First, check the recent discussion on the mailing list (on inability to embed data in schnorr), a few interesting thoughts about this model there (i was limiting discussion to P, R, s outputs, i claimed secret key revelation is inevitable if you do publish, ajtowns point in particular (but not only) is very interesting that you can actually get round that limitation in practice, on bitcoin, even if not in theory).
Currently I'm writing up a small presentation on this topic and got to thinking about the deeper point: ZK (pok or w/e) requires blinding, which requires randomness. Data can be embedded in that but the devil's in the details. A funny example: imagine choosing to do RFC6979 with a ZKP of correctness, so the randomness is deterministic and constrained; but here, if say the ZKP is Groth16 (just an e.g.), it itself contains randomness that could be similarly misused (I think? not sure yet).
As for your BLS example: good point. It's not a ZKP system, it relies on a computational assumption, it's one-shot so you do, I agree, get the property you need: deterministic without wiggle room for data embedding (I think!). But ... there's actually no way that could or would be implemented on bitcoin (btw were you imagining *only* the PoK as BLS? that seems messy).
Replies (4)
Thanks for pointing me to the mailing list post. I don’t know what you mean by there’s no way BLS could be implemented on Bitcoin — you could introduce a BLS12-381 address very easily in a soft fork. This would make data sub-exponential data embedding impossible. Also the BLS PoK (ok technically a PoP) can be constructed non-interactively for aggregated BLS multisig.
Re: BLS is "impractical": fair push back, it's not like it's totally out of the question. I have at least one practical reason why I'm super skeptical, in addition to the obvious "new crypto in btc" reason, and that is quantum. It is going to be a Herculean task to implement any form of PQC on Bitcoin, and so I'd struggle to see how the energy would be found to do this, considering it's not PQ. Still, shrug, you're right that it's possible.
I suppose it's worth mentioning at this point that I'm very against this idea, lol. (I've taken to calling it "Purecoin", do you like it?). It makes utxos massively burdensome, stops public derivation, makes L2s basically not work (when you were saying lightning could still work with adaptors, i guess you imagine a model with still having timelocks (relative in particular!)? In my "purecoin" concept I removed timelocks as well since you can embed data in them).
Also you didn't answer but I'm surmising you mean BLS for *everything* not only PoK? Because the alternative is bad in two ways, first the obvious of mapping privkeys between groups and second because if schnorr in transaction signatures you can still leak a large amount of data as per ajtowns' idea.
