7 ms·

Blind signatures for Bitcoin to secure BTC storage

66 points by oleganza 13y ago

JacobH 13y ago
A "blind signature" sounds like an odd concept. What can be done I just thought up is adding another transport layer to bitcoin. And breaking up and distributing the wallet's contents "sum" among strangers into something like a checksum. Then on transactions bringing the chunks of checksum partially back together. How it's broken down can vary. you have to remember though, if you are buying something for $10 all that needs to be verified is that you have $10 or more for the next step.
- oleganza 13y ago
  The scheme allows never holding all secret pieces in one place to make a transaction. Otherwise, if your machine is compromised, someone can send your money elsewhere. I don't quite understand your proposal, but it requires having all chunks in one place to make a transaction.
JacobH 13y ago
Something that also just came to me, instead of having one large sum on money in one wallet. Who says it can't be distributed and broken down in max wallet sizes of $50 or so. $50 is a common number no one should really care too much about. So there goes your concern about being able to see wallet size. If something costs more than $50 group multiple wallets into the transaction.
- Retric 13y ago
  And how do you plan to realistically manage 200 such wallet's? Realistically you would have a computer somewhere know there key's which introduces the same inherent risk as having that computer manage a single wallet. If you really want secure storage you print out your private key's and store them in one or more vaults. If your even more paranoid you can encrypt the information such that you need more than one vault to access the data, but have some redundancy so if one storage location floods you don't lose any bit-coins. Which is where these N of M encryption schemes become useful.
  - JacobH 13y ago
    The idea is less about losing coin, and more about concealing wallet size from people that don't need to know about how much money is in a bitcoin wallet. My idea is more along the lines of instead of pulling out a wad of money you're only pulling out $50 at a time. Me personally, I don't mind the wallet amount being public because for things lie fundraising it keeps people honest.
    - hendzen 13y ago
      In the bitcoin world, this technique is known as "merge avoidance" - read about it here: https://medium.com/bitcoin-banter/7f95a386692f https://medium.com/bitcoin-banter/7f95a386692f
  - JacobH 13y ago
    Implementation would have to be along the lines of a proxy, decentralizing ownership is a nice way to lose some friends.
- vanschelven 13y ago
  If I recall correctly Bitcoin already provides this out of the box: a wallet is already a collection of public/private keypairs (and not a single public address). You could at any point divide your money over an arbitrary amount of addresses that you own(maybe at a small transaction cost). This does not mean people could still try to understand what's really happening by analysing the full graph.
- oleganza 13y ago
  The multisig vault makes sense for relatively large stash which would take a lot of $50 transactions to brake down into. Also, as you ask your friends to sign off $50 redeeming txs, they'd see how much did you have previously. Not ideal. In my paper I propose using sequential generation of parameters so you can break down your funds into multiple transactions, but it's only for convenience, your privacy vis-a-vis your friends is still absolute.
natrius 13y ago
Why would you use this instead of a warp wallet? https://keybase.io/warp/ https://keybase.io/warp/
- mrfusion 13y ago
  Good question. I've been meaning to try that one. Anyone know how secure it is? Is there a way to get Btc out if that site goes down?
  - bglusman 13y ago
    From the page: "This page is self-contained for portability. Save it on your computer - all the JS, CSS, and images are embedded. It's also hosted on github." Link: https://github.com/keybase/warpwallet https://github.com/keybase/warpwallet
- oleganza 13y ago
  Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking. Keybase is a single point of failure. Or your machine that will do KDF. M-of-N multisig transactions are way safer because to sign a specific transaction you never need to have all secret material at once on a single machine. If my PC is compromised, I can still independently verify specific transaction I want to sign and send it out to my friends to sign. All their private keys are stored on independent machines which normally aren't compromised altogether by the same attacker. On specific problem with brainwallets - low entropy. One specific problem with web apps: no code signing. Even if your SSL pubkey is pinned (which is not supported by any browser yet), the code you receive from the server is never remembered and pinned (like with installed apps). If their server is silently compromised tomorrow, someone may humbly hijack keys of 1% of the users and go undetected for quite some time.
  - j_s 13y ago
    > which you obviously haven't read before asking This blew my mind; so unkind!
gesman 13y ago
Adding another entity to rely on to hold funds "safe" just adds another link to the chain that can die, disappear, change it's mind and be broken. I personally love how Electrum wallet does it: You may generate and regenerate wallet using only key word phrase. Keep it safe in memory or in bank deposit box. No backups needed. You may always regenerate wallet by keyphrase.
- VMG 13y ago
  The idea is spreading the security to multiple systems. Electrum doesn't help you if you enter the passphrase on a compromised computer.
- wes-exp 13y ago
  No backups needed Doesn't Electrum do this by backing up your wallet to "the cloud"? Even if it is 100% properly encrypted, I can't say that I feel good about this. Feels like one bug away from compromising many people's wallets.
  - jimrandomh 13y ago
    No, it does not.
    - wes-exp 13y ago
      Are you sure? Why does the restore process require a server address? https://electrum.org/seed.html https://electrum.org/seed.html The screenshot uses ecdsa.org, which seems to be just an Electrum server of some kind.
      - bglusman 13y ago
        Pretty sure that's because Electrum doesn't download the entire blockchain but relies on servers for most of it and only downloads a certain amount of recent history and trusts servers for older history. And it doesn't have to be that server, which is why app lets you change the URL, any server serving blockchain history you trust is fine. It's using your passphrase as the one and only seed for key generation, so it can reliably generate same private key every time. Someone correct me if I'm mistaken on any details.
betterunix 13y ago
The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Some kind of threshold system? Some kind of special-purpose multiparty computation protocol?
- oleganza 13y ago
  The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.
  - betterunix 13y ago
    "The paper only discusses blind signature algorithm" No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this: "The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does not allow anyone to prove that the signing party signed a particular message" I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful? To put it another way, what differentiates your proposal from this: https://eprint.iacr.org/2011/402.pdf https://eprint.iacr.org/2011/402.pdf ""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, " What? Where? Citation needed.
    - JoeAltmaier 13y ago
      Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.

66 points by oleganza 13y ago

A "blind signature" sounds like an odd concept. What can be done I just thought up is adding another transport layer to bitcoin. And breaking up and distributing the wallet's contents "sum" among strangers into something like a checksum. Then on transactions bringing the chunks of checksum partially back together. How it's broken down can vary. you have to remember though, if you are buying something for $10 all that needs to be verified is that you have $10 or more for the next step.

oleganza 13y ago
The scheme allows never holding all secret pieces in one place to make a transaction. Otherwise, if your machine is compromised, someone can send your money elsewhere. I don't quite understand your proposal, but it requires having all chunks in one place to make a transaction.

JacobH 13y ago

Something that also just came to me, instead of having one large sum on money in one wallet. Who says it can't be distributed and broken down in max wallet sizes of $50 or so. $50 is a common number no one should really care too much about. So there goes your concern about being able to see wallet size. If something costs more than $50 group multiple wallets into the transaction.

Retric 13y ago
And how do you plan to realistically manage 200 such wallet's? Realistically you would have a computer somewhere know there key's which introduces the same inherent risk as having that computer manage a single wallet. If you really want secure storage you print out your private key's and store them in one or more vaults. If your even more paranoid you can encrypt the information such that you need more than one vault to access the data, but have some redundancy so if one storage location floods you don't lose any bit-coins. Which is where these N of M encryption schemes become useful.
- JacobH 13y ago
  The idea is less about losing coin, and more about concealing wallet size from people that don't need to know about how much money is in a bitcoin wallet. My idea is more along the lines of instead of pulling out a wad of money you're only pulling out $50 at a time. Me personally, I don't mind the wallet amount being public because for things lie fundraising it keeps people honest.
  - hendzen 13y ago
    In the bitcoin world, this technique is known as "merge avoidance" - read about it here: https://medium.com/bitcoin-banter/7f95a386692f https://medium.com/bitcoin-banter/7f95a386692f
- JacobH 13y ago
  Implementation would have to be along the lines of a proxy, decentralizing ownership is a nice way to lose some friends.
vanschelven 13y ago
If I recall correctly Bitcoin already provides this out of the box: a wallet is already a collection of public/private keypairs (and not a single public address). You could at any point divide your money over an arbitrary amount of addresses that you own(maybe at a small transaction cost). This does not mean people could still try to understand what's really happening by analysing the full graph.
oleganza 13y ago
The multisig vault makes sense for relatively large stash which would take a lot of $50 transactions to brake down into. Also, as you ask your friends to sign off $50 redeeming txs, they'd see how much did you have previously. Not ideal. In my paper I propose using sequential generation of parameters so you can break down your funds into multiple transactions, but it's only for convenience, your privacy vis-a-vis your friends is still absolute.

natrius 13y ago

Why would you use this instead of a warp wallet? https://keybase.io/warp/ https://keybase.io/warp/

mrfusion 13y ago
Good question. I've been meaning to try that one. Anyone know how secure it is? Is there a way to get Btc out if that site goes down?
- bglusman 13y ago
  From the page: "This page is self-contained for portability. Save it on your computer - all the JS, CSS, and images are embedded. It's also hosted on github." Link: https://github.com/keybase/warpwallet https://github.com/keybase/warpwallet
oleganza 13y ago
Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking. Keybase is a single point of failure. Or your machine that will do KDF. M-of-N multisig transactions are way safer because to sign a specific transaction you never need to have all secret material at once on a single machine. If my PC is compromised, I can still independently verify specific transaction I want to sign and send it out to my friends to sign. All their private keys are stored on independent machines which normally aren't compromised altogether by the same attacker. On specific problem with brainwallets - low entropy. One specific problem with web apps: no code signing. Even if your SSL pubkey is pinned (which is not supported by any browser yet), the code you receive from the server is never remembered and pinned (like with installed apps). If their server is silently compromised tomorrow, someone may humbly hijack keys of 1% of the users and go undetected for quite some time.
- j_s 13y ago
  > which you obviously haven't read before asking This blew my mind; so unkind!

gesman 13y ago

Adding another entity to rely on to hold funds "safe" just adds another link to the chain that can die, disappear, change it's mind and be broken. I personally love how Electrum wallet does it: You may generate and regenerate wallet using only key word phrase. Keep it safe in memory or in bank deposit box. No backups needed. You may always regenerate wallet by keyphrase.

VMG 13y ago
The idea is spreading the security to multiple systems. Electrum doesn't help you if you enter the passphrase on a compromised computer.
wes-exp 13y ago
No backups needed Doesn't Electrum do this by backing up your wallet to "the cloud"? Even if it is 100% properly encrypted, I can't say that I feel good about this. Feels like one bug away from compromising many people's wallets.
- jimrandomh 13y ago
  No, it does not.
  - wes-exp 13y ago
    Are you sure? Why does the restore process require a server address? https://electrum.org/seed.html https://electrum.org/seed.html The screenshot uses ecdsa.org, which seems to be just an Electrum server of some kind.
    - bglusman 13y ago
      Pretty sure that's because Electrum doesn't download the entire blockchain but relies on servers for most of it and only downloads a certain amount of recent history and trusts servers for older history. And it doesn't have to be that server, which is why app lets you change the URL, any server serving blockchain history you trust is fine. It's using your passphrase as the one and only seed for key generation, so it can reliably generate same private key every time. Someone correct me if I'm mistaken on any details.

betterunix 13y ago

The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Some kind of threshold system? Some kind of special-purpose multiparty computation protocol?

oleganza 13y ago
The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.
- betterunix 13y ago
  "The paper only discusses blind signature algorithm" No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this: "The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does not allow anyone to prove that the signing party signed a particular message" I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful? To put it another way, what differentiates your proposal from this: https://eprint.iacr.org/2011/402.pdf https://eprint.iacr.org/2011/402.pdf ""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, " What? Where? Citation needed.
  - JoeAltmaier 13y ago
    Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.