1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
Return-Path: <earonesty@gmail.com>
Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])
by lists.linuxfoundation.org (Postfix) with ESMTP id 6EC33C013E
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 5 Mar 2020 19:01:40 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by silver.osuosl.org (Postfix) with ESMTP id 56FB72153B
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 5 Mar 2020 19:01:40 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
Received: from silver.osuosl.org ([127.0.0.1])
by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id tF9lb3oa2a-k
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 5 Mar 2020 19:01:39 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-oi1-f171.google.com (mail-oi1-f171.google.com
[209.85.167.171])
by silver.osuosl.org (Postfix) with ESMTPS id 1DB0420134
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 5 Mar 2020 19:01:39 +0000 (UTC)
Received: by mail-oi1-f171.google.com with SMTP id g6so7110277oiy.1
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 05 Mar 2020 11:01:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=q32-com.20150623.gappssmtp.com; s=20150623;
h=mime-version:from:date:message-id:subject:to;
bh=Lp7bdGbEjh+WtqjhdXVsXKNpG2wXjXu3EO4RXwSUVqY=;
b=Af/h0vEazat+o1O7RwNr3Dva7wvsEjVR621z6aPoH6adxT8Dgo7m1RodPsezwyhlte
663kB3s8g7rmb8Gt50wFleNePnQJpxXaUYJ4kKiFGQ6biAYW1IgxFgHQYvgECe/uT0KR
0uw6wihKHNS59GdPJLZtYsO9WmI23QZnJ5B857wiKZwb5ZEsM+Da1QnoPDAiCLkH/aqW
FSV9kD0R1J4URd2J/tXZuga/Nn3xZ+ejSlFrthz5g32T7wIyurTnqeiPuRPZLSSjTmM0
JzsAKQJyZQhKDZ7Pm0sOhTwfDs9nVfX5UBNF+avrmK4THjlAa66CQu/ZE+jVbTLXa9sT
CBgQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=Lp7bdGbEjh+WtqjhdXVsXKNpG2wXjXu3EO4RXwSUVqY=;
b=JGXKwYvwHOeEiFxieRnoovgdOpOsweD2zVB5X0+9hhOTngfSLNqPc5CCNXjqIsFV3C
htmBxhJ1MKFdJbHo1GgbkZthgrs7pu5RtJuvHl794YdxabXX+iOVWqqrkb9VhKXjXs71
jj3soZ7nrkJu23tkBC+zj9RzLC3OxOJ1qIYy8sU5dmmrdrQGGqBdSyOFbmXvqWZMciuS
Z/sjra0fncCT656C+TPdiRpztdFItwBCQBcGa8QmzXHsWp7bg3rXP/c8RrDUFm+ial18
6EfVfW6W54TAnpy8oIGBO4KO7OYxpE0AMeu1V3QEkaA1yjluHbXk4ZuiqRVbjev2Oq2F
XVLQ==
X-Gm-Message-State: ANhLgQ0Fai8dLKQjRFP2wYiy6+vtuz/TMbmpqmya5IY8xB6KzlpXaq66
wYSVHqGrSkIEYT1K05EHrRmO+jvOOuDfqGDGEwZVXta2udHM
X-Google-Smtp-Source: ADFU+vs/zBW23zinK562ojUA26aU2+31urtEFEY5+dqzeje96luPT+3TePJZmDqSFMuMLUivrmkb86yQudXNgGxTgUw=
X-Received: by 2002:aca:a997:: with SMTP id s145mr375092oie.140.1583434897929;
Thu, 05 Mar 2020 11:01:37 -0800 (PST)
MIME-Version: 1.0
From: Erik Aronesty <erik@q32.com>
Date: Thu, 5 Mar 2020 14:01:27 -0500
Message-ID: <CAJowKg+Sgfv-FxZ2gyYWO4HmVwVFZjpjN3RkGN4y1TJwpuLMtQ@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
X-Mailman-Approved-At: Thu, 05 Mar 2020 19:03:19 +0000
Subject: [bitcoin-dev] Schnorr sigs vs pairing sigs
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Mar 2020 19:01:40 -0000
Schnorr sigs rely so heavily on the masking provided by a random
nonce. There are so many easy ways to introduce bias (hash + modulo,
for example).
Even 2 bits of bias can result in serious attacks:
https://ecc2017.cs.ru.nl/slides/ecc2017-tibouchi.pdf
Maybe pairing based sigs - which are slower - might be both more
flexible, and better suited to secure implemetnations?
|
