conduition

https://conduition.io

Pseudonymous freelance cipherpunk :: https://conduition.io

Public Key

npub1l6uy9chxyn943cmylrmukd3uqdq8h623nt2gxfh4rruhdv64zpvsx6zvtg

NIP-05 Address

conduition@conduition.io

NIP-57 Address

conduition@conduition.io

Profile Code

nprofile1qqs0awzzutnzfj6cudj03a7txc7qxsrma9ge44yrym6337tkkd23qkgpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhskvzx4w

Publishing to

relay.damus.io

Author Public Key

npub1l6uy9chxyn943cmylrmukd3uqdq8h623nt2gxfh4rruhdv64zpvsx6zvtg

Show more details

Last Notes

2024-11-02 21:59:25

"Sell me this preimage."
You can verifiably purchase the solution to any NP-Complete problem using Bitcoin (and Lightning), combined with zero-knowledge proofs.
- Buy the solution to a sudoku puzzle
- Buy the prime factors of an RSA key
- Bridge HTLCs with PTLCs
- Buy a valid proof-of-work
- and more...
https://conduition.io/bitcoin/zkpreimage/

2024-10-22 20:02:20

I went on a deep dive into post-quantum hash-based signatures and tried to apply them to bitcoin. At the end of the article I propose a way to insure today's Bitcoin wallets with a quantum-resistant fallback key, without any consensus changes needed.
https://conduition.io/cryptography/quantum-hbs/

2024-10-03 17:56:34

I just realized my lnaddrd server was configured not to accept zaps less than 500 sats... sorry to anyone who was trying to zap me on nostr for the past few months, i'm not that greedy, i swear!
#note1c4p…wl64

2024-07-14 17:36:12

I just found out... there's a NIP for publishing discreet log contract messages on Nostr?? This is a crucial step for DLCs on Bitcoin. The present bottleneck for DLCs seems to be: How do I become an oracle? How do I find trustworthy oracles? NIP-88 would let us build apps which answer those questions.
https://github.com/nostr-protocol/nips/pull/919
Combine this with ECash DLCs and we could have scalable, instant, completely private micro-contracts, which are discovered over Nostr and settled in ECash.
https://github.com/cashubtc/nuts/pull/128
But even if you don't like ECash, this NIP is still incredibly important. Kudos @npub1u8l…turz

2024-07-13 17:01:11

- reply

Articles like this are what happens when the "bored cipherpunk" and "frustrated customer" venn-diagrams overlap 🐒
Journalists have recently been contacting me about this article because of the big Ticketmaster hack recently. It's silly that they need some amateur like me to fact-check the erroneous PR statements issued by a multi-billion company.

2024-07-12 03:24:43

Had an idea for scaling submarine swaps into a multi-party protocol, and got some interesting results. Have a look:
https://conduition.io/scriptless/multi-party-submarine-swaps/

2024-06-20 17:28:26

I made a PR into electrs to improve transaction broadcasting privacy.
https://github.com/romanz/electrs/pull/1056

2024-06-02 22:46:37

I couldn't find any reliable spec-compliant DLC oracles for real-world events, so I made my own. Meet Cassandra 🕵️‍♀️
https://conduition.io/code/cassandra/

2024-05-30 18:06:50

- reply

Excited to see how it turns out! Ecash is a great opportunity to create a layer of fungibility on top of lightning. I for one will be ready to come aboard 🧑‍🚀

2024-05-27 16:20:05

I wrote a draft NUT for Discreet Log Contracts settled on Cashu
https://github.com/cashubtc/nuts/pull/128

2024-05-19 20:33:49

You can settle Discreet Log Contracts with Chaumian ECash!
https://conduition.io/cryptography/ecash-dlc/
@npub12rv…85vg and other ecash devs: Do you think this would make a candidate NUT extension on the cashu spec?
Feedback appreciated 😎
https://github.com/conduition/conduition.io/pull/6

2024-05-17 15:28:08

- reply

I've been working on FROST+taproot lately and the xonly nonsense easily accounts for 90% of the complexity.
https://github.com/ZcashFoundation/frost/pull/584
I'd be curious if anyone has actually done the math to compute how much xonly has saved us in block space.
...only for the inscription meme lords to slide in and use 100x that space for jpegs.

2024-05-10 14:33:50

- reply

If you can, i would suggest running your own lightning node. Then you can use a remote access wallet like Zeus to interact with it.

2024-05-08 15:58:00

Privacy and self-custody services with a central point-of-failure are not stable long-term.
https://www.nobsbitcoin.com/agoradesk-localmonero-shutting-down/
https://www.nobsbitcoin.com/zksnacks-to-suspend-its-coinjoin-coordination-service-on-june-1st/
https://www.nobsbitcoin.com/samourai-dojo-v1-25-0/
https://www.nobsbitcoin.com/phoenix-wallet-to-be-removed-from-us-app-stores-on-may-3/
https://www.nobsbitcoin.com/sparrow-wallet-v1-9-0/
https://www.nobsbitcoin.com/samourai-wallet-founders-arrested-and-charged-with-money-laundering/
The cull we're seeing in the past couple weeks is just the beginning, but it's a good sign: They're pushing back because we're gaining ground.
If you want to run a privacy business, i see 3 choices:
- Decentralize your business (no single PoF)
- Mask yourself (build pseudonymously)
- Comply (by KYCing)

2024-04-25 17:20:15

- reply

Did they seriously upload entire xpubs? Not just addresses?
Can i see a source on that?

2024-04-25 17:15:27

- reply

This scheme doesn't scale.
If every TX used paypal's approach, the 'green miners' would end up with thousands of dust UTXOs which they would need to clean up, every single block. Network throughput would drop significantly.
With standard bitcoin fee subsidy, all miner fees are automatically consolidated in the coinbase transaction: No dust to clean up.
Not to mention the fact that this approach doesn't necessarily require the miners to use green energy to mine the TX - it just incentivizes a particular arbitrary set of miners to mine the TX. Those miners could pay off a different non-green miner to mine the TX, because it is still consensus-valid.
Paypal's idea is just a roundabout way of reinventing the same open fee market which already exists, but with a lame attempt at green-washing.

2024-04-25 01:05:55

@npub1hea…g9v2 How do you feel working on Sparrow Wallet, now that we're seeing the US government prosecute the Samourai devs?

2024-04-25 00:22:11

- reply

No problem 😁 great choice

2024-04-25 00:21:16

- reply

I mean pseudonymously.

2024-04-24 22:59:04

Develop pseudonymously, or else.
#nevent1q…75hh

2024-04-23 14:39:49

- reply

Responded on github about this. For your particular case, using --no-rest-tls is unsafe. However generally speaking, i should probably add a flag to allow plaintext connections as there are some cases where it is safe

2024-04-21 03:35:37

I made a self-hosted Lightning Address webserver, because for some reason I couldn't find any good ones out there already.
https://github.com/conduition/lnaddrd
This is what powers my snazzy new `conduition@conduition.io` LN address 😇

2024-04-20 19:40:05

There's no such thing as unlimited money. Take a sip of patience. This too will pass. 😌
#nevent1q…ddnc

2024-04-10 19:07:41

I made a Rust library for 2-way async TCP sockets with a Noise-powered authenticated encryption layer. Uses the NNpsk0 handshake protocol.
https://github.com/conduition/tokio-noise

2024-04-09 14:53:34

The Noise protocol is to Web3 what TLS is to Web2.
Noise is used by Wireguard, the Lightning Network, I2P, even WhatsApp to enable secure communication with all kinds of different handshake styles. If you've never played with Noise before, I would encourage you to read the spec.
https://noiseprotocol.org/

2024-03-23 16:47:37

I suppose bitcoin devs love #Rust for the same reasons they love Bitcoin.
The scarcity and careful auditing of variables passed around in memory mirrors the scarcity and careful auditing of UTXOs passed around Bitcoin's ledger. Allocating new memory is as much an event as mining new bitcoins: Regular, but noted and tracked.
In Rust, a value may be borrowed many times, but its value may be consumed only once. Bitcoins can likewise be IOU'd countless times, but ultimately only belong to one script-pubkey.
By comparison, languages like Go and Javascript feel very... inflationary. They have an opaque, centralized, bloated, and omnipotent garbage collector attached to every runtime which allocates and deallocates memory as it pleases. Memory can be needlessly duplicated thousands of times entirely by accident, or over-collateralized by shared mutable references.
Some languages are the opposite, like C: Total anarchy. "Sure, allocate as much memory as you'd like. Deallocate it whenever. Read whatever you want, write wherever. Just try not to segfault."
Only Rust, like Bitcoin, strikes the perfect balance of organized chaos: a rehearsed ballet, in which all the dancers know their movements by heart.

2024-03-22 18:54:46

As part of the #BackdropBuild Hackathon, I elected to commit myself to making a prototype of the 'Ticketed DLC' protocol I proposed a few months back.
37 days later, here I am with a working prototype. Setting a deadline for yourself can really make a difference - Who knew?
https://github.com/conduition/dlctix
There is certainly plenty of optimization and upstream-interop work left to do, and having PTLCs on Lightning would make this SO much more efficient on-chain. But as a proof of concept anyone can play with today, I'm incredibly happy with the result. Running against regtest, all tests are passing, and simulated players can buy into simulated DLCs simply by buying SHA256 preimages (e.g. via Lightning).

2024-03-20 22:39:07

- reply

It's hard. I can't talk about my work in real life, and i can't talk about my life with the people i work with. I could get so much more done if i didn't try so hard to obfuscate everything i do.
I don't think satoshi would've had to go to the lengths that we today have to go to, in order to retain privacy.
I just finished a hackathon, and they wanted me to upload a youtube video showing my work: Oops, cant do that, sorry, it's totally impractical over TOR.
Even still, it's worth it. In return for my effort i get the most perfect feeling of complete freedom to work on whatever i want to with no fear of persecution. I could publicly manage a bitcoin mixing service or a darknet market or a free speech discourse platform etc, and the worst that would happen is my web2 accounts might be taken down. If i ever feel like walking away from it all, it's as easy as deleting a few files.

2024-03-20 06:09:39

- reply

Sounds like IPFS to me. Why not just upload blobs to IPFS instead and skip the extra dev work?

2024-03-14 18:23:59

- reply

With scrypt and similar password-based key derivation functions, the salt is like a namespace which ensures an attacker has to start from scratch if they're trying to guess a key derived from a unique salt.
If a salt is reused for two different ciphertexts, then any guesses an attacker makes can be applied to both ciphertexts.
So it's not as bad as nonce or IV reuse, but still best practice is to create a unique random salt for every ciphertext.

2024-03-02 22:45:56

Hey @npub1j8d…26k2, zebra-lucky and I are trying to merge Bitcoin Taproot support into the ZCash Foundation's Rust implementation of FROST. Open to feedback or suggestions 😎
https://github.com/ZcashFoundation/frost/pull/584

2024-03-02 06:14:13

- reply

I'm halfway through the curve trees paper. I had a watershed realization moment when they described two-cycle curve (e.g secp256k1 and secq256kq). I had no idea such things existed! Wack.

2024-02-27 18:28:31

- reply

I would really hope so. I searched the name up on LinkedIn but didn't come up with anything concrete. It's probably a throwaway

2024-02-27 14:45:29

I can't put into words how good it feels to make ticketmaster engineers salty enough that they feel obliged to send me hate mail.
https://m.primal.net/HfcK.png

2024-02-26 16:08:00

- reply

I wonder if there exists some solution based on biometric key derivation which would turn the "hodl your own keys" requirement into a "be your own keys" situation.

2024-02-22 02:53:39

- reply

Woops, wrong link
https://github.com/conduition/musig2/pull/2

2024-02-22 02:52:44

- reply

I just added RFC6979 logic to my BIP340 implementation:
https://github.com/conduition/musig2/pulls/2
Seems reliable enough to me!

2024-02-21 03:14:38

- reply

You totally can use RFC6979.
BIP340 even says how to do it: https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#alternative-signing

2024-02-19 20:21:47

- reply

Mostly it's an excuse to finally put some time and effort into turning this concept into reality. It also means a shot at some grant money, which doesn't hurt either 😁
And thank you!

2024-02-19 19:35:19

They picked me! My Ticketed DLC concept has been selected for the backdropbuild.com v3 cohort 😇
https://raw.githubusercontent.com/conduition/dlctix/main/img/backdrop-build-v3.png
Check out my repository here to watch the commits coming in over the next few weeks/months 👀
https://github.com/conduition/dlctix
My end goal is to execute a real ticketed DLC on mainnet with volunteers from Nostr and StackerNews.

2024-02-19 04:22:47

Prediction: headlines in 2040 will look like:
- "EU bans sale of 'non-approved' phones and laptops"
- "Australia cracking down on illegal computation"
- "New 'client-side safeties' mandated for all devices produced for sale in USA"
Governments can't tolerate our ability to circumvent them with code. The EU is already trying to force backdoors into E2EE messengers. Someday they will escalate to banning general-purpose computing hardware because it can do things they don't like: deepfakes, bitcoin, encryption, TOR.
Draconian laws will never stop coming, but we dont have to stop them - We need only slow them down enough that we can out-engineer their weak-ass laws.
Wanna help slow them down? Donate to the Satoshi Action Fund or the EFF today using Bitcoin.
https://www.satoshiaction.io/
https://supporters.eff.org/donate

2024-02-18 15:36:11

- reply

As much as i might agree that inscriptions are spam and should be blocked, the reality is that there's no way to actually enforce this. Even if we used mempool filtering, inscribers would simply send their txs direct to the miners (who are happy to take the fees) or they can use obfuscation techniques like Inviscriptions ( https://conduition.io/bitcoin/inviscriptions/ ) to bypass the filtering in an endless cat & mouse game.

2024-02-16 15:50:53

- reply

...Aaaaand their docs site is down 🥲

2024-02-16 00:00:15

- reply

Thank you! Their zkVM seems like exactly what i'm after

2024-02-15 16:13:43

- reply

No comment 😅

2024-02-15 16:06:56

Anyone with STARK experience know how to build and validate a simple proof of secp256k1 discrete logs and SHA256 hashes?
I know ZeroSync must be doing this as part of their blockchain sync proofs. But i'm looking for a self-contained way to build and validate the proofs in rust.

2024-02-14 04:23:33

- reply

@npub1j8d…26k2
#note1pr9…mkpy

2024-02-14 04:21:43

This question was too tempting.
#note15ns…qpgn
So I wrote this:
https://conduition.io/cryptography/frost-byok/

2024-02-13 06:37:49

- reply

Yep! I have some links to some more beginner-friendly ECC stuff here:
https://conduition.io/cryptography/ecc-resources/

2024-02-13 06:26:35

- reply

My pleasure 😄 i wonder if the DKG could be run securely (incl commitment round) if the participants sampled random evaluations instead of random coefficients when building their keygen polynomial f_i(x)...
Damn, times like now, i really wish nostr had LaTeX support 🥲 stay tuned and maybe i'll write something up for this

2024-02-12 19:50:01

- reply

You sit down, put pencil to paper and work it out!
There is likely a way to do the DKG so that some cosigners have fixed keys and others have fresh random keys. It'd probably just take some clever math and a security proof that malicious cosigners couldnt bias the DKG to do evil stuff like backdoor the group key.

2024-02-12 16:06:03

- reply

Actually bringing your own key is possible, but there are limitations.
A FROST signing share is a polynomial evaluation. If, say, 3 people join together each bringing their own fixed signing shares, there exists some quadratic polynomial that interpolates their shares. However, it's impossible to find a linear (degree-one) polynomial which does the same.
In practice, this means if `n` people BYOK, they can definitely create an `n` of `n` threshold key with FROST. They can then issue new shares to add more people to the FROST group if they wanted, to make it an `n` of `m` threshold.
I'm not sure about the security implications of what a DKG would look like if only SOME keys are fixed and others can be variable. That's a different ball game 😅

2024-02-08 18:45:01

Pixels prove nothing anymore. KYC is useless. Wait till someone designs a 3d printer that can print convincing passports or ID cards.
Want me to share an image of a piece of paper so i can use your exchange? Sure, here's an image.
Want me to show you a shiny piece of plastic so i can board this plane? Sure, here is one.
The only way to rigorously prove something is to do so mathematically. In the age of AI, anything else can be faked. Identity is about what you know, not what pieces of paper you have (Debate me).
#nevent1q…6ngp

2024-02-08 18:12:51

- reply

Reverse engineering is a blast, I've been on a bit of a binge with it lately 😇
https://github.com/conduition/wos

2024-02-04 22:17:45

⚠️ Technical article ahead!
I reverse engineered TicketMaster's rotating barcodes for fun and profit. They're actually very easy to pirate.
https://conduition.io/coding/ticketmaster/

2024-01-28 00:46:12

I'm now mostly convinced that the ordinals/inscriptions crowd just don't care about efficiency. I made some simple constructive suggestions which could save millions of dollars a year in wasted mining fees. All are being ignored.
https://github.com/ordinals/ord/discussions/2879
https://github.com/ordinals/ord/issues/2944
https://l1f.discourse.group/t/brc-20-optimization/33/11

2024-01-28 00:40:02

@npub1mut…23vg I see you guys are working on some fun DLC-based features!
Do you have any interest in giving your users the option to buy into DLC wagers off-chain using Lightning? If so, my 'Ticketed DLCs' concept might be of interest.
https://conduition.io/scriptless/ticketed-dlc/
https://delvingbitcoin.org/t/off-chain-dlc-ticketing-systems/214/3

2023-12-18 23:35:27

Clever 'coiners cooperate instead of clashing.
Forget fruitless debates about whether inscriptions _ought_ to be used or not. I want to start concrete technical action to reduce the burden of inscriptions on the bitcoin mempool and fee market by going directly to the source.
We should be spending our effort streamlining the actual apps and protocols which are pushing all this data into the mempool in the first place. Who wants to help?
https://github.com/ordinals/ord/discussions/2879

2023-12-18 02:11:48

I wanna hear your ideas on how to make ordinal #inscriptions more efficient, and less onerous on bitcoin's fee market.
https://github.com/ordinals/ord/discussions/2879

2023-12-13 08:14:38

I can see #inscriptions are causing a lot of debate in the Bitcoin community, particularly regarding whether they should be "filtered" or "censored" at the mempool level by labeling them non-standard.
I'm here to tell you that this moral/ethical tennis match is irrelevant. Inscriptions can be pushed to the blockchain invisibly, by disguising the data inside normal-looking transactions. The true plaintext data is revealed only after the inscription is mined. I call these, "Inviscriptions", and they cannot be censored without resorting to flimsy heuristics.
https://conduition.io/bitcoin/inviscriptions/
Have comments? Suggestions? Hit me with a review!
https://github.com/conduition/conduition.io/pull/5

2023-12-10 04:14:58

- reply

The whole point of a standards spec document is that it is STANDARD. Saying "everyone should define their own standards" (especially for a network communication protocol) is like telling vehicle drivers to choose their own traffic bylaws.
Relevant XKCD. https://imgs.xkcd.com/comics/standards.png

2023-12-09 17:15:51

We can execute oracle-based smart contracts off-chain without trusting any middle men.
https://delvingbitcoin.org/t/off-chain-dlc-ticketing-systems/214/3
Come tell me if I'm crazy!

2023-09-04 03:55:55

Just finished some research on issuing Shamir Secret Shares using multi-party computation. Turns out, shareholders don't need to perform a full recovery if a share is lost or a new shareholder joins the party.
Find my article here: https://conduition.io/cryptography/shamir/

2023-08-15 16:27:34

Just finished my new article, describing how Wagner's Attack was used to break the first draft of MuSig in 2018.
https://conduition.io/cryptography/wagner/