| 00:03:20 | gmaxwell: | Yes, you were. |
| 00:03:48 | gmaxwell: | (you might also not be aware but all the ed25519 signature verification code also verifies that the pubkey is on the curve; https://github.com/floodyberry/ed25519-donna/blob/master/ed25519.c#L100 e.g.) |
| 00:05:10 | gmaxwell: | DJB is great, but he's somewhat sloppy in his descriptions for lay-people-- esp on the curve25519 tare, where he's really promoting it over the kinda-awful brainpool curves-- in ways that may not be all that helpful. |
| 00:07:10 | gmaxwell: | Presumably he was talking about the montgomery ladder trick for avoiding to have to check if a point is on the curve for twist secure curves. It's only applicable to ECDH. For signature verification you're doing a multi-exp, and you also don't care about constant timeness. The non-montgomery version is enormously faster. |
| 00:09:17 | gmaxwell: | (also, incidentally, the montgomery-ladder trick works for any curve, given a bit of algebra to work out the equaltions for the known difference updates... though it's only reasonable to use for twist-secure curves, but many curves are twist secure including secp256k1 and NIST P256) |
| 00:09:25 | gmaxwell: | equations* |
| 00:16:10 | adlai: | is 'why secp256k1?' a welcome question here? |
| 00:16:28 | hearn: | adlai: nobody knows |
| 00:16:36 | hearn: | adlai: it was, however, a lucky choice. |
| 00:17:24 | adlai: | ok, what about 'how does the switch happen', when railroading time ends? |
| 00:17:41 | gmaxwell: | adlai: huh? |
| 00:18:22 | adlai: | isn't it reasonable to expect that this curve will eventually be broken, especially with more attention on it due to its role in bitcoin? |
| 00:18:26 | hearn: | railway time was one of the victorian era's great inventions |
| 00:18:38 | hearn: | it led directly to the modern notion of timezones |
| 00:18:51 | hearn: | adlai: fortunately for the world, cryptography does not work quite like that. |
| 00:19:30 | hearn: | adlai: if we wanted to switch to another curve, it'd be the same as any other forking change. everyone upgrades their software. anyway, this isn't really a #wizards level discussion, i'm afraid. |
| 00:20:03 | gmaxwell: | adlai: Not unless there is some fundimental mathmathical breakthrough, which would likely render all (or at least a significant fraction of all) curves of similar sizes insecure. |
| 00:20:11 | adlai: | 'railroading time' is a heinlein reference, http://www.hjkeen.net/halqn/dor2sumr.htm#rrd |
| 00:20:31 | brisque: | hearn: wouldn't it be a soft fork? |
| 00:20:55 | gmaxwell: | adlai: Bitcoin script is forward compatible and new features can be introduced fairly easily (even without upgrading all users); e.g. p2sh added effectively a whole new scripting system (which happened to be the same as the old one, just nested inside a hash) |
| 00:21:05 | brisque: | (assuming "weakened", not "8 bits of security") |
| 00:22:00 | gmaxwell: | if there were some great need to, an opt in new cryptosystem could probably be deployed in a few weeks time. |
| 00:22:13 | adlai: | the event would reveal which utxos are cared about by their owners |
| 00:22:44 | gmaxwell: | you can care without paying attention or without having a clue. :) |
| 00:23:47 | gmaxwell: | (else you might say all these people who've reused revealed pubkeys care less; in that they're much more exposed to fanciful EC attacks; but I don't think that its true that they care less) |
| 00:23:57 | hearn: | for some very low value of "care". when we had to do a crash key rotation due to the android SecureRandom bugs, the wallets were auto updated and automatically respent the users funds back to themselves. |
| 00:24:12 | hearn: | not all users were even aware it was happening until after the fact. |
| 00:24:52 | adlai: | aha, that's the kind of process i was curious about... this is indeed more of a #bitcoin question. |
| 00:28:44 | bramc: | It used to be that people talked about cryptosystems expiring due to their key lengths being taken over by moore's law. Current key lengths should be enough to last forever though. |
| 00:29:10 | brisque: | or until the US starts restricting them again. |
| 00:29:23 | gmaxwell: | bramc: yes, they won't expire due to moore's law. |
| 00:29:41 | gmaxwell: | they'll quite possibly expire due to other things. |
| 00:30:09 | bramc: | Well, presumably they'll expire due to better systems being built which people switch to. |
| 00:30:18 | bramc: | At least, hope they do. Otherwise you have DNS. |
| 00:30:30 | gmaxwell: | Sadly, an asymetric cryptosystem which can provably expire no faster than computer speed increases is sufficent to prove P != NP, so I don't think we'll be seeing one of those anytime soon. :) |
| 00:34:18 | bramc: | We can't prove much of anything about our symmetric ciphers either |
| 00:35:29 | gmaxwell: | Well some symmetric ciphers you can prove things about. |
| 00:36:20 | gmaxwell: | For example, anything that is a complete permutation and used in a mode where the key is the same size as the data, can have information theoretic security. |
| 00:37:18 | bramc: | Information theory, yes. You can also prove reductions. |
| 00:39:11 | gmaxwell: | and even for conventional usage you don't get a tidy reduction to P!=NP.. e.g. even if you could prove your block cipher had the property that given two plaintext, ciphertext pairs one could not efficiently recover a key the size of the block... that doesn't prove that P!=NP, because it just may mean that the inputs don't form a basis that lets you recover the key. most asymetric crypto though, |
| 00:39:17 | gmaxwell: | if you can prove the key can't be recovered efficiently you _directly_ have a proof that P!=NP. |
| 00:41:02 | adlai: | oh, here's another off-topic question: should i study math or computer science, if i want to be less useless in such discussions? |
| 00:41:16 | adlai: | * adlai would be glad to take this elsewhere / pm, shuts up now |
| 00:42:19 | gmaxwell: | Both? Really depends on where you're talking about. Some CS programs are very mathy and others are very 'java webtoys lol'. |
| 00:45:33 | adlai: | probably germany, frei wenn sie sprechen es |
| 00:52:45 | rusty: | gmaxwell: I gather you're discouraging open discussion of your half puzzles, in the short term? |
| 00:53:34 | gwillen: | rusty: there are people discussing them, but those of us who haven't had a chance to work on them yet would probably encourage avoiding spoilers :-) |
| 00:54:52 | rusty: | gwillen: fair enough. I'm hoping to find some spare cycles to tinker on the weekend. Not that I'll make progress, but at least I'll learn something :) |
| 00:55:23 | gwillen: | * gwillen nodnod |
| 00:59:01 | maaku: | adlai: at my university computer science was part of the math department |
| 00:59:16 | maaku: | really, study both. it's two sides of the same coin |
| 00:59:43 | maaku: | if you're asking what major you should have, then that depends on your career goals and is OT |
| 01:02:24 | ajweiss: | there are also different types of math taught out of different departments |
| 01:03:24 | ajweiss: | statistics vs. pure math vs. linear systems (applied math) vs. ... |
| 01:07:26 | adlai: | relevance towards 'crypto' https://botbot.me/freenode/bitcoin-wizards/2015-02-28/?msg=33061842&page=3 |
| 01:08:15 | andytoshi: | adlai: if you are looking for academic/educational advice you can pm me |
| 01:26:25 | bramc: | I think with my new idea withholding attacks aren't stable because members of the coalition doing the withholding are incented to cheat |
| 01:30:16 | gmaxwell: | rusty: I updated the page to include a note that the signatures are valid. Seems many people thought they needed to find some bitflips to make them valid. |
| 01:30:44 | bramc: | Coinshuffle seems like a neat thing but it doesn't solve the hard problem, which is forming the groups in the first place |
| 01:31:35 | gmaxwell: | s/forming the groups in the first place/writing usable applications to make use of these techniques/ :) |
| 01:31:52 | bramc: | gmaxwell, Yes exactly |
| 01:31:56 | rusty: | gmaxwell: Oh, I was just hacking together some utils, decided to check that you're weren't pulling a meta-joke. Result was a wild goose chase, but I got to learn something. |
| 01:32:31 | belcher_: | if you're interested in coinjoin, check out joinmarket which im working on right now, it forms those groups by paying people |
| 01:33:23 | gmaxwell: | rusty: bitcoin.ninja has a sage notebook for secp256k1 ecdsa signatures. I'm fond of sage for random number theory noodling. |
| 01:34:49 | gmaxwell: | (sage's EC is super slow, but it's a decent pocket calculator for this stuff; and since its python there is very little learning curve) |
| 01:38:19 | rusty: | gmaxwell: great, now I have *10* tabs open awaiting reading! |
| 01:40:39 | hearn: | is is there a written description of satoshi's knapsack coin selection algorithm anywhere? |
| 01:43:08 | hearn: | specifically, why it attempts to optimise for what it does |
| 01:44:57 | rrrrandom: | rrrrandom is now known as belcher |
| 01:46:54 | bramc: | Huh this is weird, the Mixcoin paper doesn't seem to use simultaneous transfer |
| 01:47:06 | bramc: | https://eprint.iacr.org/2014/077.pdf |
| 01:48:00 | gmaxwell: | bramc: the mixcoin stuff is 'accountable' instead of secure. |
| 01:48:11 | bramc: | gmaxwell, I get that, but why not be secure? |
| 01:49:06 | bramc: | Also I'm not so sure that maxing explicit mixes is such a hot idea. If you've got a slightly trusted mix they can do a better job of keeping info off the block chain by maintaining some amount of working capital |
| 01:49:22 | gmaxwell: | I believe the work started prior to people being aware of coinjoin/coinswap; and potentially you could get better or at least different forms of privacy without that constraint. |
| 01:49:37 | bramc: | So they can do things like hand over a coin they got from somebody else without splitting or joining it as part of the change-making process |
| 01:50:06 | bramc: | I don't think coinswap hurts anything if you're doing it with a mixing third party |
| 01:50:45 | brisque: | bramc: put some more thought into it. |
| 01:51:14 | gmaxwell: | (I generally don't think the accountable but not secure approach is likely to be pratically useful; because the reputation required for it to work makes it especially vulnerable to being backdoored and also suggests a fee structure that discourages use except by criminals, and criminal use increases backdooring risk, yadda yadda) |
| 01:51:17 | bramc: | brisque, You'll have to say more than that to have any hope of convincing me |
| 01:51:54 | gmaxwell: | Indeed, I don't think coinswap implies any particular constraints that are annoying. |
| 01:52:02 | gmaxwell: | But its even less well known than coinjoin. |
| 01:54:11 | bramc: | Yeah, the things which are and aren't well known are a bit strange |
| 01:54:23 | bramc: | starting with how few journalists know that mining burns resources :-P |
| 01:55:36 | gmaxwell: | most people don't think of computers consuming energy at all.. considering that a single desktop is pretty modest to most home appliances that you think of as consuming energy. :) |
| 02:03:15 | moa: | resource allocation, substitution, pricing, usage is a substantial but underdeveloped area of economics with simplistic quantification ... e.g. find a rigorous definition of what a "resource" is? |
| 03:27:18 | kyletorpey: | kyletorpey has left #bitcoin-wizards |
| 07:37:39 | NikolaiToryzin: | NikolaiToryzin is now known as SeanAtToxIm |
| 07:38:10 | SeanAtToxIm: | SeanAtToxIm is now known as NikolaiToryzin |
| 07:41:57 | NikolaiToryzin: | NikolaiToryzin is now known as SeanAtNSAGov |
| 09:05:17 | cameron.freenode.net: | topic is: This channel is not about short-term Bitcoin development | http://bitcoin.ninja/ | This channel is logged. | For logs and more information, visit http://bitcoin.ninja |
| 09:05:17 | cameron.freenode.net: | Users on #bitcoin-wizards: andy-logbot koeppelmann CoinMuncher d1ggy lclc Mably paveljanik hktud0 RoboTeddy hashtag_ Dr-G moa dc17523be3 PaulCapestany zooko gavinandresen p15 justanotheruser amincd nuke1989 Pan0ram1x HM2 prepost shesek tromp waxwing ahmed_ jaekwon Burrito eordano x98gvyn54ugm grassass cryptowest GAit Logicwax koshii nickler Alanius luny face PRab BananaLotus Apocalyptic guruvan ryan-c MoALTz lnovy DoctorBTC melvster adlai sipa harrow grandmaster |
| 09:05:17 | cameron.freenode.net: | Users on #bitcoin-wizards: prodatalab alferz Luke-Jr gribble delll_ OneFixt amiller go1111111 jgarzik ebfull espes__ cluckj brisque cfields sdaftuar mkarrer Starduster veorq coryfields dgenr8 devrandom helo bosma Hunger- xabbix burcin runeks null_radix bedeho copumpkin Cory gmaxwell Emcy huseby GreenIsMyPepper sneak SwedFTP bepo LarsLarsen epscy nanotube binaryatrocity spinza andytoshi bliljerk101 tromp__ wizkid057 starsoccer comboy nsh Taek iddo EasyAt maaku btcdrak |
| 09:05:17 | cameron.freenode.net: | Users on #bitcoin-wizards: SeanAtNSAGov s1w Visheate crescendo livegnik optimator fluffypony Meeh cursive yoleaux dansmith_btc [d__d] berndj morcos Fistful_of_Coins dardasaba isis gwillen BlueMatt airbreather dasource smooth phantomcircuit ajweiss Xzibit17 yrashk artifexd Zouppen kumavis mariorz catcow Krellan michagogo forrestv Muis platinuum Oizopower Keefe catlasshrugged JonTitor petertodd kanzure eric mappum jbenet wiz midnightmagic heath gnusha warren Adrian_G |
| 09:05:17 | cameron.freenode.net: | Users on #bitcoin-wizards: Iriez lechuga_ dignork kinlo jessepollak Graet Eliel veox warptangent indolering K1773R TD-Linux leakypat CryptOprah Anduck fenn a5m0 bbrittain jaromil jcorgan wumpus BrainOverfl0w roasbeef phedny so hguux__ otoburb MRL-Relay azariah btc___ throughnothing @ChanServ brand0 davout NeatBasis mr_burdell d9b4bef9 |
| 09:21:05 | arubi_: | arubi_ is now known as arubi |
| 10:25:04 | wallet421: | wallet421 is now known as wallet42 |
| 13:56:26 | waxwing__: | waxwing__ is now known as waxwing |
| 14:09:01 | bbrittain_: | bbrittain_ is now known as bbrittain |
| 15:09:44 | waxwing__: | waxwing__ is now known as waxwing |
| 15:11:54 | kanzure: | someone's attempt at mining analysis http://wan.poly.edu/pam2015/papers/23.pdf |
| 15:12:33 | kanzure: | "Obviously, a miner prefers places with low electricity price η(t), and will shut down her hardware whenever the profit rate becomes negative." |
| 15:12:36 | kanzure: | uh... |
| 15:15:15 | kanzure: | "Such a race will automatically end when the profit margin hits zero." |
| 15:15:28 | kanzure: | except this is ignoring the other motivations for mining? |
| 15:19:55 | brisque: | that they don't make note of the fact that the timestamp on a block isn't reliable makes me question the validity of the rest of it. |
| 15:22:29 | brisque: | if you're interested in more insanity like that, the neighbourhood pool watch site regularly goes absolutely nuts with the graphs. http://organofcorti.blogspot.nl/ |
| 15:23:50 | arubi__: | arubi__ is now known as arubi |
| 15:30:42 | arubi__: | arubi__ is now known as arubi |
| 15:35:35 | SeanAtNSAGov: | SeanAtNSAGov is now known as NikolaiToryzin |
| 16:22:01 | instagibbs: | "obviously" and "clearly" are only used to power through arguments you can't prove |
| 16:23:44 | fluffypony: | instagibbs: obviously that's clear |
| 16:24:35 | sipa: | ha |
| 16:24:56 | instagibbs: | that said, some people were discussing death spirals of mining during price crashes. Might make sense to increase coinbase maturity time to further incentivize long-term thinking. (still not clear at all it's a problem) |
| 16:25:53 | brisque: | if I want to sell my immature coinbase output nothing is stopping me really |
| 16:26:27 | instagibbs: | hmm probably, and now that I think, it may not make any sense anyways. |
| 16:27:39 | instagibbs: | The idea would be that at least someone would want to make sure mining happens, immature coinbase buyer or otherwise. But the additional incentive to continue mining still may not exist. |
| 16:28:12 | instagibbs: | aside from what's holding it all together now |
| 16:28:26 | brisque: | keep in mind that the maturity time is just to provide reorg stability, not enforce some sort of continuation of mining |
| 16:29:01 | instagibbs: | off label uses, baby |
| 16:29:03 | instagibbs: | like viagra |
| 16:29:56 | instagibbs: | I'll think about it some more |
| 16:42:52 | instagibbs: | Yeah I seriously doubt that "fix" does anything. Myopic greedy miners will still do exactly what they'd do before, afaict |
| 16:43:23 | brisque: | we want miners to be greedy. |
| 16:43:59 | instagibbs: | That's fine. I'm just saying my idea was useless, from what I can tell. I was trying to fix a tragedy of commons issue. |
| 16:44:18 | instagibbs: | Doesn't resolve it, therefore dumb. |
| 16:46:20 | hightorque: | hightorque is now known as shea256 |
| 16:48:51 | instagibbs: | The real q is if users sending txns will jack up fees to encourage inclusion in next block if blocks would be spaced out, encouraging miners to get back into mining again. And if miners expect this, then maybe this is moot. |
| 16:50:40 | brisque: | at least nobody can claim to be surprised |
| 16:51:11 | fenn_: | fenn_ is now known as fenn |
| 19:35:42 | arubi__: | arubi__ is now known as arubi |
| 19:39:15 | gwillen: | gwillen is now known as Guest28484 |
| 19:43:27 | Guest28484: | Guest28484 is now known as gwillen |
| 19:56:24 | blazes816: | blazes816 is now known as tcrypt |
| 21:05:53 | gavinandresen: | gavinandresen has left #bitcoin-wizards |