Date: Thu, 23 Jul 2015 15:04:04 +0000

Hi CFRG,

I retract the 3rd theorem on slide 24 on my 2015 July 22 presentation on
ECDSA_CFRG.  

Consequently, if you believe that: 
(i) ECDSA and ECDSA_CFRG is severely forgeable (despite the aegis security
of ECDSA and the argued security of ECDSA and ECDSA_CFRG independent of
Schnorr) and 
(ii) Schnorr signatures are unforgeable even for some really weird hash
functions, 
then I have no argument against this combination of beliefs.  Although I
disagree with part (i), for the reasons above, I expect holders of these
beliefs to reject ECDSA_CFRG.

I request that the online version of the slides be amended to clearly
indicate that the theorem was claimed but subsequently retracted, to avoid
possible further confusion.  I had labeled this as Theorem (2015?) to
indicate it was new (2015) and vaguely questionable (?).  I suggest adding
the terms "subsequently retracted".

The defect in my attempted proof was the "contrived hash" mentioned in the
theorem was too contrived: it could only be computed using the private key.
As such, the result is nearly meaningless, because it is no longer correct
to call the resulting scheme a signature scheme: a signature scheme requires
public verification, and possibly worse, it might be circular reasoning.

I should have vetted this result more carefully before claiming it.  Sorry. 

Best regards,

Dan