In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?

Question

BIP340 describes the Schnorr signature scheme that will be implemented with Taproot.

The signature scheme involves computing an integer, e, during both signing and verification.

Under Default Signing, e is defined as

Let e = int(hashBIP0340/challenge(bytes(R) || bytes(P) || m)) mod n.

Under Verification, it is defined as

Let e = int(hashBIP0340/challenge(bytes(r) || bytes(P) || m)) mod n.

It seems to me that a the signature is valid only if e has an unambiguous definition.

Does it use the curve point, R, or its x-coordinate, r?

Link to the BIP340-documentation: https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki

Answer 1

The bytes() function is defined in BIP 340 as:

The function bytes(x), where x is an integer, returns the 32-byte encoding of x, most significant byte first.

The function bytes(P), where P is a point, returns bytes(x(P)).

Hence the bytes() function of a point is defined to return the same as the bytes() function of the x coordinate. The y coordinate is thrown away in the case that a point is fed into the bytes() function.