Timeline for Could the multisignature scheme in bitcoin alternatively also be implemented by means of a Shamir Secret Sharing Scheme?
Current License: CC BY-SA 3.0
27 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 8 at 17:06 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Oct 11, 2023 at 16:07 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jun 13, 2023 at 16:05 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Feb 13, 2023 at 16:04 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Oct 16, 2022 at 16:02 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jun 18, 2022 at 15:03 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| May 19, 2022 at 13:54 | answer | added | tur11ng | timeline score: 2 | |
| Aug 27, 2016 at 11:49 | history | tweeted | twitter.com/StackCrypto/status/769502185336037376 | ||
| Aug 25, 2016 at 13:05 | history | edited | Ilmari Karonen | CC BY-SA 3.0 |
replace the funny Greek letters with \oplus and \odot; feel free to revert if you object
|
| S Aug 25, 2016 at 12:57 | history | suggested | Guut Boy | CC BY-SA 3.0 |
formatted math better
|
| Aug 25, 2016 at 12:37 | comment | added | Guut Boy | Perhaps for that particular application of multisig transactions your scheme could work. If this is the only case your are interested in, then I guess what is known as verifiable secret sharing of $s_0$ should be sufficient. However, I have not checked that your concrete scheme is secure. | |
| Aug 25, 2016 at 10:10 | comment | added | erik | @Guut Boy: I was more thinking of using this for escrowing the value of one, single order. The seller, the buyer, and the marketplace would each hold a part of the secret. After receiving delivery, the buyer (Alice) would release her secrets to the seller (Bob). After that, the address would no longer be needed. Collectively signing a transaction without ever knowing s0 would indeed also be interesting, but it looks more complicated. I think that it will require a non-trivial intervention in the signature algorithm too. Any idea of how to do that? | |
| Aug 25, 2016 at 9:58 | review | Suggested edits | |||
| S Aug 25, 2016 at 12:57 | |||||
| Aug 25, 2016 at 9:22 | comment | added | Guut Boy | @erik The problem with your solution is that there will be some point where a single party is in full control of the funds. You cannot fix that in "the client software". Once that party has control (knows $s_0$), there is no way to make sure it does as promised, e.g., transfers some funds back to the multisig group or whatever. As pointed out above you can solve this by never revealing $s_0$ to any single party. Note, that in order to transfer (or receive) the funds you do not need to know $s_0$. You just have to be able to generate a transaction that is signed using $s_0$. | |
| Aug 25, 2016 at 8:37 | comment | added | Yehuda Lindell | @erik No. Once you get s0 you can generate any future signatures by yourself. The idea is to require all parties to approve every signature (i.e., every transfer of funds). By reconstructing, once a single transfer has taken place, it suffices for just one to transfer. | |
| Aug 25, 2016 at 6:47 | comment | added | erik |
@Yehuda Lindell: Why would it be a requirement for s0 never to be reconstructed? The party who is supposed to receive the money, would still need a copy of s0 to control the funds ...
|
|
| Aug 25, 2016 at 6:46 | comment | added | erik | @Guut Boy: I concede that it is not possible to make a new multisig transaction using (s0,p0). You are right that it can only be used one time. For a next transaction, you would need a new key exchange. Next, I concede that it is only usable for a pure 2-out-of-3 transaction. If you want to split one sum over two participants, e.g. commission for Alice ("small amount"), you will need two separate transactions. But then again, the client software could take care of that, no? This would just be a practical concern, no? | |
| Aug 25, 2016 at 5:52 | comment | added | Yehuda Lindell | @erik As the others are telling you, you cannot use Feldman (which just upgrades the secret sharing to be "verifiable"). You need a method where the signing key is NEVER reconstructed. | |
| Aug 25, 2016 at 4:50 | comment | added | Guut Boy | @erik Well if you want something similar to Bitcoin multisig transactions it seems to me you are not really getting that here. You have something where 2-out-of-3 can grant full control over all the funds to a single party. But Bitcoin transactions can be more complex than that. E.g., it is not clear how the parties in your example would make a new multisig transaction from their multisig group? Or how would they transfer a small amount of their funds while keeping the rest? This would be doable if the parties could sign with $s_0$ without knowing it. | |
| Aug 25, 2016 at 3:57 | comment | added | erik | @Yehuda Lindell: Is it acceptable to do treshold signing using the Feldman scheme/addon to SSS? Or do they use an alternative verification algorithm (for security reasons or so)? | |
| Aug 25, 2016 at 3:43 | history | edited | erik | CC BY-SA 3.0 |
distinction between elliptic and undistorted arithmetic
|
| Aug 25, 2016 at 2:23 | comment | added | erik | @Guut Boy: In the example, it does require the collaboration of Alice and Bob to control the funds. Any combination (Alice,Bob), (Alice,Charlie), (Bob,Charlie) would also grant control over the funds to one chosen player. Isn't that roughly the same effect as in a 2-of-3 signature scheme? | |
| Aug 24, 2016 at 21:06 | comment | added | Yehuda Lindell | This can be done using something called threshold signatures which is indeed a special case of MPC for signing. Threshold signature schemes are known for both RSA and ECDSA. | |
| Aug 24, 2016 at 13:27 | comment | added | Guut Boy | What you actually need to something that allows any 2 out of 3 parties to sign with $s_0$. This could of course be done using MPC. Or possibly some special signature scheme. | |
| Aug 24, 2016 at 13:14 | comment | added | Guut Boy | It appears to me that this does not give the actual functionality of Bitcoin multisig transactions. Namely, your scheme simply gives a way to reveal $s_0$ to one of three parties, who then has control and can transfer the funds as he likes. As I understand Bitcoin multisig the funds should only be transferable if 2 out of 3 agree to do so. | |
| Aug 24, 2016 at 12:17 | history | edited | erik | CC BY-SA 3.0 |
typos
|
| Aug 24, 2016 at 11:03 | history | asked | erik | CC BY-SA 3.0 |