8

BIP340 recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows:

Using unpredictable randomness additionally increases protection against other side-channel attacks, and is recommended whenever available.

However, Core always seems to provide a zeroed vector for auxiliary randomness. There's a relevant commit.

Given that Core uses randomness in generation of private keys, shouldn't it be using randomness in performance of Schnorr signatures as well?

1 Answer 1

5

As with any open source project, if no one cares enough to implement it, it doesn't get implemented. Providing no auxiliary randomness is still safe as the deterministic nonce generation algorithm includes the private key. This is enough entropy for it to be safe, so there isn't any need to provide any auxiliary randomness, although it would probably be nice to do so.

Additionally, we like deterministic signatures, so if auxiliary randomness were to be provided, it would need to be generated in a deterministic way so that all attempts to make a signature over the same message with the same private key always results in the same signature. Implementing that was presumably more effort than it was worth.

1
  • 4
    If it's deterministic, it's not random. The advice in BIP340 is to actually use random auxiliary data - that implies that re-signing the same message with the same key won't be the same. Aug 3, 2023 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.