MIME-Version: 1.0
References: <CAJowKgLrSe77sqO2iB7mYboo_HW=YjO4=AFdv7L5FUi2vygMiQ@mail.gmail.com>
	<08201f2292587821e6d23f6cc201d95e6e5ad2cd.camel@timruffing.de>
In-Reply-To: <08201f2292587821e6d23f6cc201d95e6e5ad2cd.camel@timruffing.de>
Reply-To: erik@q32.com
From: Erik Aronesty <earonesty@gmail.com>
Date: Sun, 8 Jul 2018 14:23:45 -0400
Message-ID: <CAJowKgL050GVKnadxHd=9qk=DdpZxs6gJ+8vYY1+7ss9tCJSBg@mail.gmail.com>
To: Tim Ruffing <crypto@timruffing.de>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000000ef3580570810029"
Subject: Re: [bitcoin-dev] Multiparty signatures
Precedence: list

--0000000000000ef3580570810029
Content-Type: text/plain; charset="UTF-8"

You don't have to treat the hash as a group member for the purposes of
signing.

Everything else about the algorithm works the same.

This just enables signatures to be computed much more simply.

On Sun, Jul 8, 2018, 11:32 AM Tim Ruffing via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Hi Erik,
>
> On Sun, 2018-07-08 at 10:19 -0400, Erik Aronesty via bitcoin-dev wrote:
> > Consider changing the "e" term in the schnorr algorithm to hash of
> > message (elligator style) to the power of r, rather than using
> > concatenation.
>
> How do you compute s = x*e if e is an element of group G?
> (Similar question: How do you verify if e is element of G?)
>
> Are you aware of
>  http://cacr.uwaterloo.ca/techreports/2001/corr2001-13.ps ?
> This is a threshold signature scheme for Schnorr signatures, so what
> you want is possible already with Schnorr signatures.
>
> Best,
> Tim
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000000ef3580570810029
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">You don&#39;t have to treat the hash as a group member fo=
r the purposes of signing.<div dir=3D"auto"><br></div><div dir=3D"auto">Eve=
rything else about the algorithm works the same.<br><div dir=3D"auto"><br><=
/div><div dir=3D"auto">This just enables signatures to be computed much mor=
e simply.</div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr">=
On Sun, Jul 8, 2018, 11:32 AM Tim Ruffing via bitcoin-dev &lt;<a href=3D"ma=
ilto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank" rel=3D"norefe=
rrer">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br></div><blockq=
uote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc =
solid;padding-left:1ex">Hi Erik,<br>
<br>
On Sun, 2018-07-08 at 10:19 -0400, Erik Aronesty via bitcoin-dev wrote:<br>
&gt; Consider changing the &quot;e&quot; term in the schnorr algorithm to h=
ash of<br>
&gt; message (elligator style) to the power of r, rather than using<br>
&gt; concatenation.=C2=A0 <br>
<br>
How do you compute s =3D x*e if e is an element of group G?<br>
(Similar question: How do you verify if e is element of G?)<br>
<br>
Are you aware of <br>
=C2=A0<a href=3D"http://cacr.uwaterloo.ca/techreports/2001/corr2001-13.ps" =
rel=3D"noreferrer noreferrer noreferrer" target=3D"_blank">http://cacr.uwat=
erloo.ca/techreports/2001/corr2001-13.ps</a> ?<br>
This is a threshold signature scheme for Schnorr signatures, so what<br>
you want is possible already with Schnorr signatures.<br>
<br>
Best,<br>
Tim<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" rel=3D"noreferrer =
noreferrer" target=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer noreferrer noreferrer" target=3D"_blank">https://lists.li=
nuxfoundation.org/mailman/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--0000000000000ef3580570810029--