You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**Privacy:** Nobody can tell if a transaction used multiple signers or just one. Your multi-sig setup stays private, as it looks identical to a regular transaction.
<ExpandableAlerttype="info"title="What is a key cancellation attack?"expandable={true}initialLines={1}>
62
122
63
-
### What is a key cancellation attack?
123
+
Imagine a scenario where Alice and Bob want to create a 2-of-2 aggregated signature.
64
124
65
-
Imagine a scenario where Alice and Bob want to create a 2-of-2 aggregated signature. To achieve this, they need to:
125
+
To achieve this, they need to:
66
126
67
127
1. Exchange public keys.
68
128
2. Exchange nonce commitments (needed for Schnorr signatures).
69
129
70
-
But if Bob knows Alice’s public key (P_a) and nonce (R_a) beforehand, Bob can deceive Alice by sending modified values to her:
130
+
But if Bob knows Alice's public key (P<spanclassName="text-xs align-sub">a</span>) and nonce (R<spanclassName="text-xs align-sub">a</span>) beforehand, Bob can deceive Alice by sending modified values to her:
@@ -202,44 +273,44 @@ Now, let’s move to the next step: **Aggregate Nonce**.
202
273
203
274
The process of aggregating nonces isas follows:
204
275
205
-
1. Alice, Bob, and Carol each generate a random nonce **k_A**, **k_B**, and**k_C**.
276
+
1. Alice, Bob, and Carol each generate a random nonce **k<span className="text-xs align-sub">A</span>**, **k<span className="text-xs align-sub">B</span>**, and**k<span className="text-xs align-sub">C</span>**.
### Where do the rounds of communication happen in this process?
215
286
216
287
Great question! The process of aggregating nonces is somewhat similar to aggregating public keys.
217
288
218
-
**Except**: Public keys (e.g., **P_A**, **P_B**, and**P_C**) stay the same for every signature process, but random numbers (**k_A**, **k_B**, **k_C**) must change with every signature.
289
+
**Except**: Public keys (e.g., **P<span className="text-xs align-sub">A</span>**, **P<span className="text-xs align-sub">B</span>**, and**P<span className="text-xs align-sub">C</span>**) stay the same for every signature process, but random numbers (**k<span className="text-xs align-sub">A</span>**, **k<span className="text-xs align-sub">B</span>**, **k<span className="text-xs align-sub">C</span>**) must change with every signature.
219
290
220
-
Thus, in each signature process, we need a round of communication where Alice, Bob, and Carol exchange their **R_i** values to construct:
221
-
**R_agg =R_A+R_B+R_C**
291
+
Thus, in each signature process, we need a round of communication where Alice, Bob, and Carol exchange their **R<span className="text-xs align-sub">i</span>** values to construct:
However, before this step (where they exchange **R_i**), there is a **prior round of communication** to ensure none of them cheats by changing their **R_i** after seeing the others’ values.
294
+
However, before this step (where they exchange **R<span className="text-xs align-sub">i</span>**), there is a **prior round of communication** to ensure none of them cheats by changing their **R<span className="text-xs align-sub">i</span>** after seeing the others’ values.
224
295
225
296
---
226
297
227
298
### How do we prevent cheating?
228
299
229
-
To prevent cheating, Alice, Bob, and Carol must first exchange the **hashes** of their nonce points (e.g., **H(R_A)**, **H(R_B)**, **H(R_C)**) before revealing their actual **R_i** values. This ensures that once they reveal their **R_i**, they cannot modify their values after seeing others’.
300
+
To prevent cheating, Alice, Bob, and Carol must first exchange the **hashes** of their nonce points (e.g., **H(R<span className="text-xs align-sub">A</span>)**, **H(R<span className="text-xs align-sub">B</span>)**, **H(R<span className="text-xs align-sub">C</span>)**) before revealing their actual **R<span className="text-xs align-sub">i</span>** values. This ensures that once they reveal their **R<span className="text-xs align-sub">i</span>**, they cannot modify their values after seeing others’.
230
301
231
302
---
232
303
233
304
### Summary: Two Rounds of Communication for Nonce Aggregation
234
305
235
306
1. **Exchange hash commitments:**
236
-
Alice, Bob, and Carol share **H(R_A)**, **H(R_B)**, and**H(R_C)**.
307
+
Alice, Bob, and Carol share **H(R<span className="text-xs align-sub">A</span>)**, **H(R<span className="text-xs align-sub">B</span>)**, and**H(R<span className="text-xs align-sub">C</span>)**.
0 commit comments