Some additional remarks on "Chaffing and Winnowing"
	Ronald L. Rivest
        (last updated November 14, 2000)

(1) In my note, I say:

        I note that the use of MAC's can be replaced by digital signatures.
        Not the ordinary kind of digital signatures, since then anyone would
        be able to distinguish wheat from chaff.  But the recent ``designated
        verifier signatures'' of Jakobsson, Sako, and Impagliazzo (Jakobsson
        et al. '96), which can only be verified by those the signer designates,
        would work fine. 

    As pointed out to me by Ralf Senderek (ralf@senderek.de), this is not quite
    correct.  The problem is that the DVS scheme suggested by Jakobsson, Sako, and
    Impagliazzo has the property that the designated-verifier signature can be
    "verified" by anyone, with the proviso that the verifier doesn't know whether
    the signature was produced by Alice (the real signer) or Bob (the designated
    verifier).  Furthermore, *only* Alice or Bob can produce such signatures, 
    so that it is not possible for anyone other than Alice or Bob to produce
    "chaff".  It would be better if anyone could produce chaff, and only Bob
    could distinguish "wheat" from "chaff" (as with the MAC case).