Delivery-date: Fri, 24 May 2024 08:08:16 -0700
Received-SPF: pass (google.com: domain of ganrama@proton.me designates 185.70.40.130 as permitted sender) client-ip=185.70.40.130;
Date: Fri, 24 May 2024 15:02:39 +0000
To: Andrew Poelstra <apoelstra@wpsoftware.net>
From: "'Rama Gan' via Bitcoin Development Mailing List" <bitcoindev@googlegroups.com>
Cc: "bitcoindev@googlegroups.com" <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Penlock, a paper-computer for secret-splitting BIP39
 seed phrases
Message-ID: <x8ORFhCMjZL-ViYGSXl9ek_bfU231h6sOnG97aMj6tOT3cmKKRDS8PJsfFbvfRrzGTbZLuHzSOCwmc7mGwBSxBHGAfLUyydX-OZNPYHvfrQ=@proton.me>
In-Reply-To: <ZlCg2C4kZSGUN3Qx@camus>
References: <9bt6npqSdpuYOcaDySZDvBOwXVq_v70FBnIseMT6AXNZ4V9HylyubEaGU0S8K5TMckXTcUqQIv-FN-QLIZjj8hJbzfB9ja9S8gxKTaQ2FfM=@proton.me> <ZkIYXs7PgbjazVFk@camus> <GqYxqTBUgHl6yq1UAaOc2O9Ea4-5yKnM-jGZzGaKC19c-k3KcUN_Bo2e7XPYUrNaX3NMJC0tCMudgSl0_l1BCRUz4DIYBR1ecL2ifopzs98=@proton.me> <ZkNqVZFNBNTq7mAL@camus> <e1V4sbaLiJ4XGzEEEnr7lg2O1h3OxQabGcSoeTmDeo8bLVgIGhz9HHo3qtGQIVi-5aoU4xc2Kdj_qcC8Rt_xtFvQDahhXcIg4V0raMJxh2Y=@proton.me> <ZkYJ21cloqyvT93G@camus> <ZkZBSriGn96GDLg-@camus> <EfekwtxUZKN_4z53hjqo7lXhcMDaRHlIC-EOWNjcpL_cJgeYPa1-_1g0b6PxLZPEL0oj7YAXEWK7yg7WiEHH2FkIk7WHIFGwjMB1zoxYb6M=@proton.me> <ZlCg2C4kZSGUN3Qx@camus>
Feedback-ID: 79991369:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Reply-To: Rama Gan <ganrama@proton.me>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

> Are you sure? It seems that if two shares have the same value in a given
> position, the line through them should be constant, meaning that every
> other share will have the same constant value.

For the 2-of-M split, the secret is encoded as the difference between two
consecutive shares instead of being a point at a given index. If both the secret
and share A have a header `HEAD`, then share B will start with `====` (zeros)
and share C will be the additive inverse of `HEAD`.

The secret is the "slope" of the line; for the shares headers to be constant,
the solution would be to fill the corresponding spots with zeros on the secret.
So yes it _is_ possible, but then the 2-of-M and the K-of-M cases will behave
differently which could be a source of confusion. I guess it is the
cons of going for a composite scheme.

-- Rama Gan

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/x8ORFhCMjZL-ViYGSXl9ek_bfU231h6sOnG97aMj6tOT3cmKKRDS8PJsfFbvfRrzGTbZLuHzSOCwmc7mGwBSxBHGAfLUyydX-OZNPYHvfrQ%3D%40proton.me.