reNostr
Replies: 2 comments 19 replies
-
|
Agree, just discussed that in Twitter: https://twitter.com/dr_orlovsky/status/1656652626858217477?s=61&t=9A8uvggqKVKV3sT4HPlQyg |
Beta Was this translation helpful? Give feedback.
-
|
Oh, it was actually you with whom I was talking on Twitter :) |
Beta Was this translation helpful? Give feedback.
-
|
Yes, thought it is better to have it here away from the Twitter noise |
Beta Was this translation helpful? Give feedback.
-
|
a counter-argument, using non-bitcoin EC makes it hard to use adaptor signatures between bitcoin transactions and nostr events |
Beta Was this translation helpful? Give feedback.
-
|
@dr-orlovsky hmm, good point. How big is the nonce used, and how many uses are needed to create a collision? 1 year seems low, but maybe you are right. Needs verification. |
Beta Was this translation helpful? Give feedback.
-
|
Some quick research:
If that is correct, and then pure nonce collisions are unlikely to happen in one year There might be some other attacks from key reuse though. If keys last 100+ years, or 10+ years there will be a chance to develop rotation. If it's <1 year, that might be more of a problem. But no key has been cracked yet. |
Beta Was this translation helpful? Give feedback.
-
|
It is not about the nonce collisions but about a bias in the nonce randomness 1-2 bits of bias (in all 256 bits, i.e. < 1% of bias) is enough to leak the private key over many thousands of sigs (in nostr opinion leaders may have millions of them). 1-2 bit bias - is much lower than JavaScript-based pseudorandom generations, which means most of nostr clients are vulnerable. |
Beta Was this translation helpful? Give feedback.
-
|
@dr-orlovsky do you have a link that explains this vulnerability? |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
Using the Ed25519 key as the public key a user is known as, brings the most compatibility possible with existing tools, and overlay networks, too many to enumerate, but for example, the biggest DHT (Mainline DHT used in BitTorrent clients) uses Ed25519 exclusively and would offer a very robust service providers discovery see this key published on Mainline, stating my Matrix and Nostr handles
That
root keyis only needed to sign attestations to othersigning keys, so no matter how slow it is in comparison to other primitives (it it that slower), that shouldn't factor in the choice, as long as it is secure enough to be used as a long-lasting identifier.Beta Was this translation helpful? Give feedback.
All reactions