Key Pair Agreement?

[Hal Finney]

Jeroen writes:
> Here is a scenario: Scott wants Alice to generate a key pair after 
> which he will receive Alice's public key. At the same time, Scott wants 
> to make sure that this key pair is newly generated (has not been used 
> before).

How about a discrete log key where you fix p, q, and g.  Let Alice pick
y1 = g^x1 and send it to Scott.  Scott picks an x2 and sends it to Alice,
who uses y = g^(x1+x2) = y1 * g^x2 as her public key.  Maybe one more
exchange than you wanted but it would be very fast.

What would be a use for this?

Hal

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com