5 ms·

Imagine you have 2 sets of keys to your house and if you lose both then your house is not yours anymore. That's what keeping your money outside an exchange seem

Imagine you have 2 sets of keys to your house and if you lose both then your house is not yours anymore. That's what keeping your money outside an exchange seems like to me. Exchanges are easy and familiar to people. If there was some secure way to do password recovery that was built into the currency that might be a game changer. That might be impossible by definition, not sure.

icebraining 9y ago
I think you definitively could make something like Keybase on Bitcoin, by using multiple third-party institutions (chosen by the user) as a fallback. When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity. Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again. -- Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.
- KMag 9y ago
  Too bad Bitcoin uses ECDSA instead of Ed25519 (or any other signature algorithm supporting threshold signatures). With threshold signatures, you don't even need something in the wallet saying "any N of the following M", you could just give secret shares to those M parties, and any N of them could collaborate to sign something using your single public key.
  - glitch003 9y ago
    You could just do that anyway by running Shamir's Secret Sharing Scheme on a Bitcoin private key, splitting the key into M parts where any N of M parts can be combined to recover the original private key.
    - KMag 9y ago
      That's a fair point, but threshold signatures are more generally useful, such as N of M board members authorizing payment to X, without having to place trust in a single board member not to change the transaction to a different amount or address.
- cocktailpeanuts 9y ago
  It's called "multisig wallet", and a lot of reputable online wallets implement this. Instead of doing what you suggested, normally it's 2 of 3 where it's your cold wallet, your hot wallet, and the online wallet provider.
KMag 9y ago
Do you have M friends, of which you're certain at most N-1 would collaborate to steal from you and/or get hacked? In that case, you can do secure password recovery. Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 < x < M, tell trusted party number x that they're party x and F(x) = y. Cooperation/collusion among any N of the M parties is sufficient to reconstruct the polynomial and calculate F(0). However, N-1 collaborators learn nothing about F(0), as long as you've generated all of your coefficients randomly and uniformly over the size of the subgroup generated by your elliptic curve's generator. You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation https://duckduckgo.com/?q=gennaro+distributed+key+generation Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.) Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.
- KMag 9y ago

icebraining 9y ago

I think you definitively could make something like Keybase on Bitcoin, by using multiple third-party institutions (chosen by the user) as a fallback. When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity. Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again. -- Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.

KMag 9y ago
Too bad Bitcoin uses ECDSA instead of Ed25519 (or any other signature algorithm supporting threshold signatures). With threshold signatures, you don't even need something in the wallet saying "any N of the following M", you could just give secret shares to those M parties, and any N of them could collaborate to sign something using your single public key.
- glitch003 9y ago
  You could just do that anyway by running Shamir's Secret Sharing Scheme on a Bitcoin private key, splitting the key into M parts where any N of M parts can be combined to recover the original private key.
  - KMag 9y ago
    That's a fair point, but threshold signatures are more generally useful, such as N of M board members authorizing payment to X, without having to place trust in a single board member not to change the transaction to a different amount or address.
cocktailpeanuts 9y ago
It's called "multisig wallet", and a lot of reputable online wallets implement this. Instead of doing what you suggested, normally it's 2 of 3 where it's your cold wallet, your hot wallet, and the online wallet provider.

KMag 9y ago

Do you have M friends, of which you're certain at most N-1 would collaborate to steal from you and/or get hacked? In that case, you can do secure password recovery. Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 < x < M, tell trusted party number x that they're party x and F(x) = y. Cooperation/collusion among any N of the M parties is sufficient to reconstruct the polynomial and calculate F(0). However, N-1 collaborators learn nothing about F(0), as long as you've generated all of your coefficients randomly and uniformly over the size of the subgroup generated by your elliptic curve's generator. You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation https://duckduckgo.com/?q=gennaro+distributed+key+generation Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.) Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.

KMag 9y ago