Security Proof Multiplicative Key Blinding

[mickrau]

In #7 the question came up, whether there is a formal security proof for the multiplicative blinding.

To make here progress, we should first define the exact properties for which we need a security proof and should make clear what parts of HDK are affected.

[mickrau]

References
Definition of key blinding scheme and security properties (Post-Quantum Account Recovery for Passwordless Authentication, Wilson)

Definition of key blinding using elliptic curve addition (draft-bradleylundberg-cfrg-arkg-03)

Security Analysis of ARKG (Asynchronous Remote Key Generation: An Analysis of Yubico's Proposal for W3C WebAuthn., Fryman et al. )

[sander]

This security argument may be helpful: https://crypto.stackexchange.com/a/111066

[sander]

Possibly relevant: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-voprf-07#name-blinding-considerations

[sander]

Possibly relevant: Security Analysis of Signature Schemes with Key Blinding, related to draft-irtf-cfrg-signature-key-blinding. It proves unlinkability and unforgeability of multiplicative ECDSA blinding.