Editing Atomic cloud storage (section)

== To download a file the process looks like this [9] [10]: ==

# The renter downloads the content back from the farmer.
# The renter checks that the returned content matches the hash.
# The renter and farmer sign a series of special transactions that allow the renter’s funds to be claimed by the farmer by revealing his private key.
# When the farmer broadcasts his transactions it simultaneously reveals the secrets needed for the renter to decrypt her file.

'''What’s interesting about this is that its atomic:''' the renter either pays to store a file which can be downloaded back in the future or the process fails and they get their money back. The problem is: how do you build a Bitcoin transaction that forces the farmer to reveal their private key?

There certainly are no OP_CODES that are capable of doing that . . . (well – there are some but it requires brute forcing a special ECDSA private key which is computationally expensive for both parties [12].) Instead, we’re going to do something kind of special. We’re going to build a transaction scheme that involves signing a chain of transactions in such a way that the signatures that the farmer uses are … provably insecure.

The farmer ''must'' use these insecure signatures if they want to claim their coins – and the act of doing so is enough to allow the renter to derive their private key. But how is this done? Well, its based on doing something that you should normally never do – reuse the same number used for an ECDSA signature – and as long as the renter knows what the farmer signed they have the information needed to reconstruct the private key [13].

There’s only one problem with that – the renter needs to know that a serialized transaction actually contains these weak ECDSA signatures before signing the transaction chain … and ''without'' knowing what the signatures actually are when they sign the transaction (because otherwise they could use this to derive the key before they should know it in the protocol.)

<span id="zero-knowledge-proofs-to-the-rescue"></span>