On Wed, Jul 11, 2018, 02:42 Erik Aronesty via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> wrote: > Basically you're just replacing addition with interpolation everywhere in the musig construction
Yes, but you can't do that without a delinearization mechanism to prevent adaptive public key choice being used to break the scheme using Wagner's attack. It is not specific to addition, it is a generalized birthday attack. Look at the delinearization mechanism for an intuition, all public keys are hashed along with per value hash, so that pre-commits and forces the public keys to be non-adaptively chosen. Adaptively chosen public keys are dangerous and simple to exploit for example pub keys A+B, add party C' he chooses C=C'-A-B, now we can sign for A+B+C using adaptively chose public key C. Btw Wagner also breaks this earlier delinearization scheme S=H(A)*A+H(B)*B+H(C)*C Adam
_______________________________________________ bitcoin-dev mailing list bitcoin-dev@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
