Delivery-date: Tue, 30 Apr 2024 07:23:00 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of apoelstra@wpsoftware.net designates 66.183.0.205 as permitted sender) client-ip=66.183.0.205;
Date: Tue, 30 Apr 2024 14:21:40 +0000
From: Andrew Poelstra <apoelstra@wpsoftware.net>
To: Matthew Zipkin <pinheadmz@gmail.com>
Cc: Ethan Heilman <eth3rs@gmail.com>,
	Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport
 Signatures (no changes needed)
Message-ID: <ZjD-dMMGxoGNgzIg@camus>
References: <CAEM=y+XyW8wNOekw13C5jDMzQ-dOJpQrBC+qR8-uDot25tM=XA@mail.gmail.com>
 <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="Lwd7sZ5ieIwUBdMT"
Content-Disposition: inline
In-Reply-To: <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--Lwd7sZ5ieIwUBdMT
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Tue, Apr 30, 2024 at 08:32:42AM -0400, Matthew Zipkin wrote:
> > if an attacker managed to grind a 23-byte r-value at a cost of 2^72
> computations, it would provide the attacker some advantage.
> 
> If we are assuming discrete log is still hard, why do we need Lamport
> signatures at all? In a post-quantum world, finding k such that r is 21
> bytes or less is efficient for the attacker.
>

Aside from Ethan's point that a variant of this technique is still
secure in the case that discrete log is totally broken (or even
partially broken...all we need is that _somebody_ is able to find the
discrete log of the x=1 point and for them to publish this).

Another reason this is useful is that if you have a Lamport signature on
the stack which is composed of SIZE values, all of which are small
enough to be manipulated with the numeric script opcodes, then you can
do covenants in Script.

(Sadly(?), I think none of this works in the context of the 201-opcode
limit...and absent BitVM challenge-response tricks it's unlikely you can
do much in the context of the 4MWu block size limit..), but IMO it's a
pretty big deal that size limits are now the only reason that Bitcoin
doesn't have covenants.)

-- 
Andrew Poelstra
Director, Blockstream Research
Email: apoelstra at wpsoftware.net
Web:   https://www.wpsoftware.net/andrew

The sun is always shining in space
    -Justin Lewis-Webster

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZjD-dMMGxoGNgzIg%40camus.

--Lwd7sZ5ieIwUBdMT
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEkPnKPD7Je+ki35VexYjWPOQbl8EFAmYw/nQACgkQxYjWPOQb
l8EVRgf9Fr5cFPc7iiH1Pni22OgASDmDFNYK/KQipJJ5UtfhFk12DO77L25u74OU
jCZFmhCWUs8JtBetekxCs4Tv7tfVMGSd9XAi1l0IBNn+8iV6iu89NBAmDbuaCV4j
TgJAFtPjMlf8IufRd8uZGoq4XnvoINqDZe2o2h1qiFrGFzwyra6oNxM4OLSalWIL
JMz6+5yu0XdGbRxj1V0pZ0KY8v02q5KRVy5enAhdkquklUKk1fefmbRm7UZrrefM
dxdgOF15car2RaNZKqDYenwOhpDP32HYqEqT7HBuKj5PIKeVa6Iv/lhSnIdvnCuZ
nXOhOLRbrw9rV6bTOxAagL6cAPCL9g==
=bcrp
-----END PGP SIGNATURE-----

--Lwd7sZ5ieIwUBdMT--