Date: Tue, 13 Aug 2019 10:15:32 -0400
From: Peter Todd <pete@petertodd.org>
To: Bryan Bishop <kanzure@gmail.com>
Message-ID: <20190813141532.zv5n5ghii5e44qsf@petertodd.org>
References: <CABaSBawe_oF_zoso2RQBX+7OWDoCwC7T2MeKSX9fYRUQaY_xmg@mail.gmail.com>
	<20190812150110.yf76pq47e5oszx62@petertodd.org>
	<CABaSBawwSEa_dDLEXhWncsqKmsM+rdT2Npo334LEZPvcMzrzFQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="yjxrtbbgvuymbxoa"
Content-Disposition: inline
In-Reply-To: <CABaSBawwSEa_dDLEXhWncsqKmsM+rdT2Npo334LEZPvcMzrzFQ@mail.gmail.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Bitcoin vaults with anti-theft recovery/clawback
 mechanisms
Precedence: list


--yjxrtbbgvuymbxoa
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 12, 2019 at 09:09:43PM -0500, Bryan Bishop wrote:
> > > Multisig gated by ECDSA pubkey recovery for provably-unknown keys
> > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> > >
> > > A group can participate in a multisig scheme with provably-unknown EC=
DSA
> > keys.
> > > Instead of deleting the key, the idea is to agree on a blockheight and
> > then
> > > select the blockhash (or some function of the chosen blockhash like
> > > H(H(H(blockhash)))) as the signature. Next, the group agrees on a
> > transaction
> > > and they recover the public key from the signature using ECDSA pubkey
> > recovery.
> >
> > Could you explain in more detail why you're deriving this from a blockh=
ash?
> >
>=20
> Well you need to pick an entropy source, and I wouldn't want to tell peop=
le
> to just trust the first party to tell you a good sequence of bytes.

But why does this specifically need to be entropy?

If I understand the scheme correctly, the important thing is for the ECDSA
private key to be unknown. Under the standard assumption that hash functions
are random oracles, hashing anything should be sufficient to create a pubkey
whose private key is unknown.

Secondly, there's probably better slightly privacy if a random nonce is cho=
sen
(perhaps by concatenating a nonce from each party) rather than picking pubk=
eys
unique to this use-case.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--yjxrtbbgvuymbxoa
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAl1SxgAACgkQJIFAPaXw
kfsZ8wf9EGAyzVxPI5ywhq2aSQbvuvCXMiZUq17D8z9clqgzKcpaB0CLfRD16Nbc
k/fngjyFQyGbmN4iJRHX1CP3E/Rv34UzL+9ahcqBqnZYiJoo8wAyxUj8sTrKwZUu
syEDMQwSlMXe7+ZegAjkM3jucJvpsrQFjEz3iJ5/yxpjW64wted/Df3dNli4gQGV
jiw2wi9hFjbubIutuk4rOvWfgzOVJt2nwsIgh29FOw94086LuKTkMkxMGtXicJei
CnxQ3QPjRAvwIz4JbG0zT8hPdGp6N/SrX+1Pf1j0FIogl1wDVYdMYLQS7eQ51iuV
9tJ1GaNQnMVOoPSk17YT9cBzRfAX1A==
=gGP1
-----END PGP SIGNATURE-----

--yjxrtbbgvuymbxoa--