public inbox for bitcoindev@googlegroups.com
 help / color / mirror / Atom feed
* Re: [Bitcoin-development] BIP0032
@ 2013-05-28  5:16 Tamas Blummer
  0 siblings, 0 replies; 6+ messages in thread
From: Tamas Blummer @ 2013-05-28  5:16 UTC (permalink / raw)
  To: pieter.wuille; +Cc: bitcoin-development

[-- Attachment #1: Type: text/plain, Size: 321 bytes --]

A JSON-ed version of the test vectors is here: https://github.com/bitsofproof/supernode/blob/master/api/src/test/resources/BIP32.json

The Bits of Proof code matching with them is at:
https://github.com/bitsofproof/supernode/blob/master/api/src/main/java/com/bitsofproof/supernode/api/ExtendedKey.java

Tamas Blummer

[-- Attachment #2: Message signed with OpenPGP using GPGMail --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [Bitcoin-development] BIP0032
@ 2013-05-27  9:41 Michael Gronager
  2013-05-27 13:10 ` Michael Gronager
  0 siblings, 1 reply; 6+ messages in thread
From: Michael Gronager @ 2013-05-27  9:41 UTC (permalink / raw)
  To: bitcoin-development

Pieter,

I was re-reading BIP0032, and checking some of the equations... It seems
to me that there is something wrong (or I have missed something).

As I see it there can only be one HMAC function, used for both private
and public derivation - I assume that:
[1]  CKD((k_par, c_par), i) -> (k_i, c_i)
[2]  CKD'((K_par, c_par), i) -> (K_i, c_i)

Where K_par = k_par*G, will result in K_i = k_i*G (and identical c_i's
in both expressions).

Now following your formulas for [1]:
  k_i = I_L + k_par (mod n)
where I_L = {HMACSHA512(c_par, 0x00||k_par||i)}_L (denoting left
256bits). Further c_i = I_R.
This gives a K_i = k_i*G = I_L*G + k_par(mod n)*G

Now follow the formula for [2]:
  K_i = (I_L+k_par)*G = I_L*G + K_par
This is not the same as above, however, if we remove the (mod n) we are
getting closer, but still the value of I_L are different in the two
equations as: HMACSHA512(c_par, 0x00||k_par||i) <> HMAXSHA512(c_par,
X(k_par*G)||i).

We can, however, fix things if we change private child key derivation to:

To define CDK((k_par, c_par), i) -> (k_i, c_i):
* (no difference in deriving public or private):
	I = HMACSHA512(c_par, X(k_par*G)||i)
* Split I into I_L, I_R (256bits each)
* k_i = k_par + I_L
* c_i = I_R
* and, if using public derivation, we use K_i = (k_par + I_L)*G

Now for pure public derivation (i.e. we don't know the private key):
To define CDK'((K_par, c_par), i) -> (K_i, c_i):
* I = HMACSHA512(c_par, X(K_par)||i)
* Split I into I_L and I_R
* K_i = K_par + I_L*G (= k_par*G + I_L*G = (k_par+I_L)*G = k_i*G)
* c_i = I_R

Now we have the right properties, but it required quite some changes,
also note that c_i are now equal in both private and public derivation.

Comments ?


Sincerely,

Michael



^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-05-28  5:16 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-05-28  5:16 [Bitcoin-development] BIP0032 Tamas Blummer
  -- strict thread matches above, loose matches on Subject: below --
2013-05-27  9:41 Michael Gronager
2013-05-27 13:10 ` Michael Gronager
2013-05-27 13:39   ` Michael Gronager
2013-05-27 17:21     ` Amir Taaki
2013-05-27 20:45   ` Pieter Wuille

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox