Re: [CFRG] Bitcoin delenda est. Was: Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

[Phillip Hallam-Baker <[e-mail]>]

On Mon, Apr 26, 2021 at 1:54 PM Daniel Franke <[e-mail]> wrote:

>
>  I share your alarm at the economic waste and environmental harm inherent
> in proof-of-work-based cryptocurrency. (I do not share your other
> objections, and see great promise in permissioned and proof-of-stake-based
> blockchains). But what does this have to do with the instant draft? We're
> not specifying a proof-of-work function. We're specifying a pairing-based
> signature scheme — something with myriad applications beyond
> cryptocurrency. Your argument reminds me of demands that we compromise, or
> not build, end-to-end encryption schemes because they will be useful to
> terrorists. The IETF has categorically rejected those arguments. Why should
> we accept yours?
>

Providing communications between individuals unrestricted by government
diktat has always been understood as core to the IETF mission. Providing a
means for Ponzi scammers to get rich has not.

The original article is predicated on the claim that the IETF should do
something urgently in order to prevent harm to the cryptocurrency
communities that have deployed on the basis of a draft. I am arguing that
this is a reason to delay rather than accelerate response.

It is well known I am pretty keen on threshold crypto. But I have yet to
see a really compelling case for threshold signatures that cannot be met by
multi-signatures that involves more than one distinct party. I can see real
purpose in using a threshold t out of n signature scheme to back up a t out
of n quorum redundancy scheme. I can see real purpose in splitting
signatures across multiple HSMs. But these are all applications where there
is one principal and there are multiple shares required to create a
signature (e.g. signing the DNS root zone) and all make use of completely
standard algorithms.

The only reason to go to pairing is if you want a random collection of
parties that are not co-operating to sign. And that is a concern that is
pretty much unique to BitCoin et. al.