📅 Original date posted:2016-04-18
📝 Original message:I just realize that if we have OP_CAT, OP_CHECKPRIVATEKEYVERIFY (aka OP_CHECKPRIVPUBPAIR) is not needed (and is probably better for privacy)
Bob has the prikey-x for pubkey-x. Alice and Bob will agree to a random secret nonce, k. They calculate r, in the same way as signing a transaction.
The script is:
SIZE <r-length + 1> ADD <0x30> SWAP CAT <0x02|r-length|r> CAT SWAP CAT <pubkey-x> CECHKSIGVERIFY <Bob pubkey hash> CHECKSIG
To redeem, Bob has to provide:
<Bob sig> <0x02|s-length|s|sighashtype>
With k, s and sighash, Alice (and only Alice) can recover the prikey-x with the well-known k-reuse exploit
( https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm )
The script will be much cleaner if we remove the DER encoding in the next generation of CHECKSIG
The benefit is prikey-x remains a secret among Alice and Bob. If they don’t mind exposing the prikey-x, they could use r = x coordinate of pubkey-x, which means k = prikey-x (https://bitcointalk.org/index.php?topic=291092.0) This would reduce the witness size a little bit as a DUP may be used
From: bitcoin-dev-bounces at lists.linuxfoundation.org [mailto:bitcoin-dev-bounces at lists.linuxfoundation.org] On Behalf Of Tier Nolan via bitcoin-dev
Sent: Monday, 29 February, 2016 19:53
Cc: Bitcoin Dev <bitcoin-dev at lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] BIP CPRKV: Check private key verify
On Mon, Feb 29, 2016 at 10:58 AM, Mats Jerratsch <matsjj at gmail.com <mailto:matsjj at gmail.com> > wrote:
This is actually very useful for LN too, see relevant discussion here
http://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-November/011827.html
Is there much demand for trying to code up a patch to the reference client? I did a basic one, but it would need tests etc. added.
I think that segregated witness is going to be using up any potential soft-fork slot for the time being anyway.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160419/232ba8d8/attachment.html>;
jl2012 at xbt.hk [ARCHIVE] /
npub1kc…wjfw4
2023-06-07 19:50:08
in reply to nevent1q…pzk2
Author Public Key
npub1kc0zulxt7j4a0ayhzhrz7jk84y7tm4026qcky7w97hlfkxxap24qnwjfw4Published at
2023-06-07 19:50:08Event JSON
{
"id": "f5e6d026574185cf7c73eaa12f043cf42d5004f974a624a3937100637e269952",
"pubkey": "b61e2e7ccbf4abd7f49715c62f4ac7a93cbdd5ead0316279c5f5fe9b18dd0aaa",
"created_at": 1686160208,
"kind": 1,
"tags": [
[
"e",
"d33e97d2f25b703adc1682f1b37e12fed033c34885e3a36150c314ec289a80f7",
"",
"reply"
],
[
"p",
"a23dbf6c6cc83e14cc3df4e56cc71845f611908084cfe620e83e40c06ccdd3d0"
]
],
"content": "📅 Original date posted:2016-04-18\n📝 Original message:I just realize that if we have OP_CAT, OP_CHECKPRIVATEKEYVERIFY (aka OP_CHECKPRIVPUBPAIR) is not needed (and is probably better for privacy)\n\n \n\nBob has the prikey-x for pubkey-x. Alice and Bob will agree to a random secret nonce, k. They calculate r, in the same way as signing a transaction.\n\n \n\nThe script is:\n\n \n\nSIZE \u003cr-length + 1\u003e ADD \u003c0x30\u003e SWAP CAT \u003c0x02|r-length|r\u003e CAT SWAP CAT \u003cpubkey-x\u003e CECHKSIGVERIFY \u003cBob pubkey hash\u003e CHECKSIG\n\n \n\nTo redeem, Bob has to provide:\n\n \n\n\u003cBob sig\u003e \u003c0x02|s-length|s|sighashtype\u003e\n\n \n\nWith k, s and sighash, Alice (and only Alice) can recover the prikey-x with the well-known k-reuse exploit\n\n( https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm )\n\n \n\nThe script will be much cleaner if we remove the DER encoding in the next generation of CHECKSIG\n\n \n\nThe benefit is prikey-x remains a secret among Alice and Bob. If they don’t mind exposing the prikey-x, they could use r = x coordinate of pubkey-x, which means k = prikey-x (https://bitcointalk.org/index.php?topic=291092.0) This would reduce the witness size a little bit as a DUP may be used\n\n \n\nFrom: bitcoin-dev-bounces at lists.linuxfoundation.org [mailto:bitcoin-dev-bounces at lists.linuxfoundation.org] On Behalf Of Tier Nolan via bitcoin-dev\nSent: Monday, 29 February, 2016 19:53\nCc: Bitcoin Dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e\nSubject: Re: [bitcoin-dev] BIP CPRKV: Check private key verify\n\n \n\nOn Mon, Feb 29, 2016 at 10:58 AM, Mats Jerratsch \u003cmatsjj at gmail.com \u003cmailto:matsjj at gmail.com\u003e \u003e wrote:\n\nThis is actually very useful for LN too, see relevant discussion here\n\nhttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-November/011827.html\n\n \n\nIs there much demand for trying to code up a patch to the reference client? I did a basic one, but it would need tests etc. added.\n\nI think that segregated witness is going to be using up any potential soft-fork slot for the time being anyway.\n\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160419/232ba8d8/attachment.html\u003e",
"sig": "d577fad2c5eef7abef8f5df71dfcb966d09b60937467f5218ba947c0dd788783f31fede7dc3ef01ec25c38bf5fc8fd75f3f0da8d63fd80305bd81bc3cdf91dba"
}