MIME-Version: 1.0
References: <CAJowKgLrSe77sqO2iB7mYboo_HW=YjO4=AFdv7L5FUi2vygMiQ@mail.gmail.com>
In-Reply-To: <CAJowKgLrSe77sqO2iB7mYboo_HW=YjO4=AFdv7L5FUi2vygMiQ@mail.gmail.com>
From: Pieter Wuille <pieter.wuille@gmail.com>
Date: Sun, 8 Jul 2018 19:29:19 -0700
Message-ID: <CAPg+sBhGHOcyS7M2-Vm5en7Z+74pP5gzLbX_Lx_qyi0KDtOnwQ@mail.gmail.com>
To: erik@q32.com, Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000007ce592057087c882"
Subject: Re: [bitcoin-dev] Multiparty signatures
Precedence: list

--0000000000007ce592057087c882
Content-Type: text/plain; charset="UTF-8"

On Sun, Jul 8, 2018, 07:26 Erik Aronesty via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> To save space, start with the wiki terminology on schnorr sigs.
>
> Consider changing the "e" term in the schnorr algorithm to hash of message
> (elligator style) to the power of r, rather than using concatenation.
>

This is a very vague description. Is there some paper you can reference, or
a more detailed explanation of the algorithm?

This would allow m of n devices to sign a transaction without any of them
> knowing a private key at all.
>
IE: each device can roll a random number as a share and the interpolation
> of that is the private key.
>
> The public shares can be broadcast and combines.  And signature shares can
> be broadcast and combined.
>
> The net result of this is it really possible for an arbitrary set of
> devices to create a perfectly secure public-private key pair set.
>
At no point was the private key anywhere.
>

All of this sounds like a threshold signature scheme, which as Tim pointed
out is already possible with Schnorr.

What are the advantages of what you're describing?

Cheers,

-- 
Pieter

--0000000000007ce592057087c882
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><div class=3D"gmail_quote"><div dir=3D"ltr">On Sun, =
Jul 8, 2018, 07:26 Erik Aronesty via bitcoin-dev &lt;<a href=3D"mailto:bitc=
oin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a=
>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0=
 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"auto">To s=
ave space, start with the wiki terminology on schnorr sigs.<div dir=3D"auto=
"><br></div><div dir=3D"auto">Consider changing the &quot;e&quot; term in t=
he schnorr algorithm to hash of message (elligator style) to the power of r=
, rather than using concatenation.=C2=A0=C2=A0</div></div></blockquote></di=
v></div><div dir=3D"auto"><br></div><div dir=3D"auto">This is a very vague =
description. Is there some paper you can reference, or a more detailed expl=
anation of the algorithm?</div><div dir=3D"auto"><br></div><div dir=3D"auto=
"><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"aut=
o"><div dir=3D"auto"><div dir=3D"auto">This would allow m of n devices to s=
ign a transaction without any of them knowing a private key at all.</div></=
div></div></blockquote></div></div><div dir=3D"auto"></div><div dir=3D"auto=
"><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"aut=
o"><div dir=3D"auto"><div dir=3D"auto">IE: each device can roll a random nu=
mber as a share and the interpolation of that is the private key.=C2=A0 =C2=
=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">The public shares ca=
n be broadcast and combines.=C2=A0 And signature shares can be broadcast an=
d combined.</div><div dir=3D"auto"><br></div><div dir=3D"auto">The net resu=
lt of this is it really possible for an arbitrary set of devices to create =
a perfectly secure public-private key pair set.</div></div></div></blockquo=
te></div></div><div dir=3D"auto"><div class=3D"gmail_quote"><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex"><div dir=3D"auto"><div dir=3D"auto"><div dir=3D"auto">At no=
 point was the private key anywhere.</div></div></div></blockquote></div></=
div><div dir=3D"auto"><br></div><div dir=3D"auto">All of this sounds like a=
 threshold signature scheme, which as Tim pointed out is already possible w=
ith Schnorr.</div><div dir=3D"auto"><br></div><div dir=3D"auto">What are th=
e advantages of what you&#39;re describing?</div><div dir=3D"auto"><br></di=
v><div dir=3D"auto">Cheers,</div><div dir=3D"auto"><br></div><div dir=3D"au=
to">--=C2=A0</div><div dir=3D"auto">Pieter</div><div dir=3D"auto"><br></div=
><div dir=3D"auto"><div class=3D"gmail_quote"><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex=
">
</blockquote></div></div></div>

--0000000000007ce592057087c882--