From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 38FB54832 for ; Tue, 22 Jan 2019 09:19:36 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-40136.protonmail.ch (mail-40136.protonmail.ch [185.70.40.136]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 8041F74A for ; Tue, 22 Jan 2019 09:19:35 +0000 (UTC) Date: Tue, 22 Jan 2019 09:19:27 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=default; t=1548148773; bh=G+dQS+e35hBDXf5Lm80LESlIBdYB6/xZsN+mCIOY02c=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References: Feedback-ID:From; b=mX5fdGga9Ob6mJFkKtkFSMnb8QV3n/ZkXlVenq0aAZtUSxVlvRditLUmCxgOeDds2 HtyRcXRF8Xgbd6tQvYDmD1VDiUzyTQYZ4edRqMefIEHtRu5roZ/HcNlmXKd+oaRyIJ RqIIQLZiJs9SCLMlTWQViZ4UoHhwyrV01d0idUlE= To: Matt Bell From: ZmnSCPxj Reply-To: ZmnSCPxj Message-ID: In-Reply-To: References: Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-2.2 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, FROM_LOCAL_NOVOWEL, RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Tue, 22 Jan 2019 14:11:25 +0000 Cc: Bitcoin Protocol Discussion Subject: Re: [bitcoin-dev] Proof-of-Stake Bitcoin Sidechains X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jan 2019 09:19:36 -0000 Good Morning Matt, > ### ZmnSCPxj, > > I'm intrigued by this mechanism of using fixed R values to prevent multip= le signatures, but how do we derive the R values in a way where they are unique for each blockheight but still can be used to create signatures or v= erify? One possibility is to derive `R` using standard hierarchical derivation. Then require that the staking pubkey be revealed to the sidechain network a= s actually being `staking_pubkey =3D P + hash(P || parent_R) * G` (possibly= with some trivial protection against Taproot). To sign for a blockheight `h`, you must use your public key `P` and the spe= cific `R` we get from hierarchical derivation from `parent_R` and the block= height as index. Regards, ZmnSCPxj