ࠓճͷจ Title: Simple Schnorr Multi-Signatures with Applications to Bitcoin Author: Gregory Maxwell, Andrew Poelstra, Yannick Seurin, and Pieter Wuille Article: https://eprint.iacr.org/2018/068.pdf Published: January 2018
BitcoinͷεέʔϦϯά w 5SBOTBDUJPOTJOPOFCMPDLJTGVMM w .#QFSCMPDL w *ODSFBTFPG#JUDPJOCMPDLDIBJOEBUBTJ[F w )JHI59GFF w FYTBUPTIJCZUF w d59QFSTFDPOE w NJOCMPDLUJNF w .CZUFTCZUFTNJOTFDPOE59QFSTFDPOE w 5IJTCMPDLUJNFJTOFDFTTBSZGPSTUBCMF#JUDPJOCMPDLDIBJOBOEJTFOPVHIGPSVTVBMCJUDPJOQBZNFOU w #VUJUJTWFSZTMPXDPNQBSJOHXJUIDSFEJUDBSEPS/'$ w ʜ
γϡϊΞॺ໊(Schnorr Signature) هड़๏ G: p࣍८ճ܈ g: Gͷੜݩ m: ॺ໊ରϝοηʔδ x: ൿີ伴() X: ެ։伴, X = g x H(ɾ): ϋογϡؔ ॺ໊࡞ ཚrΛબͿ([0,p-1]) R = g r mod p c = H(X, R, m) : ͜ΕʹҧײΛײ͡Δํ͕͍Δͱࢥ͍·͢ɻ௨ৗc = H(R, m)ɻ s = r + cx mod p ͜ͷͱ͖ɺॺ໊Λ(R, s)ͱ͢Δɻ : c, s, ॺ໊ʹҧײΛײ͡Δํ͕͍Δͱࢥ͍·͢ɻ௨ৗc = H(R, m)ɺs = r - cx ɺॺ໊(c, s)ɻॺ໊ʹ͍ͭͯp22 Discussionʹͯٞɻ ॺ໊ݕূ g s = RX c ͕Γཱ͔ͭͲ͏͔Λ֬ೝɻΓཱͯॺ໊ਖ਼͍͠ɻ Γཱͨͳ͚Εॺ໊ෆਖ਼ : จͰ͜͏ͳͬͯ·͢ɻ௨ৗͱҧ͏ॺ໊ݕূࣜͰ͢ɻ ·ͨfiat-shamirมෆཁʁͱ͍͏ͷٙͰ͢ɻ
γϡϊΞॺ໊ͷ γϯϓϧͳϚϧνγάωνϟ֦ு هड़๏ G: p࣍८ճ܈ g: Gͷੜݩ m: ॺ໊ରϝοηʔδ i: ॺ໊ऀʹৼͬͨ൪߸([1, n]) x i : ൿີ伴, {x 1 , …, x n } X i : ެ։伴, {X 1 =g x1 , …, X n =g xn } (x1x 1 ͷҙຯ) H(ɾ): ϋογϡؔ ॺ໊࡞ ཚri ΛબͿ([0,p-1]) Ri = g ri mod p R = R1 R2 …Rn X~ = X1 X2 …Xn , (X~ ͷ~Xͷ্ͷҙ) c = H(X~, R, m) si = ri + cxi mod p s = s1 +s2 +…+sn ͜ͷͱ͖ɺॺ໊Λ(R, s)ͱ͢Δɻ ॺ໊ݕূ g s = RX c ͕Γཱ͔ͭͲ͏͔Λ֬ೝɻΓཱͯॺ ໊ਖ਼͍͠ɻΓཱͨͳ͚Εॺ໊ෆਖ਼
ൺֱ ॺ໊ूͳ͠ ॺ໊࡞ ཚrΛબͿ([0,p-1]) R = g r mod p c = H(X, R, m) s = r + cx mod p ͜ͷͱ͖ɺॺ໊Λ(R, s)ͱ͢Δɻ ॺ໊ݕূ g s = RX c ͕Γཱ͔ͭͲ͏͔Λ֬ೝɻΓཱͯ ॺ໊ਖ਼͍͠ɻΓཱͨͳ͚Εॺ໊ෆਖ਼ ॺ໊ू͋Γ ॺ໊࡞ ཚr i ΛબͿ([0,p-1]) R i = g ri mod p R = R 1 R 2 …R n X~ = X 1 X 2 …X n , (X~ ͷ~Xͷ্ͷҙ) c = H(X~, R, m) s i = r i + cx i mod p s = s 1 +s 2 +…+s n ͜ͷͱ͖ɺॺ໊Λ(R, s)ͱ͢Δɻ ॺ໊ݕূ g s = RX c ͕Γཱ͔ͭͲ͏͔Λ֬ೝɻΓཱͯ ॺ໊ਖ਼͍͠ɻΓཱͨͳ͚Εॺ໊ෆਖ਼
ΩʔΞάϦήʔγϣϯͰͱͳΔ߈ܸ — Rogue Key ߈ܸ — Rogue Key߈ܸ Alice(ળਓ): ެ։伴X a ɺBob(ѱਓ): ެ։伴X b ूެ։伴Λ࡞Δͱ͖ʹɺAliceBobʹެ։伴ΛૹΔɻ ࣍ʹɺBobX b ΛAliceʹૹΔͷͰͳ͘ɺX b /X a ΛBobͷެ։伴ͱͯ͠ૹΔɻ Aliceूެ։伴(ຊX a X b ɺ͔͠͠X b /X a *X a = X b ʹͳ͍ͬͯΔ)Λ࡞͠ɺ͜ͷΞυϨεͷࢧ͍ ͱͯ͠τϥϯβΫγϣϯΛϒϩʔυΩϟετ BobX b ʹରԠͨ͠ൿີ伴x b Λ͖ͬͯ͞΄ͲͷτϥϯβΫγϣϯʹର͢Δॺ໊Λ࡞͠ɺAliceʹແஅ ͰτϥϯβΫγϣϯΛ͑ͯ͠·͏ ؆қతͳղܾํ๏ Bob͕ૹ͖ͬͯͨެ։伴ʹର͢Δൿີ伴ΛBob͕ؒҧ͍ͳ͍࣋ͬͯ͘Δ͜ͱΛূ໌͢ΔखஈΛ࣋ͭ͜ͱ (ೝূػؔ)
γϯϓϧͳͷͱԿ͕ҧ͏ʁ ࣭Ͱࢦఠ͕͋ͬͨͷͰهࡌ ͳͥຊจͷఏҊํ๏ͩͱRogue Key߈ܸ͕ޮ͔ͳ͍͔ʁ શͯͷa i શެ։伴ͷใΛؚΉLͱɺa i ʹରԠͨ͠X i ͕ͳ͍ͱ࡞Εͳ͍͕ɺଞͷਓͷެ։伴Λ ड͚औͬͨͷͪʹRogue Key߈ܸͷͨΊʹX i Λِͯ͠ӕͷͷʹม͑ͨͱͯ͠ɺX i Λม͑ͯ ͠·͏ͱa i ͚ͩͰͳ͘ଞͷa j≠i มΘͬͯ͠·͏ͨΊɺ͏·͘߈ܸ͕ޭ͢ΔΑ͏ͳX i ͕બͳ ͍ σΟʔϓϥʔχϯά(χϡʔϥϧωοτϫʔΫ)ͰͷӅΕͷஞ࣍తॏΈߋ৽ͷΑ͏ͳํ๏Ͱ߈ܸ͕ ޭ͢ΔΑ͏ͳX i ͕બͦ͏ͳؾ͕͕ͨ͠ɺҎԼͷͰͰ͖ͳ͍ a i ϋογϡؔH 0 Λ௨ܾͯ͠·ΔͷͰɺҾΛͪΐͬͱ͚ͩม͑ͯa i େ෯ʹ͕มΘΔ ͜ͷͨΊɺԾܾΊͨ͠X i ΛϕʔεʹX i ->a i ->X i ’->a i ’’->X i ’’->…ͷΑ͏ʹஞ࣍ߋ৽͍ͯͬͯ̎͠ ͭͷύϥϝʔλʔ͕ঃʑʹऩଋ͢ΔΑ͏ʹͳΒͳ͍
ͬͱγϯϓϧʹͰ͖ͳ͍ʁ a i = 1μϝ ͜ͷ߹୯७ͳ֦ுʹҰகͯ͠͠·͍ɺRogue Key߈ܸ͔Β੬ऑʹͳΔ a i = H 0 (X i )μϝ ѱਓॺ໊ऀ͕ेେ͖͍ͱɺ߈ܸऀWargnerͷΞϧΰϦζϜ(จϦϑΝϨϯε [Wag02])Λͬͯॺ໊Λِͯ͠ળਓऀͷ͓ۚΛ౪ΊΔɻ ߈ܸʹ͔͔Δ࣌ؒܭࢉྔΦʔμʔO(2 2√k ) k८ճ܈GͷҐpͷbit ϥϯμϜ r i ͷ͍ճ͠ݫې ू伴ͷੜաఔͰɺଞͷॺ໊ऀʹൿີ伴͕͔Εͯ͠·͍·͢