MoneroResearch.info

That is to say, if BPs are up to industry standards, so are GBPs. Moreover, other recent work in [9] demonstrates that BPs are simulation-extractable, and so future extensions of that work may yet demonstrate that GBPs are also simulation-extractable. However, the security proofs in both [3] and [7] neglect runtime and success probability of their reductions, data which is useful in assessing tightness gaps and practical security. Taking tightness gaps into account when assessing practical security is not an industry standard because doing so leads to less efficient systems, but [2] describes practical attacks against a wide variety of popular signature schemes proven secure with forking arguments (Schnorr blind, Okamoto-Schnorr blind, GJKR threshold, original FROST threshold, CoSI and two-round MuSig multi-, Abe-Okamoto partially-blind, and ZGP17 conditional-blind signatures). The GBPs tightness gap is wide since the proof of CWEE in [7] (and [3]) uses a generalized forking lemma.

For these reasons, the author recommends further investigation into whether the attack vectors in [2] apply to BPs and GBP.