MIME-Version: 1.0
References: <CAPg+sBj7f+=OYXuOMdNeJk3NBG67FSQSF8Xv3seFCvwxCWq69A@mail.gmail.com>
	<2e620d305c86f65cbff44b5fba548dc85c118f84.camel@timruffing.de>
	<20180812163734.GV499@boulet.lan>
	<CAJowKg+h11YkwOo-gyWCw+87Oh-9K34LOnJ1730hhpoVR2m5sA@mail.gmail.com>
	<20180903000518.GB18522@boulet.lan>
	<CAJowKg+PDtEV3je_N9Ra6u3n4+ZQ3ozYapt8ivxGYYU28Qad+w@mail.gmail.com>
	<20180905130559.GH18522@boulet.lan>
In-Reply-To: <20180905130559.GH18522@boulet.lan>
From: Erik Aronesty <erik@q32.com>
Date: Wed, 5 Sep 2018 09:14:55 -0400
Message-ID: <CAJowKgKOu2G37dkhyKGhFJswhq_D0N0Bz4YPiBFjWTNhGWZFCg@mail.gmail.com>
To: apoelstra@wpsoftware.net
Content-Type: multipart/alternative; boundary="0000000000006ea41a05751f90c0"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Schnorr signatures BIP
Precedence: list

--0000000000006ea41a05751f90c0
Content-Type: text/plain; charset="UTF-8"

Correct, there is an interaction step to deduce G*k, when signing, each
participant has to publishes G*ki. I didn't talk about it.   That doesn't
break it, but you're correct, it's not non-interactive.

On Wed, Sep 5, 2018 at 9:06 AM Andrew Poelstra <apoelstra@wpsoftware.net>
wrote:

> On Wed, Sep 05, 2018 at 08:26:14AM -0400, Erik Aronesty wrote:
> > Why would you call it FUD?   All the weird hemming and hawing about it is
> > really strange to me.  The more I look into it and speak to professors
> > about i, the more it seems "so trivial nobody really talks about it".
> >
> > 1. Generate an M of N shared public key (done in advance of signing ....
> > this gets you the bitcoin address)
> > 2. Generate signature fragments (this can be done offline, with no
> > communication between participants)
> >
> > Detailed explanation with code snippets:
> >
> >
> https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f
> >
>
> The hemming and hawing is because you've been repeatedly told that your
> scheme doesn't work, and to please implement it in some computer algebra
> system so that you can see that (or so we can see where your mistake is),
> and you instead continue to post incomplete/incoherent copies of the same
> thing across multiple mediums - Reddit, this list, Bitcointalk, Medium,
> etc ad nauseum.
>
> It's distracting and offensive to people who have spent a lot of time and
> energy thinking about this stuff, and more importantly it causes confusion
> in the public eye. Phrasings like "weird hemming and hawing" suggest that
> we don't know/don't care about some insight you have, which is not true.
> This is why your posts are FUD.
>
> For example, in your linked post I looked at every single instance of the
> character 'k' and *not one of them* defined the value 'k' from which 'R'
> is derived in the signing procedure.
>
>
> Of course there is no possible value, individual signers cannot learn 'R'
> at signing time without interaction, and your whole scheme is broken. Given
> the number of times you've been told this, I find it hard to believe that
> this was an honest mistake.
>
>
>
> Andrew
>
>
>
> --
> Andrew Poelstra
> Research Director, Mathematics Department, Blockstream
> Email: apoelstra at wpsoftware.net
> Web:   https://www.wpsoftware.net/andrew
>
> "Make it stop, my love; we were wrong to try
>  Never saw what we could unravel in traveling light
>  Nor how the trip debrides like a stack of slides
>  All we saw was that time is taller than space is wide"
>        --Joanna Newsom
>
>

--0000000000006ea41a05751f90c0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Correct, there is an interaction step to =
deduce G*k, when signing, each participant has to publishes G*ki. I didn=
9;t talk about it.=C2=A0=C2=A0 That doesn&#39;t break it, but you&#39;re co=
rrect, it&#39;s not non-interactive.<br></div></div><br><div class=3D"gmail=
_quote"><div dir=3D"ltr">On Wed, Sep 5, 2018 at 9:06 AM Andrew Poelstra &lt=
;<a href=3D"mailto:apoelstra@wpsoftware.net">apoelstra@wpsoftware.net</a>&g=
t; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 =
.8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, Sep 05, 2018 at 0=
8:26:14AM -0400, Erik Aronesty wrote:<br>
&gt; Why would you call it FUD?=C2=A0 =C2=A0All the weird hemming and hawin=
g about it is<br>
&gt; really strange to me.=C2=A0 The more I look into it and speak to profe=
ssors<br>
&gt; about i, the more it seems &quot;so trivial nobody really talks about =
it&quot;.<br>
&gt; <br>
&gt; 1. Generate an M of N shared public key (done in advance of signing ..=
..<br>
&gt; this gets you the bitcoin address)<br>
&gt; 2. Generate signature fragments (this can be done offline, with no<br>
&gt; communication between participants)<br>
&gt; <br>
&gt; Detailed explanation with code snippets:<br>
&gt; <br>
&gt; <a href=3D"https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-schem=
e-e7860ab34e7f" rel=3D"noreferrer" target=3D"_blank">https://medium.com/@si=
mulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f</a><br>
&gt;<br>
<br>
The hemming and hawing is because you&#39;ve been repeatedly told that your=
<br>
scheme doesn&#39;t work, and to please implement it in some computer algebr=
a<br>
system so that you can see that (or so we can see where your mistake is),<b=
r>
and you instead continue to post incomplete/incoherent copies of the same<b=
r>
thing across multiple mediums - Reddit, this list, Bitcointalk, Medium,<br>
etc ad nauseum.<br>
<br>
It&#39;s distracting and offensive to people who have spent a lot of time a=
nd<br>
energy thinking about this stuff, and more importantly it causes confusion<=
br>
in the public eye. Phrasings like &quot;weird hemming and hawing&quot; sugg=
est that<br>
we don&#39;t know/don&#39;t care about some insight you have, which is not =
true.<br>
This is why your posts are FUD.<br>
<br>
For example, in your linked post I looked at every single instance of the<b=
r>
character &#39;k&#39; and *not one of them* defined the value &#39;k&#39; f=
rom which &#39;R&#39;<br>
is derived in the signing procedure.<br>
<br>
<br>
Of course there is no possible value, individual signers cannot learn &#39;=
R&#39;<br>
at signing time without interaction, and your whole scheme is broken. Given=
<br>
the number of times you&#39;ve been told this, I find it hard to believe th=
at<br>
this was an honest mistake.<br>
<br>
<br>
<br>
Andrew<br>
<br>
<br>
<br>
-- <br>
Andrew Poelstra<br>
Research Director, Mathematics Department, Blockstream<br>
Email: apoelstra at <a href=3D"http://wpsoftware.net" rel=3D"noreferrer" ta=
rget=3D"_blank">wpsoftware.net</a><br>
Web:=C2=A0 =C2=A0<a href=3D"https://www.wpsoftware.net/andrew" rel=3D"noref=
errer" target=3D"_blank">https://www.wpsoftware.net/andrew</a><br>
<br>
&quot;Make it stop, my love; we were wrong to try<br>
=C2=A0Never saw what we could unravel in traveling light<br>
=C2=A0Nor how the trip debrides like a stack of slides<br>
=C2=A0All we saw was that time is taller than space is wide&quot;<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0--Joanna Newsom<br>
<br>
</blockquote></div>

--0000000000006ea41a05751f90c0--