📅 Original date posted:2018-07-19
📝 Original message:Probably because my descriptions are a bit vague and rambling.
but I can't help but think that a SMC of a bitcoin private key, followed by
a secure multiparty computation of a signature is going to be more secure
overall.
I couldn't figure out how to do it offline. But one round of exchange
seems to work.
It comes down to the blinding factor (k). All parties need to agree to it
... which creates the second round.
On Thu, Jul 19, 2018, 8:16 AM Erik Aronesty <erik at q32.com> wrote:
> Also Wagner's algorithm shouldn't be applicable for a number of reasons.
> you can't birthday attack something where there's only a single variable
> that you can modify. And when you change the equation from additive you
> now have a multi-dimensional equation we're partitioning won't function.
> this is the basis of the perfect security of Shamir secret sharing.
>
> On Wed, Jul 11, 2018, 10:45 AM Erik Aronesty <erik at q32.com> wrote:
>
>> OK, so you're going with this scenario:
>>
>> 1. I know Apub and Bpub,
>> 2. I know M is 3
>> 3. I'm choosing a random number for C's private key
>>
>> Cpub is g^C
>>
>> The equation I am solving for .. and trying to factor myself out of is
>> g^Ax + g^B*2 + g^C*3
>>
>> I don't know A or B... I only know their public keys.
>>
>> I don't think it's possible to adaptively choose C for an attack on the
>> multisig construction, when using hash of the public key as the X
>> coordinate in the polynomial, because in order to satisfy the equation and
>> factor out C, you would need to be able to break the hash.
>>
>> With an additive construction, yes... adaptive attacks are possible.
>> But in a shamir secret sharing interpolation, you need a public X
>> coordinate as well as a secret share. Choosing hash(pub) as X, prevents
>> this attack.
>>
>>
>> On Wed, Jul 11, 2018 at 6:35 AM, Adam Back <adam.back at gmail.com> wrote:
>>
>>> On Wed, Jul 11, 2018, 02:42 Erik Aronesty via bitcoin-dev <
>>> bitcoin-dev at lists.linuxfoundation.org> wrote:
>>> > Basically you're just replacing addition with interpolation everywhere
>>> in the musig construction
>>>
>>> Yes, but you can't do that without a delinearization mechanism to
>>> prevent adaptive public key choice being used to break the scheme using
>>> Wagner's attack. It is not specific to addition, it is a generalized
>>> birthday attack.
>>>
>>> Look at the delinearization mechanism for an intuition, all public keys
>>> are hashed along with per value hash, so that pre-commits and forces the
>>> public keys to be non-adaptively chosen.
>>>
>>> Adaptively chosen public keys are dangerous and simple to exploit for
>>> example pub keys A+B, add party C' he chooses C=C'-A-B, now we can sign for
>>> A+B+C using adaptively chose public key C.
>>>
>>> Btw Wagner also breaks this earlier delinearization scheme
>>> S=H(A)*A+H(B)*B+H(C)*C
>>>
>>> Adam
>>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180719/27427750/attachment.html>;
Erik Aronesty [ARCHIVE] /
npub1y2…5taj0
2023-06-07 18:13:44
in reply to nevent1q…xwph
Author Public Key
npub1y22yec0znyzw8qndy5qn5c2wgejkj0k9zsqra7kvrd6cd6896z4qm5taj0Published at
2023-06-07 18:13:44Event JSON
{
"id": "c4614dd1dd49a82f430dccd5b4e49517990c49c40cb8ecbb8365172135794bcc",
"pubkey": "22944ce1e29904e3826d25013a614e4665693ec514003efacc1b7586e8e5d0aa",
"created_at": 1686161624,
"kind": 1,
"tags": [
[
"e",
"5913947cd80c78b94322af07aff87080ecda6ad2abd7e1bd4a8b9634dfe27fca",
"",
"root"
],
[
"e",
"834e1c7b3870b6922e4acb65655121bb2485d80f731b322e5157b65a6a96cb52",
"",
"reply"
],
[
"p",
"22944ce1e29904e3826d25013a614e4665693ec514003efacc1b7586e8e5d0aa"
]
],
"content": "📅 Original date posted:2018-07-19\n📝 Original message:Probably because my descriptions are a bit vague and rambling.\n\nbut I can't help but think that a SMC of a bitcoin private key, followed by\na secure multiparty computation of a signature is going to be more secure\noverall.\n\nI couldn't figure out how to do it offline. But one round of exchange\nseems to work.\n\nIt comes down to the blinding factor (k). All parties need to agree to it\n... which creates the second round.\n\nOn Thu, Jul 19, 2018, 8:16 AM Erik Aronesty \u003cerik at q32.com\u003e wrote:\n\n\u003e Also Wagner's algorithm shouldn't be applicable for a number of reasons.\n\u003e you can't birthday attack something where there's only a single variable\n\u003e that you can modify. And when you change the equation from additive you\n\u003e now have a multi-dimensional equation we're partitioning won't function.\n\u003e this is the basis of the perfect security of Shamir secret sharing.\n\u003e\n\u003e On Wed, Jul 11, 2018, 10:45 AM Erik Aronesty \u003cerik at q32.com\u003e wrote:\n\u003e\n\u003e\u003e OK, so you're going with this scenario:\n\u003e\u003e\n\u003e\u003e 1. I know Apub and Bpub,\n\u003e\u003e 2. I know M is 3\n\u003e\u003e 3. I'm choosing a random number for C's private key\n\u003e\u003e\n\u003e\u003e Cpub is g^C\n\u003e\u003e\n\u003e\u003e The equation I am solving for .. and trying to factor myself out of is\n\u003e\u003e g^Ax + g^B*2 + g^C*3\n\u003e\u003e\n\u003e\u003e I don't know A or B... I only know their public keys.\n\u003e\u003e\n\u003e\u003e I don't think it's possible to adaptively choose C for an attack on the\n\u003e\u003e multisig construction, when using hash of the public key as the X\n\u003e\u003e coordinate in the polynomial, because in order to satisfy the equation and\n\u003e\u003e factor out C, you would need to be able to break the hash.\n\u003e\u003e\n\u003e\u003e With an additive construction, yes... adaptive attacks are possible.\n\u003e\u003e But in a shamir secret sharing interpolation, you need a public X\n\u003e\u003e coordinate as well as a secret share. Choosing hash(pub) as X, prevents\n\u003e\u003e this attack.\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e On Wed, Jul 11, 2018 at 6:35 AM, Adam Back \u003cadam.back at gmail.com\u003e wrote:\n\u003e\u003e\n\u003e\u003e\u003e On Wed, Jul 11, 2018, 02:42 Erik Aronesty via bitcoin-dev \u003c\n\u003e\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\u003e\u003e \u003e Basically you're just replacing addition with interpolation everywhere\n\u003e\u003e\u003e in the musig construction\n\u003e\u003e\u003e\n\u003e\u003e\u003e Yes, but you can't do that without a delinearization mechanism to\n\u003e\u003e\u003e prevent adaptive public key choice being used to break the scheme using\n\u003e\u003e\u003e Wagner's attack. It is not specific to addition, it is a generalized\n\u003e\u003e\u003e birthday attack.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Look at the delinearization mechanism for an intuition, all public keys\n\u003e\u003e\u003e are hashed along with per value hash, so that pre-commits and forces the\n\u003e\u003e\u003e public keys to be non-adaptively chosen.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Adaptively chosen public keys are dangerous and simple to exploit for\n\u003e\u003e\u003e example pub keys A+B, add party C' he chooses C=C'-A-B, now we can sign for\n\u003e\u003e\u003e A+B+C using adaptively chose public key C.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Btw Wagner also breaks this earlier delinearization scheme\n\u003e\u003e\u003e S=H(A)*A+H(B)*B+H(C)*C\n\u003e\u003e\u003e\n\u003e\u003e\u003e Adam\n\u003e\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180719/27427750/attachment.html\u003e",
"sig": "64aa13c6c2bb9a31f4b5220e689cb19a8173073bdba8257f560369655bc6db5a435555d6bdefb3ab4d95122b304229efc203483728f00edc3e09707f9fd0a76b"
}