Post by @hipsterelectron@circumstances.run

@hipsterelectron@circumstances.run 2 days ago

so because elliptic curve bullshit is confusing as shit the blockchain boys broke the foundational assertion against double-spending

As an illustration of the second complication, the Monero blockchain announced in 2017 [166] that it had patched a vulnerability allowing each coin to be spent 8 times. Monero used Curve25519, which has cofactor 8, so there are 8 points T ∈ E(Fp ) such that 8T is the neutral element; Monero’s security analysis was expecting a point P to be in the order-l group, but the software was accepting P + T as a separate expenditure for each of the 8 points T.

literally not a good protocol

7 Replies

52 Boosts

Rod Van Meter

@rdviii@famichiki.jp 2 days ago

@hipsterelectron DH and RSA are the canonical examples of vulnerable to factoring or discrete logarithm breakthroughs and surprise, that's exactly what Shor's algorithm does.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

@rdviii shor's algorithm, the one that works on a quantum computer, which will never exist

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

@rdviii it has never once been proven that the claimed mathematical framework assigned to a quantum computer is actually physically realizable

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

https://cr.yp.to/papers/safecurves-20240809.pdf if you read section 10 and onwards there are just an incredible number of problems arising from elliptic curves not using integer bit strings as points where it becomes incredibly hard to tell whether anything is a legitimate point and that seems like a huge problem

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

and furthermore the index calculus method is not very well evaluated + it seems to apply to elliptic curves anyway

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

The literature has many more examples of complications stemming from the interface gap between [bit] strings and elements of E(F_p)

this sounds like a bad protocol

Efficient bijections are known for some elliptic curves.

this is definitely not making the case

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

so because elliptic curve bullshit is confusing as shit the blockchain boys broke the foundational assertion against double-spending

As an illustration of the second complication, the Monero blockchain announced in 2017 [166] that it had patched a vulnerability allowing each coin to be spent 8 times. Monero used Curve25519, which has cofactor 8, so there are 8 points T ∈ E(Fp ) such that 8T is the neutral element; Monero’s security analysis was expecting a point P to be in the order-l group, but the software was accepting P + T as a separate expenditure for each of the 8 points T.

literally not a good protocol

1+ more replies