Quote from: gmaxwell on December 18, 2013, 12:12:15 AM

Quote from: altoz on December 17, 2013, 02:03:08 PM

If I'm not mistaken, this is an attack that can be performed on any elliptical curve, not just secp256k1.

Not so, there are twist-secure curves like the one used by curve25519 where the points on the twist are equally secure.

This might be true, but I still don't understand how useful such an attack would be. If the attack relies on sweeping the checksum, then having an impractically large checksum (2^128?) simply stops the attack.

Quote

The general statement cautioning against using the same keys for encryption and signing is because the parallel composition of signing and encryption is an unanalyzed construct. I might be able to take some signatures, combine them algebraically, ask for a decryption, and learn something about the private key as a result. Providing parallel access to the private key material, even if its via constructs which are separately accepted as cryptographically strong, voids the security proofs and deployment confidences, and surprising weaknesses have shown up in the past as a result of it. ... so it's generally considered a good practice to avoid it where possible.

This is the more valid objection. There's the possibility of a vulnerability yet undiscovered. Obviously, RSA has had this vulnerability so it makes sense that caution is being taken with ECC.

That said, a good, deliberately slow key derivation function should be able to make the attack very expensive. 50000 rounds of sha512, for example (to make it future-proof, we could make the rounds of sha512 necessary some fraction of the network difficulty and provide a timestamp of when it occurred). Would something like that make this more viable?

Also, you mention that it's good practice to avoid it where possible. does that mean there are cases where it isn't avoidable and this does take place?

Quote

I'm disappointed to see that the conversation with Luke went unproductive there, he is responsible AFAIK the largest and longest standing use of bitcoin keys for identification/authentication purposes; which were one of your enumerated use cases. I actually asked him to come here and respond specifically to those use cases.

Honestly, I'm finding your comments far more helpful than his. He could be a genius for all I know, but I'm not interested in pedantic arguments about what "account" means.

Quote

Likewise, andytoshi has been active in the Bitcoin wizards channel where a lot of advanced cryptography is discussed for some time. He's not a sock of anyone, and negative tone is just going to discourage people from evaluating your system.

Sadly, I agree with you. Of course I have some share in that responsibility. Unfortunately, other than that first comment, I don't see anything of value in their other comments and I don't see much likelihood in there being any from them at this point. Life is too short to deal rudeness like that unless absolutely necessary.

Obviously, people are free to not evaluate the system. I think given the potential of the whole thing, I would be pretty disappointed if the only technical commentary I got was from you.

That said, thank you for your thoughts so far.