Quote from: Stefan Thomas on September 11, 2012, 08:32:03 PM

Let's say you have a message pubkey M. It was calculated from issuer public key P₁ and Bond message hash b₁ as M = P₁ * b₁.

Now I'm an evil attacker and I want to create another pair P₂, b₂ that also results in M. What I can do I choose an arbitrary Bond message, calculate its hash b₂ and then calculate P₂ = M * b₂^-1. Obviously I don't have the corresponding private key but having a valid pair P₂, b₂ might be enough to cause problems

Whoever holds the private key for P₁ can easily calculate the private key for P₂. I haven't been following your scheme but I presume that's the issuer. If I catch on correctly then the issuer could misrepresent some information about the bond, saying that the issuer public key was actually P₂.

Quote from: Mike Hearn on September 11, 2012, 09:26:26 PM

For those following along b^-1 means the modular inverse of b, that is xb mod n = 1 where x is the solution and n is defined by secp256k1 as the prime in which all modular operations take place.

The "modular operations" use the prime p but for the above calculation you should use the group order n which is a somewhat smaller prime.

Code:

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

Quote from: Mike Hearn on September 11, 2012, 03:59:42 PM

I think you meant transaction hash not signature hash, right? I think the fact that the block chain is entirely self validating is pretty important though!

Yes that's what I meant. The block chain is still entirely self-validating if the transaction hash doesn't include the signature as long as you bother to store the signature. At the moment though you HAVE to store the signatures. Can anyone propose a remotely plausible scenario in which we would regret not hashing the signatures?

ByteCoin