Replies (6)

DecBytes's avatar
DecBytes 2 weeks ago
Man there are so many parts of Nostr that I don't know about.
The LLM went with Pederson because the FROST spec called for it. Could use ChillDKG though. It's just for gaming so not toonworried about that starting out. I'll be happy if it works first. Y'all are using trusted DKG, right? So have less to worry about?
Duh! --------- <AI SLOP> ----------- The current spec calls the randomness scheme "FROST Schnorr blind signatures." This is wrong in two ways: 1. Cashu's BDHKE is C' = k * B' — a scalar-point multiplication, not a Schnorr signature. FROST produces (R, z) Schnorr pairs. You can't unbind a Schnorr pair into k * Hash_to_curve(x). The math is incompatible. 2. The correct threshold extension of BDHKE is a Threshold OPRF — each signer holds a share s_i of k, computes C'_i = s_i * B', proves correctness with a DLEQ proof, and the requester reconstructs C' = k * B' via Lagrange interpolation. What FROST's DKG gives us: Pedersen DKG to distribute shares of k across players — this is still valid and stays. What replaces FROST signing: One-round Threshold OPRF with DLEQ proofs. -------- </AI SLOP> ----------- View quoted note →