5

SegWit fixed transaction malleability by just moving the signature out of the block of data that's being hashed to form the transaction id.

However, Schnorr does not suffer from signature malleability (https://medium.com/digitalassetresearch/schnorr-signatures-the-inevitability-of-privacy-in-bitcoin-b2f45a1f7287):

Non-malleability: ECDSA signatures are inherently malleable, which may enable a third party without access to the private key to alter an existing valid signature and double-spend funds. This issue was formally discussed in BIP62. In comparison, Schnorr signatures are provably non-malleable.

Consequently, is a Schnorr signature still segregated from the data that's being hashed, and if yes, why?

Improve this question
2
  • 1
    According to blockstream.com/2017/07/31/en-segwit-myths-debunked segwit does not remove signatures from blocks
    – user103136
    Jun 11, 2021 at 12:11
  • 3
    True, but also not what Dalit Sairio said. The question states "out of the block of data that's being hashed to form the transaction id", which is correct.
    – Murch ♦
    Jun 11, 2021 at 15:38

1 Answer 1

Reset to default
7

Schnorr (bip-340) signatures have been introduced as part of v1 Segwit outputs with the CHECKSIGADD opcode. Therefore bip-340 signatures are part of the witness and are not part of the hash forming the txid.

Script malleability is only a single among a lot of benefits brought by Segwit, and we shouldn't drop all the others (and encourage using legacy transactions) because part of the proposal does not need one of them.

For example, one of these benefits is simpler Script versioning and rolling out the CHECKSIGADD behaviour using the legacy versioning (NOP ops) would be a bit "dirty" (in addition to adding the incentive to use legacy transactions that are more expensive for the network to process).

Improve this answer
2
  • 3
    Furthermore, script malleability is a wider problem than signature malleability. Segwit in general fixes all types of script malleability, which includes the ones cause by signature malleability, but also others.
    – Pieter Wuille
    Jun 11, 2021 at 19:13
  • Added to the answer (s/Signature malleability/Script malleability/).
    – Antoine Poinsot
    Jun 12, 2021 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.