Craig Wright Is Not Satoshi Nakamoto
Something else that stinks about all this that I haven&#x27;t seen commented on:<p>Supposedly, Chris Wright did his ridiculous laptop dance with Gavin Andresen because he didn&#x27;t want Gavin to leak the signature early.<p>What a load of crap.  These are supposedly real cryptographers we&#x27;re talking about here.  If you ask a cryptographer (including, presumably, Satoshi) how they would prove their identity to someone else such that the other person couldn&#x27;t leak the proof, the answer doesn&#x27;t involve airplanes and fishy laptops running dubiously authentic Windows programs.  The answer is <i>deniable authentication</i>.<p>In the bitcoin case, it&#x27;s trivial.  Satoshi&#x27;s public key is g^p for some p that only Satoshi knows (using multiplicative notation) on a well-known and hopefully secure elliptic curve.  You can use this key for ECDSA, but you can also use it for, drumroll please, Diffie-Hellman.  Gavin picks a random scalar b and tells Craig Wright g^b.  Chris replies with (g^b)^p [1].  Gavin checks that the result is the same as (g^p)^b.<p>This is deniable: Gavin can trivially make up the transcript of the protocol, so Gavin can&#x27;t use it to prematurely convince anyone of anything.  No airplanes needed.<p>There are plenty of other ways to do this.  Pretty much any zero-knowledge proof of knowledge would work.<p>[1] In practice, this should be blinded to avoid cross-protocol attacks and relay attacks.  Craig could send something like H(&quot;Hi Gavin, I am Craig Wright, aka Satoshi Nakamoto&quot; || (g^b)^p).  A real cryptographer could double-check me here.