Delivery-date: Fri, 03 Oct 2025 08:51:58 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of pete@petertodd.org designates 103.168.172.152 as permitted sender) client-ip=103.168.172.152;
Feedback-ID: i525146e8:Fastmail
Date: Fri, 3 Oct 2025 13:24:38 +0000
From: Peter Todd <pete@petertodd.org>
To: waxwing/ AdamISZ <ekaggata@gmail.com>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] On (in)ability to embed data into Schnorr
Message-ID: <aN_OlgvB-Co1BL19@petertodd.org>
References: <0f6c92cc-e922-4d9f-9fdf-69384dcc4086n@googlegroups.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="qq1aX4FXbpeNWI67"
Content-Disposition: inline
In-Reply-To: <0f6c92cc-e922-4d9f-9fdf-69384dcc4086n@googlegroups.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--qq1aX4FXbpeNWI67
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Wed, Oct 01, 2025 at 07:24:50AM -0700, waxwing/ AdamISZ wrote:
> Hi all,
> 
> https://github.com/AdamISZ/schnorr-unembeddability/
> 
> Here I'm analyzing whether the following statement is true: "if you can 
> embed data into a (P, R, s) tuple (Schnorr pubkey and signature, BIP340 
> style), without grinding or using a sidechannel to "inform" the reader, you 
> must be leaking your private key".
> 
> See the abstract for a slightly more fleshed out context.
> 
> I'm curious about the case of P, R, s published in utxos to prevent usage 
> of utxos as data. I think this answers in the half-affirmative: you can 
> only embed data by leaking the privkey so that it (can) immediately fall 
> out of the utxo set.
> 
> (To emphasize, this is different to the earlier observations (including by 
> me!) that just say it is *possible* to leak data by leaking the private 
> key; here I'm trying to prove that there is *no other way*).

You can probably use timelock encryption to ensure that the leak of the private
key only happens in the future, after the funds are recovered by the owner in a
subsequent transaction.

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/aN_OlgvB-Co1BL19%40petertodd.org.

--qq1aX4FXbpeNWI67
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmjfzpcACgkQLly11TVR
LzdPKQ/7B9YF8eVl+9mknfuZqocTJT2hks/hisRx6J2ZyoHs8cJMFpsoAkQGGsvM
JeDGKz3t6RkkFENwUTZOYdw0LQTlKsy2TI9zZQG7rO8/wRch3MTr59O2GkPxk4fi
SXLqBXP2OGVfU/c051WMCJ5/An0oT4LNKzWOXGRPpkhftZUD3rjyZaCEe1+nK5yR
kuLjhl75/3oRVRdaAwxdiVuvMRz4c/fEoImSTVpJVK51JcuTdrChwZNBsArJSUZQ
JQ6nujSeRD3mEM58+vlmOKxMUkeB7R+lh2OnyTv7sgGrTEhkHsDR3gV5IvkFrYXq
rmrnCvPi48iWPL0m+bm4NmCGnZqPwcdxYXSBVnolpUzt4tA8d5OyxFI2xvIFtzCi
FjCFT3Ek+1apUDFjV4CLp5GXkdItiWnPwOwhY3GKfP4aa2KWXLHAFRY6QzrP+h+i
l+xf0Yh2hE0kTNyqu6lhxMeo4tWE1G0FgfgzrqoJYb+P/xDCex23oXx7PBUdHfXg
7QTNIMCFT8z+MVHHBct761DiS+y8NDW4XCwIKo0LGeGZPCHKYcKw4tQXIbUXrOtW
hYtj0upungN1U911QR/1FGxz3+cwx+UzTD80Rdd6VTXKpLX9kR+L+R2msce5DPv8
8hyQGWA6jGONK5xY0H3dY5HuUrm5iGawOK/tz/TzNUpk7h4mNUg=
=ZQuz
-----END PGP SIGNATURE-----

--qq1aX4FXbpeNWI67--