📅 Original date posted:2023-07-24
🗒️ Summary of this message: The text discusses concerns about the proposed scheme for blind music and suggests an alternative approach that may be worth exploring.
📝 Original message:
Hi Tom,
I'm not convinced that this works. As far as I know blind musig is still an open
research problem. What the scheme you propose appears to try to prevent is that
the server signs K times, but the client ends up with K+1 Schnorr signatures for
the aggregate of the server's and the clients key. I think it's possible to
apply a variant of the attack that makes MuSig1 insecure if the nonce commitment
round was skipped or if the message isn't determined before sending the nonce.
Here's how a malicious client would do that:
- Obtain K R-values R1[0], ..., R1[K-1] from the server
- Let
R[i] := R1[i] + R2[i] for all i <= K-1
R[K] := R1[0] + ... + R1[K-1]
c[i] := H(X, R[i], m[i]) for all i <= K.
Using Wagner's algorithm, choose R2[0], ..., R2[K-1] such that
c[0] + ... + c[K-1] = c[K].
- Send c[0], ..., c[K-1] to the server to obtain s[0], ..., s[K-1].
- Let
s[K] = s[0] + ... + s[K-1].
Then (s[K], R[K]) is a valid signature from the server, since
s[K]*G = R[K] + c[K]*a1*X1,
which the client can complete to a signature for public key X.
What may work in your case is the following scheme:
- Client sends commitment to the public key X2, nonce R2 and message m to the
server.
- Server replies with nonce R1 = k1*G
- Client sends c to the server and proves in zero knowledge that c =
SHA256(X1 + X2, R1 + R2, m).
- Server replies with s1 = k1 + c*x1
However, this is just some quick intuition and I'm not sure if this actually
works, but maybe worth exploring.
Jonas Nick [ARCHIVE] /
npub1at…y3z5a
2023-07-24 17:55:41
in reply to nevent1q…aje3
Author Public Key
npub1at3pav59gkeqz9kegzqhk2v4j4r435x42ytf23pxs8crt74tuc8s2y3z5aPublished at
2023-07-24 17:55:41Event JSON
{
"id": "3c8f294597c6632baf747f19d5a9e11a024097a93d2bd0a2c7149e10bd71383d",
"pubkey": "eae21eb28545b20116d940817b2995954758d0d5511695442681f035faabe60f",
"created_at": 1690214141,
"kind": 1,
"tags": [
[
"e",
"86a87258a295f0e8a6ce06957ce368a6146cf45a73137d0af6fcc0729ce599a0",
"",
"root"
],
[
"e",
"b186f63cf3d07272c8e0d0aa5753b97d679b5df70f121f3dd075b83a068ea2fb",
"",
"reply"
],
[
"p",
"22944ce1e29904e3826d25013a614e4665693ec514003efacc1b7586e8e5d0aa"
]
],
"content": "📅 Original date posted:2023-07-24\n🗒️ Summary of this message: The text discusses concerns about the proposed scheme for blind music and suggests an alternative approach that may be worth exploring.\n📝 Original message:\nHi Tom,\n\nI'm not convinced that this works. As far as I know blind musig is still an open\nresearch problem. What the scheme you propose appears to try to prevent is that\nthe server signs K times, but the client ends up with K+1 Schnorr signatures for\nthe aggregate of the server's and the clients key. I think it's possible to\napply a variant of the attack that makes MuSig1 insecure if the nonce commitment\nround was skipped or if the message isn't determined before sending the nonce.\nHere's how a malicious client would do that:\n\n- Obtain K R-values R1[0], ..., R1[K-1] from the server\n- Let\n R[i] := R1[i] + R2[i] for all i \u003c= K-1\n R[K] := R1[0] + ... + R1[K-1]\n c[i] := H(X, R[i], m[i]) for all i \u003c= K.\n Using Wagner's algorithm, choose R2[0], ..., R2[K-1] such that\n c[0] + ... + c[K-1] = c[K].\n- Send c[0], ..., c[K-1] to the server to obtain s[0], ..., s[K-1].\n- Let\n s[K] = s[0] + ... + s[K-1].\n Then (s[K], R[K]) is a valid signature from the server, since\n s[K]*G = R[K] + c[K]*a1*X1,\n which the client can complete to a signature for public key X.\n\nWhat may work in your case is the following scheme:\n- Client sends commitment to the public key X2, nonce R2 and message m to the\n server.\n- Server replies with nonce R1 = k1*G\n- Client sends c to the server and proves in zero knowledge that c =\n SHA256(X1 + X2, R1 + R2, m).\n- Server replies with s1 = k1 + c*x1\n\nHowever, this is just some quick intuition and I'm not sure if this actually\nworks, but maybe worth exploring.",
"sig": "bbc06bd5ed1faa949f441400a12bc9f802ba322c7611429c14fcbc48f59cb3ab9c834b091ae6eea9396795e79e2fc9b64707d3b2adc8467f69330fa6f6a1fb95"
}