5

secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for.

Is there another, more widely used public key cryptography scheme with the same property?

Nick ODell
  • 364
  • 1
  • 10

1 Answers1

5

Yes. Discrete-log based cryptosystems (e.g., El Gamal) have a similar property. It's "multiply", not "add", but that's just because that's the group operation for discrete-log based cryptosystems.

More generally, I suggest you look at threshold cryptography. Threshold public-key cryptosystems are a class of systems that can achieve the sort of thing you mention.

D.W.
  • 36,365
  • 13
  • 102
  • 187
  • Do you know of any threshold signature schemes that are not discrete-log based but have better-than-generic performance for combining already-existing verification keys? $;$ –  Apr 26 '15 at 07:00
  • @RickyDemer, I don't know. I guess that's a different question. If you're suggesting that might be what the OP wanted, if so, he needs to specify his requirements or goals in the question. Right now the question only asks for "another, more widely used" scheme. I can only answer the question that was asked.... – D.W. Apr 26 '15 at 07:03
  • Your upper paragraph does squarely address the question. $:$ I was just wondering if your lower paragraph was more related to the question than it seemed. $;;;;$ –  Apr 26 '15 at 07:08
  • @RickyDemer My feeling is that the first paragraph does answer the question, but that the text should be clarified and further explained why and how it answers the question. – Maarten Bodewes Apr 26 '15 at 11:03