To what extent might it be possible to have actions on the Bitcoin blockchain be enforced by verification of statements that involve generators other than the standard generator \(G\)? In general the answer seems like it should be "not at all", but it isn't trivial. I
Proof of being a satoshi millionaire. This file proves that I, as of block 861756, own 4 taproot utxos (that is, specifically unspent bitcoin) whose total value is between 1,000,000 and 1,262,144 sats. (Weirdly specific numbers? The proving system works for \(k\) to \(k + 2^n\
News
Migration of my blog to Ghost (previously I used strapi, and it was increasingly proving unusable for boring reasons I won't get into here) is currently ongoing. I will add more of the earlier articles as I get a chance. The URLs should not change. Thanks for bearing
Contents 1. Motivation 2. Summary of idea 3. Isn't this like X? 4. Sketch of practical use cases 5. Technical summary 6. Enforcing scarcity by preventing reuse 7. Anonymity set degradation vectors 8. Aren't the privacy promises a bit dodgy? 9. Some loose ends (Thanks to
This is the second in a set of loosely-coupled shorter blog posts. In the previous blog post, we discussed the answer to the puzzle 'how do you prove knowledge of the opening of a Pedersen commitment'? In this post, we're going to extend that, but before
A short post that while answering an earlier question, also leads into my next post(s) about a meatier topic. Talk from March 2022 on Sigma Protocols The talk I gave at "Advancing Bitcoin" in London, March 2022 was posted on vimeo here. The slides are here: sigmaproto2022sigmaproto2022.
Contents * Preamble * Science fiction Schnorr, again * Schnorr Multisignature * Fixing Problem 1 * Fixing Problem 2 * 2 round multisig in InsecureMuSig * The 4-way fork * The security proof of InsecureMuSig * The OMDL as a variant of the DL problem * Why InsecureMuSig doesn't work - Drijvers et al 2018 * The attack on
In the modern nation state, courts ("justice") operate with the threat of violence. The exact way a dispute is settled varies (jury, single judge, etc.), but the "finality" of the resolution they provide is based on the fact that the state asserts the final say, and
Outline: * Basic goal of 1-of-\(N\) ring signatures * Recap: the \(\Sigma\)-protocol * OR of \(\Sigma\)-protocols, CDS 1994 * Abe-Ohkubo-Suzuki (AOS) 2002 (broken version) * Security weaknesses * Key prefixing * Borromean, Maxwell-Poelstra 2015 * Linkability and exculpability * AND of \(\Sigma\)-protocols, DLEQ * Liu-Wei-Wong 2004 * Security arguments for the LWW LSAG * Back 2015; compression, single-use
How sure are you that the cryptography underlying Bitcoin is secure? With regard to one future development of Bitcoin's crypto, in discussions in public fora, I have more than once confidently asserted "well, but the Schnorr signature has a security reduction to ECDLP". Three comments on
"Here is a purse of monies ... which I am not going to give to you" - Edmund Blackadder P(o)ODLE, not POODLE This post, fortunately, has nothing to do with faintly ridiculous SSL 3 downgrade attacks. Irritatingly, our usage here has no made-up need for the parenthetical