This is very easy to understand.

In this attack hacker gets a pair of valid signatures for the same transaction: (R1, s1, R2, s2) and (R1', s1', R2, s2'). Here R2 is the same, but R = R1+R2 and R'=R1'+R2 are different. This means that the hacker can calculate our second private key: s2-s2'=(hash(P,R1+R2,m)-hash(P,R1'+R2,m))⋅pk2 and pk2=(s2-s2')/(hash(P,R1+R2,m)-hash(P,R1'+R2,m)). I find this the most inconvenient feature of key aggregation — we will need to use a good random number generators everywhere to use key aggregation.
How Schnorr signatures may improve Bitcoin
1.8K
7
Stepan
Daniel Olshansky
·Follow
Apr 12, 2022
--
This is very easy to understand. It's amazing how the benefits of key aggregation make lead to private key leaking if we don't have a good source for randomness.
--
--
Written by Daniel Olshansky432 Followers
·638 Following
CTO at Grove. Quick thoughts & work blogs can be found here. Substack for long form: olshansky.substack.com Personal site for everything else: olshansky.info/
No responses yet
Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams