[Bitcoin-development] Is this a safe thing to be doing with ECC addition? (Oracle protocol)

Adam Back adam at cypherspace.org
Sat Mar 8 17:41:01 UTC 2014


Also the other limitation for ECDSA is that there is no known protocol to
create a signture with a+b (where keys P=aG, Q=bG, R=P+Q=(a+b)G). without
either a sending its private key to b or viceversa (or both to a third
party).

With Schnorr sigs you can do it, but the k^-1 term in ECDSA makes a (secure)
direct multiparty signature quite difficult.

ps probably only 1 party needs to hash their key

P=aG      
            H(P) ->

		<- Q=bG

	   P ->

Adam

On Sat, Mar 08, 2014 at 12:37:30PM +0200, Joel Kaartinen wrote:
>   If both parties insist on seeing a hash of the other party's public key
>   before they'll show their own public key, they can be sure that the
>   public key is not chosen based on the public key they themselves
>   presented.




More information about the bitcoin-dev mailing list