Why is the bundle hash normalized?

Question

What is the technical reason for normalizing the bundle hash in IOTA?

Answer 1

When you apply naïve Winternitz signature scheme on a (non-normalized) hash, the amount of private key data you leak is not uniform - a hash of e. g. 999⋯9 would result in all (or none, depending on how you implement it) of the key being leaked. As a consequence, even after one signature there is a varying chance that brute forcing another hash (that leaks only a subset of the already leaked parts) becomes feasible. By normalizing the signature hash, such "extreme" cases get alleviated, so that every signature exactly leaks half of the private key and that there is no other normalized bundle hash that can be signed by the same leaked key parts as the one already used.

Answer 2

Winternitz signature scheme requires to have the checksum for the signature to be secure. Bundle normalization is an alternative way of keeping the signature secure while reducing its "strength" a little. Usage of the checksum was impossible because the final structure of the transactions wasn't supposed to contain it. In the final design the normalization will be replaced with "bundleNonce" field which will allow to have the same requirement ("sum of the bundle hash trytes must be 0") without using the normalization.