From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 41A0DC0032 for ; Wed, 26 Jul 2023 17:50:25 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 0F7DB60EF9 for ; Wed, 26 Jul 2023 17:50:25 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 0F7DB60EF9 Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=mail.wpsoftware.net header.i=@mail.wpsoftware.net header.a=rsa-sha256 header.s=default header.b=XHEVdmMt X-Virus-Scanned: amavisd-new at osuosl.org X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 20_pYW-zgpPc for ; Wed, 26 Jul 2023 17:50:24 +0000 (UTC) X-Greylist: delayed 595 seconds by postgrey-1.37 at util1.osuosl.org; Wed, 26 Jul 2023 17:50:23 UTC DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org D331060EE1 Received: from mail.wpsoftware.net (unknown [66.183.0.205]) by smtp3.osuosl.org (Postfix) with ESMTP id D331060EE1 for ; Wed, 26 Jul 2023 17:50:23 +0000 (UTC) Received: from camus (camus-andrew.lan [192.168.0.190]) by mail.wpsoftware.net (Postfix) with ESMTPSA id EF232400C4; Wed, 26 Jul 2023 17:40:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.wpsoftware.net; s=default; t=1690393228; bh=2lO7oCf5QXl75TSSO3EUfHwT9ZM8GPiuXzyKTzg4aj0=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=XHEVdmMthKx23WU/cdP3CgZD/mIXAU2GnBnbhpyoqCD7Yz/ua8iZFMacKR2ZzqKVE 2sjRL0WiLYy/U6hXzEFSeowWfPmULQrM+CITPJQYq56r/jJg0Qy8LlBKSSBauA8i9d kqhBIEjpnvh/hB5o42gpDTGpx162vyzb1clk3FvCqwHuIRznvEp7qX54b9ZOAOHC10 xUOQ9r8JLPDG5z35zn2Pu7x5jKE1CMTdu5cQHqZJuzLfA9ZAIns4wLf43srE26JibF oUbqiS8xYksima4invPnOOVzWm/bs+uwa9AXXf2WVByQj2io/3iP5tuXs+ySjtQ0SN Wsy8tqOIuzIeQ== Date: Wed, 26 Jul 2023 17:40:26 +0000 From: Andrew Poelstra To: Erik Aronesty , Bitcoin Protocol Discussion Message-ID: References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="9i61HOpSYhxQer3V" Content-Disposition: inline In-Reply-To: Cc: Tom Trevethan Subject: Re: [bitcoin-dev] Blinded 2-party Musig2 X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2023 17:50:25 -0000 --9i61HOpSYhxQer3V Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 26, 2023 at 12:09:41AM -0400, Erik Aronesty via bitcoin-dev wro= te: > personally, i think *any* time a public key is transmitted, it should come > with a "proof of secret key". it should be baked-in to low level > protocols so that people don't accidentally create vulns. alt discussion > link: https://gist.github.com/RubenSomsen/be7a4760dd4596d06963d67baf1404= 06 > POSK is not a panacea. For example, if you were to try to eliminate rogue key attacks in MuSig by using POSK rather than by rerandomizing the keys, the last person to contribute a key could add a Taproot commitment to their key, thereby modifying the final key to have a Taproot spending path that other participants don't know about. If they did this, they'd have no problem producing a POSK since Taproot commitments don't affect knowledge of the secret key. POSKs are also logistically difficult to produce in many contexts. They essentially require an interactive challege-response (otherwise somebody could just copy a POSK from some other source), meaning that all participants need to be online and have secret key access at key setup time. In some contexts maybe it's sufficient to have a static POSK. Aside from the complexity of determining this, you then need a key serialization format that includes the POSK. There are standard key formats for all widely used EC keys but none have a facility for this. If you are trying to use already-published keys that do not have a POSK attached, you are out of luck. If your protocol requires POSKs to be provably published, you also run into difficulties because they don't make sense to embed on-chain (since blockchain validators don't care about them, and they're twice as big as the keys themselves) so you need to establish some other publication medium. If you want to support nested multisignatures, you need to jointly produce POSKs, which requires its own protocol complexity. The MuSig and MuSig2 papers say essentially the same thing as the above; it's why we put so much effort into developing a scheme which was provably secure in the plain public key model, which means that POSKs are superfluous and you don't need to deal with all these logistical hurdles. --=20 Andrew Poelstra Director of Research, Blockstream Email: apoelstra at wpsoftware.net Web: https://www.wpsoftware.net/andrew The sun is always shining in space -Justin Lewis-Webster --9i61HOpSYhxQer3V Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEkPnKPD7Je+ki35VexYjWPOQbl8EFAmTBWogACgkQxYjWPOQb l8H3yAf+NgXBr9/jUkDzf4780qlV3Z8ecO1nICVwdvE8Id3DhDHbptsW3QXQ9Yxo 6YDcMFI3AXd3ZfdjmBN2k/PFSvE4R2TxU2SKCpP1MqJcV5FTurkJOnPJ62LS9odv eZqdVqH8E4U+IDFtgmG1amPyxqtiNicsAw3jQD+Y6AJjtxP8j7ovG+rgf9V+mmjg kgeg21ohImyasQBraCR7rCBmvj3TpoGEj1NpNSBx8RYv5dv/atv4wMIWP7voEOWZ v7w/q7IsQnykzr7eZHNPolm5mz67EcGO6fWyakSsiGdv2egL6iV2hWyvvVq/ONvA /OLIsCPV/pkKMiEeVqeMFo/zRDaM1A== =ptxZ -----END PGP SIGNATURE----- --9i61HOpSYhxQer3V--