EDIT: This question is not specific to Bitcoin. It's applicable to any other crypto currency that is interested in using a different signature scheme than Bitcoin or the QT reference client. One reason for this is to reduce complexity (and bugs) in the protocol.
My understanding of malleable transactions in Bitcoin is that two different values are supported for "S" when a signature is validated.
The solution for this is to ensure that S is less than the following
X9ECParameters ecParams = Org.BouncyCastle.Asn1.Sec.SecNamedCurves.GetByName("secp256k1"); HALF_CURVE_ORDER = ecParams.N.ShiftRight(1);
Given the plethora of signature mechanisms available to crypto-currency, what algorithms or signature approaches are not vulnerable to Malleable Transactions?
e.g. What if...
- A different curve was selected instead of secp256k1?
- A different signature mechanism was chosen?
- A different approach entirely, such as a blind HMAC was used to sign transactions?
I'm interested in answers that describe both solutions that are broken, and those that would prevent malleable transactions from ever occurring.
My goal is to flush out an algorithm that produces consistent results with minimal complexity for implementors. (in other words, even Mt Gox would get it right)