Blind signatures for Bitcoin to secure BTC storage

http://blog.oleganza.com/post/77474860538/blind-signatures-for-bitcoin-the-ultimate-solution-to

by oleganza • 12 years ago

66 27 12 years ago

blog.oleganza.com

JacobH4• 12 years ago

A "blind signature" sounds like an odd concept.

What can be done I just thought up is adding another transport layer to bitcoin. And breaking up and distributing the wallet's contents "sum" among strangers into something like a checksum. Then on transactions bringing the chunks of checksum partially back together.

How it's broken down can vary. you have to remember though, if you are buying something for $10 all that needs to be verified is that you have $10 or more for the next step.

oleganza6• 12 years ago

The scheme allows never holding all secret pieces in one place to make a transaction. Otherwise, if your machine is compromised, someone can send your money elsewhere. I don't quite understand your proposal, but it requires having all chunks in one place to make a transaction.

JacobH4• 12 years ago

Something that also just came to me, instead of having one large sum on money in one wallet. Who says it can't be distributed and broken down in max wallet sizes of $50 or so. $50 is a common number no one should really care too much about. So there goes your concern about being able to see wallet size. If something costs more than $50 group multiple wallets into the transaction.

Retric• 12 years ago

And how do you plan to realistically manage 200 such wallet's? Realistically you would have a computer somewhere know there key's which introduces the same inherent risk as having that computer manage a single wallet.

If you really want secure storage you print out your private key's and store them in one or more vaults. If your even more paranoid you can encrypt the information such that you need more than one vault to access the data, but have some redundancy so if one storage location floods you don't lose any bit-coins. Which is where these N of M encryption schemes become useful.

JacobH4• 12 years ago

The idea is less about losing coin, and more about concealing wallet size from people that don't need to know about how much money is in a bitcoin wallet.

My idea is more along the lines of instead of pulling out a wad of money you're only pulling out $50 at a time.

Me personally, I don't mind the wallet amount being public because for things lie fundraising it keeps people honest.

JacobH4• 12 years ago

Implementation would have to be along the lines of a proxy, decentralizing ownership is a nice way to lose some friends.

vanschelven• 12 years ago

If I recall correctly Bitcoin already provides this out of the box: a wallet is already a collection of public/private keypairs (and not a single public address). You could at any point divide your money over an arbitrary amount of addresses that you own(maybe at a small transaction cost). This does not mean people could still try to understand what's really happening by analysing the full graph.

oleganza6• 12 years ago

The multisig vault makes sense for relatively large stash which would take a lot of $50 transactions to brake down into. Also, as you ask your friends to sign off $50 redeeming txs, they'd see how much did you have previously. Not ideal.

In my paper I propose using sequential generation of parameters so you can break down your funds into multiple transactions, but it's only for convenience, your privacy vis-a-vis your friends is still absolute.

natrius• 12 years ago

Why would you use this instead of a warp wallet?

https://keybase.io/warp/

mrfusion• 12 years ago

Good question. I've been meaning to try that one. Anyone know how secure it is?

Is there a way to get Btc out if that site goes down?

bglusman2• 12 years ago

From the page: "This page is self-contained for portability. Save it on your computer - all the JS, CSS, and images are embedded. It's also hosted on github." Link: https://github.com/keybase/warpwallet

oleganza6• 12 years ago

Good question. I answered it in the paper (just 8 pages) which you obviously haven't read before asking.

Keybase is a single point of failure. Or your machine that will do KDF. M-of-N multisig transactions are way safer because to sign a specific transaction you never need to have all secret material at once on a single machine. If my PC is compromised, I can still independently verify specific transaction I want to sign and send it out to my friends to sign. All their private keys are stored on independent machines which normally aren't compromised altogether by the same attacker.

On specific problem with brainwallets - low entropy. One specific problem with web apps: no code signing. Even if your SSL pubkey is pinned (which is not supported by any browser yet), the code you receive from the server is never remembered and pinned (like with installed apps). If their server is silently compromised tomorrow, someone may humbly hijack keys of 1% of the users and go undetected for quite some time.

j_s• 12 years ago

  > which you obviously haven't read before asking

This blew my mind; so unkind!

gesman• 12 years ago

Adding another entity to rely on to hold funds "safe" just adds another link to the chain that can die, disappear, change it's mind and be broken.

I personally love how Electrum wallet does it:

You may generate and regenerate wallet using only key word phrase. Keep it safe in memory or in bank deposit box.

No backups needed. You may always regenerate wallet by keyphrase.

VMG• 12 years ago

The idea is spreading the security to multiple systems. Electrum doesn't help you if you enter the passphrase on a compromised computer.

wes-exp2• 12 years ago

No backups needed

Doesn't Electrum do this by backing up your wallet to "the cloud"? Even if it is 100% properly encrypted, I can't say that I feel good about this. Feels like one bug away from compromising many people's wallets.

jimrandomh• 12 years ago

No, it does not.

oleganza6• 12 years ago

With M-of-N multisignature you don't need to fully trust any single party.

With Electrum you have to have a fully trusted machine to sign transactions. Using M-of-N multisig transaction is safe even if NSA secretly owns your machine.

betterunix2• 12 years ago

The paper is very light on details. I am not even sure what security property is being achieved here. Is it some kind of group blind signatures protocol? Some kind of threshold system? Some kind of special-purpose multiparty computation protocol?

oleganza6• 12 years ago

The paper only discusses blind signature algorithm: how to prepare a "blinded" public key and then produce a matching signature, also blinded from the signer. The primary motivation is to use such blinded public keys in the standard Bitcoin multisignature transactions. That is, transactions, using N public keys and requiring M signatures (M <= N). "Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, paper does not discuss that. But it shows how such multiparty signing can be done absolutely privately, when neither party (except for initiator and holder of funds) can learn which transaction they allowed to spend.

betterunix2• 12 years ago

"The paper only discusses blind signature algorithm"

No, it seems to discuss something else. It starts out talking about blind signatures, then veers off with claims like this:

"The novelty of the scheme is that unlike the original Chaum blind signature scheme, this one does not allow anyone to prove that the signing party signed a particular message"

I am not actually sure what you are trying to say there. Does it mean that I can only narrow down the possible signers to some group? Does it mean that the signature key is ephemeral, yet somehow meaningful?

To put it another way, what differentiates your proposal from this:

https://eprint.iacr.org/2011/402.pdf

""Multiparty computation" with "threshold system" here are provided by Bitcoin automatically, "

What? Where? Citation needed.

Blind signatures for Bitcoin to secure BTC storage

Related Stories