5

I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms?

In this related question, I see that ECDSA signature outputs (h, s) but Schnorr outputs (r, s). So in ECDSA, r is kept as a secret value but it is revealed in Schnorr -- does that somehow make the private key recoverable?

1
  • I think OP is referring to this mail on the bitcoin-dev mailing list
    – Anunay
    Aug 4 at 15:31
4

Copying the summary from my mailing list post on this topic:

  • To stay within the realm of provably security it's advisable to make sure ECDSA key and Schnorr keys use distinct hardened derivation steps.
  • Even if you don't, you're really just back to the level of assurance we had about unhardened BIP32 ECDSA keys before a proof was known (which I think most people aren't even aware of).

There are no known attacks against reuse of keys across ECDSA and Schnorr (at least as long as the nonces are unrelated/unpredictable, but if that's not the case, you also have a problem with reuse within ECDSA or within Schnorr).

There is however also no security proof for reuse across, as far as I know, but that's not really worse than what the situation for ECDSA alone until recently.

2
  • 1
    However I should add, using the same deterministic nonce scheme (eg. rfc6979) across ECDSA and Schnorr, and signing the same message with both will leak the key!
    – Anunay
    Aug 4 at 21:44
  • 1
    That's true, though not a risk in the current transaction signing scheme, as the message is guaranteed to be different for both (hash is computed differently, and also hash commits to the output bwing spent, which commits indirectly to the script). Aug 4 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.