Contents * Introduction * Agents on the savanna * Accidents and design * The fallacy of agency * It's not a fallacy if they're really out to get you * Agency-less agents in the P2P revolution Introduction Turning and turning in the widening gyre The falcon cannot hear the falconer; Things fall
To what extent might it be possible to have actions on the Bitcoin blockchain be enforced by verification of statements that involve generators other than the standard generator \(G\)? In general the answer seems like it should be "not at all", but it isn't trivial. I
Proof of being a satoshi millionaire. This file proves that I, as of block 861756, own 4 taproot utxos (that is, specifically unspent bitcoin) whose total value is between 1,000,000 and 1,262,144 sats. (Weirdly specific numbers? The proving system works for \(k\) to \(k + 2^n\
Migration of my blog to Ghost (previously I used strapi, and it was increasingly proving unusable for boring reasons I won't get into here) is currently ongoing. I will add more of the earlier articles as I get a chance. The URLs should not change. Thanks for bearing
Contents 1. Motivation 2. Summary of idea 3. Isn't this like X? 4. Sketch of practical use cases 5. Technical summary 6. Enforcing scarcity by preventing reuse 7. Anonymity set degradation vectors 8. Aren't the privacy promises a bit dodgy? 9. Some loose ends (Thanks to
This is the second in a set of loosely-coupled shorter blog posts. In the previous blog post, we discussed the answer to the puzzle 'how do you prove knowledge of the opening of a Pedersen commitment'? In this post, we're going to extend that, but before
A short post that while answering an earlier question, also leads into my next post(s) about a meatier topic. Talk from March 2022 on Sigma Protocols The talk I gave at "Advancing Bitcoin" in London, March 2022 was posted on vimeo here. The slides are here: sigmaproto2022sigmaproto2022.
Contents * Preamble * Science fiction Schnorr, again * Schnorr Multisignature * Fixing Problem 1 * Fixing Problem 2 * 2 round multisig in InsecureMuSig * The 4-way fork * The security proof of InsecureMuSig * The OMDL as a variant of the DL problem * Why InsecureMuSig doesn't work - Drijvers et al 2018 * The attack on
From MAC to Wabisabi * Preamble - big-and-randomized * Wabisabi, from the ground up. * What the Wabisabi paper, and this article, do not cover * Signatures, keyed MACs and credentials * Creating a MAC * Algebraic MACs * Security notions needed for algebraic MACs used for anonymous credentials * Algebraic MAC attempt 1 * Algebraic MAC attempt 2
In the modern nation state, courts ("justice") operate with the threat of violence. The exact way a dispute is settled varies (jury, single judge, etc.), but the "finality" of the resolution they provide is based on the fact that the state asserts the final say, and
Outline: * Basic goal of 1-of-\(N\) ring signatures * Recap: the \(\Sigma\)-protocol * OR of \(\Sigma\)-protocols, CDS 1994 * Abe-Ohkubo-Suzuki (AOS) 2002 (broken version) * Security weaknesses * Key prefixing * Borromean, Maxwell-Poelstra 2015 * Linkability and exculpability * AND of \(\Sigma\)-protocols, DLEQ * Liu-Wei-Wong 2004 * Security arguments for the LWW LSAG * Back 2015; compression, single-use
How sure are you that the cryptography underlying Bitcoin is secure? With regard to one future development of Bitcoin's crypto, in discussions in public fora, I have more than once confidently asserted "well, but the Schnorr signature has a security reduction to ECDLP". Three comments on