sipa changed the topic of #bitcoin-wizards to: This channel is for discussing theoretical ideas with regard to cryptocurrencies, not about short-term Bitcoin development | http://bitcoin.ninja/ | This channel is logged. | For logs and more information, visit http://bitcoin.ninja
mol has quit [Ping timeout: 260 seconds]
tromp has quit [Remote host closed the connection]
CheckDavid has quit [Quit: Connection closed for inactivity]
rusty has quit [Read error: Connection reset by peer]
rusty1 has joined #bitcoin-wizards
<gmaxwell>
adiabat: you're naughty, the rest of us were politely not publishing that you can do MW without CT.
<gmaxwell>
adiabat: FWIW, if you do the math on the aggregation gains, the savings from transaction-wide to block wide are not that significant, especially when you count in the extra overhead needed to do the MW style aggregation.
<gmaxwell>
adiabat: Have you seen the non-accepted paper we submitted for FC? it had aggregation gains in it just taking the existing txn traffic (e.g. no assumption of increased CJ use)... it's within a couple percent of what you'd get from doing blockwide aggregation.
* sipa
guesses that adiabat indeed saw that paper
<adiabat>
I have seen the FC schnorr aggregation paper (well I think so; it was "anonymized" but the anonymity set is quite limited)
<gmaxwell>
adiabat: if you'd like a copy of it, feel free to let sipa, andrew, or I know. (reviewers found tremendous prior publications in the area that we searched for but couldn't find, but the concrete stats on Bitcoin in it are useful.)
<adiabat>
It only talked about interactive aggregation though right?
<gmaxwell>
adiabat: thats what it talked about, but I thought we also gave the figure for what blockwide aggregation would achieve.
<adiabat>
blockwide would be really cool but only aggregating half the signature is.. half as good?
<adiabat>
but anyway sounds like I'm not missing anything and it does actually work...
<adiabat>
also sounds like you guys already knew this
* nsh
is designated knower of nothing
<gmaxwell>
adiabat: yea, it works. Basically you can directly take the MW results and just drop the CT part. You lose all the CT advantages, but keep all the other ones. Including the strongly binding history part that lets you sync coinbases + extravalues + utxo set and know the history was spend-faithful.
<adiabat>
so an s-value that accumulates over multiple blocks... huh.
<adiabat>
still need all the R-values though so doesn't give you huge savings
CryptAxe has joined #bitcoin-wizards
<adiabat>
it does seem like if you're doing schnorr sigs though, why not do the non-interactive aggregation
<gmaxwell>
But relative to the 'interactive aggregate' where you just assume all inputs for txn will be aggregated, the space savings is not that great (just a couple more percent IIRC)... and since the MW style utxo sync can't provide security for general smart contracts the syncing scaling doesn't really help.
<gmaxwell>
adiabat: because you have the overhead of the extra r values.
<gmaxwell>
and it's slower to verify.
<adiabat>
is it actually slower to verify? It seemed like it would be faster
<adiabat>
replacing base point multiplications with point additions
harrymm has quit [Ping timeout: 260 seconds]
<gmaxwell>
nah, it's slightly slower, IIRC (I could be wrong)... none of this aggregation really speeds up validation. Because to prevent wangers algorithim you have to blind all the values, which requires non-fixed-point * scalar operations.
<gmaxwell>
wagners algorithin and straight up cancellation.
<adiabat>
OK yeah I didn't consider that part. So maybe saves a bit of space but not any time
tromp has joined #bitcoin-wizards
<gmaxwell>
similarly, BLS has really nice aggregation that saves more space... but the primiative operations are a lot slower.
<adiabat>
hm.. OK so if this works, then I'm pretty sure the other thing I was working on which let me to this also works.
<adiabat>
which is... if you could have a checksig operation or witness program where you commit not just to the public key, but also to an R-value
<adiabat>
and consider only the s-value to be the signature.
<adiabat>
with a pre-commited R-value, other users can make contracts based on the s value that they don't know yet, because they *do* know s*G for any message
<adiabat>
downside (which is pretty big) is that you can only sign once. So no RBF.
<adiabat>
and ... sortof risky
<gmaxwell>
yea, and very stateful.
<adiabat>
probably too foot-cannon-y to be useful but would allow for cool contracts; if you sign message m, sending coins over there, you reveal a partial key that lets me take other coins
<gmaxwell>
Another issue is that it's very ECC dependant, I feel kinda uneasy about going down the rathole of ECC stunts now that people are spreading a lot of QC concerns and recommending larger groups. At least we know how to make unconditionally sound CT. ISTM protocol that depend on EC stunts may have a short life.
<adiabat>
heh but EC stunts are so much fun :)
<gmaxwell>
I know!
<adiabat>
also if there's problems with secp256k1 discrete log then bitcoin is in real trouble
<adiabat>
some ZKP that you know the preimage... but so many pubkeys are known
<gmaxwell>
Depends on the nature of the problems. We can migrate to other signature schemes... with only a horrific bandwidth hit (storage is okay due to pruning, cpu is okay because hash based signatures are fast).
<gmaxwell>
Basically the question is how fast a break comes in... does it take the form of "oh this looks bad but not pratical yet" vs "surprise, totally busted!"
<adiabat>
yeah... hash based signatures, from what I've seen, don't let you do any fun stuff
<gmaxwell>
Yea, thats what I mean about reliance on EC stunts... basically everything we do now works in a world where we need to drop EC, except for the 30x increase in bandwidth.
<adiabat>
I don't think you can do non-hardened BIP32 though
<adiabat>
but that's not really a protocol level thing
<gmaxwell>
Thats true, though I kind of regret every introducing that to the world.
harrymm has joined #bitcoin-wizards
<gmaxwell>
er ever.
<gmaxwell>
It's seldom used at all correctly.
rusty1 has quit [Ping timeout: 260 seconds]
<adiabat>
oh... I like it. well other than I wish having the most significant bit = 0 should be 'hardened' or 'neutered' or whatever
MaxSan has quit [Ping timeout: 268 seconds]
<gmaxwell>
Almost all the things that use it send their extended public keys to some server, and using an untrusted one run by an anonymous and self-selecting third party.. oops there goes your privacy. Most of them also export private keys.. oops there goes your security.
<adiabat>
lots of " |= 1 << 31 "
<adiabat>
oh I don't think i've ever used the actual EC derivation ones, I just use it as a hash based key derivation path
<adiabat>
OK well I will still work on some non-consensus-based EC fun stuff for now
<gmaxwell>
Hardened (non EC based) is fine, I'm happy with that, though almost nothing uses it. The EC based is just too attractive to people.
<adiabat>
I bet we've got quite a few years left :)
<gmaxwell>
adiabat: well don't let me slow you down. For a lot of things the lifetime of the contracts is limited, so I think there is no harm in using EC for them.
rusty has joined #bitcoin-wizards
<adiabat>
in terms of schnorr, you think it's still worth trying to get a post-segwit schnorr operation in right?
<sipa>
absolutely
<gmaxwell>
adiabat: yes, though now we are in a little bit of a awkward position that doing it without segwit would be stupid, so we're sequence locked on segwit.. and also we need to find a way to get peer review on the exact specifics of the scheme; which is somewhat hard because it's inherently boring. :)
<adiabat>
I can't claim to be an expert in this area but whatever you want another set of eyes on, I'd definitely want to take a look
<gmaxwell>
Yes, you'd be a valuable reviewer on it. I already considered you conscripted to the task. :)
oleganza has joined #bitcoin-wizards
<adiabat>
would miners somehow be OK with schnorr but not segwit...?
<adiabat>
hah OK
<gmaxwell>
adiabat: I think not likely.
<adiabat>
also I propose we call ECDSA signatures "Schnorr signatures" since he is completely responsible for that algorithm ever being used.
<adiabat>
(also totally wouldn't be confusing at all)
oleganza has quit [Client Quit]
<gmaxwell>
Also apetite from developers on doing another non-segwit script upgrade is kinda low, it's really a PITA to be confident that a softfork is really a softfork, the best way of implementing that is to basically validate each scriptpubkey under every possible set of rules, which is more or less awful. :)
<gmaxwell>
adiabat: hah well also my pet-peeve: seems the bitcoin space has taken to calling signature aggregation "schnorr signatures", which mildly drives me nuts.
<CryptAxe>
Each scriptPubKey possible?
<gmaxwell>
Then we have the bit of fun where some sockpuppet is on twitter claiming random jibberish that schnorr signatures are encumbered by patents-- so more or less we've already seen the fighting against that begin even absent a proposal. (the motivation now is basically conflating segwit with schnorr signatures, either because the attacker is stupid or because they just assume their audience is ignor
<gmaxwell>
ant.)
rusty has quit [Ping timeout: 260 seconds]
Noldorin has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
MaxSan has joined #bitcoin-wizards
rmwb has joined #bitcoin-wizards
<adiabat>
they used to be encumbered I guess. I can't anticipate what miners will like / not like. OP_CSV activated without any discussion, even though it doesn't do much without some kind of malleability fix
<gmaxwell>
adiabat: yes, which is in fact probably the strongest form of patent clearence you can get! "we do what this clearly expired patent says."
<gmaxwell>
adiabat: oh CSV is pretty useful without any malleability anything; to the extent that smart contracts are useful.. perhaps doesn't help lightning so much.
<gmaxwell>
E.g. look at what green address does for 2 of 2 with a recovery timeout-- the recovery timeours require the server to behave honestly and send you nlocktimed clearence signatures. With CSV, the timeout doesn't need that anymore.
<gmaxwell>
Similarly a lot of proposed protocols like coinswaps are much simplier to implement and malleability immunie with a CSV.
<adiabat>
gmaxwell: huh... I guess there are some use cases. It seems like nobody complained about it though. Now seems like anything will be contentious
<adiabat>
hash-based signatures are pretty much all deterministic / non-malleable, right? So if it's the discrete log apocalypse and we have to switch to quantumn hard sigs... then we don't need segwit anymore!
Piper-Off has quit [Quit: I'm Gone!]
<gmaxwell>
adiabat: only if you eliminate smart contracts, DSA's inherent mallability is trivial to fix (make low-S a rule). Also the 30x size increase in hash based signatures makes segwit all the more critical.
<gmaxwell>
you ever hear about my fiat shamir sampling for hash based signtaures? Use the block hash to select a random subset of the hash based signature to reveal, to make it a couple times smaller. Perhaps reveal less the deeper a block is burried. :)
<adiabat>
sounds fun. See there are still stunts to be had even with only symmetric crypto
MaxSan has quit [Ping timeout: 255 seconds]
Piper-Off has joined #bitcoin-wizards
MaxSan has joined #bitcoin-wizards
CryptAxe has left #bitcoin-wizards [#bitcoin-wizards]
checksum0 has joined #bitcoin-wizards
oleganza has joined #bitcoin-wizards
MaxSan has quit [Ping timeout: 258 seconds]
MaxSan has joined #bitcoin-wizards
kankles has joined #bitcoin-wizards
MaxSan has quit [Ping timeout: 240 seconds]
Piper-Off has quit [Ping timeout: 240 seconds]
MaxSan has joined #bitcoin-wizards
rusty has joined #bitcoin-wizards
Ylbam has quit [Quit: Connection closed for inactivity]
tromp has quit [Remote host closed the connection]
mol has joined #bitcoin-wizards
tromp has joined #bitcoin-wizards
molz_ has quit [Ping timeout: 245 seconds]
Belkaar_ has quit [Ping timeout: 240 seconds]
Belkaar has joined #bitcoin-wizards
Belkaar has joined #bitcoin-wizards
Belkaar has quit [Changing host]
Pr0t3us has joined #bitcoin-wizards
tromp has quit [Remote host closed the connection]
bsm1175321 has joined #bitcoin-wizards
bsm117532 has quit [Read error: Connection reset by peer]
bsm1175321 has quit [Read error: Connection reset by peer]
binaryatrocity has joined #bitcoin-wizards
binaryatrocity has joined #bitcoin-wizards
binaryatrocity has quit [Changing host]
pro has quit [Quit: Leaving]
tromp has joined #bitcoin-wizards
belcher has quit [Quit: Leaving]
tromp has quit [Remote host closed the connection]
tromp has joined #bitcoin-wizards
zooko has joined #bitcoin-wizards
pedrovian has joined #bitcoin-wizards
rmwb has quit [Remote host closed the connection]
rmwb has joined #bitcoin-wizards
rmwb has quit [Ping timeout: 255 seconds]
rusty has quit [Ping timeout: 240 seconds]
Guest183884 has joined #bitcoin-wizards
Pr0t3us has quit [Quit: Leaving]
Guest183884 has quit [Quit: Page closed]
legogris has quit [Remote host closed the connection]
legogris has joined #bitcoin-wizards
rusty has joined #bitcoin-wizards
rmwb has joined #bitcoin-wizards
zooko has quit [Ping timeout: 260 seconds]
d9b4bef9 has quit [Remote host closed the connection]
oleganza has quit [Quit: oleganza]
TheSeven has quit [Ping timeout: 255 seconds]
TheSeven has joined #bitcoin-wizards
moli_ has joined #bitcoin-wizards
mol has quit [Ping timeout: 240 seconds]
Giszmo has quit [Quit: Leaving.]
tromp has quit [Remote host closed the connection]
rmwb has quit [Remote host closed the connection]
rmwb has joined #bitcoin-wizards
n1ce has quit [Ping timeout: 260 seconds]
n1ce_ has joined #bitcoin-wizards
waxwing has quit [Ping timeout: 268 seconds]
n1ce_ has quit [Quit: Leaving]
waxwing has joined #bitcoin-wizards
rmwb has quit [*.net *.split]
TheSeven has quit [*.net *.split]
dnaleor has quit [*.net *.split]
marcoagner has quit [*.net *.split]
qpm has quit [*.net *.split]
PsychoticBoy has quit [*.net *.split]
robmyers has quit [*.net *.split]
jtremback_____ has quit [*.net *.split]
dnaleor has joined #bitcoin-wizards
rmwb has joined #bitcoin-wizards
TheSeven has joined #bitcoin-wizards
marcoagner has joined #bitcoin-wizards
robmyers has joined #bitcoin-wizards
jtremback_____ has joined #bitcoin-wizards
tromp has joined #bitcoin-wizards
PsychoticBoy has joined #bitcoin-wizards
tromp has quit [Ping timeout: 268 seconds]
BashCo has quit [Ping timeout: 240 seconds]
rusty has quit [Ping timeout: 240 seconds]
BashCo has joined #bitcoin-wizards
mountaingoat has quit [Ping timeout: 240 seconds]
dnaleor has quit [Ping timeout: 240 seconds]
<fluffypony>
which wizards are going to be at Consensus?
<fluffypony>
I know andytoshi will be, I will be
dnaleor has joined #bitcoin-wizards
Guyver2 has joined #bitcoin-wizards
* sipa
won't
<sipa>
but i'm nearbt
<sipa>
*nearby
<sipa>
oh, it's in NY
<sipa>
nvm then
mountaingoat has joined #bitcoin-wizards
jtimon has joined #bitcoin-wizards
WungFu has joined #bitcoin-wizards
tromp has joined #bitcoin-wizards
tromp has quit [Ping timeout: 264 seconds]
mountaingoat has quit [Ping timeout: 240 seconds]
d9b4bef9 has joined #bitcoin-wizards
RubenSomsen has joined #bitcoin-wizards
mountaingoat has joined #bitcoin-wizards
rmwb has quit [Remote host closed the connection]
dnaleor_ has joined #bitcoin-wizards
dnaleor has quit [Ping timeout: 258 seconds]
renlord has quit [Quit: going to water the plants...]
laurentmt has joined #bitcoin-wizards
laurentmt has quit [Client Quit]
mryandao has quit [Read error: Connection reset by peer]
swoup has quit [Remote host closed the connection]
baffo32 has quit [Remote host closed the connection]
pro has quit [Quit: Leaving]
Aaronvan_ has quit []
AaronvanW has joined #bitcoin-wizards
MaxSan has quit [Ping timeout: 240 seconds]
MaxSan has joined #bitcoin-wizards
<JackH_>
is the problem this solves a real threat? Do we have any history on node spam by this type of attack?
JackH_ is now known as JackH
pro has joined #bitcoin-wizards
tromp has joined #bitcoin-wizards
RubenSomsen has quit [Ping timeout: 240 seconds]
rmwb has joined #bitcoin-wizards
RubenSomsen has joined #bitcoin-wizards
rmwb has quit [Ping timeout: 272 seconds]
mol has joined #bitcoin-wizards
moli_ has quit [Ping timeout: 258 seconds]
RubenSomsen has quit [Ping timeout: 255 seconds]
<Eliel_>
JackH: It's a potential attack. Whether it's actually happening in the wild is almost irrelevant because past experience from the last decades says that if an important system has a flaw like that, it'll be exploited by someone eventually.
molz_ has joined #bitcoin-wizards
mol has quit [Ping timeout: 240 seconds]
<benthamshead>
<stonecoldpat> I found out recently I would still be in US for consensus, but I couldn't justify paying extortionate registration fee :/ so I'll be in SF that week if anyone is around
rmwb has joined #bitcoin-wizards
asok has quit [Ping timeout: 245 seconds]
asok has joined #bitcoin-wizards
Giszmo has joined #bitcoin-wizards
<adiabat>
fluffypony: I think I will be at Consensus herding undergrads around
<mryandao>
why'd there be ugrads in Consensus?
<adiabat>
there's a "scholars program" where 50 undergrads get to go for free
<fluffypony>
adiabat: ok cool - we'll have a -wizards lunch or something
<adiabat>
in the list of applicants it was a little bit depressing as the "most interesting organization" students wrote about was often hyperledger or R3 or something
<mryandao>
isnt R3 defunct now?
<adiabat>
I dunno. I'm hoping to show them around and introduce them to people doing more decentralized / cryptographically secured work
<adiabat>
also for those in NYC who don't have free tickets, I *may* set up a dinner or event called "Contentious 2017"
laurentmt has joined #bitcoin-wizards
<adiabat>
for the cool kids who don't go to Consensus 2017
laurentmt has quit [Client Quit]
<mryandao>
i'd like to be a cool kid, but sadly i'm not in NYC.
<petertodd>
adiabat: ha, I'll go to NYC for that :)
<petertodd>
adiabat: a few of us are thinking of doing a Contentious 2017 conference as well :)
<adiabat>
petertodd: cool, everyone can argue and nobody will agree on anything. Like real life.
btcdrak has quit []
btcdrak has joined #bitcoin-wizards
<petertodd>
adiabat: can we at least agree we need a website?
rmwb has quit [Ping timeout: 272 seconds]
<fluffypony>
ConsensusLink.com
<fluffypony>
unmasking the real identities
<fluffypony>
behind Consensus attendees
<petertodd>
fluffypony: lol
<fluffypony>
from Consensus 2014
tromp has quit [Remote host closed the connection]
cyphase has quit [Ping timeout: 255 seconds]
<sipa>
stonecoldpat: come say hi in SF :)
herzmeister[m] has quit [Ping timeout: 252 seconds]
cyphase has joined #bitcoin-wizards
Davasny has joined #bitcoin-wizards
Davasny is now known as Guest3496
Guest3496 is now known as Dav2
herzmeister[m] has joined #bitcoin-wizards
Jeremy_Rand[m] has quit [Read error: Connection reset by peer]
frabrunelle has quit [Remote host closed the connection]
kewde[m] has quit [Remote host closed the connection]
bjorn[m]1 has quit [Read error: Connection reset by peer]
herzmeister[m] has quit [Read error: Connection reset by peer]
bjorn[m]1 has joined #bitcoin-wizards
jtremback_____ has quit []
jtremback_____ has joined #bitcoin-wizards
abpa has joined #bitcoin-wizards
rmwb has joined #bitcoin-wizards
<waxwing>
surprised consensus 2017 didn't ICO its tickets
UnrealLife has joined #bitcoin-wizards
<sipa>
Initial Conference Offering
<fluffypony>
waxwing: I'm even more surprised Token Summit hasn't