MIME-Version: 1.0
References: <CAPg+sBj7f+=OYXuOMdNeJk3NBG67FSQSF8Xv3seFCvwxCWq69A@mail.gmail.com>
	<2e620d305c86f65cbff44b5fba548dc85c118f84.camel@timruffing.de>
	<20180812163734.GV499@boulet.lan>
	<CAJowKg+h11YkwOo-gyWCw+87Oh-9K34LOnJ1730hhpoVR2m5sA@mail.gmail.com>
	<20180903000518.GB18522@boulet.lan>
In-Reply-To: <20180903000518.GB18522@boulet.lan>
From: Erik Aronesty <erik@q32.com>
Date: Wed, 5 Sep 2018 08:26:14 -0400
Message-ID: <CAJowKg+PDtEV3je_N9Ra6u3n4+ZQ3ozYapt8ivxGYYU28Qad+w@mail.gmail.com>
To: apoelstra@wpsoftware.net
Content-Type: multipart/alternative; boundary="00000000000050e10105751ee29e"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Schnorr signatures BIP
Precedence: list

--00000000000050e10105751ee29e
Content-Type: text/plain; charset="UTF-8"

Why would you call it FUD?   All the weird hemming and hawing about it is
really strange to me.  The more I look into it and speak to professors
about i, the more it seems "so trivial nobody really talks about it".

1. Generate an M of N shared public key (done in advance of signing ....
this gets you the bitcoin address)
2. Generate signature fragments (this can be done offline, with no
communication between participants)

Detailed explanation with code snippets:

https://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f


On Sun, Sep 2, 2018 at 8:05 PM Andrew Poelstra <apoelstra@wpsoftware.net>
wrote:

> On Wed, Aug 29, 2018 at 08:09:36AM -0400, Erik Aronesty wrote:
> > Note:
> >
> > This spec cannot be used directly with a shamir scheme to produce
> > single-round threshold multisigs, because shares of point R would need to
> > be broadcast to share participants in order to produce valid single
> > signatures.
> >
> > (R, s) schemes can still be used "online", if share participants publish
> > the R(share).... but, not sure if it matter much, this choice eliminates
> > offline multiparty signing in exchange for batch validation.
> >
>
> Please stop with this FUD. No tradeoff was made. There are no
> non-interactive
> Schnorr signatures.
>
>
> Andrew
>
>
> --
> Andrew Poelstra
> Mathematics Department, Blockstream
> Email: apoelstra at wpsoftware.net
> Web:   https://www.wpsoftware.net/andrew
>
> "A goose alone, I suppose, can know the loneliness of geese
>  who can never find their peace,
>  whether north or south or west or east"
>        --Joanna Newsom
>
>

--00000000000050e10105751ee29e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Why would you call it FUD?=C2=A0=C2=A0 All the weird =
hemming and hawing about it is really strange to me.=C2=A0 The more I look =
into it and speak to professors about i, the more it seems &quot;so trivial=
 nobody really talks about it&quot;.<br></div><div><br></div><div>1. Genera=
te an M of N shared public key (done in advance of signing .... this gets y=
ou the bitcoin address)<br></div><div>2. Generate signature fragments (this=
 can be done offline, with no communication between participants)<br></div>=
<div></div><div><br></div><div></div><div></div><div dir=3D"ltr">Detailed e=
xplanation with code snippets:<br><br></div><div dir=3D"ltr"><a href=3D"htt=
ps://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f">htt=
ps://medium.com/@simulx/an-m-of-n-bitcoin-multisig-scheme-e7860ab34e7f</a><=
/div><div dir=3D"ltr"><br></div><div dir=3D"ltr"><br></div></div><br><div c=
lass=3D"gmail_quote"><div dir=3D"ltr">On Sun, Sep 2, 2018 at 8:05 PM Andrew=
 Poelstra &lt;<a href=3D"mailto:apoelstra@wpsoftware.net">apoelstra@wpsoftw=
are.net</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"=
margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, Aug =
29, 2018 at 08:09:36AM -0400, Erik Aronesty wrote:<br>
&gt; Note:<br>
&gt; <br>
&gt; This spec cannot be used directly with a shamir scheme to produce<br>
&gt; single-round threshold multisigs, because shares of point R would need=
 to<br>
&gt; be broadcast to share participants in order to produce valid single<br=
>
&gt; signatures.<br>
&gt; <br>
&gt; (R, s) schemes can still be used &quot;online&quot;, if share particip=
ants publish<br>
&gt; the R(share).... but, not sure if it matter much, this choice eliminat=
es<br>
&gt; offline multiparty signing in exchange for batch validation.<br>
&gt;<br>
<br>
Please stop with this FUD. No tradeoff was made. There are no non-interacti=
ve<br>
Schnorr signatures.<br>
<br>
<br>
Andrew<br>
<br>
<br>
-- <br>
Andrew Poelstra<br>
Mathematics Department, Blockstream<br>
Email: apoelstra at <a href=3D"http://wpsoftware.net" rel=3D"noreferrer" ta=
rget=3D"_blank">wpsoftware.net</a><br>
Web:=C2=A0 =C2=A0<a href=3D"https://www.wpsoftware.net/andrew" rel=3D"noref=
errer" target=3D"_blank">https://www.wpsoftware.net/andrew</a><br>
<br>
&quot;A goose alone, I suppose, can know the loneliness of geese<br>
=C2=A0who can never find their peace,<br>
=C2=A0whether north or south or west or east&quot;<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0--Joanna Newsom<br>
<br>
</blockquote></div>

--00000000000050e10105751ee29e--