{"type":"rich","version":"1.0","author_name":"npub1f2nvlx49er5c7sqa43src6ssyp6snd4qwvtkwm5avc2l84cs84esecrwet","author_url":"https://nostr.ae/npub1f2nvlx49er5c7sqa43src6ssyp6snd4qwvtkwm5avc2l84cs84esecrwet","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2018-09-11\n📝 Original message:On Tue, Sep 11, 2018 at 4:34 PM Erik Aronesty \u003cerik at q32.com\u003e wrote:\n\n\u003e To answer points:\n\u003e\n\u003e - I switched to the medium article so that I could correct, edit and\n\u003e improve things to make them more clear.\n\u003e - I responded to feedback by modifying the protocol to make it work - not\n\u003e by ignoring it.\n\u003e\n\nTo this moment there remains no response at your post.\nhttps://bitcointalk.org/index.php?topic=4973123.0\n\nI'm not sure how I am supposted to have figured out that you wrote a\nsomewhat different repost of it elsewhere...\n\n- An M-1 rogue-key attack would require the attacker would to either\n\u003e\n\u003e   - attack the hash function to produce a predictable R based on a known\n\u003e mesage\n\u003e   - attack the DLP to influence x or k\n\u003e\n\u003e Neither attack gives any particular advantage to someone who has M-1 keys.\n\u003e\n\nYou keep asserting this. It isn't true. Asserting it more does not make it\nany more true.  I already explained how to attack this style of signature\n(e.g. in the BCT thread).\n\nSet aside your 'interpolation' for a moment, and imagine that you construct\na 2 of 2 signature by just adding the keys.  Your tell me your key, P1  and\nthen I tell you that my key P2 which I derived by computing -P1  + xG.   We\nnow compute P = P1 + P2 = P1 + -P1 + xG = xG ... and now in spite adding P1\nwith an unknown discrete log, I know the discrete log of P with respect to\nG and I did not need to violate the standard DL security assumption to\nachieve that.\n\nWith the 'interpolation' in effect the same attack applies but its\nexecution is somewhat more complex: instead of adding the negation of P1  I\nmust add a number of multiplicities of P1 (like P1*2, P1*3, P1*4...)\nselected so that their interpolation coefficients add up to -1. Finding a\nsuitable subset requires solving a randomized modular subset sum problem\nand Wagner's algorithm provides a computationally tractable solution to it.\n\nThe potential of rogue keys applies to both the keys themselves and to the\nnonces. There are several ways to prevent these attacks, the musig paper\ndescribes a delinearization technique which doesn't require additional\ninteraction or communication.\n\nI haven't tested whether the R,s version is susceptible though.\n\u003e\n\nThere is a perfect bijection between the two encodings which is easily\ncomputable, so they're the same thing from an abstract security perspective.\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180911/6d4ebd71/attachment.html\u003e"}