All Questions
Tagged with cryptography schnorr-signatures
8 questions
4
votes
1
answer
507
views
Why does BIP-340 use secp256k1?
If the entire Taproot/Schnorr soft-fork was going to implement an entirely new signing scheme anyway that was completely independent from the previous ECDSA scheme, why did it use secp256k1?
Couldn't ...
- 631
2
votes
1
answer
197
views
Why is the challenge scalar multiplied with the private key scalar In the Schnorr identification protocol?
If Alice wants to prove to Bob she is the holder of private key x, without exposing x, they can use the Schnorr identification protocol which has the public function sG = kG + exG and the private ...
- 105
8
votes
1
answer
209
views
Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?
BIP340 recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows:
Using unpredictable randomness additionally increases protection against other side-channel ...
- 81
4
votes
1
answer
216
views
How does the BIP340 lift_x algorithm work?
Couple questions of code that I'm reviewing trying to learn schnorr sigs.
Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
- 331
2
votes
1
answer
200
views
Why is Public Key aggregation in MuSig described as a product of the public keys?
In the the MuSig2 paper, it is described that:
Each signer randomly generates and communicates to others a nonce
Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where
̃X=∏ni=1Xiis the ...
2
votes
0
answers
122
views
Schnorr Fiat Shamir Transformation
In the Schnorr identity protocol, we can transform the interactive ZKP into a non-interactive one by replacing the role of the verifier (i.e. providing a random challenge value) with a hash function ...
- 141
0
votes
2
answers
561
views
The order of the generator point G used in bitcoin
Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated.
From the specification listed http://www.secg.org/SEC2-Ver-1.0.pdf for secp256k1 I can see ...
- 125
4
votes
1
answer
129
views
Why is the Schnorr verification formula working and actually verifying the validity of a signature?
Reading the bottom of page 2 of the Musig Paper we can find that a Schnorr Signature for a cyclic Group G of prime order p with generator g is a tuple (R,s) where
R = gr for a random secret r and
s=r+...
- 11.9k