Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.216.182 as permitted sender)
	client-ip=209.85.216.182;
	envelope-from=decker.christian@gmail.com;
	helo=mail-qy0-f182.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAAS2fgSwkvcpFTUAAEdXg2upGTXfToztS_bKfUNbUGcvRJ9xOQ@mail.gmail.com>
References: <CABsx9T1uw43JuvhEmJP0KCyojsDi1r7v6BaLBHz7wWazduE5iw@mail.gmail.com>
	<CALxbBHXAcRse9YE-evKNmDut684vjkUMHkbx+8E+aTNT5wMg5A@mail.gmail.com>
	<CAAS2fgSwkvcpFTUAAEdXg2upGTXfToztS_bKfUNbUGcvRJ9xOQ@mail.gmail.com>
Date: Thu, 25 Aug 2011 23:30:56 +0200
Message-ID: <CALxbBHWYg_OmPcNnckAyRM_rsaeWkUWwQCA=ZLFPuUWCRKiyKQ@mail.gmail.com>
From: Christian Decker <decker.christian@gmail.com>
To: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Content-Type: multipart/alternative; boundary=000e0cd23ecc084ad504ab5b255d
Subject: Re: [Bitcoin-development] New standard transaction types: time to
 schedule a blockchain split?
Precedence: list

--000e0cd23ecc084ad504ab5b255d
Content-Type: text/plain; charset=ISO-8859-1

If I remember the details correctly you could combine (lagrange
interpolation) the results of m smaller encryptions/signatures without ever
sharing the secret key share itself. No idea if that is possible with ecdsa
at all, but it sure would solve quite a few problems, as it would allow
several independent servers to share a secret key, sign transactions with
it, but no m-1 compromised machines would endanger the whole balance.
I will definitely look into it when I'm back from holidays.

Cheers,
Cdecker
On Aug 24, 2011 9:29 PM, "Gregory Maxwell" <gmaxwell@gmail.com> wrote:
> On Wed, Aug 24, 2011 at 3:05 PM, Christian Decker
> <decker.christian@gmail.com> wrote:
>> we could add an rsa-like scheme which allows m-out-of-n signatures. It
works
>> by distributing shares of the key which are points on a curve having the
>> actual key as 0-value. It does not require special length for the key so
if
>> ecdsa allows something similar there need not be anything changed.
>
> This works fine for ECC. But it requires that the composite key
> signer has simultaneous access to all the key-parts, so it doesn't
> solve the "my PC has malware" problem.

--000e0cd23ecc084ad504ab5b255d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p>If I remember the details correctly you could combine (lagrange interpol=
ation) the results of m smaller encryptions/signatures without ever sharing=
 the secret key share itself. No idea if that is possible with ecdsa at all=
, but it sure would solve quite a few problems, as it would allow several i=
ndependent servers to share a secret key, sign transactions with it, but no=
 m-1 compromised machines would endanger the whole balance.<br>

I will definitely look into it when I&#39;m back from holidays.</p>
<p>Cheers,<br>
Cdecker</p>
<div class=3D"gmail_quote">On Aug 24, 2011 9:29 PM, &quot;Gregory Maxwell&q=
uot; &lt;<a href=3D"mailto:gmaxwell@gmail.com">gmaxwell@gmail.com</a>&gt; w=
rote:<br type=3D"attribution">&gt; On Wed, Aug 24, 2011 at 3:05 PM, Christi=
an Decker<br>
&gt; &lt;<a href=3D"mailto:decker.christian@gmail.com">decker.christian@gma=
il.com</a>&gt; wrote:<br>&gt;&gt; we could add an rsa-like scheme which all=
ows m-out-of-n signatures. It works<br>&gt;&gt; by distributing shares of t=
he key which are points on a curve having the<br>
&gt;&gt; actual key as 0-value. It does not require special length for the =
key so if<br>&gt;&gt; ecdsa allows something similar there need not be anyt=
hing changed.<br>&gt; <br>&gt; This works fine for ECC.  But it requires th=
at the composite key<br>
&gt; signer has simultaneous access to all the key-parts, so it doesn&#39;t=
<br>&gt; solve the &quot;my PC has malware&quot; problem.<br></div>

--000e0cd23ecc084ad504ab5b255d--