1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
Return-Path: <bitcoin-dev@wuille.net>
Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])
by lists.linuxfoundation.org (Postfix) with ESMTP id A31CAC0033
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 28 Jul 2022 15:36:45 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by smtp3.osuosl.org (Postfix) with ESMTP id 6CC2E605A3
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 28 Jul 2022 15:36:44 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 6CC2E605A3
Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key,
unprotected) header.d=wuille.net header.i=@wuille.net header.a=rsa-sha256
header.s=protonmail2 header.b=w04woVxi
X-Virus-Scanned: amavisd-new at osuosl.org
X-Spam-Flag: NO
X-Spam-Score: -1.102
X-Spam-Level:
X-Spam-Status: No, score=-1.102 tagged_above=-999 required=5
tests=[BAYES_00=-1.9, BITCOIN_OBFU_SUBJ=1, DKIM_SIGNED=0.1,
DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from smtp3.osuosl.org ([127.0.0.1])
by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id yqK0vsGBLSup
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 28 Jul 2022 15:36:43 +0000 (UTC)
X-Greylist: delayed 00:09:23 by SQLgrey-1.8.0
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 2864460F66
Received: from mail-4321.protonmail.ch (mail-4321.protonmail.ch [185.70.43.21])
by smtp3.osuosl.org (Postfix) with ESMTPS id 2864460F66
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 28 Jul 2022 15:36:41 +0000 (UTC)
Date: Thu, 28 Jul 2022 15:27:05 +0000
Authentication-Results: mail-4321.protonmail.ch;
dkim=pass (2048-bit key) header.d=wuille.net header.i=@wuille.net
header.b="w04woVxi"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wuille.net;
s=protonmail2; t=1659022036; x=1659281236;
bh=gOArorsqvqHHecmG/3J1R2HdoIZB1QFWkprEUJY2D1Q=;
h=Date:To:From:Reply-To:Subject:Message-ID:In-Reply-To:References:
Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID:
Message-ID;
b=w04woVxicbMxMkEopkWmlZQt9qJ+9KMjHmWr3Qb5R0gmtUgXMsLuDfoj0gS1WAjFi
LH64HHNsvBZp7p6wGZK8mp89W0ANL7XC5oXUGDZx0NYA5b1IthMHf0jjfd5EJhIms6
J9CuGDT8ptJ0mK2Ad1RwvIOdOWdjm4X21MYTkwVuglpxBo+VhKGoG5OYoXT4LYljPQ
v878aGHGifXMQ6jCi3ss2vePHh7cX8o6dsJfZWv1HebzDgNOYFKKYuWIRPBnGePRTM
nwjoygtc1OsInnWqVUzL65TOHvWfgLYvEo1ECEvN/qJiIdjrbL+U20dMShFSI8aGYd
KgaoXycoJvJIg==
To: Ali Sherief <ali@notatether.com>,
Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: Pieter Wuille <bitcoin-dev@wuille.net>
Reply-To: Pieter Wuille <bitcoin-dev@wuille.net>
Message-ID: <BQZI2zpZwzJcXi_Gxr0f1wg9ZD6U5nb0HTOfIu4i50nM6FqFNqFjfm4DbOIxg94IwZQ4pHAthUNeGUkwHENJwAhap-bIkuKRN8ErZyFeR-o=@wuille.net>
In-Reply-To: <bG2Fk0bM_4lbwijBwZRiGgCAmktVOFSY5vR5k1D7QSc8imn9NWXxfOLPgMl5p22vfAPDHeuEA_p6TDhU7qGFoVmZok57RzA9rEV1LJzHpsM=@notatether.com>
References: <bG2Fk0bM_4lbwijBwZRiGgCAmktVOFSY5vR5k1D7QSc8imn9NWXxfOLPgMl5p22vfAPDHeuEA_p6TDhU7qGFoVmZok57RzA9rEV1LJzHpsM=@notatether.com>
Feedback-ID: 19463299:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Mailman-Approved-At: Thu, 28 Jul 2022 15:39:22 +0000
Subject: Re: [bitcoin-dev] Zero-knowledge proofs e.g. Schnorr are
incompatible with address signing without compromise
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Jul 2022 15:36:45 -0000
------- Original Message -------
On Thursday, July 28th, 2022 at 3:27 AM, Ali Sherief via bitcoin-dev <bitco=
in-dev@lists.linuxfoundation.org> wrote:
> Essentially, zero-knowledge proofs such as Schnorr are not compatible wit=
h address message signing - the public key cannot be retrieved from the add=
ress or the signature, so the address does not actually prove the authentic=
ity of a Schnorr signature. That's why the public key is required as an inp=
ut in the first place.
Yes, that's an intentional design choice in BIP340, see note 5: https://git=
hub.com/bitcoin/bips/blob/master/bip-0340.mediawiki#cite_ref-5-0. The choic=
e is either batch verifiability or public key recovery.
I regret ever using public key recovery when introducing the old legacy mes=
sage signing scheme. It should just have used script signatures like BIP322=
proposes.
> In order to make it compatible with the address signing mechanism, the ze=
ro-knowledge part would have to be sacrificed in my BIP, or else a complete=
ly separate message signing format just for Taproot would be required
You can avoid relying on public key recovery, and include the public key + =
BIP340 signature in the encoded signature.
> (which, in my view, is redundant - there is already the draft BIP322 whic=
h can verify anything and everything, but nobody is implementing that
I think it would be much better if people would cooperate to get BIP322 to =
move forward than to keep inventing other formats. It's the obvious solutio=
n in my opinion: not restricted to single-key policies, compatible with eve=
ry script type, and trivially extensible to future schemes.
> , just like BIP340).
How so? Every taproot compatible wallet has a BIP340 implementation.
Cheers,
--
Pieter
|
