Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

How does SpeedyMuSig compare to MuSig2?

This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
user avatar
2 votes
2 answers
82 views

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
user avatar
4 votes
1 answer
184 views

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

BIP342 defines OP_CHECKSIGADD as a replacement for OP_CHECKMULTISIG. In the footnote it's mentioned that OP_CHECKMULTISIG is not compatible with batch verification, but I can't understand why and I ...
user avatar
1 vote
0 answers
36 views

Example of Schnorr signature on a block explorer?

Can somebody link to a Schnorr signed transaction on Mainnet or Testnet? Looking to see how the SCRIPTSIG differs.
user avatar
1 vote
1 answer
39 views

Standard library for schnorr signature algorithm

I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
user avatar
1 vote
1 answer
43 views

What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks, if we say signature=F(r,s,e)...
user avatar
1 vote
0 answers
46 views

"Non-mandatory-script-verify-flag (Invalid Schnorr Signature)" on testnet

I'm using the FROST algorithm to create a threshold signature for some taproot output (using this code). When I tried using it on the testnet, it works most of the time but from time to time I would ...
user avatar
  • 65
3 votes
1 answer
170 views

Support for taproot multisig descriptors

I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr ...
user avatar
  • 143
4 votes
2 answers
142 views

Is it possible to use a P2PKH output with a schnorr signature?

I know that Bitcoin has many different transaction output types (P2SH, P2WPKH, P2WSH, P2TR, etc). And I know that P2PKH is an old transaction output type that has existed since before Segwit and ...
user avatar
  • 213
5 votes
2 answers
318 views

What is an adaptor signature?

What is an adaptor signature in Bitcoin? A simple definition with some examples that could be understood without knowing cryptography in detail
user avatar
6 votes
1 answer
245 views

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

The way I've understood Schnorr signatures is that multiple parties can combine their signatures into a one shared signature, thus obfuscating the number of participants involved in the signature ...
user avatar
  • 133
3 votes
1 answer
406 views

2-of-3 multisig with Schnorr signatures

From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone. Or is it? Suppose we need a 2-of-3 scheme. As far as I ...
user avatar
3 votes
1 answer
89 views

In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?

BIP340 describes the Schnorr signature scheme that will be implemented with Taproot. The signature scheme involves computing an integer, e, during both signing and verification. Under Default Signing, ...
user avatar
0 votes
0 answers
23 views

Cryptographic Block Ordering

I've been working on a cryptographic clock for Bitcoin, so other cryptographic systems to leverage as a tool for coordination and security. As a result, I gave each block on the bitcoin core timechain ...
user avatar
3 votes
0 answers
73 views

Schnorr signature key storage

So everyone talks about Schnorr signatures and Taproot when talking about Bitcoin. I would like to know if there is any standard that they will use to store the keys used in this algorithm. And also I ...
user avatar
5 votes
1 answer
208 views

Are there risks to using the same private key for both ECDSA and Schnorr signatures?

I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms? In this ...
user avatar
  • 4,676
2 votes
1 answer
175 views

Why Schnorr was added to secp256k1 library instead of a separate library?

Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library? ...
user avatar
2 votes
0 answers
59 views

Why is adding s values in half aggregation insecure?

Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason) They presented a secure solution which ...
user avatar
3 votes
1 answer
147 views

Why is full blockwide signature aggregation of schnorr signatures non-interactive?

I can only think of the MuSig paper describing how Rouge attacks are prevented by also committing to the public key of all signers. But as far as I understand the case of multisig is not the same as ...
user avatar
4 votes
2 answers
235 views

Why does blockwide signature aggregation prevent adaptor signatures?

In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs). I am confused about ...
user avatar
2 votes
2 answers
95 views

Retweaking other person's or my own taproot address

Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key. This will yield a potentially different public key. ...
user avatar
5 votes
1 answer
166 views

Are the witnesses segregated with Schnorr signatures?

SegWit fixed transaction malleability by just moving the signature out of the block of data that's being hashed to form the transaction id. However, Schnorr does not suffer from signature malleability ...
user avatar
7 votes
1 answer
228 views

Possible number of signers with MuSig

With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?). As far as I understand, there should be no hard-coded ...
user avatar
0 votes
1 answer
56 views

Is ECDSA signing supported from within a Taproot tree or must all signing be Schnorr?

Let's say a server is set up to do ECDSA signing and you want to include the requirement to provide a ECDSA signature within your Taproot tree (script path). Is this supported?
user avatar
1 vote
1 answer
305 views

Taproot, potential quantum bug, and general clarification

Here seeking information. I have 2 questions marked with parens Would like some clarification pertaining to the Mark Friedenbach article: Why I'm Against Taproot The point of contention with Mark ...
user avatar
5 votes
1 answer
361 views

What is the difference between key aggregation and signature aggregation?

What is the difference between key aggregation (e.g. MuSig) and signature aggregation? Many people (including myself) have in the past used these terms interchangeably. Why is it important to be ...
user avatar
0 votes
1 answer
34 views

1 of n Multisig Scriptless Scripts?

I know MuSig makes n of n multisig scriptless. However, can we also aggregate multiple internal public keys in one public key, and unlock funds using either one of the internal public keys?
user avatar
  • 362
2 votes
1 answer
131 views

Why is Public Key aggregation in MuSig described as a product of the public keys?

In the the MuSig2 paper, it is described that: Each signer randomly generates and communicates to others a nonce Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where ̃X=∏ni=1Xiis the ...
user avatar
2 votes
1 answer
66 views

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function (PRF)? If the nonce space is big enough it would never be reused. This question was asked by emzy on ...
user avatar
4 votes
1 answer
883 views

What makes cross input signature aggregation complicated to implement?

What makes cross input signature aggregation complicated to implement? Other than for design space reasons why didn't it make it into BIP-Taproot? (Key aggregation within one input can be achieved ...
user avatar
0 votes
1 answer
71 views

How do I tweak the bip340_test_vectors to check that signature verification fails for other test vectors?

I now understand why some of the bip340_test_vectors fail signature verification. I would like to tweak these test vectors to check that signature verification fails for other test vectors. How do I ...
user avatar
1 vote
1 answer
169 views

I'm digging further into the open Taproot PR. Can you explain the bip340_test_vectors?

I'm digging further into the open Taproot PR. I found these bip340_test_vectors. They have secret keys, public keys, aux_rand (auxiliary randomness), message, signature and whether the signature ...
user avatar
2 votes
1 answer
110 views

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)? Who will the first adopters of ...
user avatar
0 votes
1 answer
64 views

Two threats to Bitcoin: Quantum Computing and Mining farm seizures - what new BIPs are needed before it is too late? [closed]

How resistant is bitcoin blockchain against physical attacks? Contrary to other consensus mechanisms, Bitcoin's PoW model is dependent on massive Mining Farms with tons of ASIIC hardware. These farms ...
user avatar
3 votes
1 answer
142 views

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
user avatar
4 votes
2 answers
204 views

What are "leaf versions" in Taproot?

What are "leaf versions", when do you upgrade a version, how many versions are there and how do they differ from segwit versions?
user avatar
0 votes
1 answer
35 views

Is there already reached consensus on network upgrades like Taproot, Submarine Swaps?

I have read about some very interesting new protocol amendments. I am not asking for their explanations, but would be great if anyone explained their current status, if they are still considered to ...
user avatar
0 votes
1 answer
73 views

Schnorr without R in the challenge

I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the ...
user avatar
4 votes
3 answers
1k views

What are some interesting applications of Taproot "smart contracts"?

From a strictly technical perspective, MAST makes a lot of sense. However, understanding it in the context of Taproot/Tapscript does require prior knowledge in Merkle Trees and hash functions. What ...
user avatar
3 votes
1 answer
538 views

k selection for Schnorr signatures

So i was reading the BIP for Schnorr signatures and I couldn't find any explanation on why the simple RFC6979 Variant wasn't chosen for their nonce generation. Instead, they decided to go with their ...
user avatar
  • 51
3 votes
1 answer
86 views

Is Z-man's PTLC construction implementable using libsecp256k1-zkp?

In a mailing list post Z-man details a PTLC construction which he claims is "is almost entirely a MuSig ritual". My question is whether this MusigTweak is what is called the adaptor (last argument of ...
user avatar
3 votes
2 answers
791 views

Could Taproot create larger security risks or even hinder future protocol adjustments re Quantum threats?

I am quoting here a user named "blk014" who responded to Pieter's Taproot tweets from 24JAN. I find this user's comments very interesting and would like to ask a developer expert how much of a ...
user avatar
2 votes
1 answer
88 views

Will g'root be included in the Taproot soft-fork?

G'root, which I understands as generalised Taproot, was announced a year and a half ago. I'm wondering what the development is on it and if it is part of the taproot softfork.
user avatar
14 votes
1 answer
656 views

Musig Signature Interactivity

2 Questions: Why is Musig signing always interactive? Let's say I have a Musig wallet where keys are stored in secure locations with no internet access. What are some methods to sign from these ...
user avatar
3 votes
1 answer
255 views

Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?

A P2WPKH PubKey is shorter than a P2WSH PubKey. Would this also be the case that a Taproot PubKey is larger than a Schnorr PubKey? If so, wouldn't people be incentivised to use the Schnorr PubKey and ...
user avatar
2 votes
1 answer
185 views

how difficult is it to generating an ECDSA (or Schnorr) signature with a certain number of leading zeros?

If both the public key and the private key are known ahead of time (public knowledge), and the goal is to choose a message/nonce that generates a signature with, for example, a certain number of ...
user avatar
  • 404
8 votes
1 answer
668 views

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
user avatar
  • 2,391
2 votes
1 answer
131 views

bip-schnorr and HD Key Derivation

Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key. It is important to not mix up the 32-byte bip-schnorr public ...
user avatar
4 votes
2 answers
200 views

Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?

There is currently a discussion on the mailing list about truncating the 33rd byte from public keys when used in bip-schnorr. Public keys are (x, y) coordinates and compressed public keys simply ...
user avatar
  • 4,676
2 votes
1 answer
194 views

Why do aggregate Schnorr signatures reverse the hash and the random number

A bitcoin signature has: z = hash(m) Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, ...
user avatar