MIME-Version: 1.0
In-Reply-To: <CAAS2fgQtf_LDDcWDmvM+kjPCSqaQVwVd2rKWVtho4-XSAHpJZQ@mail.gmail.com>
References: <51280a45-f86b-3191-d55e-f34e880c1da8@satoshilabs.com>
	<CAAS2fgRQk4EUp6FO2f+RkJpDTyZX0N4=uGp7ZF=0aUchZX8hSA@mail.gmail.com>
	<4003eed1-584f-9773-8cf9-6300ebd1eac6@satoshilabs.com>
	<CAAS2fgSw0mAQPJ-ai-3kFr7pWXd7pjbrEoXN4r6Ak3o4c8_vjw@mail.gmail.com>
	<d6eb0fc3-d729-30cb-986b-b1d7b8aacbd6@satoshilabs.com>
	<CAAS2fgQtf_LDDcWDmvM+kjPCSqaQVwVd2rKWVtho4-XSAHpJZQ@mail.gmail.com>
From: "Russell O'Connor" <roconnor@blockstream.io>
Date: Mon, 22 Jan 2018 14:21:14 -0500
Message-ID: <CAMZUoK=ffKHM9WN=zrSME5y904u6ZYsfnCpeT_BYT=5Z+NxYsw@mail.gmail.com>
To: Gregory Maxwell <greg@xiph.org>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="94eb2c0afc44999db005636256e7"
Subject: Re: [bitcoin-dev] Satoshilabs secret shared private key scheme
Precedence: list

--94eb2c0afc44999db005636256e7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 18, 2018 at 1:58 PM, Gregory Maxwell via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Thu, Jan 18, 2018 at 4:59 PM, Ond=C5=99ej Vejpustek
> <ondrej.vejpustek@satoshilabs.com> wrote:
> >> If being secure against partial share leakage is really part of your
> >> threat model the current proposal is gratuitously insecure against it.
> >
> > I don't think that is true. Shared secret is an input of KDF which
> > should prevent this kind of attack.
>
> My post provided a concrete example. I'd be happy to answer any
> questions about it, but otherwise I'm not sure how to make it more
> clear.
>
> > Actually, we've been considering something like that. We concluded that
> it is to much "rolling your own crypto". Instead of diffusion layer we
> decided to apply KDF on the shared secret.
>
>
> Quite the opposite-- a large block cipher is a standard
> construction... and the off-label application of a KDF that you've
> used here doesn't provide any protection against the example I gave.
>

At this point, is it better just to use GF(2^256+n)?  Is GF(2^256+n) going
to be that much slower than GF(2^8) that we care to make things this
complicated?  (I honestly don't know the answer.)

--94eb2c0afc44999db005636256e7
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On T=
hu, Jan 18, 2018 at 1:58 PM, Gregory Maxwell via bitcoin-dev <span dir=3D"l=
tr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"=
_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span> wrote:<br><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left=
:1px solid rgb(204,204,204);padding-left:1ex"><span class=3D"gmail-">On Thu=
, Jan 18, 2018 at 4:59 PM, Ond=C5=99ej Vejpustek<br>
&lt;<a href=3D"mailto:ondrej.vejpustek@satoshilabs.com">ondrej.vejpustek@sa=
toshilabs.<wbr>com</a>&gt; wrote:<br>
&gt;&gt; If being secure against partial share leakage is really part of yo=
ur<br>
&gt;&gt; threat model the current proposal is gratuitously insecure against=
 it.<br>
&gt;<br>
&gt; I don&#39;t think that is true. Shared secret is an input of KDF which=
<br>
&gt; should prevent this kind of attack.<br>
<br>
</span>My post provided a concrete example. I&#39;d be happy to answer any<=
br>
questions about it, but otherwise I&#39;m not sure how to make it more<br>
clear.<br>
<span class=3D"gmail-"><br>
&gt; Actually, we&#39;ve been considering something like that. We concluded=
 that it is to much &quot;rolling your own crypto&quot;. Instead of diffusi=
on layer we decided to apply KDF on the shared secret.<br>
<br>
<br>
</span>Quite the opposite-- a large block cipher is a standard<br>
construction... and the off-label application of a KDF that you&#39;ve<br>
used here doesn&#39;t provide any protection against the example I gave.<di=
v></div></blockquote><div><br></div>At this point, is it better just to use=
 GF(2^256+n)?=C2=A0 Is GF(2^256+n) going to be that much slower than GF(2^8=
) that we care to make things this complicated?=C2=A0 (I honestly don&#39;t=
 know the answer.)<br></div></div></div>

--94eb2c0afc44999db005636256e7--