MIME-Version: 1.0
From: Erik Aronesty <erik@q32.com>
Date: Sun, 8 Jul 2018 10:19:52 -0400
Message-ID: <CAJowKgLrSe77sqO2iB7mYboo_HW=YjO4=AFdv7L5FUi2vygMiQ@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000dec8a605707d9790"
Subject: [bitcoin-dev] Multiparty signatures
Precedence: list

--000000000000dec8a605707d9790
Content-Type: text/plain; charset="UTF-8"

To save space, start with the wiki terminology on schnorr sigs.

Consider changing the "e" term in the schnorr algorithm to hash of message
(elligator style) to the power of r, rather than using concatenation.

I don't think this changes the security.   An attacker would need to know k
to either way to compromise the private key.

This would allow m of n devices to sign a transaction without any of them
knowing a private key at all.

IE: each device can roll a random number as a share and the interpolation
of that is the private key.

The public shares can be broadcast and combines.  And signature shares can
be broadcast and combined.

The net result of this is it really possible for an arbitrary set of
devices to create a perfectly secure public-private key pair set.

At no point was the private key anywhere.

--000000000000dec8a605707d9790
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">To save space, start with the wiki terminology on schnorr=
 sigs.<div dir=3D"auto"><br></div><div dir=3D"auto">Consider changing the &=
quot;e&quot; term in the schnorr algorithm to hash of message (elligator st=
yle) to the power of r, rather than using concatenation.=C2=A0=C2=A0<div di=
r=3D"auto"><br></div><div dir=3D"auto">I don&#39;t think this changes the s=
ecurity.=C2=A0 =C2=A0An attacker would need to know k to either way to comp=
romise the private key.</div><div dir=3D"auto"><br></div><div dir=3D"auto">=
This would allow m of n devices to sign a transaction without any of them k=
nowing a private key at all.</div><div dir=3D"auto"><br></div><div dir=3D"a=
uto">IE: each device can roll a random number as a share and the interpolat=
ion of that is the private key.=C2=A0 =C2=A0</div><div dir=3D"auto"><br></d=
iv><div dir=3D"auto">The public shares can be broadcast and combines.=C2=A0=
 And signature shares can be broadcast and combined.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">The net result of this is it really possible f=
or an arbitrary set of devices to create a perfectly secure public-private =
key pair set.</div><div dir=3D"auto"><br></div><div dir=3D"auto">At no poin=
t was the private key anywhere.</div><div dir=3D"auto"><br></div><div dir=
=3D"auto"><br></div><div dir=3D"auto"><br></div></div></div>

--000000000000dec8a605707d9790--