This is very easy to understand.

In this attack hacker gets a pair of valid signatures for the same transaction: (R1, s1, R2, s2) and (R1', s1', R2, s2'). Here R2 is the same, but R = R1+R2 and R'=R1'+R2 are different. This means that the hacker can calculate our second private key: s2-s2'=(hash(P,R1+R2,m)-hash(P,R1'+R2,m))⋅pk2 and pk2=(s2-s2')/(hash(P,R1+R2,m)-hash(P,R1'+R2,m)). I find this the most inconvenient feature of key aggregation — we will need to use a good random number generators everywhere to use key aggregation.

How Schnorr signatures may improve Bitcoin

1.8K

Stepan

Daniel Olshansky

Apr 12, 2022

This is very easy to understand. It's amazing how the benefits of key aggregation make lead to private key leaking if we don't have a good source for randomness.

Written by Daniel Olshansky

424 Followers

Check out olshansky.substack.com

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams