Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
41 views

non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this "Invalid Schnorr signature" error from my RPC node: { "...
Michael Hamilton's user avatar
0 votes
0 answers
80 views

How does tweaking work for x-only keys, and what is not good in the example I gave?

How does normal key tweaking work in case of Schnorr digital signature schemes? For all examples I am using online tool for point multiplication and point addition. (I suggest you to use them if it is ...
LeaBit's user avatar
  • 478
0 votes
2 answers
99 views

How to get x-only public key from the private key, and what does the obtained value represent?

In ECDSA, the public key is the result of multiplying the private key (some random 256-bit value) with a generic point (G). So the public key would be one of the points (X,Y) of the elliptic curve ...
LeaBit's user avatar
  • 478
4 votes
1 answer
240 views

Is the Schnorr digital signature scheme a multisignature interactive scheme, and also not an aggregated non-interactive scheme?

In his answer Pieter Wuille defined a concepts of multisignature scheme and aggregated signature scheme as follows: A multisignature scheme is a scheme where multiple parties jointly produce a ...
LeaBit's user avatar
  • 478
0 votes
1 answer
98 views

What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?

Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms: (key generation, signing, verification) Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
LeaBit's user avatar
  • 478
0 votes
2 answers
104 views

Example of key-path BIP-0341 signature message computation

Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please? deriveaddresses "rawtr(...
Greg Tonoski's user avatar
0 votes
1 answer
44 views

Do we pay cheaper fees for less security in P2TR rather than P2PKH?

Answer quote: P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds. If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
Mercedes's user avatar
  • 797
3 votes
0 answers
26 views

Should an even Y coordinate be enforced after every key-tweak operation, or only at the end?

This is a very niche question regarding BIP340 and key tweaking with even-only public keys. I feel my question may be a matter of opinion, since there doesn't appear to be an accepted right / wrong ...
cmdruid's user avatar
  • 31
1 vote
1 answer
59 views

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
AncientTides's user avatar
8 votes
1 answer
125 views

Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?

BIP340 recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows: Using unpredictable randomness additionally increases protection against other side-channel ...
Matthew Leon's user avatar
5 votes
0 answers
76 views

Which wallets are spending P2TR with SIGHASH_ALL?

I noticed there are quite a lot of transactions spending taproot key path inputs that use SIGHASH_ALL instead of SIGHASH_DEFAULT in signatures (around 20% in the last two weeks). Recall that ...
Vojtěch Strnad's user avatar
3 votes
1 answer
130 views

taproot script spending issue

I have been working in a bitcoin library for educational purposes (being taught in courses/meetups/etc.). I had quite some time to work on it and decided it was about time to support taproot. I have ...
karask's user avatar
  • 2,520
2 votes
1 answer
112 views

Taproot Script Path Spending can't pass signature verification

I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help? The raw transaction: ...
lj zn's user avatar
  • 31
3 votes
1 answer
94 views

Questions wrt taproot's message digest signing

BIP-341 describes how to construct the message to be signed for taproot (subsection Common signature message). It mostly makes sense but I have a couple of quick questions: Is the ext_flag 0 when ...
karask's user avatar
  • 2,520
3 votes
1 answer
59 views

Are there CoinSwap-like protocols that don't need access to raw private keys?

Say you would like to atomically swap Bitcoins with a counterparty, without an obvious on-chain link such as a hash pre-image used in an HTLC-like Bitcoin Script. The constructions I am aware of ...
Dominik Spicher's user avatar
2 votes
1 answer
68 views

How can I store a file hash in a Schnorr signature? Or something other than an OP_RETURN?

I have this python script that puts file hashes on the bitcoin blockchain: from bitcoinutils.utils import to_satoshis from bitcoinutils.setup import setup from bitcoinutils.transactions import ...
ChristianOConnor's user avatar
2 votes
1 answer
80 views

Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce. Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th". I want to ...
Kaizen's user avatar
  • 331
0 votes
1 answer
52 views

Looking for resources on doing Schnorr signatures in Bitcoin transactions

Please leave any resources you think will help, thank you.
Poseidon's user avatar
  • 633
1 vote
0 answers
115 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
Son Kaos999's user avatar
6 votes
1 answer
553 views

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? Is it faster to verify, say 100 (non-interactively) aggregated BLS ...
Son Kaos999's user avatar
0 votes
2 answers
190 views

Is Taproot the best address against quantum computers attack?

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit. Another question I have about Taproot, is that if ...
Dodi Alf's user avatar
2 votes
1 answer
71 views

Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?

Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
user77340's user avatar
  • 131
4 votes
1 answer
160 views

How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
Kaizen's user avatar
  • 331
1 vote
1 answer
161 views

What would happen if you tweaked a public key with an odd y-coordinate?

From BIP341 this example code shows how you can tweak an x-only pubkey: def taproot_tweak_pubkey(pubkey, h): t = int_from_bytes(tagged_hash("TapTweak", pubkey + h)) if t >= ...
Darius's user avatar
  • 779
2 votes
2 answers
313 views

How do you calculate a taproot sighash?

I'm having trouble manually recreating the taproot sighash from the example below. I used btcdeb to pass in an input transaction (with a P2TR output), and a valid tx that spends from it. In the logs ...
Darius's user avatar
  • 779
0 votes
1 answer
126 views

To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?

I have seen it discussed in various places (e.g. 1, 2) that using BIP32 key derivation impacts the design of secure key aggregation multisig and threshold schemes like MuSig(2) and FROST. What are the ...
Michael Folkson's user avatar
1 vote
0 answers
27 views

What is the argument for not using proofs of possession in Bitcoin multisig and threshold key aggregation schemes?

A number of multisig and threshold sig key aggregation schemes developed outside of the Bitcoin ecosystem (e.g. SpeedyMuSig, FROST) use proofs of possession yet those developed in the Bitcoin ...
Michael Folkson's user avatar
2 votes
0 answers
186 views

How does OP_CHECKSIG work for Taproot script path spending?

I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is ...
Zephyrus's user avatar
  • 658
0 votes
1 answer
70 views

Why does only one of the two nonce points in MuSig2 have the exponent b?

In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b). Why does only one of the nonce points have the ...
Michael Folkson's user avatar
0 votes
1 answer
89 views

In MuSig2 how is multiplication of coordinates defined?

In the MuSig2 paper each signer multiplies all the nonces together (in the naive version): R_1 * R_2 * R_3 * .... R_n where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
Michael Folkson's user avatar
0 votes
2 answers
177 views

How does SpeedyMuSig compare to MuSig2?

This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
Michael Folkson's user avatar
1 vote
1 answer
624 views

How do MuSig2 and FROST compare for multisig key aggregation schemes?

Although FROST is primarily for threshold (k-of-n, k<n) key aggregation schemes (and MuSig2 doesn't support threshold) FROST can support multisig (n-of-n) key aggregation. So what are the upsides ...
Michael Folkson's user avatar
2 votes
2 answers
210 views

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
miketery's user avatar
4 votes
1 answer
254 views

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

BIP342 defines OP_CHECKSIGADD as a replacement for OP_CHECKMULTISIG. In the footnote it's mentioned that OP_CHECKMULTISIG is not compatible with batch verification, but I can't understand why and I ...
David A. Harding's user avatar
1 vote
0 answers
134 views

Example of Schnorr signature on a block explorer?

Can somebody link to a Schnorr signed transaction on Mainnet or Testnet? Looking to see how the SCRIPTSIG differs.
Hemphta's user avatar
  • 11
1 vote
1 answer
158 views

Standard library for schnorr signature algorithm

I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
rafael__bg's user avatar
1 vote
1 answer
56 views

What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks, if we say signature=F(r,s,e)...
Prasanth Vuppala's user avatar
2 votes
0 answers
238 views

"Non-mandatory-script-verify-flag (Invalid Schnorr Signature)" on testnet

I'm using the FROST algorithm to create a threshold signature for some taproot output (using this code). When I tried using it on the testnet, it works most of the time but from time to time I would ...
sa8's user avatar
  • 75
4 votes
1 answer
520 views

Support for taproot multisig descriptors

I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr ...
Alex's user avatar
  • 163
4 votes
2 answers
224 views

Is it possible to use a P2PKH output with a schnorr signature?

I know that Bitcoin has many different transaction output types (P2SH, P2WPKH, P2WSH, P2TR, etc). And I know that P2PKH is an old transaction output type that has existed since before Segwit and ...
yzernik's user avatar
  • 223
4 votes
2 answers
796 views

What is an adaptor signature?

What is an adaptor signature in Bitcoin? A simple definition with some examples that could be understood without knowing cryptography in detail
user avatar
6 votes
1 answer
373 views

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

The way I've understood Schnorr signatures is that multiple parties can combine their signatures into a one shared signature, thus obfuscating the number of participants involved in the signature ...
max's user avatar
  • 173
2 votes
1 answer
131 views

Where can I get some MuSig2 test vectors?

I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
Jimmy Song's user avatar
  • 7,749
3 votes
1 answer
600 views

2-of-3 multisig with Schnorr signatures

From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone. Or is it? Suppose we need a 2-of-3 scheme. As far as I ...
Vojtěch Strnad's user avatar
3 votes
1 answer
123 views

In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?

BIP340 describes the Schnorr signature scheme that will be implemented with Taproot. The signature scheme involves computing an integer, e, during both signing and verification. Under Default Signing, ...
Morten Schaiffel-Nielsen's user avatar
3 votes
0 answers
95 views

Schnorr signature key storage

So everyone talks about Schnorr signatures and Taproot when talking about Bitcoin. I would like to know if there is any standard that they will use to store the keys used in this algorithm. And also I ...
Razvan Marian's user avatar
3 votes
1 answer
486 views

Why is the tag repeated twice in a tagged hash?

I noticed that the hash message for the tagged hash in BIP340 is prefixed with SHA256(tag) || SHA256(tag), which also describes the reason Because this is a 64-byte long context-specific constant and ...
sphpmp's user avatar
  • 127
5 votes
1 answer
310 views

Are there risks to using the same private key for both ECDSA and Schnorr signatures?

I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms? In this ...
pinhead's user avatar
  • 4,992
3 votes
1 answer
526 views

Why Schnorr was added to secp256k1 library instead of a separate library?

Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library? ...
yerzhan7's user avatar
2 votes
0 answers
70 views

Why is adding s values in half aggregation insecure?

Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason) They presented a secure solution which ...
Rene Pickhardt's user avatar