bitcoin-dev
Reiterating centralized coinjoin (Wasabi & Samourai) deanonymization attacks
Posted on: January 24, 2025 16:38 UTC
In a detailed exploration of the cryptographic nuances between Schnorr and ECDSA signatures, a significant point of analysis arises concerning the possibility of creating a new public key for a given signature and message tuple that remains valid under both schemes.
The inquiry centers on the feasibility of generating a secondary public key (P2) such that a pre-existing tuple consisting of a message (m), a signature (s), and an original public key (P) would validate under (P2) as well. This scenario is particularly scrutinized within the context of Schnorr signatures.
Schnorr's design incorporates key-prefixing, a method that effectively binds a signature to a specific public key. The argument proceeds by examining a scenario where, for a valid signature tuple ((m, (R,s), P)), one attempts to contrive a new public key (P2) that validates the same tuple. The mathematical foundation of this impossibility lies in the equation (sG = R + e'P2), with (e') being the hash value (H(R,P2,m)). For a new (P2) to satisfy this equation, it would necessitate solving for (P2 = e/e' * P), a task rendered infeasible due to the hash function's preimage resistance, illustrating the robustness of Schnorr signatures against such manipulations.
Conversely, the analysis shifts towards ECDSA, highlighting its distinct approach where the public key is not fixed within the hash function, thus enabling public key recovery scenarios. However, even in the absence of key-prefixing, the examination suggests that fabricating a new (P2) for the same ((R,s),m) tuple in ECDSA encounters different challenges. Specifically, the immutable nature of (R), (s), and (m) in the verification equation leaves no room for altering (P), despite the theoretical viability of negating (s).
The discourse encapsulates a technical comparison between Schnorr and ECDSA digital signatures, emphasizing the inherent security features and limitations of each scheme in the context of creating valid signature tuples with substitute public keys. The detailed examination underscores the intricacies of cryptographic signature algorithms and their implications for digital security practices.