BIP340 describes the Schnorr signature scheme that will be implemented with Taproot.

The signature scheme involves computing an integer, e, during both signing and verification.

Under Default Signing, e is defined as

Let e = int(hashBIP0340/challenge(bytes(R) || bytes(P) || m)) mod n.

Under Verification, it is defined as

Let e = int(hashBIP0340/challenge(bytes(r) || bytes(P) || m)) mod n.

It seems to me that a the signature is valid only if e has an unambiguous definition.

Does it use the curve point, R, or its x-coordinate, r?

Link to the BIP340-documentation: https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki

1 Answer 1


The bytes() function is defined in BIP 340 as:

The function bytes(x), where x is an integer, returns the 32-byte encoding of x, most significant byte first.

The function bytes(P), where P is a point, returns bytes(x(P)).

Hence the bytes() function of a point is defined to return the same as the bytes() function of the x coordinate. The y coordinate is thrown away in the case that a point is fed into the bytes() function.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.