MIME-Version: 1.0
References: <CAHk9a9ct_h485MY4gk7S++FAu5FEH3PL9pd9mrrh+wA8nWaVUA@mail.gmail.com>
	<80e4e9b8-0cf3-b99e-7ac3-87ebbd8bb97c@gmail.com>
In-Reply-To: <80e4e9b8-0cf3-b99e-7ac3-87ebbd8bb97c@gmail.com>
From: nakagat <nakagat@gmail.com>
Date: Wed, 12 Sep 2018 15:00:17 +0900
Message-ID: <CAHk9a9dEu9y1-trZLyTwd3vWrwrUt2SOB=zi4covG6XkOy7ZbA@mail.gmail.com>
To: jonasdnick@gmail.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: bitcoin-dev@lists.linuxfoundation.org
Subject: Re: [bitcoin-dev] Multisignature for bip-schnorr
Precedence: list

Hi Jonas

Thank you for your comment.

I wrote a new text.
https://gist.github.com/tnakagawa/e6cec9a89f698997dc58a09db541e1eb

If you have time, please review this.
2018=E5=B9=B49=E6=9C=887=E6=97=A5(=E9=87=91) 17:09 Jonas Nick <jonasdnick@g=
mail.com>:
>
> Your multisignature writeup appears to be vulnerable to key cancellation
> attacks because the aggregated public key is just the sum of public keys =
(and
> there is no proof of knowledge of the individual secret keys). Therefore,=
 in a
> multisignature between Alice and an attacker, the attacker can choose the=
ir key
> to be -alice_key+attacker_key resulting in an aggregated key for which th=
e
> attacker can sign alone (without requiring Alice's partial signature). Th=
e
> Schnorr BIP links to the MuSig paper which describes a secure key aggrega=
tion
> scheme. See https://eprint.iacr.org/2018/068
>
> On 8/7/18 6:35 AM, nakagat via bitcoin-dev wrote:
> > Hi all,
> >
> > I wrote a multisignature procedure using bip-schnorr.
> >
> > If you have time to review and give feedback, I=E2=80=99d really apprec=
iate it.
> > Thanks in advance!
> >
> > Multisignature
> > https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
> >
> > Original
> > https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Mul=
tisignatures_and_Threshold_Signatures
> >