You are viewing a single comment's thread from:

RE: Why does steem use this canonical thing instead of strict secp256k1?

in #beyondbitcoin • 8 years ago (edited)

Steem community,

Can anyone really read that doc and not get the heebie jeebies about widening the attack surface?

I'm sorry, but it truly seems baroque. What happened to simple is beautiful?

And this is my honest advice: stop doing things that are done better, yourself. grpc is better than this for you and for developers. Capn'proto would also work.

You may proceed with the ritualistic throwing of eggs.

You are also encouraged to test the crap out of our chains security in the same fashion. Maybe, somehow we can all make this work. And it would be neat, because there's a lot we can offer each other, and this is me all "whoa, alright, cool, but totally that's not... What you might ever expect..."

8 years ago in #beyondbitcoin by
$0.00
    Reply 7
    Sort:  
  • Trending
    • [-]
     8 years ago  

    If you really need sonething canonical you can try the rfc-compliant k and if the sig fail to be canonical .. you can increment k by one until you sig is canonical. Easy as that.

    $0.00
      Reply
      [-]
       8 years ago  

      @xeroc

      Your word carries a lot of weight with me, so please put it to me squarely:

      Do you think this poses a threat to security?

      How about usability?

      Isn't it something that can be simplified a great deal?

      If I'm off-base here, tell me so.

      $0.00
        Reply
        [-]
         8 years ago  

        Just give up the FUDing already, we've explained why you had this issue. There is no security issue here, in fact it's a non issue that you're attempting to make a big deal out of.

        If you weren't trying to FUD you would've just asked someone like xeroc who knows how this works and he would've explained it in 1 minute.

        $1.72
        • Past Payouts $1.72
        • - Author $1.72
        • - Curators $0.00
        4 votes
        Reply
        [-]
         8 years ago  

        In fact, these more strict requirements make the system more secure.
        You can realize that when you think about it from the information theoretical point of view. The requirement for r and s each being of length 32 means that the signature has to have a length of 64 (+1 for the pubkey recovery parameter). This requirement makes it impossible to leak information of the private key into the signature, no matter what you do.

        As for not being deterministic, there actually is no requirement for it whatsoever. All that RFC6979 results in is a random k which is needed to prevent an easy derivation of k from two signatures (if the same k is used twice). This can be done by using RFC6979, or just some random timestamp. Being able to deterministically derive k has no other impact than making sure that k isn't reused. And for that reason, graphene (as well as most clients) implement RFC6979 and then permute the k if necessary.

        $0.78
        • Past Payouts $0.78
        • - Author $0.78
        • - Curators $0.00
        2 votes
        Reply
        [-]
         8 years ago  

        @svk

        Attitudes like that are a threat to security here. Hell, it's why I stopped using the site. Why is there this extreme anti-progress undercurrent around here?

        [-]
         8 years ago (edited) 

        Hey xeroc, regarding to Piston, is this still available?
        There is a 'Lost connection to node' error message.

        $0.00
          Reply