Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Signatures in ScriptlessScripts
Jonas Nickjonasd.nick@gmail.com@n1ckler
February 17, 2019

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

1/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Schnorr Signatures
G is generator of a DLog hard groupdef keygen():x := rand, P := x*G
return (x, P)
def sign(x, m):
k := rand, R := k*G
s := k + hash(R,P,m)*x
return (R, s)
def verify(P, m, R, s):return s*G ?= R + hash(R,P,m)*P
Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

2/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Signatures
Blind signer does not know the message beingsigned
I Blind signature gets unblinded, s.t. unblinded
and blind sig are not linkableI 2 party protocol between Client and ServerI

1. Client knows message, Server does not
2. Client creates blind challenge
3. Server signs blind challenge and gives to Client
4. Client unblinds signature

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

3/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Schnorr Signatures
def server_nonce():k := rand, R := k*G
return (k, R)

def client_blind(R, m):alpha := rand, beta := rand
R’ := R + alpha*G + beta*Pc’ := hash(R’,P,m), c := c’+beta
return (alpha, beta, R’, c’, c)

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

4/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Schnorr Signatures
def server_sign (k, x, c):s := k + c*x
return s
def client_unblind(alpha, s):s’ := s + alphareturn s’
def verify(P, m, R, s):return s*G ?= R + hash(R,P,m)*P
Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

5/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

EDIT: Blind Schnorr Signatures are notsecure per se
EDIT: At this point I should have stressed that
implementations of above Blind Schnorr
signatures are not secure against forgery
I They are vulnerable to Wagner’s attack. With65536 parallel signing sessions can forge asignature with only O(232 ) work.
I This could be somewhat mitigated by having
the signer abort in p < 1/2 cases during thesigning step.
I

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

6/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

EDIT: Blind Schnorr Signatures are notsecure per seMoreover, they can’t be proven secure in theROM (Baldimtsi, Lysyanskaya)
I Use them only when the signatures need topass normal Schnorr verification.
I

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

7/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Ecash
Trusted server maintains a database to prevent
double spending
I Server database consists of serial numbers thathave been spent
I Ecash token is tupleII(serial number,server sig(serial number))Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

8/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Ecash
Reissuance protocol to exchange token for fresh
unlinkable token:
1. Client chooses new random serial number andblind challenge
2. Client shows token and blind challenge toServer
3. Server aborts if token serial number is in DB
4. Server signs blind challenge and inserts serial
number in database
5. Client unblinds signature to get fresh token(reissuance proocol is also used for payments)
Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

9/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchange Discrete Logs for Bitcoin
Buyer wants to buy discrete log of point T = t*Gfrom Seller
1. Buyer creates multisig output with Seller
2. Seller sends transaction and adaptor signature
with T to Buyer
3. Buyer gives Seller her signature over thetransaction
4. Seller spends the output
5. Buyer computes the discrete log t from Seller’s
tx signature and adaptor signature
Blockchain footprint: single boring transaction
Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

10/24Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchange Discrete Logs for LN Payments

Requires Lightning with Multi-Hop Locks in place ofHTLCs.
I HTLCshash(p)hash(p)1. Buyer −−−−−→ Hop −−−−−→ Seller
2. Seller claims with preimage p

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

11/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchange Discrete Logs for LN Payments
Multi-Hop Locks use curve points instead of hashes
L1L2

1. Buyer −−→ Hop −−→ Seller
Buyer set up route to buy discrete log of T = t*G
L1 = T + l1*G
I L2 = L1 + l2*GII

2. Buyer gives l2 to Hop and l1 + l2 to Seller
3. Seller claims L2 with c2 = (t + l1 + l2)
4. Hop claims L1 with c1 = c2 - l2
5. Buyer computes t = c1 - l1

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

12/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchange Blind Signatures for Bitcoin

Building block: Committed R-point signatures
1. Seller creates public nonce R
2. Buyer can compute Seller’s signature s times G(without being able to compute s of course) as
R + hash(R,P,m)*P = s*G

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

13/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchange Blind Signatures for Bitcoin

Committed R-point signatures work for blind
signatures too! So Client computes Server’s
blind signature s times GI Then buys discrete log of s*G with bitcoinsusing above techniques
IBlind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

14/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Coinswaps

ICoinswap where Server can not link coinsIII

similar to Tumblebit
but with scriptless scripts

Key idea: Client buys blind signature from
Server where the message is a transaction thatgives Server’s coins to the Client

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

15/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Blind Coinswaps

1. Create blind challenge from unsigned tx
2. Create blind sig times G
3. Pay for its DLog (the actual blind sig)
4. Unblind and broadcast tx

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

16/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchanging Ecash Tokens for Bitcoin
Want Clients buy tokens from each otherwithout trust
I Server needs to make sure that buyer getstoken and seller bitcoinsI

1. Payment uses multisig with Server
2. Or Server is part of lightning payment route
3. Or issue token with locktime

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

17/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Brands credentials

think ecash tokens that encode more attributes
I essentially Pedersen multicommitments of theattributes
III

a1*G1 + a2*G2 + ....

+ r*G

allows proving properties of token attributes inzero knowledge

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

18/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Brands credentials
Reissuance of example ecash token(type, amount, serial number, serversignature)
1. Client chooses new random serial number andblind challenge
2. Client shows token and blind challenge toServer
3. Client proves that type and amount intoken and in challenge is the same
4. [...]
Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

19/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchanging Ecash Tokens for Bitcoin
Token seller runs version of reissuance protocol
with Server and receives two tokens with thesame serial number
I Buyer token(BUYERSECRET, SELLERSECRET,type buyer, amount, serial number,server signature)I

IIreissued only when providing BUYERSECRET,SELLERSECRETSeller token(LOCKTIME, type seller, amount,serial number, server signature)I

reissued only when LOCKTIME is over

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

20/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Exchanging Ecash Tokens for Bitcoin
1. Seller gives buyer token without SELLERSECRETto buyer and proves that LOCKTIME of seller
token is sufficiently far in the future
2. Buyer buys SELLERSECRET from seller either
on-chain or off-chain using above techniques
3. EITHER Buyer runs reissuance protocol withServerOR Buyer becomes unresponsive and Seller
runs reissuance protocol after LOCKTIME

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

21/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Conclusion
Blind signatures are useful in Bitcoin protocol
designs (blind coinswaps)
I Can build trustless off-chain or on-chain ecashtoken exchange protocols using scriptlessscripts
I Next steps
IIISchnorr soft fork
Lightning v1.x

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

22/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Further Reading
Schnorr, C.. Security of Blind Discrete Log
Signatures Against Interactive Attacks
I Scriptless Scripts
I Scriptless Scripts in Lightning
I Malavolta, G., Moreno-Sanchez, P.,
Schneidewind, C., Kate, A., & Maffei, M.
Multi-Hop Locks for Secure, Privacy-Preserving
and Interoperable Payment-Channel Networks.
I Blind Coinswaps
I Brands, S. (2002). A technical overview ofdigital credentials.
I

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

23/24

Blind Signatures

Ecash

Fair Exchange

Blind Coinswaps

TokensConclusion

Q&ASlides:
https://nickler.ninja/slides/2018-bob.pdf
I Questions?
I

Blind Signatures in Scriptless Scripts

Jonas Nick jonasd.nick@gmail.com @n1ckler

24/24