Talk:Direct Anonymous Attestation

message: Should there be a seperate entry for basic attestation? Should this entry be a sub-part of that entry? Also, I think would it be more accurate to say that DAA is a cryptographic protocol rather than a digital signature scheme.
:What do you mean by `basic attestation'? I do not believe that it should be a subsection regardless, since DAA is a particular means of attestation. More precisely it enables the remote authentication of a trusted host, whilst preserving the privacy of user.
:Personally I would define DAA as a cryptographic protocol. Although more precisely DAA is a group signature scheme without the ability to revoke anonymity.--Bah23 17:02, 24 January 2007 (UTC)
thread_title:  Untitled 

message: I am not convinced that this paper provides a good explanation of DAA.
Prior to transmission to the TP, the signature is encrypted using the public part of the EK; as a result it can only be decrypted by the TPM it is destined for.
Is quite frankly incorrect. The issuer authenticates the TP as follows: On receipt of the bling message U, the issuer creates a nonce n_i encrypts it with the public endorsement key of the TPM and returns the encrypted value. The TP computes hash(U||n_i) and sends it to the issuer. The issuer checks the value is correct and is convinced that it is communicating with a valid TP.
The description of rogue tagging is confusing and quite probably wrong - although I am unable to tell because it doesn't quite make sense... The paper does not distinguish between the zeta value which is used during the Join protocol and the zeta value used during the Sign/Verify protocols. —The preceding unsigned comment was added by Bah23 (talk • contribs) 13:39, 31 January 2007 (UTC)
thread_title:  "Interdomain.." paper  

message: idemix should be discussed somewhere in the main body of the text in order to explain its relevance. —The preceding unsigned comment was added by Bah23 (talk • contribs) 11:12, 6 February 2007 (UTC)
thread_title:  idemix 

message: I believe that the claim about anonymity revocation is incorrect.   The principle referenced paper by Brickell et. al. states that "... our scheme can be seen as a group signature scheme without the capability to open signatures (or anonymity revocation)...".   
This problem is touched on in a separate discussion above, but was not addressed.
Perhaps the author was confusing the notion of anonymity revocation with the blacklisting capability, which exists, but still preserves anonymity.  
I'm removing the claim from the article. 
Leotohill (talk) 03:06, 28 June 2009 (UTC)
thread_title:  No anonymity revocation 

message: I would suggest to remove reference to zero knowledge. Challenges are generated at DAA Join and Sign with a hash and not by a Verifier. Zero knowledge requires a simulator that was never introduced for DAA. Choosing a challenge with a hash makes simulator (almost) impossible. A general reference to proofs of knowledge still may be acceptable.
A DAA Verifier colluding with a DAA Issuer can always track DAA Users that have specific credentials issued,
as explained in IACR 2008/277 preprint.
Signing keys (like RSA) with DAA may be considered pointless because of easy linking all signatures produced with that keys. In may be advised to sign messages instead.
132.204.53.187 (talk) 20:17, 30 June 2010 (UTC)
thread_title:  On zero knowledge, tracking and signing keys