MIME-Version: 1.0
References: <CAJvkSsc_rKneeVrLkTqXJDKcr+VQNBHVJyXVe=7PkkTZ+SruFQ@mail.gmail.com>
 <ca674cee-6fe9-f325-7e09-f3efda082b6b@gmail.com>
 <YwMiFAEImHAJfAHHU7WbN1C1JuHjh0vC18Hn61QplFOlY5mEgKmjsAlj2geV1-28E36_wgfL9_QHTRJsbtOLt73o9C4JfoVt8scvYGzKHOI=@protonmail.com>
 <CAJowKgJ61nWBHMfNVx7J+C1QwZZMQ9zUaFQnAw1roXiPfi5O6A@mail.gmail.com>
 <CAJvkSsdAVFf44XXXXhXqV7JcnmV796vttHEtNEp=v-zxehUofw@mail.gmail.com>
 <CAJowKgJFHzXEtJij4K0SR_KvatTZMDfUEU40noMzR2ubj8OSvA@mail.gmail.com>
 <c5ae9d75-e64f-1565-93d0-e2b5df45d3f4@gmail.com>
 <CAJvkSsdRCHA6pB0mMY-7SE4GbDodAR34_RMgPrhEZAAq_8O2Aw@mail.gmail.com>
In-Reply-To: <CAJvkSsdRCHA6pB0mMY-7SE4GbDodAR34_RMgPrhEZAAq_8O2Aw@mail.gmail.com>
From: Erik Aronesty <erik@q32.com>
Date: Wed, 26 Jul 2023 18:06:44 -0400
Message-ID: <CAJowKg+wjq8kTOmhEuu--hS2s_FvYEg61z8C_SOvFLsANesc7g@mail.gmail.com>
To: Tom Trevethan <tom@commerceblock.com>
Content-Type: multipart/alternative; boundary="000000000000dff90f06016b10f3"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Blinded 2-party Musig2
Precedence: list

--000000000000dff90f06016b10f3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

correct.  you cannot select R if it is shipped with a POP

On Wed, Jul 26, 2023, 4:35 PM Tom Trevethan <tom@commerceblock.com> wrote:

> Not 'signing' but 'secret' i.e. the r values (ephemeral keys). Proof of
> knowledge of the r values used to generate each R used prevents the Wagne=
r
> attack, no?
>
> On Wed, Jul 26, 2023 at 8:59=E2=80=AFPM Jonas Nick <jonasdnick@gmail.com>=
 wrote:
>
>> None of the attacks mentioned in this thread so far (ZmnSCPxj mentioned =
an
>> attack on the nonces, I mentioned an attack on the challenge c) can be
>> prevented
>> by proving knowledge of the signing key (usually known as proof of
>> possession,
>> PoP).
>>
>

--000000000000dff90f06016b10f3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">correct.=C2=A0 you cannot select R if it is shipped with =
a POP=C2=A0</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"g=
mail_attr">On Wed, Jul 26, 2023, 4:35 PM Tom Trevethan &lt;<a href=3D"mailt=
o:tom@commerceblock.com">tom@commerceblock.com</a>&gt; wrote:<br></div><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex"><div dir=3D"ltr">Not &#39;signing&#39; but &#39;=
secret&#39; i.e. the r values (ephemeral keys). Proof of knowledge of the r=
 values used to generate each R used prevents the Wagner attack, no?</div><=
br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed,=
 Jul 26, 2023 at 8:59=E2=80=AFPM Jonas Nick &lt;<a href=3D"mailto:jonasdnic=
k@gmail.com" target=3D"_blank" rel=3D"noreferrer">jonasdnick@gmail.com</a>&=
gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0=
px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">None =
of the attacks mentioned in this thread so far (ZmnSCPxj mentioned an<br>
attack on the nonces, I mentioned an attack on the challenge c) can be prev=
ented<br>
by proving knowledge of the signing key (usually known as proof of possessi=
on,<br>
PoP).<br>
</blockquote></div>
</blockquote></div>

--000000000000dff90f06016b10f3--