remix

Formal Methods, Cryptography and Bitcoin

[remix @remix7531]

@FutureDies been at 70 this whole time and it is been working out great

[remix @remix7531]

@paarrthhbirla @n1ckler Neither secp256k1 ECDSA nor Schnorr is NIST approved. Also, an American agency's approval list is not a global adoption requirement.

[conduition @conduition_io]

allow me to reintroduce SHRINCS:
- https://t.co/MO8DRnAs4c
- https://t.co/TKuj2JNqq1
- https://t.co/0EeVfmxWFu

[Jonas Nick @n1ckler]

Today, we're publishing BIP SHRINCS, the first concrete proposal for a post-quantum signature scheme designed specifically for Bitcoin.

The BIP draft turns what began as a rough idea into exact algorithms with an executable reference implementation.
This is an important milestone: the discussion can now focus on analyzing, criticizing, and improving a concrete proposal.

The BIP makes choices ranging from major design questions, such as whether to support flexible XMSS and how to balance signature size against verification time, to the many smaller decisions involved in saving a byte here or there.
All of these choices are up for debate.

Big thanks to Mike Casey, @conduition, @Ethan_Heilman, @kudinov_mikhail, @olkurbatov, Boris Nagaev, and @remix7531 for their contributions to the BIP.

A lot more work lies ahead:

- The draft BIP specifies only the cryptography. Using SHRINCS in Bitcoin Script will require a separate BIP.
- We are working on a security proof for the exact construction and parameters.
- Wallet integration and user experience, for example around backups and recovery after state loss, are still at an early stage. The design space remains wide open.

SHRINCS is not intended to be Bitcoin's "final" signature scheme, and it is not optimal along every axis.
I do think it is a very good trade-off among the options we have now.

bitcoin-dev post:
https://t.co/BHYMfQ5c97

Draft BIP:
https://t.co/rl3X7VdbRy

[Bitcoin Optech @bitcoinoptech]

Changes to services and client software:

- Payjoin Dev Kit (rust-payjoin) 1.0.0 released
- Silent Payments sender plugin for Electrum
- Superscalar implementation announced
- Cofund multisig wallet announced
- Lexe adds human-readable addresses and LNURL-withdraw
- Ledger Bitcoin app 2.5.0 adds human-readable policy descriptions
- Bark 0.5.0 released
- Bitcoin-PIR for private UTXO queries
- OP_TEMPLATEHASH Ark demonstration
- libshrincs formally verified hash-based signatures

https://t.co/A2X05snpBP

[remix @remix7531]

Read my latest post on:

Towards libshrincs: verified hash-based signatures for Bitcoin: https://t.co/uYjjSm40es & Choosing the verification toolchain for libshrincs: https://t.co/6kUWIqeLTp

[Jonas Nick @n1ckler]

LLMs are used very successfully to find vulnerabilities in Bitcoin software.
Can they also help prove the security of a modern cryptographic library for Bitcoin?

To explore this question, @remix7531 and I are publishing libshrincs.

https://t.co/gWmdh7zwtD

libshrincs is a handwritten C library implementing WOTS+C, the one-time signature used by SHRINCS.
It is a proof of concept and should not be used in production.
Its machine-checked proofs connect the C implementation to an unforgeability theorem.

The current theorem does not yet give a full post-quantum security bound.
The post and review tutorial describe its current limits.

Code and proofs:
https://t.co/GiGcRXVSm3

Review tutorial for the security proof (no Rocq or SSProve background required):
https://t.co/r7748cpphH

@remix7531 has written three excellent posts on the library and verification work:

Towards libshrincs
https://t.co/NsMEGnPcfe

The grind was the only detector
https://t.co/2rBkPj0UpG

Choosing a verification toolchain
https://t.co/jUdPy1DF1B

[remix @remix7531]

Hello, World!