MIME-Version: 1.0
Sender: gmaxwell@gmail.com
In-Reply-To: <bb3ea695-f1f6-3f92-267d-281aedb850ed@satoshilabs.com>
References: <CAAS2fgR-or=zksQ929Muvgr=sgzNSugGp669ZWYC6YkvEG=H5w@mail.gmail.com>
	<ae570ccf-3a2c-a11c-57fa-6dad78cfb1a5@satoshilabs.com>
	<CAAS2fgRQvpa8VXE8YAYSfugDvCu=1+5ANsGk1V_OXtHPGD=Ltw@mail.gmail.com>
	<f2fbb0ec-0c18-f866-29fe-41de882f4706@satoshilabs.com>
	<bb3ea695-f1f6-3f92-267d-281aedb850ed@satoshilabs.com>
From: Gregory Maxwell <greg@xiph.org>
Date: Wed, 10 Jan 2018 23:47:23 +0000
Message-ID: <CAAS2fgSn7kYoKi2cBRUP39G6LLZZgG1B6Sc47U+ba8H22rTQ6Q@mail.gmail.com>
To: Pavol Rusnak <stick@satoshilabs.com>
Content-Type: text/plain; charset="UTF-8"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Satoshilabs secret shared private key scheme
Precedence: list

On Wed, Jan 10, 2018 at 8:28 PM, Pavol Rusnak <stick@satoshilabs.com> wrote:
> On 09/01/18 16:12, Pavol Rusnak via bitcoin-dev wrote:
>> On 09/01/18 00:47, Gregory Maxwell wrote:
>>> Have you considered using blind host-delegated KDFs, where the KDF
>>> runs on the user's computer instead of the hardware wallet, but the
>>> computer doesn't learn anything about they keys?
>>
>> Any examples of these?

Yes, this scheme.
https://bitcointalk.org/index.php?topic=311000.msg3342217#msg3342217

> Actually, scratch that. HW wallet would not know whether the host
> computer is lying or not. The computer would not learn about the keys,
> but still could be malicious and provide invalid result. Is that correct?


I believe that can be avoided by having the computer do somewhat more
work and checking the consistency after the fact.

(or for decode time, having a check value under the encryption...)