What is the technical reason for normalizing the bundle hash in IOTA?
-
1Please add some context to the question, like how it's normalized and what's normalization generally for and maybe why you think that normalizing is unnecessary in this case. SE requires a bit of research for good questions.– HelmarFeb 23, 2018 at 8:24
-
Possibly related: iota.stackexchange.com/questions/1241/…– HelmarFeb 23, 2018 at 8:25
Add a comment
|
2 Answers
When you apply naïve Winternitz signature scheme on a (non-normalized) hash, the amount of private key data you leak is not uniform - a hash of e. g. 999⋯9 would result in all (or none, depending on how you implement it) of the key being leaked. As a consequence, even after one signature there is a varying chance that brute forcing another hash (that leaks only a subset of the already leaked parts) becomes feasible. By normalizing the signature hash, such "extreme" cases get alleviated, so that every signature exactly leaks half of the private key and that there is no other normalized bundle hash that can be signed by the same leaked key parts as the one already used.
Winternitz signature scheme requires to have the checksum for the signature to be secure. Bundle normalization is an alternative way of keeping the signature secure while reducing its "strength" a little. Usage of the checksum was impossible because the final structure of the transactions wasn't supposed to contain it. In the final design the normalization will be replaced with "bundleNonce" field which will allow to have the same requirement ("sum of the bundle hash trytes must be 0") without using the normalization.
-
So in the final design, we will no longer modify the hash itself but add a nonce to the bundle to change the hash completely unless it satisfies the requirement? But wouldn’t that constitute a PoW kind of scheme? Or will a nonce literally be added to the hash itself?– ralfFeb 23, 2018 at 17:08
-
Correct. That will be like very little PoW (~100 tries for lowest security level). Feb 23, 2018 at 18:22