Re: BLS is "impractical": fair push back, it's not like it's totally out of the question. I have at least one practical reason why I'm super skeptical, in addition to the obvious "new crypto in btc" reason, and that is quantum. It is going to be a Herculean task to implement any form of PQC on Bitcoin, and so I'd struggle to see how the energy would be found to do this, considering it's not PQ. Still, shrug, you're right that it's possible.
I suppose it's worth mentioning at this point that I'm very against this idea, lol. (I've taken to calling it "Purecoin", do you like it?). It makes utxos massively burdensome, stops public derivation, makes L2s basically not work (when you were saying lightning could still work with adaptors, i guess you imagine a model with still having timelocks (relative in particular!)? In my "purecoin" concept I removed timelocks as well since you can embed data in them).
Login to reply
Replies (1)
Also you didn't answer but I'm surmising you mean BLS for *everything* not only PoK? Because the alternative is bad in two ways, first the obvious of mapping privkeys between groups and second because if schnorr in transaction signatures you can still leak a large amount of data as per ajtowns' idea.