MIME-Version: 1.0
References: <CAJowKg+Sgfv-FxZ2gyYWO4HmVwVFZjpjN3RkGN4y1TJwpuLMtQ@mail.gmail.com>
In-Reply-To: <CAJowKg+Sgfv-FxZ2gyYWO4HmVwVFZjpjN3RkGN4y1TJwpuLMtQ@mail.gmail.com>
From: Lloyd Fournier <lloyd.fourn@gmail.com>
Date: Fri, 6 Mar 2020 17:40:24 +1100
Message-ID: <CAH5Bsr3CbG6b4tk0hkLECfg0LM38BNp7nfspLv+NbMg6f79iDg@mail.gmail.com>
To: Erik Aronesty <erik@q32.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000033f49d05a029ef9f"
Subject: Re: [bitcoin-dev] Schnorr sigs vs pairing sigs
Precedence: list

--00000000000033f49d05a029ef9f
Content-Type: text/plain; charset="UTF-8"

Hi Erik,

There are a strong arguments for and against pairing based sigs in Bitcoin.
One very strong argument in favour over non-deterministic signatures like
Schnorr over BLS is it enables a kind of signature encryption called
"adaptor signatures". This construction is key to many exciting up and
coming layer 2 protocols and isn't possible unless the signature scheme
uses randomness.

self plug: I have a paper on this topic called "One-Time Verifiably
Encrypted Signatures A.K.A Adaptor Signatures"
 https://github.com/LLFourn/one-time-VES/blob/master/main.pdf

LL


On Fri, Mar 6, 2020 at 6:03 AM Erik Aronesty via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Schnorr sigs rely so heavily on the masking provided by a random
> nonce.   There are so many easy ways to introduce bias (hash + modulo,
> for example).
>
> Even 2 bits of bias can result in serious attacks:
>
> https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf
>
> Maybe pairing based sigs  - which are slower - might be both more
> flexible, and better suited to secure implemetnations?
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--00000000000033f49d05a029ef9f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Erik,<div><br>There are a strong arguments for and agai=
nst pairing based sigs in Bitcoin. One very strong argument in favour over =
non-deterministic signatures like Schnorr over BLS is it enables a kind of =
signature encryption called &quot;adaptor signatures&quot;. This constructi=
on is key to many exciting up and coming layer 2 protocols and isn&#39;t po=
ssible unless the signature scheme uses randomness.=C2=A0</div><div><br></d=
iv><div>self plug: I have a paper on this topic called &quot;One-Time Verif=
iably Encrypted Signatures A.K.A Adaptor Signatures&quot;</div><div>=C2=A0<=
a href=3D"https://github.com/LLFourn/one-time-VES/blob/master/main.pdf">htt=
ps://github.com/LLFourn/one-time-VES/blob/master/main.pdf</a></div><div><br=
></div><div>LL</div><div><br></div></div><br><div class=3D"gmail_quote"><di=
v dir=3D"ltr" class=3D"gmail_attr">On Fri, Mar 6, 2020 at 6:03 AM Erik Aron=
esty via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundatio=
n.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br></div><block=
quote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1=
px solid rgb(204,204,204);padding-left:1ex">Schnorr sigs rely so heavily on=
 the masking provided by a random<br>
nonce.=C2=A0 =C2=A0There are so many easy ways to introduce bias (hash + mo=
dulo,<br>
for example).<br>
<br>
Even 2 bits of bias can result in serious attacks:<br>
<br>
<a href=3D"https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf" rel=3D"nor=
eferrer" target=3D"_blank">https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi=
.pdf</a><br>
<br>
Maybe pairing based sigs=C2=A0 - which are slower - might be both more<br>
flexible, and better suited to secure implemetnations?<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--00000000000033f49d05a029ef9f--