Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.217.180 as permitted sender)
	client-ip=209.85.217.180; envelope-from=gmaxwell@gmail.com;
	helo=mail-lb0-f180.google.com; 
MIME-Version: 1.0
In-Reply-To: <1888881.3JyvKYNUFa@crushinator>
References: <CAC7yFxSE8-TWPN-kuFiqdPKMDuprbiVJi7-z-ym+AUyA_f-xJw@mail.gmail.com>
	<12583269.b0SUbSGuCb@crushinator>
	<CAAS2fgTD7D2SiEOcNkq+MfOPnPJ-D7dOFwO0umwTF0WGQd5d3w@mail.gmail.com>
	<1888881.3JyvKYNUFa@crushinator>
Date: Fri, 4 Apr 2014 10:08:05 -0700
Message-ID: <CAAS2fgTEMtH99yvwv_79UvUQjFOuZymHOaa1+ZzYmKvaUDPmTA@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Matt Whitlock <bip@mattwhitlock.name>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: bitcoin-development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Presenting a BIP for Shamir's Secret
 Sharing of Bitcoin private keys
Precedence: list

On Fri, Apr 4, 2014 at 9:36 AM, Matt Whitlock <bip@mattwhitlock.name> wrote=
:
> Are you proposing to switch from prime fields to a binary field? Because =
if you're going to "break up" a secret into little pieces, you can't assume=
 that every piece of the secret will be strictly less than some 8-bit prime=
 modulus. And if you're going to do a base conversion, then you have to do =
arbitrary-precision integer math anyway, so I don't see that the small fiel=
d really saves you any code.

Yes, I'm proposing using the binary extension field of GF(2^8).  There
are many secret sharing and data integrity applications available
already operating over GF(2^8) so you can go compare implementation
approaches without having to try them our yourself. Obviously anything
efficiently encoded as bytes will efficiently encode over GF(2^8).

> Weren't you just clamoring for implementation *simplicity* in your previo=
us paragraph? :)

I do think there is a material difference in complexity that comes in
layers rather than at a single point. It's much easier to implement a
complex thing that has many individually testable parts then a single
complex part. (Implementing arithmetic mod some huge P is quite a bit
of work unless you're using some very high level language with
integrated bignums=E2=80=94 and are comfortable hoping that their bignums a=
re
sufficiently consistent with the spec).