MIME-Version: 1.0
References: <CAPg+sBj7f+=OYXuOMdNeJk3NBG67FSQSF8Xv3seFCvwxCWq69A@mail.gmail.com>
	<2e620d305c86f65cbff44b5fba548dc85c118f84.camel@timruffing.de>
	<20180812163734.GV499@boulet.lan>
	<CAJowKg+h11YkwOo-gyWCw+87Oh-9K34LOnJ1730hhpoVR2m5sA@mail.gmail.com>
	<20180903000518.GB18522@boulet.lan>
	<CAJowKg+PDtEV3je_N9Ra6u3n4+ZQ3ozYapt8ivxGYYU28Qad+w@mail.gmail.com>
	<CAAS2fgT0uBGbLBOW4TxA-qCzOLwoQ1qSV-R0dMKRzPLAm_UOqQ@mail.gmail.com>
	<CAJowKg+-45h6vraL1PpnqfhHSbG+G40L+FD7xN+C-Dn1E6Y_Vg@mail.gmail.com>
	<CAAS2fgSfdfQ2CiEabjrjspQGQufwzk84f1mzM1j_LRWqAPd8wA@mail.gmail.com>
	<CAJowKgK3Pxev4pDH4xVLPvmHda8oAfq=fya4TY+_dodUJ7j9Nw@mail.gmail.com>
	<CAAS2fgQOb4UJBkH=pMre=tsbAUmMNYx=4jkBawX4Rc_dKcpwZg@mail.gmail.com>
In-Reply-To: <CAAS2fgQOb4UJBkH=pMre=tsbAUmMNYx=4jkBawX4Rc_dKcpwZg@mail.gmail.com>
From: Erik Aronesty <erik@q32.com>
Date: Tue, 11 Sep 2018 13:37:59 -0400
Message-ID: <CAJowKgK9UdavrGnKum43dx+DXe+LakHXuVU6bNhMFtEoy2U3Og@mail.gmail.com>
To: Gregory Maxwell <greg@xiph.org>
Content-Type: multipart/alternative; boundary="0000000000003abadd05759bf07d"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Schnorr signatures BIP
Precedence: list

--0000000000003abadd05759bf07d
Content-Type: text/plain; charset="UTF-8"

- Musig, by being M of M, is inherently prone to loss.

- Having the senders of the G*x pubkey shares sign their messages with the
associated private key share should be sufficient to prevent them from
using wagner's algorithm to attack the combined key.   Likewise, the G*k
nonce fragments should also be signed with the pubkey shares.



On Tue, Sep 11, 2018 at 1:27 PM Gregory Maxwell <greg@xiph.org> wrote:

> On Tue, Sep 11, 2018 at 5:20 PM Erik Aronesty <erik@q32.com> wrote:
> > The security advantages of a redistributable threshold system are huge.
>  If a system isn't redistributable, then a single lost or compromised key
> results in lost coins... meaning the system is essetntially unusable.
> >
> > I'm actually worried that Bitcoin releases a multisig that encourages
> loss.
>
> There is no "non- edistributiable multisig" proposed for Bitcoin
> anywhere that I am aware of.
>

--0000000000003abadd05759bf07d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>- Musig, by being M of M, is inherently prone to loss=
.</div><div><br></div><div>- Having the senders of the G*x pubkey shares si=
gn their messages with the associated private key share should be sufficien=
t to prevent them from using wagner&#39;s algorithm to attack the combined =
key.=C2=A0=C2=A0 Likewise, the G*k nonce fragments should also be signed wi=
th the pubkey shares.=C2=A0=C2=A0 <br></div><div><br></div><div><br></div><=
/div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Tue, Sep 11, 2018 a=
t 1:27 PM Gregory Maxwell &lt;<a href=3D"mailto:greg@xiph.org">greg@xiph.or=
g</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, Sep 11, 20=
18 at 5:20 PM Erik Aronesty &lt;<a href=3D"mailto:erik@q32.com" target=3D"_=
blank">erik@q32.com</a>&gt; wrote:<br>
&gt; The security advantages of a redistributable threshold system are huge=
.=C2=A0 =C2=A0If a system isn&#39;t redistributable, then a single lost or =
compromised key results in lost coins... meaning the system is essetntially=
 unusable.<br>
&gt;<br>
&gt; I&#39;m actually worried that Bitcoin releases a multisig that encoura=
ges loss.<br>
<br>
There is no &quot;non- edistributiable multisig&quot; proposed for Bitcoin<=
br>
anywhere that I am aware of.<br>
</blockquote></div>

--0000000000003abadd05759bf07d--