Post
Topic
Board Development & Technical Discussion
Re: [ANN] CoinMessage: Secure Messaging with Bitcoin Addresses
by
gmaxwell
on 18/12/2013, 00:12:15 UTC
If I'm not mistaken, this is an attack that can be performed on any elliptical curve, not just secp256k1.
Not so, there are twist-secure curves like the one used by curve25519 where the points on the twist are equally secure.

Quote
Is the fact that the private exponent is also used to sign messages somehow related to this attack?
The general statement cautioning against using the same keys for encryption and signing is because the parallel composition of signing and encryption is an unanalyzed construct. I might be able to take some signatures, combine them algebraically, ask for a decryption, and learn something about the private key as a result. Providing parallel access to the private key material, even if its via constructs which are separately accepted as cryptographically strong, voids the security proofs and deployment confidences, and surprising weaknesses have shown up in the past as a result of it. ... so it's generally considered a good practice to avoid it where possible.

I'm disappointed to see that the conversation with Luke went unproductive there, he is responsible— AFAIK— the largest and longest standing use of bitcoin keys for identification/authentication purposes; which were one of your enumerated use cases.  I actually asked him to come here and respond specifically to those use cases.

Likewise, andytoshi has been active in the Bitcoin wizards channel where a lot of advanced cryptography is discussed for some time. He's not a sock of anyone, and negative tone is just going to discourage people from evaluating your system.