MIME-Version: 1.0
References: <CAPg+sBj7f+=OYXuOMdNeJk3NBG67FSQSF8Xv3seFCvwxCWq69A@mail.gmail.com>
	<2e620d305c86f65cbff44b5fba548dc85c118f84.camel@timruffing.de>
	<20180812163734.GV499@boulet.lan>
	<CAJowKg+h11YkwOo-gyWCw+87Oh-9K34LOnJ1730hhpoVR2m5sA@mail.gmail.com>
	<20180903000518.GB18522@boulet.lan>
	<CAJowKg+PDtEV3je_N9Ra6u3n4+ZQ3ozYapt8ivxGYYU28Qad+w@mail.gmail.com>
	<CAAS2fgT0uBGbLBOW4TxA-qCzOLwoQ1qSV-R0dMKRzPLAm_UOqQ@mail.gmail.com>
In-Reply-To: <CAAS2fgT0uBGbLBOW4TxA-qCzOLwoQ1qSV-R0dMKRzPLAm_UOqQ@mail.gmail.com>
From: Erik Aronesty <erik@q32.com>
Date: Tue, 11 Sep 2018 12:34:11 -0400
Message-ID: <CAJowKg+-45h6vraL1PpnqfhHSbG+G40L+FD7xN+C-Dn1E6Y_Vg@mail.gmail.com>
To: Gregory Maxwell <greg@xiph.org>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000000656ce05759b0ce0"
Subject: Re: [bitcoin-dev] Schnorr signatures BIP
Precedence: list

--0000000000000656ce05759b0ce0
Content-Type: text/plain; charset="UTF-8"

 To answer points:

- I switched to the medium article so that I could correct, edit and
improve things to make them more clear.
- I responded to feedback by modifying the protocol to make it work - not
by ignoring it.
- I coded it up in python so I could be sure it worked, because I was
concerned that it was broken
- Yes, coding it up showed me that it's definitely interactive, and no
different than a "standard shnorr sig" in any meaningful way regarding the
security
- No special protocol support is needed over Schnorr signing itself.  The
e, s version can be made at least as secure as schnorr + DLP.  I haven't
researched the R,s version.
- An M-1 rogue-key attack would require the attacker would to either

  - attack the hash function to produce a predictable R based on a known
mesage
  - attack the DLP to influence x or k

Neither attack gives any particular advantage to someone who has M-1 keys.

I haven't tested whether the R,s version is susceptible though.


On Thu, Sep 6, 2018 at 9:15 AM Gregory Maxwell via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Wed, Sep 5, 2018 at 1:49 PM Erik Aronesty via bitcoin-dev
> <bitcoin-dev@lists.linuxfoundation.org> wrote:
> > Detailed explanation with code snippets:
> >
> > https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-[snip]
>
> This appears to be a repost of the broken scheme you posted about on
> Bitcointalk, but then failed to respond to the response.
>
> https://bitcointalk.org/index.php?topic=4973123.0
>
> > The more I look into it and speak to professors about i, the more it
> seems "so trivial nobody really talks about it".
>
> I think you might be falling into the trap of ignoring feedback you
> don't like and and accepting that which sounds like "yea yea,
> something like that".
>
> Something "like that" does work: and is expressly and explicitly
> anticipated by the BIP but to be both secure and functional requires
> proper delineation (E.g. musig) _and_ interaction. What you're
> proposing is continually vague.  My best efforts at making sense of
> what you've written indicate that either it's non-interactive and
> not-actually functional at all,  OR it's interactive and just a less
> secure subset (no proper delinearization to prevent rogue key attacks)
> of what we already propose.
>
> When Poelstra suggests a CAS implementation he means something like
> this Sage notebook: http://bitcoin.ninja/secp256k1.ecdsa.sage  This
> provides for a method of communicating in both directions which is
> completely precise.
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000000656ce05759b0ce0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">
<div>To answer points:</div><div><br></div><div>- I switched to the medium =
article so that I could correct, edit and improve things to make them more =
clear.</div><div></div><div>- I responded to feedback by modifying the prot=
ocol to make it work - not by ignoring it.</div><div>- I coded it up in pyt=
hon so I could be sure it worked, because I was concerned that it was broke=
n<br></div><div>- Yes, coding it up showed me that it&#39;s definitely inte=
ractive, and no different than a &quot;standard shnorr sig&quot; in any mea=
ningful way regarding the security <br></div><div></div><div>-
 No special protocol support is needed over Schnorr signing itself.=C2=A0 T=
he e, s version can be made at least as secure as schnorr + DLP.=C2=A0 I ha=
ven&#39;t researched the R,s version.<br></div><div>- An M-1 rogue-key atta=
ck would require the attacker would to either <br></div><div><br></div><div=
>=C2=A0 - attack the hash function to produce a predictable R based on a kn=
own mesage</div><div>=C2=A0 - attack the DLP to influence x or k=C2=A0</div=
><div><br></div><div>Neither attack gives any particular advantage to someo=
ne who has M-1 keys.</div><div><br></div><div>I haven&#39;t tested whether =
the R,s version is susceptible though.=C2=A0=C2=A0 <br></div><div><br><div =
class=3D"gmail-yj6qo gmail-ajU"><div id=3D"gmail-:1l8" class=3D"gmail-ajR" =
tabindex=3D"0"><img class=3D"gmail-ajT" src=3D"https://ssl.gstatic.com/ui/v=
1/icons/mail/images/cleardot.gif"></div></div></div>

</div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Thu, Sep 6, 2018 a=
t 9:15 AM Gregory Maxwell via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev=
@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; w=
rote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex">On Wed, Sep 5, 2018 at 1:49 P=
M Erik Aronesty via bitcoin-dev<br>
&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_bla=
nk">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br>
&gt; Detailed explanation with code snippets:<br>
&gt;<br>
&gt; <a href=3D"https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-schem=
e-%5Bsnip%5D" rel=3D"noreferrer" target=3D"_blank">https://medium.com/@simu=
lx/an-m-of-n-bitcoin-multisig-scheme-[snip]</a><br>
<br>
This appears to be a repost of the broken scheme you posted about on<br>
Bitcointalk, but then failed to respond to the response.<br>
<br>
<a href=3D"https://bitcointalk.org/index.php?topic=3D4973123.0" rel=3D"nore=
ferrer" target=3D"_blank">https://bitcointalk.org/index.php?topic=3D4973123=
.0</a><br>
<br>
&gt; The more I look into it and speak to professors about i, the more it s=
eems &quot;so trivial nobody really talks about it&quot;.<br>
<br>
I think you might be falling into the trap of ignoring feedback you<br>
don&#39;t like and and accepting that which sounds like &quot;yea yea,<br>
something like that&quot;.<br>
<br>
Something &quot;like that&quot; does work: and is expressly and explicitly<=
br>
anticipated by the BIP but to be both secure and functional requires<br>
proper delineation (E.g. musig) _and_ interaction. What you&#39;re<br>
proposing is continually vague.=C2=A0 My best efforts at making sense of<br=
>
what you&#39;ve written indicate that either it&#39;s non-interactive and<b=
r>
not-actually functional at all,=C2=A0 OR it&#39;s interactive and just a le=
ss<br>
secure subset (no proper delinearization to prevent rogue key attacks)<br>
of what we already propose.<br>
<br>
When Poelstra suggests a CAS implementation he means something like<br>
this Sage notebook: <a href=3D"http://bitcoin.ninja/secp256k1.ecdsa.sage" r=
el=3D"noreferrer" target=3D"_blank">http://bitcoin.ninja/secp256k1.ecdsa.sa=
ge</a>=C2=A0 This<br>
provides for a method of communicating in both directions which is<br>
completely precise.<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--0000000000000656ce05759b0ce0--