sipa changed the topic of #bitcoin-wizards to: This channel is for discussing theoretical ideas with regard to cryptocurrencies, not about short-term Bitcoin development | http://bitcoin.ninja/ | This channel is logged. | For logs and more information, visit http://bitcoin.ninja
weez17 has quit [Quit: Lost terminal]
MarcoFalke has joined #bitcoin-wizards
_tin has joined #bitcoin-wizards
bildramer has quit [Quit: Of course we scientists have our little secrets. For instance, the moon is in Spain. Another: stars aren't real. Also, cells are huge. One cell is roughly the size of a marble.]
jcorgan_ has quit [Ping timeout: 268 seconds]
_tin has quit [Ping timeout: 252 seconds]
nejon has quit [Quit: Connection closed for inactivity]
Chris_Stewart_5 has joined #bitcoin-wizards
nejon has joined #bitcoin-wizards
bildramer has joined #bitcoin-wizards
mn3monic has quit [Excess Flood]
mn3monic has joined #bitcoin-wizards
mn3monic has quit [Changing host]
mn3monic has joined #bitcoin-wizards
mn3monic has quit [Excess Flood]
mn3monic has joined #bitcoin-wizards
AaronvanW has joined #bitcoin-wizards
AaronvanW has quit []
Krellan has quit [Read error: Connection reset by peer]
Krellan has joined #bitcoin-wizards
thrmo has quit [Quit: Waiting for .007]
jb551 has quit [Quit: WeeChat 2.1]
jb55 has joined #bitcoin-wizards
Belkaar has quit [Ping timeout: 252 seconds]
Belkaar has joined #bitcoin-wizards
Belkaar has quit [Changing host]
Belkaar has joined #bitcoin-wizards
rh0nj has joined #bitcoin-wizards
AaronvanW has joined #bitcoin-wizards
thomasan_ has joined #bitcoin-wizards
CheckDavid has quit [Quit: Connection closed for inactivity]
tromp_ has quit [Remote host closed the connection]
tromp has joined #bitcoin-wizards
thomasan_ has quit [Remote host closed the connection]
_tin has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 252 seconds]
Cory has quit [Ping timeout: 272 seconds]
Pasha has joined #bitcoin-wizards
Pasha is now known as Cory
SopaXorzTaker has joined #bitcoin-wizards
Krellan has quit [Read error: Connection reset by peer]
Krellan has joined #bitcoin-wizards
Guyver2 has joined #bitcoin-wizards
_tin has quit [Ping timeout: 272 seconds]
p0nziph0ne has joined #bitcoin-wizards
tromp has quit [Remote host closed the connection]
tromp has joined #bitcoin-wizards
tombusby has quit [Ping timeout: 256 seconds]
tombusby has joined #bitcoin-wizards
Krellan has quit [Read error: Connection reset by peer]
wildermind has joined #bitcoin-wizards
gribble has quit [Remote host closed the connection]
gribble has joined #bitcoin-wizards
<jl2012>
Do we know which points are valid on the curve, but not a multiple of G?
<jl2012>
I think there are (p - n) of such points?
<sipa>
G is a generator for the curve; by definition every point is a multiple of it
<sipa>
(this is true for secp256k1, but not for all curves - in particular EC groups with cofactors it isn't true)
<sipa>
jl2012: there are p possible x and y coordinates, but only n (x,y) pairs are on the curve
<jl2012>
sipa: thanks!
<sipa>
jl2012: in some EC systems only s subgroup of the curve is used, i that case not every group element is a multiple of the generator
<sipa>
however group theory says that a subgroup of a finite group must always be a divisor of its size
<jl2012>
sipa: for things like g'root that requires another generator, it must also be a multiple of G?
<sipa>
indeed
<sipa>
but it must be an unknown multiple of G
<jl2012>
We could take a hash of a trivial message, and see if it is a valid x value?
<sipa>
yup, that's how you do it
<sipa>
also include G in the message
<sipa>
so that nobody can claim you secret are the author of G, and picked it in function of this newgenerator you're just proposing
<sipa>
for CT in Elements we just used SHA256(G.x)
<sipa>
iirc
<sipa>
or something like that
<jl2012>
Thanks
<nsh>
called "nothing up my sleeves" constructions
<nsh>
or numbers
<sipa>
nums!
<sipa>
(not confusing at all)
TheoStorm has quit [Quit: Leaving]
<nsh>
:)
<nsh>
nums numbs
TheoStorm has joined #bitcoin-wizards
<waxwing>
sometimes called coerce-to-point; a kind of cryptographer's micro-aggression
Zenton has quit [Read error: Connection reset by peer]
Zenton has joined #bitcoin-wizards
thrmo has joined #bitcoin-wizards
SopaXorzTaker has quit [Quit: Leaving]
laurentmt has joined #bitcoin-wizards
laurentmt has quit [Quit: laurentmt]
Chris_Stewart_5 has joined #bitcoin-wizards
nuncanada has joined #bitcoin-wizards
SopaXorzTaker has joined #bitcoin-wizards
deusexbeer has quit [Quit: Konversation terminated!]
SopaXorzTaker has quit [Quit: Leaving]
jb55 has quit [Quit: WeeChat 2.1]
jb55 has joined #bitcoin-wizards
Krellan has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 268 seconds]
vcorm has quit [Ping timeout: 256 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 268 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
nuncanada has quit [Quit: Leaving]
Krellan has quit [Ping timeout: 250 seconds]
Chris_Stewart_5 has quit [Ping timeout: 252 seconds]
bildramer has quit [Ping timeout: 264 seconds]
bildramer has joined #bitcoin-wizards
Giszmo has joined #bitcoin-wizards
Giszmo has quit [Client Quit]
Krellan has joined #bitcoin-wizards
Emcy has quit [Ping timeout: 244 seconds]
Guyver2 has quit [Remote host closed the connection]
Emcy has joined #bitcoin-wizards
shesek has quit [Ping timeout: 272 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
_tin has joined #bitcoin-wizards
vdo has quit [Ping timeout: 245 seconds]
Krellan has quit [Ping timeout: 240 seconds]
nickler has quit [Ping timeout: 252 seconds]
_tin has quit [Ping timeout: 252 seconds]
kenshi84 has quit [Ping timeout: 268 seconds]
kenshi84 has joined #bitcoin-wizards
kenshi84 has quit [Ping timeout: 252 seconds]
kenshi84 has joined #bitcoin-wizards
kenshi84 has quit [Ping timeout: 252 seconds]
kenshi84 has joined #bitcoin-wizards
schmidty has joined #bitcoin-wizards
schmidty is now known as Guest75321
Guest81722 has quit [Ping timeout: 268 seconds]
nickler has joined #bitcoin-wizards
ghost43 has quit [Remote host closed the connection]
ghost43 has joined #bitcoin-wizards
<jimpo>
In the batch verification algorithm in BIP schnorr, why is a_1 omitted (or == 1)?
<sipa>
jimpo: only the ratios between the different factors need to be unpredictable
<sipa>
so one of them can be chosen as 1
morcos has quit [Remote host closed the connection]
morcos has joined #bitcoin-wizards
<jimpo>
Right. So it can be 1, but it would not be unsafe if there was a random a_1 coefficient?
<jl2012>
it seems possible to batch validate taproot (Q = kG + P) with Schnoor (R = sG - eP) ?
<jl2012>
But what about y(Q)?
<jl2012>
Just replace e = n-1; and signature(r,s) = (x(Q),k)
thrmo has quit [Remote host closed the connection]
thrmo has joined #bitcoin-wizards
<jimpo>
y(Q) would be known because the pubkey Q would be pushed into the script in compressed form, I assume?
<jl2012>
yes, but could it work with the batch validation in bip_schnorr, which requires jacobi(y(R)) = 1 ?
<jimpo>
Yeah, I don't think that would be a problem. It's only required in the BIP so that a 32 byte x coordinate can be unambiguously mapped to a pubkey
<jimpo>
And in the batch verification the group element R is reconstructed
<jimpo>
so if you start with Q, I believe it's fine
p0nziph0ne has quit [Quit: Leaving]
<jl2012>
thanks
<sipa>
jimpo: yeah, there could be a random a_1
<sipa>
jl2012: and indeed if you start from the x coordinate and decompress, the jacobi symbol of y will always be 1
<sipa>
also jacobi symbols are an order of magnitude less work than an EC multiplication
Krellan has joined #bitcoin-wizards
<jl2012>
we could also "convert" a Schnorr sig into an ECDSA sig? msg = -rs/e; sig = r||-r/e
<sipa>
what does that mean?
<jl2012>
take a schnorr_bip sig (r,s) for e and P. We can convert it to an ECDSA sig (r, -r/e) for msg = -rs/e and P
<jl2012>
the schnorr sig is valid if and only if the transformed ECDSA is valid
<sipa>
e is the message, or e = H(R||P||m) ?
<jl2012>
e = H(R||P||m)
<sipa>
that's technically not true, as the msg in ECDSA needs to be a hash
<jl2012>
yes, but libsecp256k1 allows me to inject any msg I want
<sipa>
that's true
<jl2012>
my point is, I could cheat libsecp256k1 to validate a Schnorr sig for me
<sipa>
but if you're talking about specific schemes, ECDSA won't check that the jacobi symbol is right, and you always have overflow issues in theory
<sipa>
(the R'x coordinate is stored modulo n in an ECDSA sig)
<jl2012>
I'm just trying to figure out their mathematical relationship
<jl2012>
it seems ECDSA, Schnorr, taproot are all related
bildramer has quit [Ping timeout: 252 seconds]
bildramer has joined #bitcoin-wizards
<sipa>
jl2012: well they're all just an EC multiplication and soke hashes :)
<sipa>
*some
<jl2012>
yes, adding 2 multiplications
deusexbeer has joined #bitcoin-wizards
jb55 has quit [Quit: WeeChat 2.2]
vdo has joined #bitcoin-wizards
vdo has joined #bitcoin-wizards
vdo has quit [Changing host]
Dizzle has joined #bitcoin-wizards
bitcoin-wizards3 has joined #bitcoin-wizards
bitcoin-wizards3 has quit [Client Quit]
arubi has quit [Remote host closed the connection]
arubi has joined #bitcoin-wizards
luke-jr has quit [Read error: Connection reset by peer]
belcher has quit [Read error: Connection reset by peer]
belcher has joined #bitcoin-wizards
belcher has quit [Remote host closed the connection]
luke-jr has joined #bitcoin-wizards
wildermind has quit [Quit: Connection closed for inactivity]
belcher has joined #bitcoin-wizards
Krellan has quit [Read error: Connection reset by peer]
Krellan has joined #bitcoin-wizards
thrmo_ has joined #bitcoin-wizards
thrmo has quit [Ping timeout: 256 seconds]
Chris_Stewart_5 has quit [Ping timeout: 252 seconds]
thrmo_ is now known as thrmo
Murch has joined #bitcoin-wizards
Emcy has quit [Remote host closed the connection]
shesek has joined #bitcoin-wizards
shesek has quit [Changing host]
shesek has joined #bitcoin-wizards
thomasan_ has joined #bitcoin-wizards
Krellan has quit [Ping timeout: 260 seconds]
mn3monic has quit [Excess Flood]
mn3monic has joined #bitcoin-wizards
Dizzle has quit [Remote host closed the connection]
Dizzle has joined #bitcoin-wizards
thomasa__ has joined #bitcoin-wizards
thomasan_ has quit [Read error: Connection reset by peer]