MIME-Version: 1.0
References: <CAJvkSsc_rKneeVrLkTqXJDKcr+VQNBHVJyXVe=7PkkTZ+SruFQ@mail.gmail.com>
 <ca674cee-6fe9-f325-7e09-f3efda082b6b@gmail.com>
 <YwMiFAEImHAJfAHHU7WbN1C1JuHjh0vC18Hn61QplFOlY5mEgKmjsAlj2geV1-28E36_wgfL9_QHTRJsbtOLt73o9C4JfoVt8scvYGzKHOI=@protonmail.com>
 <CAJowKgJ61nWBHMfNVx7J+C1QwZZMQ9zUaFQnAw1roXiPfi5O6A@mail.gmail.com>
 <CAJvkSsdAVFf44XXXXhXqV7JcnmV796vttHEtNEp=v-zxehUofw@mail.gmail.com>
 <CAJowKgJFHzXEtJij4K0SR_KvatTZMDfUEU40noMzR2ubj8OSvA@mail.gmail.com>
 <c5ae9d75-e64f-1565-93d0-e2b5df45d3f4@gmail.com>
 <CAJvkSsdRCHA6pB0mMY-7SE4GbDodAR34_RMgPrhEZAAq_8O2Aw@mail.gmail.com>
 <7eae57c9-be42-ae07-9296-ae9e8e03c1b8@gmail.com>
 <CAJvkSsfa8rzbwXiatZBpwQ6d4d94yLQifK8gyq3k-rq_1SH4OQ@mail.gmail.com>
In-Reply-To: <CAJvkSsfa8rzbwXiatZBpwQ6d4d94yLQifK8gyq3k-rq_1SH4OQ@mail.gmail.com>
From: Tom Trevethan <tom@commerceblock.com>
Date: Thu, 27 Jul 2023 14:25:33 +0100
Message-ID: <CAJvkSsea+aKJFkNpNxHPAGCxrYwU+8wXOzV-8yH=qacGta++ig@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000c5b71a060177e63a"
Subject: [bitcoin-dev] Fwd:  Blinded 2-party Musig2
Precedence: list

--000000000000c5b71a060177e63a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

@Jonas

OK, thanks, I get the logic now. I believe this attack can be mitigated (at
least in the case of using this scheme for statechains) by the receiver of
a coin verifying the construction of all previous challenges.

So in this case, the sender of a coin would record R2[K-1] in addition to m
(and any c blinding nonce used) for the signature it generates with the
server. It would then send this (and all previous R2 values i =3D 0, ...,
K-2) to the receiver.

The receiver would then query the server for the full set (i =3D 0, ..., K-=
1)
of R1[i] values it has generated, and the corresponding (blinded) c[i]
values used for each co-signing it has performed on this key. The
receiver would then verify that each previous c[i] (i =3D 0, ... K-1) has
been correctly formed and includes the server generated R1[i].

If any of the c values fail to verify against the values of R1 provided by
the server, then the coin is invalid.

On Thu, Jul 27, 2023 at 9:08=E2=80=AFAM Jonas Nick <jonasdnick@gmail.com> w=
rote:

> No, proof of knowledge of the r values used to generate each R does not
> prevent
> Wagner's attack. I wrote
>
>  >   Using Wagner's algorithm, choose R2[0], ..., R2[K-1] such that
>  >    c[0] + ... + c[K-1] =3D c[K].
>
> You can think of this as actually choosing scalars r2[0], ..., r2[K-1] an=
d
> define R2[i] =3D r2[i]*G. The attacker chooses r2[i]. The attack wouldn't
> make
> sense if he didn't.
>

--000000000000c5b71a060177e63a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_quote"><div dir=3D"ltr"><div><a cl=
ass=3D"gmail_plusreply" id=3D"m_3497204169207510401plusReplyChip-2">@Jonas<=
/a><br></div><div><br></div><div>OK, thanks, I get the logic now. I believe=
 this attack can be mitigated (at least in the case of using this scheme fo=
r statechains) by the receiver of a coin verifying the construction of all =
previous challenges.=C2=A0</div><div><br></div><div>So in this case, the se=
nder of a coin would record R2[K-1] in addition to m (and any c blinding no=
nce used) for the signature it generates with the server. It would then sen=
d this (and all previous R2 values i =3D 0, ..., K-2) to the receiver.=C2=
=A0</div><div><br></div><div>The receiver would then query the server for t=
he full set (i =3D 0, ..., K-1) of R1[i] values it has generated, and the c=
orresponding (blinded) c[i] values used for each co-signing it has performe=
d on this key. The receiver=C2=A0would then verify that each previous c[i] =
(i =3D 0, ... K-1) has been correctly formed and includes the server genera=
ted R1[i].=C2=A0</div><div><br></div><div>If any of the c values fail to ve=
rify against the values of R1 provided by the server, then the coin is inva=
lid.=C2=A0<a class=3D"gmail_plusreply"><br></a></div><br><div class=3D"gmai=
l_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Jul 27, 2023 at 9:08=
=E2=80=AFAM Jonas Nick &lt;<a href=3D"mailto:jonasdnick@gmail.com" target=
=3D"_blank">jonasdnick@gmail.com</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex">No, proof of knowledge of the r values use=
d to generate each R does not prevent<br>
Wagner&#39;s attack. I wrote<br>
<br>
=C2=A0&gt;=C2=A0 =C2=A0Using Wagner&#39;s algorithm, choose R2[0], ..., R2[=
K-1] such that<br>
=C2=A0&gt;=C2=A0 =C2=A0 c[0] + ... + c[K-1] =3D c[K].<br>
<br>
You can think of this as actually choosing scalars r2[0], ..., r2[K-1] and<=
br>
define R2[i] =3D r2[i]*G. The attacker chooses r2[i]. The attack wouldn&#39=
;t make<br>
sense if he didn&#39;t.<br>
</blockquote></div></div>
</div></div>

--000000000000c5b71a060177e63a--