Received: from sog-mx-2.v43.ch3.sourceforge.com ([172.29.43.192]
	helo=mx.sourceforge.net)
	by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
	(envelope-from <elombrozo@gmail.com>) id 1XGHo4-0001Xv-4g
	for bitcoin-development@lists.sourceforge.net;
	Sun, 10 Aug 2014 01:20:20 +0000
Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.192.173 as permitted sender)
	client-ip=209.85.192.173; envelope-from=elombrozo@gmail.com;
	helo=mail-pd0-f173.google.com; 
Received: from mail-pd0-f173.google.com ([209.85.192.173])
	by sog-mx-2.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
	(Exim 4.76) id 1XGHo2-00070Y-VJ
	for bitcoin-development@lists.sourceforge.net;
	Sun, 10 Aug 2014 01:20:20 +0000
Received: by mail-pd0-f173.google.com with SMTP id w10so8888587pde.18
	for <bitcoin-development@lists.sourceforge.net>;
	Sat, 09 Aug 2014 18:20:13 -0700 (PDT)
X-Received: by 10.66.245.140 with SMTP id xo12mr33158798pac.38.1407633613163; 
	Sat, 09 Aug 2014 18:20:13 -0700 (PDT)
Received: from [192.168.1.108] (cpe-76-167-237-202.san.res.rr.com.
	[76.167.237.202])
	by mx.google.com with ESMTPSA id 5sm10762781pds.12.2014.08.09.18.20.10
	for <multiple recipients>
	(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
	Sat, 09 Aug 2014 18:20:11 -0700 (PDT)
Content-Type: multipart/signed;
	boundary="Apple-Mail=_0C2F2A54-EE8A-41AC-8CCC-9E22ABFC1B1C";
	protocol="application/pgp-signature"; micalg=pgp-sha1
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Eric Lombrozo <elombrozo@gmail.com>
In-Reply-To: <CAFWhrvR+4wsMwzjvqb7w7XmhESagzc_0pvQuGx3Fn4qeWFbinA@mail.gmail.com>
Date: Sat, 9 Aug 2014 18:20:09 -0700
Message-Id: <501F55C1-6307-487B-91D8-9CC0193DA747@gmail.com>
References: <CAFWhrvR+4wsMwzjvqb7w7XmhESagzc_0pvQuGx3Fn4qeWFbinA@mail.gmail.com>
To: second isogeny <secondisogeny@gmail.com>
X-Mailer: Apple Mail (2.1510)
X-Spam-Score: -1.6 (-)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
	sender-domain
	0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
	(elombrozo[at]gmail.com)
	-0.0 SPF_PASS               SPF: sender matches SPF record
	-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
	author's domain
	0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
	not necessarily valid
	-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1XGHo2-00070Y-VJ
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] BIP32 - invalidation
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Sun, 10 Aug 2014 01:20:20 -0000


--Apple-Mail=_0C2F2A54-EE8A-41AC-8CCC-9E22ABFC1B1C
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

Does bitcoin properly handle the case of a hash collision? no - because =
it is considered too unlikely. The case of I_L >=3D n is also =
astronomically unlikely, so it's more a matter of improved performance =
and simpler data structures under expected circumstances and taking that =
less than 1 in 2^127 chance that it will fail, in which case we can =
recover by moving everything over to a new tree.

-Eric Lombrozo



On Aug 9, 2014, at 5:34 PM, second isogeny <secondisogeny@gmail.com> =
wrote:

> > Does anyone see any concerns when it comes to security of the =
proposed
> > change?
>=20
> Yes.  This proposal is less secure.
>=20
> It is incompatible in theory with existing implementations of the
> specification.  The incompatibility is also a potentially a security
> problem because it may cause users to believe a key is worthless when
> it is not or to lose funds when they are unable to spend them.
>=20
> It is also an untimely proposal and would be inconsiderate other =
parties
> who have done the work to produce correct and compatible =
implementations.
>=20
> > In case I_L >=3D n assign I_L :=3D I_L mod n.
>=20
> This will make the selection of private keys uneven.
>=20
> The unevenness is small and it is unlikely to very matter much but it
> is objectively less secure.  Future advances in cryptography may make
> the distinction more important.  The change would eliminate any hope =
of
> the specification ever having provable security equal to random keys.
>=20
> The bignum modulo operation also requires complex additional logic and =
is
> just as likely to remain untested in implementations, though =
unit-testing
> can test these cases by replacing the hash function.
>=20
> Because of layering no suitable modulo may be available and an =
incorrect
> implementation could create a devastating weakness, like reflecting a
> large class of keys to a small number of values.  A similar error =
would
> be unlikely for an incorrect implementation of skipping and someone =
who
> managed to still fail would likely have failed either way.
>=20
> > most of the implementations don't do the checking at all, because =
tjen
> > it's rather hard at application level to implement skipping logic. =
OTOH
>=20
> There are many corner cases which must be handled in cryptographic
> software.
>=20
> You must handle the point at infinity cases, you must handle the =
signature
> having a value of zero (or you leak the private key), in the point
> arithemetics you must handle the special case of adding colinear =
points.
>=20
> If someone is unprepared to deal with these and many other =
complications
> they may want to leave writing this kind of software for other people.
>=20
> =
--------------------------------------------------------------------------=
----
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development


--Apple-Mail=_0C2F2A54-EE8A-41AC-8CCC-9E22ABFC1B1C
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP using GPGMail

-----BEGIN PGP SIGNATURE-----

iQIcBAEBAgAGBQJT5sjJAAoJEAA1EyJsW9n+zvgP/RKwczorptcZHBJkyQ4fu9QJ
DJNYEsC1CtqBwwaUG0mqtLTQ/3kyaXE1NPLEnQZadn5e77CWbZ+olvzev2/1Vg/A
kXdV/YVv2NpmxXgY1PMX1wxeJ+F0k4EKZ0erFFN5BB3oFWKsjDteC+UlyyUXnuiX
hqkKaA4jJf7B9p7kjSpwwW5r52oNrREuvxEbjCZ281aQwo5BdXtk9EE/jmgGejLS
DvPUDEE04S8wL+pc0+saQlTccvgX5kI4rjVC7nHtvKa6GCpxgTtRk3NOF/TqWdd/
yebb9crD3lhK3SFxftec+z4bFZ0lvVS4MHuDRCtFJMpmdPMNVJVT+qDiJyVAf6JD
WBA/UhsA0hemg42eaj1iahtUCsm45LPCPJ6mhOU5FUNSFspl6kXf5Lzn6TXe4RL4
NzvwzDaED8eOC4pLFxQB4FFnpg/PBzW54ETF0nkvh6zMhXjzbqqxfTOi/x7lXjh6
7Vk8zmtcdU8zpkYzRJ5s8o9y6VBix8RZp7GsV5iripI3Px024VyBHZz/Usuqbrop
ascgdG6Dy8/sOD6Yc4p7cpxyzRfVwSaTQWjsSljqss/9bucOabswwqkQK5RfTVEr
vN9gOhlQIajTg7j0n3rkyQK85tG8oU7Qa1gEy/0eNIaRgJvhYyLaefAQbQiMWoLt
yGmXUrBduHQ1rVFlsP/y
=BYJj
-----END PGP SIGNATURE-----

--Apple-Mail=_0C2F2A54-EE8A-41AC-8CCC-9E22ABFC1B1C--