Subject: Re: [CFRG] Escalation: time commitment to fix *production* security bugs for BLS RFC v4?

From: Quan Thoi Minh Nguyen <[email-masked]>
Date: Fri, 23 Apr 2021 12:31:11 -0700

On Fri, Apr 23, 2021 at 9:13 AM Quan Thoi Minh Nguyen <[email-masked]>
wrote:

> Hi,
>
> I'd like to escalate this issue to the CFRG chairs as a last resort. By
> responsibility disclosure mechanism, I reported the bugs *privately far
> before* I posted it publicly at
> https://github.com/cfrg/draft-irtf-cfrg-bls-signature/issues/38. I did
> everything in my capability: reported the bugs, wrote proof-of-concept
> attack, wrote proof-of-concept fix.
>
> I'm curious what is the time commitment of the RFC's authors in resolving
> the following deadlock:
> + Libraries code (ethereum/py ecc, supranational/blst,
> herumi/bls,sigp/milagro bls) are deployed in *production*. They're not
> academic nor experimental code.
> + Libraries' authors can't fix the code because they have to follow the
> standard.
> + BLS RFC v4's authors don't move an inch in fixing it nor have any time
> commitment.
>
> The standard authors are in an extremely powerful position where they
> dictate what every library should do. Does it go with responsibility for
> responding in a timely manner for security bugs deployed in *production*?
> Even if they don't want to fix the message binding bug, should they at
> least fix a very obvious bug? AggregateVerify((PK_1, PK_2), (msg, msg), 0)
> = True, FastAggregateVerify((PK_1, PK_2), msg, 0) = False.
>
> Note that I'm not saying my proposed fix is correct and RFC's authors
> should follow it. What I'm asking is the BLS RFC authors' time commitments
> in resolving the security issues deployed in production?
>
> Thanks,
> - Quan
>
>

---

From: Quan Thoi Minh Nguyen <[email-masked]>
Date: Fri, 23 Apr 2021 09:13:39 -0700

Hi,

Thanks,
- Quan

---

From: "Riad S. Wahby" <[email-masked]>
Date: Fri, 23 Apr 2021 15:55:04 -0400

Hi Quan,

(Reposting my message from GitHub.)

I really appreciate your reporting the bug and all of the thought
you have clearly put into this.

The short answer to your question, "what is the time commitment of the
authors?" is: we're doing this on a volunteer basis, and therefore real
life takes priority. For my part: I have not had a moment's spare time
in the last 6 months. I hope to have time in the next several weeks
to think more about this but I do not have more specific information
than that. I can't speak for any of the other authors.

Regarding deployment in production: I really do understand the concern
here, and I share it. But this document is in draft status, which means
the risk of bugs or incomplete features is understood to be nonzero,
including by people who choose to deploy the draft specification.
I am not pointing this out to be legalistic or to justify inaction,
only to push back on the idea that somehow production deployment
changes the authors' volunteer status or time commitment.

I very much plan to deal with this issue once real life lets up a bit,
but I do not know how soon that is. That is really the best commitment
I can give you.

Thanks for understanding,

-=rsw

---

From: Quan Thoi Minh Nguyen <[email-masked]>
Date: Fri, 23 Apr 2021 15:41:15 -0700

Hi Riad,

Thanks for your response. From github repository, you're the main
contributor. However, I think it's *not* your sole responsibility to deal
with it. There are *5* authors in the BLS RFC draft v4
https://tools.ietf.org/html/draft-irtf-cfrg-bls-signature-04. Should at
least another author step up and make a concrete time commitment to fix it?
These bugs have been existing for a few months in *production*.

It's very unfortunate that the bottleneck for fixing security bugs is
purely voluntary and has no commitment. This sounds pretty wrong from a
vulnerability management point of view. I don't have any proposal to
mitigate this deadlock.

Thanks,
- Quan

---

From: Loup Vaillant-David <[email-masked]>
Date: Sat, 24 Apr 2021 01:38:27 +0200

Hi Quan,

> purely voluntary and has no commitment. This sounds pretty wrong from
> a vulnerability management point of view. I don't have any proposal
> to mitigate this deadlock.

There may be one way: holding implementers accountable.

They relied on a draft. As such, they took a gamble. Now they lost that
gamble, and gambling ethics dictates that they pay up.

Specifically, they can hire a professional cryptographer to devise or
vet a fix. Or better yet, proposing a fix that is very likely to be
adopted in the RFC itself.

We could counter with the idea that it would be too expensive for the
maintainers of those implementations. You mentioned Ethereum, though. I
would expect it'd be easy for them to raise enough funds for a couple
day's worth of expertise (which I expect would cost a couple thousand
euros).

If implementers argue that they are *not* responsible for bugs
resulting of the adoption of an RFC *draft*, we can consider making
some noise on the relevant social networks and news aggregators. I do
not relish the idea of feeding them to the lynch mob, but I'm afraid
this is the closest we can have from a trial.

Loup.

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 24 Apr 2021 14:56:38 +0000

Yes.  Strongly agree that this is the best approach.  This is a *DRAFT*  It would be like implementing Rijndael and then complaining that it has bugs and isn't AES.

Contact the people who developed and put things into production.

---

From: "Paul Hoffman" <[email-masked]>
Date: Sat, 24 Apr 2021 10:53:31 -0700

On a tangential note, but one that is relevant to your complaint:

- Internet Drafts are absolutely not RFCs. RFCs always have been more 
reviewed than Internet Drafts. That is, even the "final" draft that is 
given to the RFC Editor has additional reviews that sometime surface 
technical bugs that must be fixed before the RFC is published. As others 
have pointed out, implementing from an Internet Draft comes with 
significant risks.

- The CFRG does not create standards. All RFCs from the CFRG have a 
status of "informational", not "standard". They might be treated as 
standards by implementers, but they are not in fact standards. In the 
IETF, standards have more reviews than CFRG RFCs.

(I note that https://github.com/cfrg/draft-irtf-cfrg-bls-signature 
incorrectly uses the word "standard" at the top of the repo. Maybe the 
CFRG chairs could review all of the repos in https://github.com/cfrg to 
make sure that their wording is accurate.)

--Paul Hoffman

---

From: Quan Thoi Minh Nguyen <[email-masked]>
Date: Sun, 25 Apr 2021 11:23:26 -0700

Hi,

Thanks for your information and responses.

As a software engineer (SWE) myself, let me give you a bit more sympathetic
view from a SWE's perspective. Let's say product teams decide to use BLS
aggregate signature. Implementing it purely from academic papers is very
risky because in cryptography, details matter. They see some BLS RFC
"draft" v4 published by world well-known authors in the field, so they
rightly trust it. It's a reasonable thing to do. I think the current BLS
"draft" series helped implementers avoid several serious security issues.

Now, I reported reproducible security bugs. I proposed a fix that can't
decrease security because it only adds *extra* checks but my fix may be
*useless* as it might not fix the core issues. Furthermore, product teams
also worry about *consensus*. If they follow my fix and BLS RFC's authors
disagree, different implementations will have different
interpretations/views of the same data causing consensus bugs. Things will
get messier quickly.

To make it crystal clear, my email is not about security bugs in BLS RFC
draft v4. Security bugs are a natural part of software development cycles
and everyone (including me, of course) can make mistakes. When security
bugs are found, we have to fix them. My email is about the *fixing* part
because it's a deadlock now.

Thanks,
- Quan

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 26 Apr 2021 13:28:39 -0400

As a human being living on a planet threatened by environmental damage from
CO2 emissions, I am strongly opposed to any IETF work to support any form
of purported 'cryptocurrency' that relies on any form of 'proof of work' or
'proof of waste'.

The electricity requirements of cryptocurrencies have been larger than that
of entire countries. This is an experiment that it is time to stop.

I am entirely serious in this position.

Besides the environmental issues, there is the fact that the
crypto-currency community has consistently failed to establish any
effective means of preventing the endemic frauds in their systems.
Fraudulent exchanges regularly steal money from their customers.
Applications developed by individuals with minimal expertise are used for
transfers of vast quantities of fictional cash with no effective oversight
and this results in further frauds.

The cryptocurrency community has a long history of misrepresenting the
engagement of parties with established reputations as endorsing their
'product'. And this presents real risk to the IETF when the least
objectionable use of the product in question is to evade currency controls.
Cryptocurrency became popular as a means of paying for illegal drugs and
has since become the enabler for ransomware.

The cryptocurrency world has no shortage of people who will trash anyone
criticizing their activities as 'stupid', 'uninformed', 'need to do some
research'. Fine, let them sort their own messes out.

IETF should take no action that risks a headline 'IETF endorses
cryptocurrency'. If the ransomware, child abuse and Ponzi scheme industries
have a problem as a result of a bad technology decision, we should not lift
a finger to save them.

The only conversations I want to have on cryptocurrencies is with
government regulators looking for ways to regulate these criminal
facilitation enterprises out of existence as they previously did with
eGold, Gold Age and BTC's very long line of predecessors which like BTC
were entirely different but completely the same.

On Sat, Apr 24, 2021 at 10:57 AM Salz, Rich <rsalz=
[email-masked]> wrote:

> Yes.  Strongly agree that this is the best approach.  This is a *DRAFT*
> It would be like implementing Rijndael and then complaining that it has
> bugs and isn't AES.
>
> _______________________________________________
> CFRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Daniel Franke <[email-masked]>
Date: Mon, 26 Apr 2021 13:54:12 -0400

On Mon, Apr 26, 2021 at 1:29 PM Phillip Hallam-Baker <[email-masked]>
wrote:

> As a human being living on a planet threatened by environmental damage
> from CO2 emissions, I am strongly opposed to any IETF work to support any
> form of purported 'cryptocurrency' that relies on any form of 'proof of
> work' or 'proof of waste'.
>
> The electricity requirements of cryptocurrencies have been larger than
> that of entire countries. This is an experiment that it is time to stop.
>

 I share your alarm at the economic waste and environmental harm inherent
in proof-of-work-based cryptocurrency. (I do not share your other
objections, and see great promise in permissioned and proof-of-stake-based
blockchains). But what does this have to do with the instant draft? We're
not specifying a proof-of-work function. We're specifying a pairing-based
signature scheme — something with myriad applications beyond
cryptocurrency. Your argument reminds me of demands that we compromise, or
not build, end-to-end encryption schemes because they will be useful to
terrorists. The IETF has categorically rejected those arguments. Why should
we accept yours?

---

From: Kyle Rose <[email-masked]>
Date: Mon, 26 Apr 2021 14:02:28 -0400

> that of entire countries. This is an experiment that it is time to stop.

This massively overstates the impact of mining.

Total worldwide energy use per year is ~160,000 TWh.[1] Bitcoin mining is
responsible for ~120 TWh,[2] or about 0.075%. It's just not significant. It
could become significant, so it's worth keeping an eye on, but right now
it's just not having that much of an effect.

Moreover, the way Bitcoin mining works, the difficulty of mining a block is
scaled such that blocks are discovered at roughly the same rate over time,
regardless of the amount of computing power in the network. This
effectively means that the expected reward from mining scales roughly
inversely to the number of miners, while the cost scales proportionally
with the number of miners. This acts as a strong disincentive to the number
of miners, and therefore the size and energy cost of the network, growing
unbounded.

That said, there are experiments going on right now in other ways to do
distributed, fault-tolerant consensus. I'm not sure why the IETF would want
to preclude itself from an entire area of engineering because of some
arguably deleterious effects of existing technologies, but I'm certain the
IRTF (including CFRG) is an entirely appropriate forum for discussing,
developing, and advancing new technologies that could mitigate these
effects while preserving some of the key characteristics—including
non-repudiation, permissionless participation, and resistance to capital
controls—that make Bitcoin an unparalleled resource for people living in
places with repressive regimes and/or poor currencies.

Kyle

[1] https://en.wikipedia.org/wiki/World_energy_consumption
[2]
https://www.forbes.com/sites/lawrencewintermeyer/2021/03/10/bitcoins-energy-consumption-is-a-highly-charged-debate--whos-right/?sh=141df32d7e78

---

From: Michael Sierchio <[email-masked]>
Date: Mon, 26 Apr 2021 11:27:50 -0700

Thank you for your lucid and cogent remarks.

Let them cease their nonsense, or continue without the imprimatur of the
IETF.

Bitcoin is clearly not a currency.  Bitcoin is not a store of value.  The
liquidity problem is real, best illustrated by the absurd workflow required
to get cash (in some fiat currency) from a "Bitcoin ATM" – it resembles
nothing more than an old Soviet-era shop, in which you pick out your
chicken, get it weighed, take the chit to the cashier, take the stamped
chit back to the counter and retrieve your hen.  Instead of cash, you get a
printout to scan  – at some indeterminate future time – to get your funds.

And it doesn't resemble Chaum's anonymous digital cash – KYC rules at
(legitimate) exchanges make that impossible.

Bitcoin, NFTs, etc. are asset bubbles, *tulpenmanie**, *

-- 

"Well," Brahmā said, "even after ten thousand explanations, a fool is no
wiser, but an intelligent person requires only two thousand five hundred."

- The Mahābhārata

---

From: Michael Sierchio <[email-masked]>
Date: Mon, 26 Apr 2021 11:28:50 -0700

On Mon, Apr 26, 2021 at 11:03 AM Kyle Rose <[email-masked]> wrote:

> This massively overstates the impact of mining.

A single bitcoin transaction uses over 700 kW-h of energy – equivalent to
the power consumed by an average U.S. household over 24 days.  Do you claim
otherwise?

– M

---

From: Kyle Rose <[email-masked]>
Date: Mon, 26 Apr 2021 14:38:47 -0400

On Mon, Apr 26, 2021 at 2:29 PM Michael Sierchio <[email-masked]> wrote:

> On Mon, Apr 26, 2021 at 1:29 PM Phillip Hallam-Baker <
>> [email-masked]> wrote:
>>
> the power consumed by an average U.S. household over 24 days.  Do you
> claim otherwise?
>

I claim the numbers I referenced (with sources) in my email.

Kyle

---

From: Michael Sierchio <[email-masked]>
Date: Mon, 26 Apr 2021 11:42:44 -0700

On Mon, Apr 26, 2021 at 11:03 AM Kyle Rose <[email-masked]> wrote:

> Total worldwide energy use per year is ~160,000 TWh.[1]
>

The total worldwide consumption of energy in the form of electricity is 40,443
billion kWh / y.  About 1/4 of the total.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 26 Apr 2021 15:07:47 -0400

> terrorists. The IETF has categorically rejected those arguments. Why should

Providing communications between individuals unrestricted by government
diktat has always been understood as core to the IETF mission. Providing a
means for Ponzi scammers to get rich has not.

The original article is predicated on the claim that the IETF should do
something urgently in order to prevent harm to the cryptocurrency
communities that have deployed on the basis of a draft. I am arguing that
this is a reason to delay rather than accelerate response.

It is well known I am pretty keen on threshold crypto. But I have yet to
see a really compelling case for threshold signatures that cannot be met by
multi-signatures that involves more than one distinct party. I can see real
purpose in using a threshold t out of n signature scheme to back up a t out
of n quorum redundancy scheme. I can see real purpose in splitting
signatures across multiple HSMs. But these are all applications where there
is one principal and there are multiple shares required to create a
signature (e.g. signing the DNS root zone) and all make use of completely
standard algorithms.

The only reason to go to pairing is if you want a random collection of
parties that are not co-operating to sign. And that is a concern that is
pretty much unique to BitCoin et. al.

---

From: Mike Hamburg <[email-masked]>
Date: Mon, 26 Apr 2021 17:12:37 -0300

> On Apr 26, 2021, at 3:42 PM, Michael Sierchio <[email-masked]> wrote:
> 
> 
> 
> On Mon, Apr 26, 2021 at 11:03 AM Kyle Rose <[email-masked] <mailto:[email-masked]>> wrote:
> On Mon, Apr 26, 2021 at 1:29 PM Phillip Hallam-Baker <[email-masked] <mailto:[email-masked]>> wrote:
> As a human being living on a planet threatened by environmental damage from CO2 emissions, I am strongly opposed to any IETF work to support any form of purported 'cryptocurrency' that relies on any form of 'proof of work' or 'proof of waste'. 
> 
> The electricity requirements of cryptocurrencies have been larger than that of entire countries. This is an experiment that it is time to stop.
> 
> The total worldwide consumption of energy in the form of electricity is 40,443 billion kWh / y.  About 1/4 of the total.

Do you have a source on that?  According to e.g. https://www.vgb.org/en/data_powergeneration.html?dfid=98054 <https://www.vgb.org/en/data_powergeneration.html?dfid=98054>, that’s the projection for 2040, not 2021.  The 2017 values were 25,679 TWh, so more like 1/6th of the total.  This would place Bitcoin at about 0.45% of worldwide electricity consumption: not a huge fraction, but a huge amount in absolute terms, especially considering that it has yet to provide any real value to the world.  Also note that there are ~195 countries in the world, depending how you count, so this is almost the mean electricity consumption of an entire country; in Bitcoin's case, it is approximately the same as Norway.

Also, these consumption figures are only for Bitcoin.  Ethereum, the #2 cryptocurrency by market cap, draws another ~39 TWh/year, about a third of what Bitcoin uses.  They say they’re eventually moving to proof of stake, but I haven’t seen any news that the move is imminent.  Then there’s the rest of the cryptocurrencies: Bitcoin and Ethereum are only half the world market cap, according to coinmarketcap.com <http://coinmarketcap.com/>, but I don’t have figures on energy consumption.  In any case, it’s plausible that cryptocurrency amounts to 1% of human electricity consumption (but not overall energy consumption).

Furthermore, if Bitcoin or Ethereum were to achieve widespread adoption, then its value would likely increase because so little extra bitcoin can be mined.  This is why people speculate on it.  But since mining energy consumption is closely tied to the value of the currency, this would incentivize miners to increase their energy consumption proportionally.

I’m no fan of Bitcoin or other proof-of-work systems, and I would rather not work on them, but I don’t have any objection to fixing BLS draft specs.  I just wanted to correct some apparent mistakes in the thread.

Cheers,
— Mike

---

From: Mike Hamburg <[email-masked]>
Date: Mon, 26 Apr 2021 17:23:35 -0300

Also, sorry for the double post, but according to https://digiconomist.net/ethereum-energy-consumption <https://digiconomist.net/ethereum-energy-consumption>, Bitcoin energy consumption is up 37% year-on-year, and Ethereum is up by a factor of 5 (!!!) year-on-year.  Something that's ~1% of human electricity consumption, and rising significantly year-on-year, is absolutely something to be concerned about.

There are claims that this will somehow help us soak up surplus solar energy during the day, and be idle by night, but this is like Ethereum-proof-of-stake from my POV: until it actually happens at scale, I won’t trust it.

Apologies again,
— Mike

---

From: Thomas Dineen <[email-masked]>
Date: Mon, 26 Apr 2021 13:37:08 -0700

Climate Change is a hoax, stop this nonsense, and get back to work.

Thomas Dineen

On 4/26/2021 1:23 PM, Mike Hamburg wrote:
> Also, sorry for the double post, but according to 
> https://digiconomist.net/ethereum-energy-consumption 
> <https://digiconomist.net/ethereum-energy-consumption>, Bitcoin energy 
> consumption is up 37% year-on-year, and Ethereum is up by a factor of 
> 5 (!!!) year-on-year.  Something that's ~1% of human electricity 
> consumption, and rising significantly year-on-year, is absolutely 
> something to be concerned about.
>
> There are claims that this will somehow help us soak up surplus solar 
> energy during the day, and be idle by night, but this is like 
> Ethereum-proof-of-stake from my POV: until it actually happens at 
> scale, I won’t trust it.
>
> Apologies again,
> — Mike
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 26 Apr 2021 16:54:44 -0400

> Climate Change is a hoax, stop this nonsense, and get back to work.
1) Climate change is not a hoax.

2) I don't work for you, so what work I do or do not do is none of your
business.

3) A community that claims to be manufacturing vast sums of digital cash
from thin air comes here demanding free consulting. If this is indeed an
issue, why not sell the bug as an NFT and use the proceeds to pay a
consultant?

> https://digiconomist.net/ethereum-energy-consumption, Bitcoin energy
> consumption is up 37% year-on-year, and Ethereum is up by a factor of 5
> (!!!) year-on-year.  Something that's ~1% of human electricity consumption,
> and rising significantly year-on-year, is absolutely something to be
> concerned about.
>
> Ethereum-proof-of-stake from my POV: until it actually happens at scale, I
> won’t trust it.
>
>
I had intended to direct the response to the IETF list where this appeared
to originate (gmail's approach to threads sometimes breaks expectations).

But since they are continuing, I will note that the 'flexible' approach to
facts is rather a problem when claiming to be creating the new form of
finance.

I have been hearing how proof of work will be superseded for over a decade
at this point. Using projections for electricity consumption in 2040 to
compare actual consumption by crypto in 2021 is not honest.

We have gone to great effort to reduce global demand for electricity by a
few percent with the shift to LED lightbulbs. And crypto currencies are
basically throwing 0.5% of electricity generated down the drain. And most
of that in countries like China where energy demand is booming because of
the needs of the human population and the state is building coal power
stations in a desperate attempt to meet demand.

---

From: Thomas Dineen <[email-masked]>
Date: Mon, 26 Apr 2021 14:22:17 -0700

Hey I do have a bridge for sale, its a really big one!

Also i have an new exchange where I will trade your stimulus check for 
Magic Beans.

Thomas Dineen

On 4/26/2021 1:54 PM, Phillip Hallam-Baker wrote:
> On Mon, Apr 26, 2021 at 4:38 PM Thomas Dineen <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
> 2) I don't work for you, so what work I do or do not do is none of 
> your business.
>
> 3) A community that claims to be manufacturing vast sums of digital 
> cash from thin air comes here demanding free consulting. If this is 
> indeed an issue, why not sell the bug as an NFT and use the proceeds 
> to pay a consultant?
>
>>     <https://digiconomist.net/ethereum-energy-consumption>, Bitcoin
>>     energy consumption is up 37% year-on-year, and Ethereum is up by
>>     a factor of 5 (!!!) year-on-year. Something that's ~1% of human
>>     electricity consumption, and rising significantly year-on-year,
>>     is absolutely something to be concerned about.
>>
>>     There are claims that this will somehow help us soak up surplus
>>     solar energy during the day, and be idle by night, but this is
>>     like Ethereum-proof-of-stake from my POV: until it actually
>>     happens at scale, I won’t trust it.
>
>
> I had intended to direct the response to the IETF list where this 
> appeared to originate (gmail's approach to threads sometimes breaks 
> expectations).
>
> But since they are continuing, I will note that the 'flexible' 
> approach to facts is rather a problem when claiming to be creating the 
> new form of finance.
>
> I have been hearing how proof of work will be superseded for over a 
> decade at this point. Using projections for electricity consumption in 
> 2040 to compare actual consumption by crypto in 2021 is not honest.
>
> We have gone to great effort to reduce global demand for electricity 
> by a few percent with the shift to LED lightbulbs. And crypto 
> currencies are basically throwing 0.5% of electricity generated down 
> the drain. And most of that in countries like China where energy 
> demand is booming because of the needs of the human population and the 
> state is building coal power stations in a desperate attempt to meet 
> demand.
>
>

---

From: Thomas Dineen <[email-masked]>
Date: Mon, 26 Apr 2021 14:54:36 -0700

Thomas Dineen

---

From: denis bider <[email-masked]>
Date: Mon, 26 Apr 2021 18:18:22 -0500

> As a human being living on a planet threatened by environmental damage
from CO2 emissions

This is probably false. You believe it because you've been bombarded by
messages about it from manipulated media. You spend your time focusing on
your own work. You are doing your work honestly, so you trust that other
people are doing honest work as well.

This is not the case. The anthropogenic climate change narrative is most
likely false. The world is not warming and does not face harm from CO2
emissions.

Who are the people who want you to believe the climate change narrative?

- The IPCC, which is an agency similar to WHO and has a similar amount of
credibility (this is: none). ClimateGate emails have shown the IPCC to be
driven by ideology and to use dishonest science in pursuit of their goals.
Despite claims that subsequent studies have vindicated the research, these
studies were as limited as possible and made minimal findings.

- Mass media, which are basically run by intelligence agencies and have
consolidated into about 6 corporations. Their narratives are not driven for
clicks, they are driven for control. If you observed the mass media
reaction to 9/11 and the universal support of the subsequent Iraq invasion,
you may know this. If you observed the mass media reaction to the
fraudulent November 2020 election, you know this. If you observed the mass
media reaction to Covid-19, the universal support for lockdowns that
achieve nothing except bankrupt the middle class on purpose, pointless
masks that do nothing but engender obedience, and outright malicious
censorship of vaccine side effects - then you know this.

If you do not know these things, then all I can tell you that Dan Kaminsky
died a few days ago after a Pfizer vaccination, which he got on purpose to
"encourage others to get vaccinated" in his tweet on March 22. The mass
media are reporting his death as from complications from diabetes, and
playing down any relationship to the vaccines. Dan Kaminsky joins other
notable deaths that coincidentally came after Covid vaccines, including
boxer Marvin Hagler, baseball legend Hank Aaron, Larry King, rapper DMX,
and thousands of everyday people. The vaccine deaths are common enough that
I know some of the dead myself. I still don't know anyone who died from
Covid.

The mass media are lying to you, and this is not by accident, it is on
purpose. They are lying about the election, about Covid, about vaccines,
and about climate change.

- China has signed up to the Paris agreement, but its obligations do not
start until 2030. Until then, it is free to build coal power plants, which
it does with gusto. As far as China is concerned, "climate change" is a
great way to get the West to completely tank its manufacturing, so that we
can be dependent on China for all production. This allows them to take over
the West without firing a shot, a coup which they have almost completed in
Australia, Canada, Europe and now also the US.

- There is a globalist elite that rules the Western world. We have now seen
conclusively that they control most corporations, media and government
agencies, have done so for decades, and they're not elected. These people
have more in common ideologically with China than they do with classical
liberal principles of the West. With the advent of the internet and social
media, their control over the narrative has slipped, and they must now rule
openly. The US constitution is being thrown away and the people are being
indoctrinated to accept more of a Chinese style of rule.

Climate change is helpful here because it leads people to believe that
there is this worldwide crisis that must be solved, so if we empower the
globalists, we sacrifice "some" liberties but it's for the benefit of
saving the world.

There is in fact no such climate catastrophe. There hasn't been since 1989,
when the UN predicted that "whole nations will be wiped out" if radical
measures aren't taken by the year 2000.

That was 21 years ago, and still the world hasn't warmed.

If you want to educate yourself on this, you'll need a few hours.

I recommend this very entertaining lecture by Malaysian scientist Willie
Soon:
https://www.youtube.com/watch?v=1zrejG-WI3U&t=221s

Judith Curry:
https://www.youtube.com/watch?v=D4AAN0H8MRg

Christopher Monckton:
https://www.youtube.com/watch?v=UGqcweY1a3I

ClimateGate emails - 10 years after (PDF):
https://www.rossmckitrick.com/uploads/4/8/0/8/4808045/climategate.10yearsafter.pdf

ClimateGate emails (PDF):
http://www.lavoisier.com.au/articles/greenhouse-science/climate-change/climategate-emails.pdf

If you believe in climate change, it is your civic duty to educate
yourself, because this is the overarching narrative that is pushing is into
a worldwide dystopia based on the Chinese model.

Our work means nothing, our lives mean nothing if the world is allowed to
unfold like this.

denis

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 26 Apr 2021 16:35:36 -0700

Denis, Phill, etc.

Please take this discussion of this list. It is off-topic.

-Ekr

On Mon, Apr 26, 2021 at 4:19 PM denis bider <[email-masked]>
wrote:

> - There is a globalist elite that rules the Western world. We have now
> seen conclusively that they control most corporations, media and government
> There is in fact no such climate catastrophe. There hasn't been since
> 1989, when the UN predicted that "whole nations will be wiped out" if
> radical measures aren't taken by the year 2000.
>
> On Mon, Apr 26, 2021 at 12:29 PM Phillip Hallam-Baker <

---

From: denis bider <[email-masked]>
Date: Mon, 26 Apr 2021 19:38:21 -0500

Now that I've pointed out the probable hoax nature of anthropogenic climate
change, a few words on the value of cryptocurrencies.

As far as I know, no cryptocurrency has yet solved the scalability problem
so it could replace a network like VISA.

Bitcoin (BTC) has been captured by banker types to limit its transaction
potential. This remains at ~7 transactions per second, when VISA can handle
tens of thousands. A majority of the Bitcoin developers were hired by a
company run by hedge fund types, and these then restricted BTC to remove
its growth potential. In this form, BTC is now viable only as a custodian
solution - virtual property that you pay some banker to hold on your
behalf. BTC just completely lacks the transaction capacity to even onboard
most of the population if they wanted to use it. It is now a parody of its
original intent.

Other cryptocurrencies are not similarly hobbled. One of these is BCH
(Bitcoin Cash), which retains developers who didn't sell out. This and
other cryptocurrencies can process hundreds of transactions per second,
while the banker-owned media lionize the hobbled BTC (on purpose). Even so,
all cryptocurrencies of which I know are far from VISA-level scalability.
The solution is always "a few years down the road", but this may never come
because it's not an engineering problem. It requires a breakthrough of
similar magnitude as the invention of Bitcoin itself.

Clearly, our centrally controlled solutions are more efficient. The problem
is, these centrally controlled solutions allow for centralized control, and
this centralized control is being used to undermine democratic processes.

Cases in point:

(1) Andrew Torba, the founder of the free speech social network Gab, is not
only unable to accept credit card payments to fund Gab, but his entire
family has been blacklisted by credit card companies from using credit
cards personally. Literally, his entire family that lives at his address is
unable to use credit cards:

https://news.gab.com/2020/06/26/social-credit-score-is-in-america-visa-blacklisted-my-business-and-my-family-for-building-gab/

(2) Gab is blacklisted from simply having checking accounts with banks. The
company keeps opening accounts with new banks, and a week later the banks
decide to close them:

https://nationalfile.com/revealed-andrew-torba-names-two-banks-who-banned-gab-after-media-smears/

(3) If you rely on mass media for your information, you might be forgiven
for not knowing that a massive forensic election audit, the first of its
kind in the US, has started in Maricopa County, AZ. This comes after 6
months of the Arizona Senate fighting the Maricopa County tooth and nail to
cooperate with the audit, after having all possible dirty tricks thrown at
them. The tricks continue: Democrats have sent 73 lawyers and legal staff
to stop the audit through the courts. If that fails, word is that they've
sent in antifa from Portland.

Election fraud occurred in states that are compromised deeply enough so
that the executive branch can be counted on to prevent audits. In Georgia,
Kemp almost permitted an actual audit. Then his daughter's boyfriend was
blown up in a car accident that looked like a thermite explosion. Kemp then
quickly backtracked on the audit.

In Arizona, Doug Ducey is a governor like that. He has refused to provide
security for the Senate's audit. So the Senate contracted for security with
Arizona Rangers.

This prompted PayPal to suspend donations to Arizona Rangers. On Saturday,
the PayPal donation link displayed "This organization is currently
ineligible to receive donations." (I checked again right now and it appears
that for the time being, service has been restored.)

These are the problems involved with someone having centralized control of
payments.

Even if cryptocurrencies are not currently good enough; even if they are
wasteful; they are a welcome lifeline as a backup.

We must defend the ability of those who have been "unpersoned" by banks to
at least be able to use cash and cryptocurrencies.

If those who control payment systems can "unperson" people; and can do so
for "offenses" such as operating a free speech platform, or for securing an
election audit; then there's no limit to what they can control.

denis

---

From: Soatok Dreamseeker <[email-masked]>
Date: Mon, 26 Apr 2021 21:01:45 -0400

I'm conflicted on the topic of cryptocurrency intersecting with
cryptography because of bad faith on one side (as this thread demonstrates)
and the risk of excessive gatekeeping on the other. (I have a blog post on
the topic [1] if anyone is interested.)

However, that's about cryptography in general.

In my opinion, it would be a very big mistake for the IETF to tacitly or
directly endorse any cryptocurrency project in 2021. (We can revisit this
when the technologies have had a chance to mature, become greener, and
on-chain privacy becomes ubiquitous.)

If there are security concerns about the BLS draft, that's worth fixing
irrespective of whether it impacts cryptocurrency or not. Fixing a security
concern that is only know to impact cryptocurrency is not sufficient to be
tacit endorsement or direct support, as there may be other unknown impacted
use cases. That's just good security engineering, and well within the
mission of CFRG.

Thus, I propose we end this thread before more irrelevant material gets
submitted. We can do the good thing without doing bad things.

[1]: https://soatok.blog/2021/04/19/a-furrys-guide-to-cryptocurrency/

---

From: denis bider <[email-masked]>
Date: Mon, 26 Apr 2021 20:04:14 -0500

With all due respect, Eric: the world as we imagined it is literally
ending, and the future of liberal democracy is hanging by a thread.

There are two paths from this fork: a widespread realization of what's
going on, or 1984-style totalitarianism.

Those who want to continue business as usual are opting for 1984.

Under 1984, this group has no meaning, and its rules have no meaning,
because no human value is being realized. Only control.

On Mon, Apr 26, 2021 at 6:36 PM Eric Rescorla <[email-masked]> wrote:

>> If you do not know these things, then all I can tell you that Dan
>> Kaminsky died a few days ago after a Pfizer vaccination, which he got on
>> purpose to "encourage others to get vaccinated" in his tweet on March 22.
>> The mass media are reporting his death as from complications from diabetes,
>> and playing down any relationship to the vaccines. Dan Kaminsky joins other
>>>> Yes.  Strongly agree that this is the best approach.  This is a
>>>> *DRAFT*  It would be like implementing Rijndael and then complaining that
>>>> it has bugs and isn't AES.
>>>>

---

From: Nick Sullivan <[email-masked]>
Date: Mon, 26 Apr 2021 21:30:27 -0400

Dear CFRG thread participants,

Please take this conversation to a different medium if you wish to continue
in this direction.

Phillip Hallam-Baker's original question has been answered: BLS is useful
in non-cryptocurrency applications and the BLS document is not relevant to
proof-of-work systems. Further discussion of the topic of cryptocurrency is
not relevant or useful here.

Nick (for the Chairs)

On Mon, Apr 26, 2021 at 9:04 PM denis bider <[email-masked]>
wrote:

>>> > As a human being living on a planet threatened by environmental
>>> damage from CO2 emissions
>>>
>>> - The IPCC, which is an agency similar to WHO and has a similar amount
>>> of credibility (this is: none). ClimateGate emails have shown the IPCC to
>>> be driven by ideology and to use dishonest science in pursuit of their
>>> goals. Despite claims that subsequent studies have vindicated the research,
>>> these studies were as limited as possible and made minimal findings.
>>>
>>> Our work means nothing, our lives mean nothing if the world is allowed
>>> to unfold like this.
>>>
>>> denis
>>>
>>>
>>>> The cryptocurrency world has no shortage of people who will trash
>>>> anyone criticizing their activities as 'stupid', 'uninformed', 'need to do
>>>> some research'. Fine, let them sort their own messes out.
>>>>

---

From: Jeff Burdges <[email-masked]>
Date: Tue, 27 Apr 2021 12:35:48 +0200

> On 25 Apr 2021, at 20:23, Quan Thoi Minh Nguyen <[email-masked]> wrote:
> Things will get messier quickly.

This is not a forum where things should be rushed.  If an organizations wants to move fast then it should hire people who can do so securely.  

At its core BLS is a signature for consensus protocols, but consensus protocols require coherent software, invariably led by one organization, and always require an upgrade path, and they’ll always have upgrades in the pipe anyways.  We could tweak BLS every year for then next ten years with zero real harm done.

Increasingly, the serious BLS proponents have turned towards even fancier verification strategies, including:
1.  zkSNARKs verifying BLS with extra properties, ala Celo,
2.  inner pairing product arguments compressing BLS https://eprint.iacr.org/2019/1177
3.  non-BLS VUF that support vastly more scalable DKGs https://eprint.iacr.org/2021/005
4.  zkSNARKs of correct behavior in non-scalable DKGs https://eprint.iacr.org/2021/339

We’re a very long ways from establishing any human consensus across organizations over what really makes sense. 

Jeff

p.s.  It never came up, but you literally cannot deploy BLS for account keys on blockchains because then some asshat writes BIP32-BLS, and their users loose all their funny money.  It’s safer for users if developers stay scared of BLS for a while longer.