Re: [Taler] question about "how to issue": quantum computer attacks

[Calvin Burns]

On Fri, 10/21/2022 11:01:27 PM, Jeff Burdges wrote:
> 
> On Oct 21 2022, at 4:55 pm, Calvin Burns via Taler <taler@gnu.org> wrote:
> > I cite from [1]: "Furthermore, RSA blinding would provide privacy protection
> > even against quantum computer attacks."
> > 
> > Could someone please give an explanation for why this is true?
> > Or please give a link to literature or some keywords or other pointers.
> 
> Many blind signature flavors like RSA, BLS, Schnor have issuing that
> morally looks like  b^{-1} (sk (b x))  with () being protocol moves, so
> the bank sees  b x  when issuing and  x  when spending.  As b is random,
> these are perfectly / statistically / information theoretically hiding,
> as opposed to only computationally hiding.
> 
> Many zero knowledge proofs like Groth16 in ZCash are similarly perfectly 
> hiding.
> 
> Jeff

Thanks, Jeff.

So what an attacker (who does not know b) with a quantum computer (qc) could try
is to calculate sk⁽⁻¹⁾ ("morally") which gives bx.  But for all messages x'
there is a b' ∈ B from the set B of blinding factors (like b) such that b'x' = 
bx.
That means from the attackers perspective x could have been any message. He just
needs to choose an appropriate b' ∈ B to get bx.

signature.asc
Description: PGP signature