Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
1answer
68 views

Why Schnorr was added to secp256k1 library instead of a separate library?

Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library? ...
2
votes
0answers
48 views

Why is adding s values in half aggregation insecure?

Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason) They presented a secure solution which ...
1
vote
1answer
78 views

Why is full blockwide signature aggregation of schnorr signatures non-interactive?

I can only think of the MuSig paper describing how Rouge attacks are prevented by also committing to the public key of all signers. But as far as I understand the case of multisig is not the same as ...
4
votes
1answer
168 views

Why does blockwide signature aggregation prevent adaptor signatures?

In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs). I am confused about ...
2
votes
2answers
51 views

Retweaking other person's or my own taproot address

Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key. This will yield a potentially different public key. ...
5
votes
1answer
126 views

Are the witnesses segregated with Schnorr signatures?

SegWit fixed transaction malleability by just moving the signature out of the block of data that's being hashed to form the transaction id. However, Schnorr does not suffer from signature malleability ...
7
votes
1answer
120 views

Possible number of signers with MuSig

With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?). As far as I understand, there should be no hard-coded ...
0
votes
1answer
36 views

Is ECDSA signing supported from within a Taproot tree or must all signing be Schnorr?

Let's say a server is set up to do ECDSA signing and you want to include the requirement to provide a ECDSA signature within your Taproot tree (script path). Is this supported?
1
vote
1answer
115 views

Taproot, potential quantum bug, and general clarification

Here seeking information. I have 2 questions marked with parens Would like some clarification pertaining to the Mark Friedenbach article: Why I'm Against Taproot The point of contention with Mark ...
5
votes
1answer
172 views

What is the difference between key aggregation and signature aggregation?

What is the difference between key aggregation (e.g. MuSig) and signature aggregation? Many people (including myself) have in the past used these terms interchangeably. Why is it important to be ...
0
votes
1answer
25 views

1 of n Multisig Scriptless Scripts?

I know MuSig makes n of n multisig scriptless. However, can we also aggregate multiple internal public keys in one public key, and unlock funds using either one of the internal public keys?
2
votes
1answer
94 views

Why is Public Key aggregation in MuSig described as a product of the public keys?

In the the MuSig2 paper, it is described that: Each signer randomly generates and communicates to others a nonce Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where ̃X=∏ni=1Xiis the ...
2
votes
1answer
49 views

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function (PRF)? If the nonce space is big enough it would never be reused. This question was asked by emzy on ...
3
votes
1answer
654 views

What makes cross input signature aggregation complicated to implement?

What makes cross input signature aggregation complicated to implement? Other than for design space reasons why didn't it make it into BIP-Taproot? (Key aggregation within one input can be achieved ...
0
votes
1answer
36 views

How do I tweak the bip340_test_vectors to check that signature verification fails for other test vectors?

I now understand why some of the bip340_test_vectors fail signature verification. I would like to tweak these test vectors to check that signature verification fails for other test vectors. How do I ...
1
vote
1answer
123 views

I'm digging further into the open Taproot PR. Can you explain the bip340_test_vectors?

I'm digging further into the open Taproot PR. I found these bip340_test_vectors. They have secret keys, public keys, aux_rand (auxiliary randomness), message, signature and whether the signature ...
2
votes
1answer
66 views

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)? Who will the first adopters of ...
0
votes
1answer
51 views

Two threats to Bitcoin: Quantum Computing and Mining farm seizures - what new BIPs are needed before it is too late? [closed]

How resistant is bitcoin blockchain against physical attacks? Contrary to other consensus mechanisms, Bitcoin's PoW model is dependent on massive Mining Farms with tons of ASIIC hardware. These farms ...
3
votes
1answer
83 views

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
4
votes
2answers
161 views

What are “leaf versions” in Taproot?

What are "leaf versions", when do you upgrade a version, how many versions are there and how do they differ from segwit versions?
0
votes
1answer
33 views

Is there already reached consensus on network upgrades like Taproot, Submarine Swaps?

I have read about some very interesting new protocol amendments. I am not asking for their explanations, but would be great if anyone explained their current status, if they are still considered to ...
0
votes
1answer
52 views

Schnorr without R in the challenge

I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the ...
4
votes
3answers
807 views

What are some interesting applications of Taproot “smart contracts”?

From a strictly technical perspective, MAST makes a lot of sense. However, understanding it in the context of Taproot/Tapscript does require prior knowledge in Merkle Trees and hash functions. What ...
3
votes
1answer
517 views

k selection for Schnorr signatures

So i was reading the BIP for Schnorr signatures and I couldn't find any explanation on why the simple RFC6979 Variant wasn't chosen for their nonce generation. Instead, they decided to go with their ...
2
votes
1answer
62 views

Is Z-man's PTLC construction implementable using libsecp256k1-zkp?

In a mailing list post Z-man details a PTLC construction which he claims is "is almost entirely a MuSig ritual". My question is whether this MusigTweak is what is called the adaptor (last argument of ...
3
votes
2answers
539 views

Could Taproot create larger security risks or even hinder future protocol adjustments re Quantum threats?

I am quoting here a user named "blk014" who responded to Pieter's Taproot tweets from 24JAN. I find this user's comments very interesting and would like to ask a developer expert how much of a ...
2
votes
1answer
67 views

Will g'root be included in the Taproot soft-fork?

G'root, which I understands as generalised Taproot, was announced a year and a half ago. I'm wondering what the development is on it and if it is part of the taproot softfork.
13
votes
1answer
612 views

Musig Signature Interactivity

2 Questions: Why is Musig signing always interactive? Let's say I have a Musig wallet where keys are stored in secure locations with no internet access. What are some methods to sign from these ...
3
votes
1answer
209 views

Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?

A P2WPKH PubKey is shorter than a P2WSH PubKey. Would this also be the case that a Taproot PubKey is larger than a Schnorr PubKey? If so, wouldn't people be incentivised to use the Schnorr PubKey and ...
2
votes
1answer
147 views

how difficult is it to generating an ECDSA (or Schnorr) signature with a certain number of leading zeros?

If both the public key and the private key are known ahead of time (public knowledge), and the goal is to choose a message/nonce that generates a signature with, for example, a certain number of ...
7
votes
1answer
588 views

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
2
votes
1answer
95 views

bip-schnorr and HD Key Derivation

Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key. It is important to not mix up the 32-byte bip-schnorr public ...
3
votes
2answers
152 views

Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?

There is currently a discussion on the mailing list about truncating the 33rd byte from public keys when used in bip-schnorr. Public keys are (x, y) coordinates and compressed public keys simply ...
2
votes
1answer
159 views

Why do aggregate Schnorr signatures reverse the hash and the random number

A bitcoin signature has: z = hash(m) Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, ...
2
votes
1answer
46 views

Is it cryptographically possible to have aggregate signature schemes that can improve privacy in UTXO consolidation?

My understanding of Schnorr signatures, Taproot and Graftroot and how they improve privacy in smart contracts / multi-sig is by allowing users to aggregate signatures so the individual signatures and ...
0
votes
1answer
182 views

What are the limitations for amortizing the interactive session setup of MuSig?

I'm trying to find a way to amortize the interactive session setup in the MuSig signature aggregation scheme. My motivation is to use signature aggregation between devices communicating using low ...
4
votes
1answer
251 views

Is the BCH version of Schnorr signatures compatible with taproot?

BCH is going to introduce support for Schnorr signatures on May 15th. One of the most anticipated features for Schnorr signatures on Bitcoin is the introduction of taproot constructions. Will it be ...
2
votes
0answers
76 views

Schnorr Fiat Shamir Transformation

In the Schnorr identity protocol, we can transform the interactive ZKP into a non-interactive one by replacing the role of the verifier (i.e. providing a random challenge value) with a hash function ...
3
votes
1answer
96 views

What is the current Status of major proposed BTC upgrades like Taproot, MAST, Submarine Swaps?

I have read during the last year about some very interesting BIPs or initiatives. I am not asking for their explanations, just would be great if anyone would know about their simple status as of now, ...
8
votes
2answers
631 views

How could Schnorr signatures be aggregated across the whole transaction?

I am studying the MuSig protocol and am having trouble grasping certain segments. This is my understanding thus far: In current Bitcoin CHECKMULTISIG format, the size of the signature grows linearly ...
0
votes
2answers
290 views

The order of the generator point G used in bitcoin

Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated. From the specification listed http://www.secg.org/SEC2-Ver-1.0.pdf for secp256k1 I can see ...
10
votes
1answer
622 views

When Schnorr signatures are part of Bitcoin will it be possible validate each block with only one signature validation?

In a recent talk Pieter Wuille talked about speed up verification when using Schnorr signatures and various algorithms for verifying multiple signatures. Would it really be possible to verify one ...
4
votes
1answer
76 views

Why is the Schnorr verification formula working and actually verifying the validity of a signature?

Reading the bottom of page 2 of the Musig Paper we can find that a Schnorr Signature for a cyclic Group G of prime order p with generator g is a tuple (R,s) where R = gr for a random secret r and s=r+...
0
votes
1answer
50 views

Does a blockchain become opaque if it enable's schnorr-signatures, and require trust in the code?

When you sign a transaction with schnorr-signatures, it does not include the pubkey in the transaction data. 1)Does this mean the input addresses become unknown, aka creating a opaque blockchain ? ...
3
votes
1answer
127 views

Are sipa's standardized schnorr signatures incompatible with blind signatures?

Here, sipa proposes a standardization of schnorr signatures: https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki For example, sign() returns Sig{R,s} which can be encoded with 64 ...
3
votes
1answer
53 views

Would signature aggregation reduce the largest feasible blocksize

If a Schnorr signature aggregation scheme were to be integrated into Bitcoin. Would the reduction in witness data versus non witness data (need less bytes for a signature therefore witness data usage ...
8
votes
2answers
526 views

How are scriptless scripts and taproot different?

I recently read Aaron van Wirdum's layman explanation of both scriptless scripts and taproot. I gather that both utilize the aggregation of Schnorr signatures to hide complex scripts (smart contracts) ...
13
votes
1answer
649 views

Will a Schnorr soft-fork introduce a new address format (i.e. not bech32)

When we (hopefully) soft-fork to Schnorr signatures will the address be indistinguishable from bech32 addresses?
1
vote
1answer
141 views

Can R/r in Musig be derived from only seeds and message hashes?

I am wondering if the first two roundtrips of pre-committing and then revealing R/r in MuSig signing can be moved to the keygen phase and made deterministic. That reduces the amount of messages that ...
5
votes
1answer
242 views

Schnorr batch validation speed statistics

In this question Schnorr vs ECDSA I see in the Peter Wuille's answer the following comment about Schnorr signature batch validation: "Improving verification speed, by supporting batch validation of ...