brave-intl / brave-payments-tools Goto Github PK

Right now, the usage model of the brave-payments-tools cli is that there is an offline machine with a keychain that can sign transactions, and an online machine that talks to the Uphold service and sends the transactions to them to execute. That means that the offline machine has unilateral power to cryptographically authorize transactions for Uphold.

(The keychain is also encrypted with a passphrase, and for recovery purposes, we also use Shamir's secret-sharing scheme to save a copy of the passphrase for the keychain split k-of-n ways. The point remains that whoever has the offline machine and the passphrase has unilateral power to authorize transactions.)

It would be nice if we could arrange that there were never a single machine with unilateral power to authorize transactions for Uphold, so that it always takes at least two parties to authorize a transaction for high-value wallets. The signatures in question are standard Ed25519 signatures, and it turns out there is a relatively easy way to distribute key generation and signing for Ed25519 into an n-of-n collective signature scheme with no changes to the verifier.

(k-of-n for thresholds k < n is harder and probably requires changes to the verifier; there's an I-D in progress on that subject, though of course if we could change the verifier a concatenation of k signatures from keys the verifier confirms distinct would work without fancy math.)

Although there's probably no implementation of this readily available, it is not far off from a standard Ed25519 signer either -- just requires a few extra additions on the curve. Obviously I would want to consult a Real Cryptographer first before implementing and deploying this, but here's a description of the scheme with references: https://crypto.stackexchange.com/a/50450