Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why does the all 0 public key have a known private key in SR25519 and ED25519?

substrate.stackexchange.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#41

Post by nailer »

hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

> So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key.

Is this sentence a mistake? A private key is a secret key.

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#42

Post by anothernewdude »

hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

Why is an image viewer using PKI?

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#43

Post by doomrobo »

etna_ramequin wrote: post #32
hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

Thanks for the layman’s explanation, I didn’t realise something like that was even possible! What are some use cases for using it? Are they all crypto-currency related?

Another use is for password authenticated key exchange. The CPace protocol picks its generator using a hash to group operation. See page 13 of https://eprint.iacr.org/2018/286

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#44

Post by hgsgm »

nailer wrote: post #41
hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

> So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. Is this sentence a mistake? A private key is a secret key.

It's a use of a synonym to make the writing more pleasant to read.

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#45

Post by hgsgm »

jagged-chisel wrote: post #37
3np wrote: post #35

Earlier quoted context omitted.

This reasoning doesn't hold if we're still operating within the base assumptions of RSA (and if we're not, no private key is secure)

Let’s try it this way: what if two people, unlikely as it may be, generate the same key pair? Two people know the private key, and factoring is still hard.

"someone might guess a key by luck" has always been an accepted risk of RSA or any key-based encryption system. It's an "act of God".

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#46

Post by nailer »

hgsgm wrote: post #44
nailer wrote: post #41

Earlier quoted context omitted.

> So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. Is this sentence a mistake? A private key is a secret key.

It's a use of a synonym to make the writing more pleasant to read.

Ok. It’s better to use consistent terminology rather than move between two different technical terms.

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#47

Post by Retr0id »

anothernewdude wrote: post #42
hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

Why is an image viewer using PKI?

Did you reply to the wrong comment? Which image viewer?

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#48

Post by nullc »

The choice of the identity element, if one can be encoded at all, gives you one point with known key by design. Choice of the generator, if it isn't NUMS, can give you a second arbitrary value with a known key-- this latter one could even be a no-one-but-us backdoor but a somewhat contrived one.

Like if you want to secretly know the private key of 0xDEADBEEF, set your generator to lift(0xDEADBEEF) x (1/$secret). Now the deadbeef pubkey has a DL relative to your generator of $secret.

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#49

Post by hdevalence »

nailer wrote: post #41
hdevalence wrote: post #24

I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…

> So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. Is this sentence a mistake? A private key is a secret key.

I wrote it while waiting to board in the airport, sorry

Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?

#50

Post by girvo »

hdevalence wrote: post #36
etna_ramequin wrote: post #32

Earlier quoted context omitted.

Thanks for the layman’s explanation, I didn’t realise something like that was even possible! What are some use cases for using it? Are they all crypto-currency related?

One use case for generating group elements with verifiably unknown discrete logs is for a commitment scheme, like a Pedersen commitment. In a Pedersen commitment, you have two generators, let’s call them G_value and G_blinding. To commit to a value v, you choose a random blinding factor v_blinding and form the commitment C_v as C_v = v * G_value + v_blinding * G_blinding Later, you can publish (v, v_blinding) to open…

Which, for a particular real-world use case; I built a PoC for the four biggest insurance companies in my country that allowed them to query each others claims data to see if a claim has been made with another insurance company for the same car/accident/etc (apparently it’s pretty common, with a dodgy repairer involved to do this), without ever revealing the actual data and who was answering it. This would allow the companies to reduce fraud without falling afoul of data sharing prohibitions (which rightfully exist) or needing to necessarily trust one another.

We used a partial homomorphic encryption system for it, but I’m sure we could’ve used a Pederson commitment if we tweaked how we approached it.

One factor though that the PoC never truly got rid of was a semi-trusted central system. We didn’t need to though, at the time. Would’ve been neat however!

Post reply on HN