0

How does normal key tweaking work in case of Schnorr digital signature schemes?

For all examples I am using online tool for point multiplication and point addition. (I suggest you to use them if it is easier for you)

Let's consider the following curve (it's same as secp256k1 just smaller - it has 17 points including point of Inf):

a = 2
b = 4
p = 11
G = (2, 4)

Also, let's consider two private keys and it's corresponding public keys:

PrivK1 = 7
PrivK2 = 10
PubK1 = 7 * (2, 4) = (3, 9)
PubK2 = 10 * (2, 4) = (3, 2)

At the end, let's consider that the tweak is 3 (TW).

In ECDSA, this key tweaking works as I expect and it looks as follow:

For the first private key (7) - public key (3, 9) pair:
(1) From the private key side:
PrivK1' = PrivK1 + TW = 7 + 3
PrviK1' = 10
PubK1' = PrivK1' * G = 10 * (2, 4)
PubK1' = (3, 2)
(2) From the public key side:
PubK1' = PubK1 + G + G + G = (3, 9) + (2, 4) + (2, 4) + (2, 4)
PubK1' = (3, 2)

(1) == (2)

For the second private key (10) - public key (3, 2) pair:
(1) From the private key side:
PrivK1' = PrivK1 + TW = 10 + 3
PrviK1' = 13
PubK1' = PrivK1' * G = 13 * (2, 4)
PubK1' = (7, 3)
(2) From the public key side:
PubK1' = PubK1 + G + G + G = (3, 2) + (2, 4) + (2, 4) + (2, 4)
PubK1' = (7, 3)

(1) == (2)

For both private key - public key pairs, we got a match.

However, for the Schnorr it does not match when the private key produce the ODD Y coordinate. That is the case with the first private key - public key pair, take a look:

For the first private key (7) - public key (3, 2) pair:
NOTE: Here the public key is not (3, 9) but (3, 2) since we take always EVEN Y coo
(1) From the private key side:
PrivK1' = PrivK1 + TW = 7 + 3
PrviK1' = 10
PubK1' = PrivK1' * G = 10 * (2, 4)
PubK1' = (3, 2)
(2) From the public key side:
PubK1' = PubK1 + G + G + G = (3, 2) + (2, 4) + (2, 4) + (2, 4)
PubK1' = (7, 3)

(1) != (2)

For the second private key (10) - public key (3, 2) pair:
(1) From the private key side:
PrivK1' = PrivK1 + TW = 10 + 3
PrviK1' = 13
PubK1' = PrivK1' * G = 13 * (2, 4)
PubK1' = (7, 3)
(2) From the public key side:
PubK1' = PubK1 + G + G + G = (3, 2) + (2, 4) + (2, 4) + (2, 4)
PubK1' = (7, 3)

(1) == (2)

So, the private key after tweaking does not match the tweaked public key in case of odd Y coordinate, so it will not be able to produce a valid signature.

What am I doing wrong or what did I not understand correctly?

Thanks!!

Improve this question
1
  • 1
    I may write a full answer later, but perhaps this lets you solve it yourself: going from odd to even Y coordinate corresponds to implicitly negating the private key. If you tweak after dropping an odd Y coordinate, you need to therefore do the same and subtract the tweak rather than adding it.
    – Pieter Wuille
    Nov 11 at 21:08

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.