Quote from: Crowex on March 05, 2014, 06:18:31 AM

I agree, the public verification is a problem. But it seems so close to a threshold scheme I am wondering if a similar construction could be used to achieve this. Maybe revealing T and showing that it could only have been constructed with the knowledge of p and q. Probably needs a lot more thinking about.

But if the message-holding party knows p and q, then she can construct the entire private key and sign messages herself. Basically the problem is that only the message-holding party knows the public key that is being signed with, and as long as any of a, b, c or d is secret, she is welcome to lie about this, and she can use this lie to trick the blindsigner into signing something he doesn't want to.

I agree it seems close. But it's not

It's a worthwhile exercise spending a few days trying to extend oleganza's scheme to do something other than his specific blind-escrow scenario. You will see that the security breaks every time you get it to do something interesting.

Quote from: AsymmetricInformation on March 05, 2014, 06:32:05 AM

However, you are saying that it IS possible, just only for one week,

No, that is not at all what DeathAndTaxes is saying, and this kind of complete lack of understanding is exactly why I opened with my "don't roll your own crypto" article.

I added a 'Where do I go from here?' section to alts.pdf (and blocked in some ideas for what I want to talk about in the "stupid shit" sections). If you actually want to do cryptography you should go read that.