Hi James,

m is the message to be signed . The signature is the pair (r, s).

Andrew

Hi James,

It seems like are a few misunderstandings here. Let me start with some background. It is easier to explain what's going on if we abstract a bit: let's start by defining a group. A group is simply a set with an operation (called +), some set element 0 such that 0 + x = x + 0 = x for all x in the group, and a unary operation - such that x + (-x) = 0 for all x in the group. So, the integers with addition are a group (as are the reals, rationals, etc), the reals with multiplication are a group, the set of invertible nxn matrices are a group under matrix multiplication, etc.

An important group in cryptography is an elliptic curve group, which is a group whose elements are pairs (x, y) of numbers which satisfy an elliptic curve equation. Addition is defined in a bit of a funny way, but there is a Wikipedia page on it that is interesting.

What's important about these groups for cryptography is the following: given a group element G, you can "multiply" by an integer n by adding G to itself n times. (If n is negative, add -G to itself -n times.) It turns out that if you fix an element G in some group, then take all the elements {nG} for integers n, this set is itself a group such that (nG) + (mG) = (n + m)G. It's a true statement that given any nonzero elements in this group, say P and Q, there is always some number n such that P = nQ. But for elliptic curve group, there is the so-called "discrete logarithm assumption" which says that actually calculating n is very hard. There is also the "Diffie-Hellman" assumption which says that given nG, mG in the group, it is hard to calculate nmG. (Of course, if you know n or m, it's easy to calculate. This is why the "shared secret" scheme you described is efficiently computable by the participants, and the Diffie-Hellman assumption is why it is a secret.)

So...everywhere you say Curve25519(n, G), you really mean nG, where G is some element in the elliptic curve group defined by djb's curve25519 curve. Where you say Curve25519(A, B) where both A and B are elements .... I don't know what you mean. Can you clarify what you are actually computing here? It is possible you are interpreting curvepoints as numbers without realize it, in which case you should use a better programming language that has a type system. (In particular, C is has a very weak type system and djb's code uses char* for everything, which is an asinine thing to do in public code with subtle operation. But possibly it compiles to faster code than it would if he'd used wrapper structs..) It is possible to convert a group element to a number, e.g. by choosing a binary encoding, hashing this, and interpreting the hash as a number.

Now, shared secrets are not really useful for building multisignature schemes. They let you build 1-of-N signatures (every party who has the secret is able to sign) but nothing stronger. The reason is that any party who knows the shared secret is able to use this to sign arbitrary messages. As an example of an actual multisig scheme, I will show how to construct a N-of-N multisig Schnorr signature. The semantics will be that as long as all parties agree to sign a specific message, they are able to form a signature on that message. However, no individual will see enough secret material to form signatures or her own, or even with the cooperation of (fewer than N) other members.

djb's ed25519 signature scheme is based off the standard Schnorr signature, but has some changes to allow efficient batch validation. I don't recall what these changes are (and don't have the paper with me on the bus that I'm typing this from), so I'm not sure if this is directly applicable .... but it is illustrative in any case. So here it is:

Suppose we have a public key P, and let G be a generator of some elliptic curve group, and let H be a hash function. A standard Schnorr signature is a pair (s, e) of numbers which satisfy the following relation: if R = eP + sG then e = H(m || R). It is possible to create such a signature if you know x such that xG = P (so x is the secret key here, and the "discrete logarithm assumption" above is why it is secret even though P is public), by the following mechanism: choose random secret k and compute R = kG; then set e = H(m||R) and s = k - xe. The signature is (s, e). Given some very strong assumptions on the hash function (that it is a opaque mystical source of uniformly random numbers except that it returns the same output when given same input), we can prove that any algorithm which forges Schnorr signatures can be extended to extract the secret key. So given such a hash function, forging Schnorr signatures is as hard as the discrete log problem.

Now, the question is: how can we make a 2-of-2 signature? One idea, as you suggested, is to use a shared secret: users have secret values x and y and form a private key from (a hash of) xyG. The problem with this is as mentioned: both parties knows the whole secret, so they can both form signatures on their own. So this is really a 1-of-2 multisig scheme. To get 2-of-2, we need to be a bit more clever. Here is a protocol:
0. Suppose we have two keypairs (x, xG) and (y, yG) belonging to parties A and B. We will show how to construct a signature with the "2-of-2" key (x + y, (x + y)G).
1. Both parties choose secret random numbers. Call A's secret α and B's secret β. A sends αG to B, and B sends βG to A. Now both parties can compute R = αG + βG = (α + β)G, and they compute e = H(m||R).
2. A computes s' = α - xe and B computes s'' = β - ye, and they send these to each other. Then both compute s = s' + s''.

Now (s, e) is a signature of m on public key (x + y)G, which required both parties' cooperation to form, but neither party gained enough information to produce such a signature alone.


It's a worthwhile exercise to (a) verify that the standard Schnorr signature k - xe actually satisfies the relation (e = H(m||R) where R = sG + eP) that I claimed it did, and (b) so does the 2-of-2 version.


This isn't really an answer to your question, but I hope it sheds some light on things.

Andrew

curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
  limb bp[5], x[5], z[5], zmone[5];
  uint8_t e[32];
  int i;

  for (i = 0;i < 32;++i) e[i] = secret[i];
  e[0] &= 248;
  e[31] &= 127;
  e[31] |= 64;

  fexpand(bp, basepoint);
  cmult(x, z, e, bp);
  crecip(zmone, z);
  fmul(z, x, zmone);
  fcontract(mypublic, z);
}

0. Suppose we have two keypairs (x, xG) and (y, yG) belonging to parties A and B. We will show how to construct a signature with the "2-of-2" key (x + y, (x + y)G).
1. Both parties choose secret random numbers. Call A's secret α and B's secret β. A sends αG to B, and B sends βG to A.

/* Calculates nQ where Q is the x-coordinate of a point on the curve
 *
 *   resultx/resultz: the x coordinate of the resulting curve point (short form)
 *   n: a little endian, 32-byte number
 *   q: a point of the curve (short form)
 */
static void cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q)

Now both parties can compute R = αG + βG = (α + β)G,

/* Input: Q, Q', Q-Q'
 * Output: 2Q, Q+Q'
 *
 *   x2 z3: long form
 *   x3 z3: long form
 *   x z: short form, destroyed
 *   xprime zprime: short form, destroyed
 *   qmqp: short form, preserved
 */
static void
fmonty(limb *x2, limb *z2, /* output 2Q */
       limb *x3, limb *z3, /* output Q + Q' */
       limb *x, limb *z,   /* input Q */
       limb *xprime, limb *zprime, /* input Q' */
       const limb *qmqp /* input Q - Q' */)

and they compute e = H(m||R).

2. A computes s' = α - xe and B computes s'' = β - ye, and they send these to each other. Then both compute s = s' + s''.

Hi James,

Thanks for creating the superNET and teleport.

SuperNET and teleport are both very unique and exceptional project .

Your name will be recorded in the history of cryptography sciences  .

Quoted from J1777 post above:

Anyway, I am glad 5000bitcoins is open minded enough to actually learn about SuperNET before making any decisions. Does any other network allow routing to an address without any node actually knowing its IP address (without broadcasting)? This is just one feature of SuperNET and it is continually being improved.



I dont think that James realizes that Crypti is not meant to be in any way an anonymous network.  Crypti is to have VERIFIED MERCHANTS. The process is still in debate for verification, but it will be complete enough so that a user will be absolutely sure who they are sending their coins to, and they will have an opportunity to call back the transaction within a certain time limit.  There is even plans for in-wallet escrow services. 

How would he integrate XCR, designed to be anonymous-proof, onto a network that has anonymity "that is continually being improved?"

Wulf I like you but, you haven't done your due dilligence on the matter, and can't speak for the whole community in that sense either.

That being said XCR can't compare to coins in the top 20s or coins/projects that raised millions of dollars (yet).
To me SuperNET seems like a network of coins taking advantages over others to strengthen their networks because the ulterior goal is to break midcap and go top.

What Crypti needs is exposure, userbase, forgers, contributors to appreciate it's innovations
If Crypti connects to Supernet, it does not become "CryptiSuperNet" or labelled in the same section as Vericoin.
I tihnk you get the idea a little twisted, that's all. It's more of a suppliment. Just like we don't become Storj by partnering up with them but strengthen both bases.

Okay, technicalities aside, on the financial front, to become a part of SuperNET, any coin has to "surrender" 10% of it's total supply. Don't you think that it's quite a huge ask for a coin to give away 10% of its total supply, only to join a network where it will experience a few tiny benefits from other coins, all of which are probably leeching off other coins on SuperNET to maintain their own userbases.

To me SuperNET seems like a network of shitcoins (plain and simple), bringing together their, mostly useless features, to try and rival other big-currencies in the crypto-space. Let me know when coins like Ethereum, MaidSafe, BitShares X and Peercoin join SuperNET, which of course will never happen.

#Take note this is my personal opinion and does not reflect that of the Crypti Team, of which I am not a part of

 

Are you going to be looking for people to contribute hardware/bandwidth for masternodes?

I realize that SuperNET is not a coin, nor does it have a blockchain, but are you sure that the only way that it can be done is offchain? Is it not possible at all to replicate SuperNET with blockchain support?

Let's say for example when Ethereum launches (Ethereum's platform is described similarly to Crypti's custom block-chain support), are you absolutely sure that that a network similar to SuperNET can't be created via a custom blockchain, and linked with its own blockchain with coins used as the "fuel" for the system to perform arbitrary actions? Those arbitrary actions being the connections made between different coins.

5000, with all due respect I really don't think that adding Crypti to SuperNet would be a good idea. In my opinion, I think Crypti is much bigger then SuperNet and can achieve far more than SuperNet.

For comparison, I think Crypti requesting to be added to SuperNet, is kind of like Facebook requesting MySpace to allow users to log into MySpace with their Facebook account. Facebook is obviously the far bigger network and they don't need to ask MySpace to comply, MySpace will make the change on their own to get more users.

When Crypti's Custom Blockchains launches, the whole of SuperNets functionality can be mirrored onto Crypti via a custom blockchain, rendering SuperNet useless.

I know that you might think that being added to SuperNet might bring about more network activity, but in 6 months time when Custom Blockchain support is launched, you'll see that the possibilities are endless. Why add Crypti to an inferior network, when our own is far more powerful.

Here is my previous response to this along with GreXX's

Thanks for the updates James. Really excited to see SuperNET in action! I assume the price will jump quite a bit once people see it working and in the wild.

This is pretty cool
Today I happened to read this article: http://www.bbc.co.uk/news/technology-29567782
in which the head of Europol's Cybercrime Centre says, "There is confusion among the good guys on the internet between anonymity and privacy. I don't think they are the same. I think that you have right to privacy but that doesn't mean that you have the right to anonymity."

The increasing trend towards greater encryption of online communications is not acceptable, he said.

"Imagine in the physical world if you were not able to open the trunk of a car if you had a suspicion that there were weapons or drugs inside... we would never accept this.

"I think that should also count for the digital world. I hate to talk about backdoors but there has to be a possibility for law enforcement, if they are authorised, to look inside at what you are hiding in your online world."

That is an entirely different level of crazy.
Way to go james!