š
Original date posted:2019-08-13
š Original message:On Mon, Aug 12, 2019 at 09:09:43PM -0500, Bryan Bishop wrote:
> > > Multisig gated by ECDSA pubkey recovery for provably-unknown keys
> > > =================================================================
> > >
> > > A group can participate in a multisig scheme with provably-unknown ECDSA
> > keys.
> > > Instead of deleting the key, the idea is to agree on a blockheight and
> > then
> > > select the blockhash (or some function of the chosen blockhash like
> > > H(H(H(blockhash)))) as the signature. Next, the group agrees on a
> > transaction
> > > and they recover the public key from the signature using ECDSA pubkey
> > recovery.
> >
> > Could you explain in more detail why you're deriving this from a blockhash?
> >
>
> Well you need to pick an entropy source, and I wouldn't want to tell people
> to just trust the first party to tell you a good sequence of bytes.
But why does this specifically need to be entropy?
If I understand the scheme correctly, the important thing is for the ECDSA
private key to be unknown. Under the standard assumption that hash functions
are random oracles, hashing anything should be sufficient to create a pubkey
whose private key is unknown.
Secondly, there's probably better slightly privacy if a random nonce is chosen
(perhaps by concatenating a nonce from each party) rather than picking pubkeys
unique to this use-case.
--
https://petertodd.org 'peter'[:-1]@petertodd.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190813/686185e5/attachment.sig>;
Peter Todd [ARCHIVE] /
npub1m2ā¦a2np2
2023-06-07 18:20:08
in reply to nevent1qā¦jh7l
Author Public Key
npub1m230cem2yh3mtdzkg32qhj73uytgkyg5ylxsu083n3tpjnajxx4qqa2np2Seen on
wss://relay.noswhere.comPublished at
2023-06-07 18:20:08Event JSON
{
"id": "028a2cff09fb512e14a817776968d11a50d7d4466f0ae7441e4996b83e155469",
"pubkey": "daa2fc676a25e3b5b45644540bcbd1e1168b111427cd0e3cf19c56194fb231aa",
"created_at": 1686162008,
"kind": 1,
"tags": [
[
"e",
"b5bf86cbe856764608f643541819ee58498f1f856faf0b3188f430c12259a46d",
"",
"root"
],
[
"e",
"501fa3e900a39a81a17248036f36762ab5bc6af9196b511b1539927414cd64fb",
"",
"reply"
],
[
"p",
"62ddcb547224b421822b62845fb1bbd77c838b924bd022814cfcbe25b7a07475"
]
],
"content": "š
Original date posted:2019-08-13\nš Original message:On Mon, Aug 12, 2019 at 09:09:43PM -0500, Bryan Bishop wrote:\n\u003e \u003e \u003e Multisig gated by ECDSA pubkey recovery for provably-unknown keys\n\u003e \u003e \u003e =================================================================\n\u003e \u003e \u003e\n\u003e \u003e \u003e A group can participate in a multisig scheme with provably-unknown ECDSA\n\u003e \u003e keys.\n\u003e \u003e \u003e Instead of deleting the key, the idea is to agree on a blockheight and\n\u003e \u003e then\n\u003e \u003e \u003e select the blockhash (or some function of the chosen blockhash like\n\u003e \u003e \u003e H(H(H(blockhash)))) as the signature. Next, the group agrees on a\n\u003e \u003e transaction\n\u003e \u003e \u003e and they recover the public key from the signature using ECDSA pubkey\n\u003e \u003e recovery.\n\u003e \u003e\n\u003e \u003e Could you explain in more detail why you're deriving this from a blockhash?\n\u003e \u003e\n\u003e \n\u003e Well you need to pick an entropy source, and I wouldn't want to tell people\n\u003e to just trust the first party to tell you a good sequence of bytes.\n\nBut why does this specifically need to be entropy?\n\nIf I understand the scheme correctly, the important thing is for the ECDSA\nprivate key to be unknown. Under the standard assumption that hash functions\nare random oracles, hashing anything should be sufficient to create a pubkey\nwhose private key is unknown.\n\nSecondly, there's probably better slightly privacy if a random nonce is chosen\n(perhaps by concatenating a nonce from each party) rather than picking pubkeys\nunique to this use-case.\n\n-- \nhttps://petertodd.org 'peter'[:-1]@petertodd.org\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 488 bytes\nDesc: not available\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190813/686185e5/attachment.sig\u003e",
"sig": "d899e743fcffd3654388200a6572809445292792cc1b5c5afda0fa5bd73f0bd6b73e6d783666052825c83ee3f2edceeddd8ff5a79614b37289546bf43cf3437d"
}