bip-schnorr and HD Key Derivation

Question

Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key.

It is important to not mix up the 32-byte bip-schnorr public key format and other existing public key formats (e.g. encodings used in Bitcoin's ECDSA). Concretely, a verifier should only accept 32-byte public keys and not, for example, convert a 33-byte public key by throwing away the first byte.

Later in the bip, it mentions that you should do this when doing HD key derivation.

Link: https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#public-key-generation

Alternatively, the public key can be created according to BIP32 which describes the derivation of 33-byte compressed public keys. In order to translate such public keys into bip-schnorr compatible keys, the first byte must be dropped.

It sounds like its safe for the prover to drop the extra byte but not the verifier. Is this correct?

Answer 1

Is it safe to use HD Key Derivation with bip-schnorr?

Yes, it is designed to be.

The bip mentions that you should not throw away the first byte of a generated key.

Perhaps this is worded confusingly.

It means that you can't use a variant of the signature scheme, which uses full public keys, but then throws away one byte of the public key at verification time. Doing so would just result in 50% of the signatures being rejected (because the public key wouldn't match what was used at signing time).

It sounds like its safe for the prover to drop the extra byte but not the verifier.

This has nothing to do with safety, but about correctness.