Note that this scheme is not quite safe to implement with Ed25519 or other DSA-like signature schemes as described; the base point needs to be multiplied by the same number as the public-key group element.

---------- Forwarded message ---------- From: Robert Ransom rransom.8774@gmail.com Date: Wed, 19 Jan 2011 08:42:40 -0800 Subject: New HS protocol To: Kadianakis George desnacked@gmail.com Cc: [redacted], [redacted], tor-assistants@torproject.org

I wrote up the following new HS protocol on 2011-01-13, but haven't sent it out anywhere publicly visible yet.

The only system I have come up with to hide a hidserv's identity key from the directory servers requires that the hidserv use a discrete-log cryptosystem for its identity key, and that the HS address contain enough of the identity key that a client can compute a scalar multiple of the identity key. (For example, the identity key can be a point on an elliptic curve in Weierstrass form, and the HS address can be the point's x coordinate.)

The system designer chooses a group, an element P of prime order p in that group, and a publicly computable one-way function h mapping bitstrings to integers in the interval [1, p-1].

The HS chooses a secret key n and computes its public key nP; its descriptor index in time period t can be computed by any party which knows its public key as h(t | nP)*nP, but only the HS will know the discrete logarithm h(t | nP)*n of the descriptor index with base P. The HS can therefore compute an ECDSA signature, for example, which the directory server can verify using the descriptor index as a public key.

Robert Ransom