[Cryptography] open questions in secure protocol design?

[Peter Todd]

On Fri, May 29, 2015 at 06:49:53PM -0700, Tony Arcieri wrote:
> On Fri, May 29, 2015 at 6:24 PM, ianG <iang at iang.org> wrote:
> 
> > Strongly disagree. I have a long-form comment on this as part of this
> >> blog post (see "A Bitcoin Crypto Meltdown")
> >>
> >> http://tonyarcieri.com/the-death-of-bitcoin
> >>
> >
> >
> > Except, you changed the topic.  Coming back to the topic ... do you
> > disagree that Bitcoin uses one alg for each function?  Oh wait, your post
> > is about how you agree that it's only using one alg.
> >
> > You're real disagreement is that you don't like that it is using one alg,
> > and predict it will therefore melt-down :)
> >
> 
> Satoshi chose a bad curve. Nobody who knows anything about ECC would
> suggest using secp256k1 over Curve25519. They should switch, if only
> because that 1-bit backdoor is particularly scary, but they can't do that
> easily because the Bitcoin protocol has nothing to signal that wallet keys
> are anything but ECDSA with secp256k1.

Actually it's really easy for Bitcoin to switch to another curve, as
Bitcoin addresses can be the hash of a *script* that executes to
evaluate if the spend is valid. The upgrade would happen in a process
called a "soft-fork" that only requires a majority of hashing power to
implement the new change.

FWIW I'm the author of the proposed OP_CHECKLOCKTIMEVERIFY opcode,
BIP65, that will likely soon be added to the Bitcoin protocol via the
soft-fork mechanism.

https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki

-- 
'peter'[:-1]@petertodd.org
000000000000000002b312e15b63b9a6a7fc88c25205f2789905a1f771f5c5e4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 650 bytes
Desc: Digital signature
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20150530/ffb226df/attachment.sig>