Nathan George: hello, I can report to the areas call just wrapped up, but also the reminders that I w is going on right now, so I don't know what our attendance will be like.
Nathan George: anything.
Camilo Parra: um yeah i'm just I think heart, said that he would be here and so as Mike.
Michael Lodder: Hello.
Nathan George: Hello.
Michael Lodder: hey there.
Nathan George: I think everyone's just kind of waiting to see if we get any more stragglers show up.
Nathan George: we're hoping heart joins right.
Michael Lodder: He won't he's an idea w SOS brand.
Camilo Parra: yeah I thought hard, said that he was going to join today either way.
Michael Lodder: Oh well, i'm not quite done yet.
Michael Lodder: But this proof is incredibly huge.
Nathan George: Ah.
Michael Lodder: I mean it's it's a nightmare so i'm I can maybe we should discuss the ramifications of this.
Camilo Parra: yeah that'd be good so Nathan um so with me and Mike kind of discussed offline this but um yeah the the size of this proof would mean that it wouldn't be able to fit into a normal credit def.
Michael Lodder: Let me, let me show you what I mean.
Michael Lodder: i'll try i'll try to just skip them like too much of the math but just know how many how many it is so after doing a deep dive of this.
Michael Lodder: So there are two possible proofs one, is where the rsc modulus is secret, the other is where it is known, so initially I went down this path.
Michael Lodder: And this parts, the same in both this part some similar to both but then this is what's different between the two Okay, when you go look at this paper.
Michael Lodder: And I confirmed it with heart.
Michael Lodder: The security guarantees are actually really crappy like really, really bad so it's not even worth doing it doesn't save you anything either, so the simpler protocol is actually this one.
Michael Lodder: But here's here's where the proof gets nasty okay.
Michael Lodder: In order to check that your RSA modules and, in our case, which is 2048 bits or two kilobits right.
Michael Lodder: You have to generate and operate in something bigger than that which is this prime order queue so the smallest that I could go was three kilobits for this, which means every operation that you see down below is going to be in MOD Q.
Michael Lodder: So, or three kilobits Okay, so if you come down here.
Michael Lodder: here's one of them there's 12345.
Michael Lodder: And then each of these represents ashore proof of that same size, so now we're up to 56789 and then it says, you have to do this so here's 10 1112 1314 1516 Okay, and then a sharper for each of these so that's 818 1920 2122 2320 420-526-2728 and then you have to run this.
Michael Lodder: TEE times so in our case, since 48 That means that you have to run this 112 times.
Michael Lodder: times for okay so we're up to about 30 right here, right 30 times three kilobits now this four times.
Michael Lodder: So look what look at the size of this proof.
Michael Lodder: Here we go again.
Michael Lodder: This which is 248.
Nathan George: To 50, such as the short are talking about a couple bag.
Michael Lodder: it's its massive so you have 30 times.
Michael Lodder: 384 which is 11 kilobytes and then this are so you have to pick 112 of these other 112 of these hundred and 12 of these which yields hundred and 12 and Z Q, which is 380 412 of these.
Nathan George: All of those right yeah.
Nathan George: Well, this is.
Michael Lodder: All this.
Nathan George: If it only has to be done once with a trusted authority probably not that big of deal if you have to do it every time a credential is issued, it starts to be a lot.
Michael Lodder: No, I wouldn't say you have to do it every time a credential is issued, I would say, every time you, you are each time you like what's a way to describe it like you certify an issuer right.
Michael Lodder: So maybe it's just the first time you get a credential from this public key.
Camilo Parra: yeah and I think I don't think that would be a problem, I think it like we found out a sovereign was that people will rarely right pred depths to the ledger.
Michael Lodder: yeah well i'm just telling you the size of this thing right before even running this four times i'm already up 12 kilobytes and now i've got to do this so 112 times to 56 times two that's 58 kilobytes plus the 12 I already had so now you're up to 80 kilobytes.
Michael Lodder: And now you've got to do 112 of these that's 384 times 112 that's another 43 kilobytes so now you're up to 112 kilobytes or 120 23 and then all this stuff.
Michael Lodder: So times to whoops so three four times to 24 year up to 86 plus 86 so I mean you're.
Michael Lodder: By the time you're done you're at half a megabyte for this whole thing which is way too big to put on the ledger.
Michael Lodder: Did you have to do this, four times.
Michael Lodder: So.
Michael Lodder: Actually yeah.
Michael Lodder: So you're up you're up to 100 you're up to five about half a megabyte for this proof.
Michael Lodder: So it's quite nasty.
Michael Lodder: And I know sovereign that's bigger than the indie transaction limit.
Michael Lodder: So the only way that you would store this on the ledger in my mind is to hash the proof.
Michael Lodder: and have an address for it off chain like I pfs or something like that.
Michael Lodder: So if you did it when you started off chain and I pfs, then you only have to store the hash on chain much because then the hash also functions as the address, and you have to do a double lookup.
Michael Lodder: So.
Michael Lodder: that's where it's at, but it is nasty the other one doesn't save you much in is actually has weaker security and then, if we up the cl signatures to be 128 bit versus 112 bit you're almost to a megabyte in size.
Michael Lodder: In fact, you are over a megabyte in size, because remember that Q has to be bigger than the other one.
Nathan George: Well, the megabyte itself doesn't concern me so much as how often do we have to transmit sick right right.
Michael Lodder: Well yeah.
Michael Lodder: My, mind you just do it whenever your youth, this is a brand new public key that you've never seen before.
Camilo Parra: yeah and i'm not too concerned about how it will be implemented, I think, like the way will be implemented, would be like like Mike said, like something like a tail server or.
Camilo Parra: You know you'd call this, whatever your.
Camilo Parra: I guess your.
Camilo Parra: security check server whatever you want to call it, and.
Camilo Parra: yeah just be a new.
Camilo Parra: A new thing that would accompany the indie ledger.
Camilo Parra: And it wouldn't be that big of a you know wouldn't be costly to anybody because it just be a few Meg.
Nathan George: Well, I played it.
Camilo Parra: yeah go ahead and ethan.
Nathan George: there's a few different aspects to talk about this with one is OK mechanically, how do we capture and distribute the bites right there that's where I think, can you just directly jumps to the second is what the perception danger of making it seem like the setup process is very expensive.
Nathan George: Then.
Nathan George: The third, the third one is is this check sufficient is there, another alternative check, we should be investigating and I think for the earth to call the third discussions, the one that's the most interesting.
Nathan George: In terms of being able to capture the data, whether it's big or small, I think the rest of the community's gonna say go give me what I need to make the proof and then we'll decide how often and where to store it.
Camilo Parra: Right and will, I think that there isn't a a simpler solution for cl signatures, I think the question is, do we want to can do you want to move forward with with recommending cl signatures and supporting sealed signatures if it's going to bring you know all this extra baggage with it.
Nathan George: Well, I think all of us are of the opinion that, if we can get to the kp predicate proof some other way, we were happy to move.
Nathan George: forward that that progress is progress right, so I don't I don't think that's that's I don't have any rebuttal for that, nor do I think we need to have are both for that.
Nathan George: The question I was trying to ask Mike Is there something else we should be investigating before we move forward with just kind of you know.
Nathan George: Putting a bandaid on it and.
Nathan George: And figuring out what's next.
Michael Lodder: well.
Michael Lodder: I haven't given that much thought.
Michael Lodder: Because this proof stuff is quite old.
Michael Lodder: I mean, maybe there's some maybe we could reduce some of the proof stuff like.
Michael Lodder: You could do a square free proof, which is substantially smaller and some of the other proofs to maybe just enhance the security without doing this whole thing.
Michael Lodder: I mean there's there's like four different things you could do.
Michael Lodder: I mean, this is probably why young Commission the first place just to just abandon to this.
Michael Lodder: Proof all together right.
Michael Lodder: That makes sense.
Michael Lodder: I.
Michael Lodder: mean it just depends what's the risk we're willing to take here.
Nathan George: So I remember conversations about whether we these checks were worthwhile or not occurring really early on, because probably.
Nathan George: Oh gosh That was a long time ago, but I don't remember what the conclusions of those discussions, where.
Nathan George: If someone is here.
Nathan George: If someone has a direct line to heart, we might want to ask heart to go bother Jason because Jason is there a w two and a Jason might remember more.
Michael Lodder: Well, so there's like two other proofs that I think we could add that they're pretty decent one is called square free.
Michael Lodder: What that means is it proves that the.
Michael Lodder: what's the best way to describe this is a hard time this morning it's too early.
Michael Lodder: it's basically saying that, like the the two prime numbers are not equal to each other, so it doesn't produce a squared number a squared product.
Michael Lodder: So that's one thing and then the other is what's called a destroyer prime product, which means they have no odd common factors.
Michael Lodder: So.
Michael Lodder: that's so that kind of like I said Those are two relatively small proofs that you could add to it that maybe enhance that does enhance maybe the.
Michael Lodder: The guarantees.
Michael Lodder: But i'm not entirely sure well The thing is, in the original ID mix paper this proof is completely left out right.
Camilo Parra: Right.
Michael Lodder: Probably intentionally for this very reason, the other two that you that are problematic is it was called the prime power product.
Michael Lodder: This is, and this is the one that doesn't give you very much, security that when the heart and I investigated right you basically have to prove that the modulus can't be divided by any prime factors.
Michael Lodder: So that's that's the other one, and then the other one is that the set of the two PRIMES that make up the modulus.
Michael Lodder: it's another huge proof and it proves that they are distinct and they're not can grow into certain factors which makes them safe they're not small so.
Camilo Parra: Right I just don't see how they are would be I guess like I haven't looked to the proofs that you're mentioning but I don't see like how it would be easy, how it could be done, you know, safer and you an easier way.
Michael Lodder: I I don't know like.
Michael Lodder: When i've done threshold signing algorithms where they use pyre encryption, where we have the similar.
Michael Lodder: problem here, where you have to do a product of two PRIMES right.
Michael Lodder: They the only proof that they do is proof of square free.
Michael Lodder: that's literally, the only profile ever see them do.
Michael Lodder: which basically means the two PRIMES are not equal to each other.
Michael Lodder: Among and they're big enough that's pretty much all day guarantee with that point.
Michael Lodder: i'm trying to remember how big that one is.
Camilo Parra: yeah and that and that one doesn't it doesn't solve the problem of what of what these a of this vulnerability is reporting because they're saying.
Camilo Parra: You know I can get away with a pseudo or like a pseudo or unsafe prime I guess or an unsafe prime and it's not going to be one of them, you know could pass off, but the other one couldn't and so you I guess you could fake you can fake that you know that that wouldn't.
Camilo Parra: Your the square free proof wouldn't wouldn't be able to capture that.
Michael Lodder: Well, what the square pre proof does is it proves that the parameters were created honestly right.
Camilo Parra: mm hmm.
Michael Lodder: So it's still fairly large, but then, like you, all i'm saying is you could just replace the I wonder if you could just replace it with that instead.
Camilo Parra: And I can do the research on that, like that that's not a problem.
Michael Lodder: Let me know your time is limited Mike so so.
Camilo Parra: So we could do the we could do the.
Michael Lodder: Whole here's the paper that has that has that proof like i've already i've already implemented this not for sale signatures, but for other stuff.
Michael Lodder: Those are the two papers have the proof of square free and the guarantees that they provide i'm wondering if that would be good enough.
Michael Lodder: Art will probably disagree and say well depends on what guarantees you want, you know, this is where he's going to say, if you want to.
Michael Lodder: guarantee everything, then you should do this massive proof.
Michael Lodder: But if you are acceptable if it's acceptable to not be quite a secure, maybe we do the current sorry proof of correctness setup plus the square free proof and call it good.
Camilo Parra: yeah I don't know what do you think Nathan.
Nathan George: well.
Nathan George: part of what we're after is a rebuttal to the security paper and we understand the the security vulnerability is very limited in scope and i'm Okay, if the fix is limited in scope.
Nathan George: Now it feels like the right due diligence, to see if one of these other techniques works in a way that's a little bit better.
Nathan George: But you know I don't really have the wherewithal to evaluate, you know how much time it's worth to do that investigation versus to just implement the thing is already in the literature and say, if you want to use it.
Nathan George: It feels like a bit of a sloppy fix to just implement this really large group if we know that there's a better option.
Nathan George: But I know i'm not hearing a lot of confidence that we know that there's a better option just that there's probably a few things we should check on Mike is that that fair I don't want to sign you up for work, as was part of what i'm trying to say here.
Michael Lodder: That that's accurate yes.
Nathan George: So Mike what I don't think anyone else could really say what we should do I think it's kind of a deal, well, I would go with your recommendation here.
Michael Lodder: My yeah my recommendation is can we, is it like is the Community okay with going well, can we get.
Michael Lodder: better guarantees than what we have now, but not quite as good as the full blown one but close enough right such that the risk is more mitigated.
Michael Lodder: By doing one of these other techniques.
Nathan George: It feels to me like the answer that question is yes, and because we're really just trying to catch the malicious cheater.
Nathan George: If you can cheat in a way that's more obscure than what that proof would catch my guess is that the proof that cheating is too expensive practical, but again.
Nathan George: It unless we had a dialogue with the vulnerability writer, where we say here's our check, can you try it again, to see if it breaks i'm not sure how how how how strong my confidence is there.
Nathan George: anytime you presented proof of P Q there's a lot of risk of revealing more than you expect right.
Michael Lodder: kind of yeah the other here's the other thought is to just keep going with what we have and and say here's the proof of step correctness that goes on the ledger.
Michael Lodder: This other proof.
Michael Lodder: You should ask you could ask it from the issuer at any time, but they don't have to publish it.
Michael Lodder: So it's kind of like a sanity check.
Michael Lodder: Does that make sense.
Michael Lodder: Like you just petitioned the issuer to say you have to give me this proof before i'll even accept the credential from you at all.
Michael Lodder: Because you know what the modulus is so Therefore, you can check it.
Camilo Parra: Well, we don't need to know the module is right for the proof that the proof that you're implementing right now.
Nathan George: yeah but the idea here is by putting evidence of the proof that is too large for the ledger in the credential definition, then.
Nathan George: verify can say oh yeah, this is the same credential definition, I saw before i've already looked at that evidence, I agree with it right it's kind of like a it's a route hash kind of a thing.
Nathan George: I know that's an abusive determined.
Nathan George: But I like the idea that, even if the proofs too big, we could still put something in but let the.
Nathan George: folder on the verify or no Yes, this is the same evidence i've seen before.
Michael Lodder: cuz I mean.
Michael Lodder: My guess is the other guy that recommended this he's gonna you know.
Michael Lodder: This proof in my mind is not practical.
Michael Lodder: Right.
Michael Lodder: We encounter this a lot from the theoreticians they say oh just do this and then you go that's not practical right.
Michael Lodder: You know, come up with something that is practical.
Michael Lodder: So.
Michael Lodder: In my mind if there's a way that the you would just.
Michael Lodder: not do this proof, but you do something sufficient or you have them do the proof, but it doesn't go on the ledger but you could ask them for it at any time might be a better idea.
Michael Lodder: i'm open to suggestions.
Camilo Parra: I guess My biggest concern here is is that while there couldn't be better solutions we don't have the time to find better solutions like we're pretty constrained on the top, I guess, like.
Michael Lodder: The best solution is to not use cl signatures at all.
Camilo Parra: Right right right right right yeah I agree with that.
Michael Lodder: Not in the cards yet so.
Camilo Parra: yeah so so there's there's a couple trains that are moving that I can't stop and that's why I suggested this proof.
Camilo Parra: Was that I can't stop I can't stop this being presented at or this one or be ability being revealed at hyper ledger global forum and I can't stop the non credit working group from.
Camilo Parra: From.
Camilo Parra: You know standardizing a non creds that that will be discredited soon after by this by this by this vulnerability, so that those are those are the two time constraints, both of those trains are going faster than I thought they would be and so that's I agree there could be a better solution.
Camilo Parra: it's it's I would hope yeah this is, I like i've read this proof like hundreds of times now and it's huge like it's.
Camilo Parra: it's obviously archaic, but I don't see like a easier quicker solution like are an easier to implement and quicker solutions that are to implement that than this right now that's that those are my concerns.
Michael Lodder: mean the only other solution, I can think of was this one, when I looked around was this one from.
Michael Lodder: Because basically this proof says P, and then are the same size and they're distinct that's what this proof is I think it's smaller they do site, the commit this very this very paper from 99.
Camilo Parra: You know.
Michael Lodder: A guy recommended that's quite gnarly.
Michael Lodder: So.
Michael Lodder: anyway.
Michael Lodder: His his.
Michael Lodder: His proof is substantially smaller but i'm not quite sure if it accomplishes the same thing, yet.
Michael Lodder: Having just kind of briefly glanced at it and giving it a brief read.
Camilo Parra: mm hmm.
Michael Lodder: I mean the output of the proof is, you know that P amp Q, are the same size and they are distinct.
Michael Lodder: yeah.
Camilo Parra: yeah basically the requirements is even if I we can even if we can one of the PRIMES like it would it would be caught in this in this proof, you know.
Michael Lodder: yeah.
Camilo Parra: And that's that's basically the requirement I I think like what we're looking for is being able to run whatever code these the people at.
Camilo Parra: irma have and like them, not being able to to.
Camilo Parra: to correlate me one in the credit Aaron and the credential presentations I guess.
Michael Lodder: yeah.
Camilo Parra: I guess next steps for me would be or for the group and not you don't dig any of this work on Mike I can look papers and.
Camilo Parra: and start talking to heart and and asked him if If those are you know if any of these solutions would guarantee you know get bring the guarantees that we want to fix an ursa.
Michael Lodder: yeah I mean.
Michael Lodder: Just between the three of us wait, this is being recorded right.
Camilo Parra: yeah I don't know how to turn that off.
Michael Lodder: Oh well, maybe I won't say it then.
Michael Lodder: But we can hop on a separate call, if you want to discuss it where it's not recorded.
Camilo Parra: Nathan, what do you think.
Nathan George: um well as long as it's not something that's IP encumbered i'm happy to have an offline.
Nathan George: Not obviously the call today is mostly about the security related issues, so I don't know you can you need to do something to to put the recording in a different category there's nothing on supporting that I think too much trouble as long as papers, already been made public, but particular.
Michael Lodder: papers, the approach that i'm going to talk about all the papers or public there's.
Camilo Parra: yeah and now and then in this and the vulnerability is it, we can talk about it there's no we we've discussed already that it's something that is so, like it's not it would there wouldn't be any.
Camilo Parra: threat if someone found out about it.
Nathan George: Like well immediately my vote here is, I think we know, the next step is we've got to investigate a couple more techniques and.
Nathan George: It sounds like we all want to go off and work on that, so I think with that we probably ought to call this particular discussion over yes Mike and Kim you have any objection to that approach and Mike are you okay to come back with the next round of what you think about to happen here.
Michael Lodder: Sure yeah.
Nathan George: Okay, with that I think so i'm gonna fail off the call and.
Nathan George: we'll talk to you about soon.
Camilo Parra: All right.
Michael Lodder: You can I can give you a zoom meeting, if you want to hop on the BAT.
Camilo Parra: yeah I can do that.
Camilo Parra: yeah thanks everybody or going to just call this this it for today, but thanks and then y'all wait for that link.
Michael Lodder: Jay all right.
Camilo Parra: All right, bye bye.