On 03/08/2014 01:55 AM, Edmund Edgar wrote:
Consider that I see your public key <a_pub> before I create
and send you my public key <b_pub>.
I create a new keypair, <c_pub> with <c_priv> which I
know (it can be any arbitrary key pair). But I don't give you
<c_pub>, I give you <b_pub> = <c_pub> minus
<a_pub> (which I can do because I've seen <a_pub> before
doing this).
Sure, I don't know the private key for <b_pub>, but it doesn't
matter... because what
<b_pub> + <a_pub> = <c_pub> (mine)
You have no way to detect this condition, because you don't know
what c_pub/c_priv I created, so you can only detect this after it's
too late (after I abuse the private key)
-Alan