Nostr Web Client

Oh also public derivation could work with the BLS scheme I think. Just don’t commit to the public key in the hash to curve for the PoK and it becomes malleable.

waxwing 2mo ago

OK. But my gut would tell me that malleable (not pubkey prefixed) BLS sigs would be unsafe. I'm assuming by PoK you do mean BLS sigs. Wouldn't you be able to forge sigs on related keys?

Reply to this note

Please Login to reply.

Discussion

Zero-Knowledge Goof 1mo ago

Yeah that’s a feature. You can forge the PoK on related keys. If a key has a known key then you can’t sub-exponential data with it or any related keys either.

waxwing 1mo ago

I think I agree.

(Apart from 'key has a known key' 😁)

Zero-Knowledge Goof 1mo ago

Haha that sentence was extremely slurred but it sounds like you got the idea!