00:07:29 breesy has quit 00:13:27 go1111111 has joined #bitcoin-wizards 00:51:00 mapppum has joined #bitcoin-wizards 00:51:16 christo has joined #bitcoin-wizards 01:04:54 cpacia has quit 01:08:43 flotsamuel has joined #bitcoin-wizards 01:14:58 cpacia has joined #bitcoin-wizards 01:28:50 Ursium has joined #bitcoin-wizards 01:30:24 DougieBot5000 has quit 01:40:52 shinybro has joined #bitcoin-wizards 01:44:11 zzyzx has joined #bitcoin-wizards 01:46:26 roidster has quit 02:03:22 roconnor_ has quit 02:23:11 fractastical has joined #bitcoin-wizards 02:45:14 Taek42 has quit 02:46:29 cpacia has quit 02:48:10 fractastical has quit 02:49:32 Luke-Jr has quit 02:49:53 Luke-Jr has joined #bitcoin-wizards 02:52:12 nOgAnOo has joined #bitcoin-wizards 02:52:38 Luke-Jr has quit 02:53:27 Luke-Jr has joined #bitcoin-wizards 02:55:07 zooko has joined #bitcoin-wizards 02:58:29 home_jg is now known as jgarzik 02:59:41 Taek42 has joined #bitcoin-wizards 03:00:08 epscy has quit 03:01:00 breesy has joined #bitcoin-wizards 03:02:20 epscy has joined #bitcoin-wizards 03:09:35 roconnor has joined #bitcoin-wizards 03:13:28 Luke-Jr has quit 03:21:30 Luke-Jr has joined #bitcoin-wizards 03:23:28 tromp_ has quit 03:24:01 tromp has joined #bitcoin-wizards 03:28:11 tromp has quit 03:30:49 zooko has quit 03:34:47 <[\\\]> [\\\] has quit 03:35:26 <[\\\]> [\\\] has joined #bitcoin-wizards 03:49:00 austinhill has joined #bitcoin-wizards 03:58:38 freewil has quit 04:10:01 roconnor has quit 04:10:26 jtimon has quit 04:11:51 roconnor has joined #bitcoin-wizards 04:12:41 christo has quit 04:13:46 Ursium has quit 04:26:01 gmaxwell, blargh 04:26:03 man fuck the people who made this pdu 04:26:05 circuit 1/2/3 != phase a/b/c 04:26:13 to balance the load you have to plugin to specific outlets 04:26:15 what the fuck 04:42:35 flotsamu_ has joined #bitcoin-wizards 04:45:04 flotsamuel has quit 04:46:49 wangbus has quit 04:49:35 wangbus has joined #bitcoin-wizards 04:59:51 tacotime_ is now known as tt_away 05:06:03 licnep__ has joined #bitcoin-wizards 05:09:14 licnep has quit 05:14:25 licnep__ has quit 05:14:25 licnep__ has joined #bitcoin-wizards 05:27:36 samesong has quit 05:30:18 shinybro_ has joined #bitcoin-wizards 05:33:25 flotsamu_ has quit 05:34:08 Xarikins has quit 05:34:39 firepacket has quit 05:42:24 uiop has joined #bitcoin-wizards 05:45:46 shinybro_ has quit 05:46:06 shinybro_ has joined #bitcoin-wizards 05:54:09 freewil has joined #bitcoin-wizards 06:01:36 zzyzx has quit 06:16:52 shaman_ua has joined #bitcoin-wizards 06:18:27 roidster has joined #bitcoin-wizards 06:21:04 shaman_ua has quit 06:24:34 oleganza has joined #bitcoin-wizards 06:26:49 tromp has joined #bitcoin-wizards 06:26:53 oleganza has quit 06:31:41 tromp has quit 06:44:50 eristisk has quit 06:48:57 eristisk has joined #bitcoin-wizards 06:49:30 c--O-O has quit 06:57:59 mike4 has joined #bitcoin-wizards 07:13:12 shinybro_ has quit 07:32:54 roidster has quit 07:38:01 firepacket has joined #bitcoin-wizards 07:38:06 firepacket is now known as Guest26356 07:45:56 tromp has joined #bitcoin-wizards 07:50:29 tromp has quit 07:59:30 antephialtic has joined #bitcoin-wizards 07:59:52 shaman_ua has joined #bitcoin-wizards 08:10:53 <_ingsoc> _ingsoc has joined #bitcoin-wizards 08:21:06 antephialtic has quit 08:22:39 antephialtic has joined #bitcoin-wizards 08:36:02 fractastical has joined #bitcoin-wizards 09:04:20 shaman_ua has quit 09:04:56 shaman_ua has joined #bitcoin-wizards 09:21:00 oleganza has joined #bitcoin-wizards 09:22:32 go1111111 has quit 09:26:58 MoALTz has joined #bitcoin-wizards 09:36:23 go1111111 has joined #bitcoin-wizards 09:44:17 K1773R has quit 09:50:15 antephialtic has quit 09:50:51 antephialtic has joined #bitcoin-wizards 09:52:07 K1773R has joined #bitcoin-wizards 09:53:59 rdymac has quit 09:55:40 antephialtic has quit 09:57:38 oleganza has quit 09:59:58 oleganza has joined #bitcoin-wizards 10:03:34 roconnor has quit 10:08:39 go1111111 has quit 10:15:14 adam3us has quit 10:20:25 adam3us has joined #bitcoin-wizards 10:21:48 Alanius has quit 10:22:07 UukGoblin has quit 10:22:16 UukGoblin has joined #bitcoin-wizards 10:22:57 Alanius has joined #bitcoin-wizards 10:28:55 go1111111 has joined #bitcoin-wizards 10:30:39 UukGoblin has quit 10:30:39 UukGoblin has joined #bitcoin-wizards 10:38:59 mappum has quit 10:45:10 jtimon has joined #bitcoin-wizards 11:23:59 adam3us has quit 11:27:01 freewil has quit 11:34:53 c0rw|zZz_ has joined #bitcoin-wizards 11:35:33 go1111111 has quit 11:35:38 c0rw|zZz has quit 11:37:22 Ursium has joined #bitcoin-wizards 11:37:26 c0rw|zZz has joined #bitcoin-wizards 11:38:33 <_ingsoc_> _ingsoc_ has joined #bitcoin-wizards 11:40:26 c0rw|zZz_ has quit 11:40:29 <_ingsoc> _ingsoc has quit 11:43:26 <_ingsoc_> _ingsoc_ has quit 11:54:46 fractastical has quit 11:56:58 go1111111 has joined #bitcoin-wizards 12:01:19 rdymac has joined #bitcoin-wizards 12:06:23 rdymac has quit 12:09:15 orperelman has joined #bitcoin-wizards 12:10:10 zooko has joined #bitcoin-wizards 12:11:49 rdymac has joined #bitcoin-wizards 12:22:37 MoALTz has quit 12:23:21 MoALTz has joined #bitcoin-wizards 12:26:20 go1111111 has quit 12:32:33 oleganza has quit 12:34:24 c0rw|zZz is now known as c0rw1n 12:42:02 oleganza has joined #bitcoin-wizards 12:47:31 <_ingsoc> _ingsoc has joined #bitcoin-wizards 13:05:19 rdymac has quit 13:06:29 K1773R has quit 13:06:49 rdymac has joined #bitcoin-wizards 13:11:39 K1773R has joined #bitcoin-wizards 13:21:59 orperelman has quit 13:33:02 mike4 is now known as c--O-O 13:33:13 c--O-O has quit 13:33:13 c--O-O has joined #bitcoin-wizards 13:33:13 c--O-O has quit 13:33:13 c--O-O has joined #bitcoin-wizards 13:36:31 breesy has quit 13:46:48 <_ingsoc> _ingsoc has quit 13:46:58 roidster has joined #bitcoin-wizards 13:55:50 adam3us has joined #bitcoin-wizards 13:57:15 RBRubicon has joined #bitcoin-wizards 14:07:56 jgarzik_ has joined #bitcoin-wizards 14:07:57 Ursium has quit 14:08:38 jgarzik_ has quit 14:08:57 Ursium has joined #bitcoin-wizards 14:24:24 <[\\\]> [\\\] has quit 14:31:31 lnovy has quit 14:31:40 adam3us has quit 14:34:15 shaman_u_ has joined #bitcoin-wizards 14:34:50 shaman___ has joined #bitcoin-wizards 14:37:39 shaman_ua has quit 14:38:45 shaman_u_ has quit 14:41:24 bebopzzz has joined #bitcoin-wizards 14:51:27 RBRubicon has quit 14:53:17 zooko has quit 15:00:01 austinhill has quit 15:24:11 roidster has quit 15:25:02 roidster has joined #bitcoin-wizards 15:26:05 <_ingsoc> _ingsoc has joined #bitcoin-wizards 15:32:48 zooko has joined #bitcoin-wizards 15:32:58 samesong has joined #bitcoin-wizards 15:33:35 jedunnigan has joined #bitcoin-wizards 15:37:30 jedunnig_ has joined #bitcoin-wizards 15:37:33 DougieBot5000 has joined #bitcoin-wizards 15:38:58 jedunnigan has quit 15:47:25 roidster has quit 15:51:17 RBRubicon has joined #bitcoin-wizards 15:54:50 shaman___ has quit 15:55:37 orperelman has joined #bitcoin-wizards 16:03:59 samson_ has quit 16:04:19 roidster has joined #bitcoin-wizards 16:04:47 samson_ has joined #bitcoin-wizards 16:06:55 austinhill has joined #bitcoin-wizards 16:19:48 gavinandresen has quit 16:21:39 nessence has joined #bitcoin-wizards 16:31:01 zooko has quit 16:32:51 gavinandresen has joined #bitcoin-wizards 16:40:17 zooko has joined #bitcoin-wizards 16:45:04 samesong has quit 16:48:50 samesong has joined #bitcoin-wizards 16:58:01 spin123456 has joined #bitcoin-wizards 16:58:01 spinza has quit 16:59:34 shaman_ua has joined #bitcoin-wizards 17:00:29 bebopzzz has quit 17:05:33 <_ingsoc> _ingsoc has quit 17:05:58 <_ingsoc> _ingsoc has joined #bitcoin-wizards 17:20:16 shaman_ua has quit 17:26:37 shaman_ua has joined #bitcoin-wizards 17:26:46 shaman_ua has quit 17:32:46 shinybro has quit 17:41:07 orperelman has quit 17:51:24 Ursium has quit 17:59:27 nessence has quit 18:05:44 Luke-Jr has quit 18:07:16 qwertyoruiop is now known as BigBIitz 18:07:24 BigBIitz is now known as qwertyoruiop 18:15:36 diesel_ has joined #bitcoin-wizards 18:16:49 diesel_ is now known as flotsamuel 18:18:15 oleganza has quit 18:22:21 Ursium has joined #bitcoin-wizards 18:26:15 austinhill has quit 18:28:22 MoALTz_ has joined #bitcoin-wizards 18:31:10 MoALTz has quit 18:31:51 zooko has quit 18:37:28 shaman_ua has joined #bitcoin-wizards 18:39:38 shinybro has joined #bitcoin-wizards 18:40:48 oleganza has joined #bitcoin-wizards 18:42:33 shaman_ua has quit 18:54:04 zzyzx has joined #bitcoin-wizards 18:56:38 fractastical has joined #bitcoin-wizards 18:57:20 roidster has quit 18:59:08 RBRubicon has quit 19:01:20 fractastical has quit 19:01:32 zooko has joined #bitcoin-wizards 19:07:32 gmaxwell: on https://bitcointalk.org/index.php?topic=440572.0 (oleganza's first blindsig) attempt you pointed out that the signer can simply recognize r after the fact to see what he had signed 19:07:50 this breaks oleganza's "oblivious escrow" usecase, but does it matter for normal blindsig applications? 19:08:29 andytoshi: usually r is unique to message 19:08:30 even in the blind schnorr scheme http://blog.cryptographyengineering.com/p/note-on-blind-signature-schemes.html , the signer can find out after-the-fact what parameters he used to sign the original message 19:09:23 oleganza: yeah, but you can't obtain a message from r until after the signature is published 19:09:35 and by that point, it's too late for the sender to do any censorship or to have any liability 19:09:45 if signature is not published, then what's the use? 19:09:57 can you clarify the use case 19:10:32 to prevent censorship i can simply send my hash to the signer. It'll hide my message sufficiently. 19:11:16 not necessarily, if the message has low entropy 19:11:37 * oleganza current mood: watching storm of Kiev's euromaidan http://www.youtube.com/watch?v=Y_LFrMcoEm4 19:11:41 roconnor has joined #bitcoin-wizards 19:11:42 andytoshi: it gets too abstract too quickly :-) 19:15:22 <_ingsoc> _ingsoc has quit 19:15:34 oleganza: see http://cryptography.wikia.com/wiki/Blind_signature for some applications 19:15:46 say, if you are voting for one of four people then the hash does not protect you at all 19:16:30 i think my above claim that matt green's blind signatures can be linked back to the signing session is a serious break actually 19:16:38 andytoshi: i see. But I started with ECDSA-compatible scheme to have something useful for Bitcoin 19:16:47 orperelman has joined #bitcoin-wizards 19:17:41 oooooo has quit 19:18:13 oleganza: right, and there are definitely useful applications to bitcoin along the same lines as what's in that wikia article (using a trusted signer without making him liable) 19:20:41 <_ingsoc> _ingsoc has joined #bitcoin-wizards 19:20:42 <_ingsoc> _ingsoc has quit 19:20:42 <_ingsoc> _ingsoc has joined #bitcoin-wizards 19:22:52 so, in the typical RSA blindsig example, what gets published is a valid signature H(m)^d, and obviously the signer can't determine any context from that. but both schnorr and ecdsa signatures have this extra nonce and it seems hard to actually blind the nonce so that the holder of the private key can't figure out how it was made 19:23:19 your initial "don't even blind r" proposal fails this, the complicated protocol I emailed you fails this, the schnorr sig scheme on matt green's blog fails this... 19:26:43 oleganza: so when i get some i'll help you clean up your original proposal, since i'm pretty sure that works exactly as intended. for any extensions like this i'd like one of the crypto guys here to clarify the above concerns for me 19:26:56 s/extensions/variations/ ;) 19:27:42 andytoshi: thanks :) 19:31:19 Luke-Jr has joined #bitcoin-wizards 19:33:22 andytoshi: wait, are you saying that with matt green's protocol a coinjoin facilitator would be able to figure out after the fact which blind-signed output is which? 19:35:58 maaku: yes, if he kept track of the parameters used every time he blindsigned 19:36:20 he'd have to loop through every parameter-set and check each one for a match, it is not an efficient way to identify signatures.. 19:37:27 oooooo has joined #bitcoin-wizards 19:38:40 andytoshi: well the facilitator isn't a signing oracle 19:38:48 oooooo has quit 19:38:52 for N mixed outputs, he only makes N signatures 19:39:19 that is a serious break, and pretty much defeats the point of blind signing cj outputs 19:39:25 yeah, wow 19:39:43 maaku: the algo on that site has two secret parameters a,b that only the output owner should know. but a is the difference between the blinded and unblinded signatures, while b is the difference between the message hash and the 'fake message hash' given to the signer 19:39:59 is oleganza's new/old protocol immune to this? 19:40:08 andytoshi: hm? in blind schnorr you rerandomize r too. 19:40:24 gmaxwell: you 'rerandomize' it as r' = r*(g^a)*(y^b) mod p 19:40:29 what's the point of blind singing coinjoin txs? 19:40:56 andytoshi: oh so the signer could recover the randomization parameters if he sees the signature. 19:41:06 yea, thats a break of blind singing in general. 19:41:12 oleganza: so no one, not even the signing oracle / facilitator can determine which inputs match to which outputs 19:41:13 maaku: yeah, i believe oleganza's new protocol is what we want. and it even works with ecdsa :) 19:41:29 s3gfault has quit 19:41:31 The original purpose of blind signing is to mask the signed object from even the signer (chaum cash!) 19:41:58 nessence has joined #bitcoin-wizards 19:43:25 <_ingsoc> _ingsoc has quit 19:43:26 well, it might work for chaum cash because you only reveal the signature when you redeem the token, right? 19:43:48 but it wouldn't work for cj-like protocols, or brands credentials 19:43:53 maaku: but the bank needs to be unable to link the signature to their prior signing incident. 19:44:00 ah yeah 19:44:13 well, the bank could in principle determine the first and last owners, but nobody in between.. 19:44:23 if you just want to mask what is being signed you don't need blind signing, you just need a nonce in your message. 19:44:33 andytoshi: ... 19:44:52 andytoshi: the whole idea in chaum cash is that every trade goes via the bank to prevent double spending. 19:44:58 oh :} 19:45:08 right 19:45:27 adam3us has joined #bitcoin-wizards 19:45:54 zzyzx has quit 19:46:07 <_ingsoc> _ingsoc has joined #bitcoin-wizards 19:46:53 oleganza: did i explain how coinjoin blindsigning works in one of my emails to you? i don't remember.. and imo it's pretty nonobvious and you won't get it just from the conversation here 19:48:12 yeah, looks like i did 19:50:10 andytoshi: it would be pretty 0_o if people have been going around with non-blind blindsinging techniques. 19:51:09 gmaxwell: yeah, i'm actually a bit concerned about this. i should tell somebody about this but i don't know who 19:51:12 maybe i'll email matt green.. 19:51:25 what's the concern? 19:51:27 or just leave a comment on that blog post, i'm sure someone will notice :P 19:51:36 is there a flaw in mattgreen's blinding scheme? 19:51:37 andytoshi: you should probably try out compromising it and send a sage notebook. 19:51:55 ooh, i like that. that'll be my weekend project 19:52:09 nsh: i believe so, yes 19:52:11 it's really easy to sign at the prompt in sage... 19:52:23 interesting. *reads buffer* 19:52:32 oh, i didn't realize sage had those functions 19:53:02 yea... 19:53:02 sage: F = FiniteField (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F) 19:53:05 sage: C = EllipticCurve ([F (0), F (7)]) 19:53:43 . o O ( it'd be nice if -- using Sage or something -- we could have some public scratchpads/notebooks of crypto[currency] investigations and elucidations ) 19:54:17 sage has a whole web-ui. 19:54:25 * nsh nods 19:57:10 andytoshi: so you can just pocket calculator all this stuff. 19:57:39 andytoshi: try it out, then write it up. this is too big to give up to a comment on a blog ;) 19:58:41 Finding weaknesses in things is the only concrete indicator that you're doing real cryptographic work in any case. Otherwise perhaps its all navel-gazing. 19:58:53 adam3us has quit 19:59:39 zooko has quit 20:01:02 cpacia has joined #bitcoin-wizards 20:01:40 (and if you gaze at a navel with a high enough frequency, it can't even evolve...) 20:02:16 ((Zeno)) 20:02:23 fractastical has joined #bitcoin-wizards 20:02:23 fractastical has quit 20:06:47 orperelman has quit 20:09:20 Krellan_ has joined #bitcoin-wizards 20:09:51 zooko has joined #bitcoin-wizards 20:16:53 sagenb says 'public worksheets' currently disabled. can you guys give me some sage usernames so i can share this? 20:17:09 roconnor has quit 20:17:35 austinhill has joined #bitcoin-wizards 20:18:17 sagenb says 'public worksheets currently disabled', wants sagenb usernames to share with specific people 20:21:51 Ursium has quit 20:27:44 or i will post an uncropped screenshot for you to read http://wpsoftware.net/andrew/secrets/exploit.png 20:32:11 are you unable to share worksheets because of... silly reasons? 20:32:29 guess so :/ 20:33:40 orperelman has joined #bitcoin-wizards 20:34:15 one sec, i'll just pastebin the code 20:36:08 Ursium has joined #bitcoin-wizards 20:39:02 http://0bin.net/paste/MrGNUVUxr0DR44Nu#6tGBRjT1+FPADOfOhpuBHBFtfCMxelinPFh+0GWJuUg= 20:40:05 cpacia has quit 20:42:21 rastapopuloto has joined #bitcoin-wizards 20:44:57 spinza has joined #bitcoin-wizards 20:44:59 spin123456 has quit 20:48:27 adam3us has joined #bitcoin-wizards 20:50:15 cpacia has joined #bitcoin-wizards 20:54:53 fractastical has joined #bitcoin-wizards 20:58:15 samesong has quit 20:58:46 samesong has joined #bitcoin-wizards 20:59:39 samesong has quit 20:59:58 samesong has joined #bitcoin-wizards 21:02:50 forrestv has quit 21:03:01 pigeons has quit 21:05:30 ageis has quit 21:05:51 forrestv has joined #bitcoin-wizards 21:07:02 forrestv has quit 21:07:11 shaman_ua has joined #bitcoin-wizards 21:07:50 phrackage has joined #bitcoin-wizards 21:11:23 orperelman has quit 21:15:06 fractastical has quit 21:16:09 fractastical has joined #bitcoin-wizards 21:16:45 antephialtic has joined #bitcoin-wizards 21:20:06 fractastical has quit 21:30:17 i sent a note to matt green about it 21:31:53 could you annotate the 0bin post with it? (or at least, to the extent that there are bits that add context/elaboration, as opposed to any private contents) 21:32:10 (you can't annotate posts on 0bin, sorry) 21:34:40 nsh: sure, i can post the whole email to 0bin, one sec 21:34:59 ty 21:36:25 http://0bin.net/paste/WSj45yA0+E1r2jls#GuwWRW/7Uw2Goakt6i0Oq55ZY/2r9/0dpdvs84/VT/w= i'm not sure that this says any more than what's been mentioned here tho 21:37:44 right. i tend to perpetually read diagonally though so sometimes there's utility in redundancy 21:39:17 orperelman has joined #bitcoin-wizards 21:42:13 rdymac has quit 21:43:20 tt_away is now known as tacotime_ 21:44:13 orperelman has quit 21:44:31 orperelman has joined #bitcoin-wizards 21:44:35 shaman_ua has quit 21:47:20 rdymac has joined #bitcoin-wizards 21:47:23 antephialtic has quit 21:47:41 go1111111 has joined #bitcoin-wizards 21:47:46 samesong has quit 21:53:10 samesong has joined #bitcoin-wizards 21:56:02 samesong has quit 21:59:10 <_ingsoc> _ingsoc has quit 22:01:00 e4xit has quit 22:04:07 e4xit has joined #bitcoin-wizards 22:04:38 cool, he got back to me and said i'm wrong. 22:05:00 interesting 22:05:05 my equation that the attacker checks to see if he got the right (a, b) parameters -- it always passes 22:05:10 samesong has joined #bitcoin-wizards 22:07:39 o.O it's really simple algebra but it's still surprising, i had to read it three times 22:08:28 antephialtic has joined #bitcoin-wizards 22:08:39 http://0bin.net/paste/8kE0Ak3D39ubpt1U#hIGPJyFjfgtDvHupTnwHdGBJv7KSZv6XX6koL2C/hCU= 22:08:59 (sadly, he did not write all that for me, somebody else came up with my attack so he just copied the response to me) 22:09:39 orperelman has quit 22:11:39 andytoshi: yea, I wondered if that would be the case— that you'll always get a a/b value that works for any transaction. 22:11:50 but a quite glance surprised me due to the a*gen in the equation. 22:13:00 the end of his message was a plea for tor applications, which -wizards may be interested in: 22:13:02 NOW, moving on to applications ---- which interests me a lot. What are you planning to do with these blind signatures? We have some ideas related to decentralized anonymous credentials and we've been dying for a Tor related application. Here's our paper. Can you think of one? 22:13:03 https://eprint.iacr.org/2013/622.pdf 22:13:05 We were thinking about doing node bandwidth controls at the Tor exit nodes, for example, without the need for a central server. Any thoughts you have would be terrific. Maybe we could write a paper about it together? 22:13:24 gmaxwell: yeah, ditto 22:14:03 adam3us has quit 22:17:20 e4xit has quit 22:17:36 MoALTz_ has quit 22:18:00 samesong has quit 22:18:00 freewil has joined #bitcoin-wizards 22:21:28 adam3us has joined #bitcoin-wizards 22:23:18 samesong has joined #bitcoin-wizards 22:29:08 roidster has joined #bitcoin-wizards 22:31:17 jedunnig_ has quit 22:35:43 samesong has quit 22:37:11 fractastical has joined #bitcoin-wizards 22:37:28 oooooo has joined #bitcoin-wizards 22:42:19 fractastical has quit 22:44:57 samesong has joined #bitcoin-wizards 22:57:12 spinza has quit 22:57:29 fractastical has joined #bitcoin-wizards 22:57:44 oooooo has quit 22:58:14