2 ms·

The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Som

The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Some kind of threshold system? Some kind of special-purpose multiparty computation protocol?

oleganza 13y ago
The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.
- betterunix 13y ago
  "The paper only discusses blind signature algorithm" No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this: "The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does not allow anyone to prove that the signing party signed a particular message" I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful? To put it another way, what differentiates your proposal from this: https://eprint.iacr.org/2011/402.pdf https://eprint.iacr.org/2011/402.pdf ""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, " What? Where? Citation needed.
  - JoeAltmaier 13y ago
    Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.

oleganza 13y ago

The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.

betterunix 13y ago
"The paper only discusses blind signature algorithm" No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this: "The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does not allow anyone to prove that the signing party signed a particular message" I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful? To put it another way, what differentiates your proposal from this: https://eprint.iacr.org/2011/402.pdf https://eprint.iacr.org/2011/402.pdf ""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, " What? Where? Citation needed.
- JoeAltmaier 13y ago
  Yeah confused. If you can't tell who signed a particular message, then what are signatures for? I thought they were for authentication, which means the message was not modified, and, I know who sent it.