* [bitcoin-dev] Multisignature for bip-schnorr
@ 2018-08-07 6:35 nakagat
2018-08-29 11:28 ` Erik Aronesty
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: nakagat @ 2018-08-07 6:35 UTC (permalink / raw)
To: bitcoin-dev
Hi all,
I wrote a multisignature procedure using bip-schnorr.
If you have time to review and give feedback, I’d really appreciate it.
Thanks in advance!
Multisignature
https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
Original
https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
--
nakagawa
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bitcoin-dev] Multisignature for bip-schnorr
2018-08-07 6:35 [bitcoin-dev] Multisignature for bip-schnorr nakagat
@ 2018-08-29 11:28 ` Erik Aronesty
2018-08-31 5:22 ` nakagat
2018-09-07 8:11 ` Jonas Nick
2 siblings, 0 replies; 5+ messages in thread
From: Erik Aronesty @ 2018-08-29 11:28 UTC (permalink / raw)
To: nakagat, Bitcoin Protocol Discussion
[-- Attachment #1: Type: text/plain, Size: 953 bytes --]
It's cool but
- there's a lot of online steps.
- it's not a threshold system
Using a shamir scheme solves this and isn't subject to birthday attacks:
https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f
On Mon, Aug 13, 2018 at 7:08 AM nakagat via bitcoin-dev <
bitcoin-dev@lists•linuxfoundation.org> wrote:
> Hi all,
>
> I wrote a multisignature procedure using bip-schnorr.
>
> If you have time to review and give feedback, I’d really appreciate it.
> Thanks in advance!
>
> Multisignature
> https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
>
> Original
>
> https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
>
> --
> nakagawa
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists•linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
[-- Attachment #2: Type: text/html, Size: 1919 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bitcoin-dev] Multisignature for bip-schnorr
2018-08-07 6:35 [bitcoin-dev] Multisignature for bip-schnorr nakagat
2018-08-29 11:28 ` Erik Aronesty
@ 2018-08-31 5:22 ` nakagat
2018-09-07 8:11 ` Jonas Nick
2 siblings, 0 replies; 5+ messages in thread
From: nakagat @ 2018-08-31 5:22 UTC (permalink / raw)
To: bitcoin-dev
Hi all,
I wrote t-of-k threshold signature procedure using bip-schnorr.
If you have time to review and give feedback, I’d really appreciate it.
Thanks in advance!
Threshold Signatures
https://gist.github.com/tnakagawa/e6cec9a89f698997dc58a09db541e1eb
Original
https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
--
nakagawa
2018年8月7日(火) 15:35 nakagat <nakagat@gmail•com>:
>
> Hi all,
>
> I wrote a multisignature procedure using bip-schnorr.
>
> If you have time to review and give feedback, I’d really appreciate it.
> Thanks in advance!
>
> Multisignature
> https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
>
> Original
> https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
>
> --
> nakagawa
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bitcoin-dev] Multisignature for bip-schnorr
2018-08-07 6:35 [bitcoin-dev] Multisignature for bip-schnorr nakagat
2018-08-29 11:28 ` Erik Aronesty
2018-08-31 5:22 ` nakagat
@ 2018-09-07 8:11 ` Jonas Nick
2018-09-12 6:00 ` nakagat
2 siblings, 1 reply; 5+ messages in thread
From: Jonas Nick @ 2018-09-07 8:11 UTC (permalink / raw)
To: nakagat, Bitcoin Protocol Discussion
Your multisignature writeup appears to be vulnerable to key cancellation
attacks because the aggregated public key is just the sum of public keys (and
there is no proof of knowledge of the individual secret keys). Therefore, in a
multisignature between Alice and an attacker, the attacker can choose their key
to be -alice_key+attacker_key resulting in an aggregated key for which the
attacker can sign alone (without requiring Alice's partial signature). The
Schnorr BIP links to the MuSig paper which describes a secure key aggregation
scheme. See https://eprint.iacr.org/2018/068
On 8/7/18 6:35 AM, nakagat via bitcoin-dev wrote:
> Hi all,
>
> I wrote a multisignature procedure using bip-schnorr.
>
> If you have time to review and give feedback, I’d really appreciate it.
> Thanks in advance!
>
> Multisignature
> https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
>
> Original
> https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [bitcoin-dev] Multisignature for bip-schnorr
2018-09-07 8:11 ` Jonas Nick
@ 2018-09-12 6:00 ` nakagat
0 siblings, 0 replies; 5+ messages in thread
From: nakagat @ 2018-09-12 6:00 UTC (permalink / raw)
To: jonasdnick; +Cc: bitcoin-dev
Hi Jonas
Thank you for your comment.
I wrote a new text.
https://gist.github.com/tnakagawa/e6cec9a89f698997dc58a09db541e1eb
If you have time, please review this.
2018年9月7日(金) 17:09 Jonas Nick <jonasdnick@gmail•com>:
>
> Your multisignature writeup appears to be vulnerable to key cancellation
> attacks because the aggregated public key is just the sum of public keys (and
> there is no proof of knowledge of the individual secret keys). Therefore, in a
> multisignature between Alice and an attacker, the attacker can choose their key
> to be -alice_key+attacker_key resulting in an aggregated key for which the
> attacker can sign alone (without requiring Alice's partial signature). The
> Schnorr BIP links to the MuSig paper which describes a secure key aggregation
> scheme. See https://eprint.iacr.org/2018/068
>
> On 8/7/18 6:35 AM, nakagat via bitcoin-dev wrote:
> > Hi all,
> >
> > I wrote a multisignature procedure using bip-schnorr.
> >
> > If you have time to review and give feedback, I’d really appreciate it.
> > Thanks in advance!
> >
> > Multisignature
> > https://gist.github.com/tnakagawa/0c3bc74a9a44bd26af9b9248dfbe598b
> >
> > Original
> > https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Multisignatures_and_Threshold_Signatures
> >
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-09-12 6:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-07 6:35 [bitcoin-dev] Multisignature for bip-schnorr nakagat
2018-08-29 11:28 ` Erik Aronesty
2018-08-31 5:22 ` nakagat
2018-09-07 8:11 ` Jonas Nick
2018-09-12 6:00 ` nakagat
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox