Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
55 views

Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce. Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th". I want to ...
  • 331
0 votes
1 answer
42 views

Looking for resources on doing Schnorr signatures in Bitcoin transactions

Please leave any resources you think will help, thank you.
  • 172
1 vote
0 answers
57 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
6 votes
1 answer
263 views

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? Is it faster to verify, say 100 (non-interactively) aggregated BLS ...
0 votes
1 answer
80 views

Is Taproot the best Address against quantum computers attack

Im looking for an address type for long term storage of btc but I don't know what to choose.Im not sure if Taproot is more secure than segwit. Another Question I have about Taproot is that if it uses ...
2 votes
1 answer
47 views

Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?

Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
  • 131
4 votes
1 answer
106 views

How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
  • 331
1 vote
1 answer
80 views

What would happen if you tweaked a public key with an odd y-coordinate?

From BIP341 this example code shows how you can tweak an x-only pubkey: def taproot_tweak_pubkey(pubkey, h): t = int_from_bytes(tagged_hash("TapTweak", pubkey + h)) if t >= ...
  • 779
2 votes
2 answers
162 views

How do you calculate a taproot sighash?

I'm having trouble manually recreating the taproot sighash from the example below. I used btcdeb to pass in an input transaction (with a P2TR output), and a valid tx that spends from it. In the logs ...
  • 779
0 votes
1 answer
74 views

To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?

I have seen it discussed in various places (e.g. 1, 2) that using BIP32 key derivation impacts the design of secure key aggregation multisig and threshold schemes like MuSig(2) and FROST. What are the ...
0 votes
0 answers
19 views

What is the argument for not using proofs of possession in Bitcoin multisig and threshold key aggregation schemes?

A number of multisig and threshold sig key aggregation schemes developed outside of the Bitcoin ecosystem (e.g. SpeedyMuSig, FROST) use proofs of possession yet those developed in the Bitcoin ...
2 votes
0 answers
92 views

How does OP_CHECKSIG work for Taproot script path spending?

I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is ...
  • 462
0 votes
1 answer
34 views

Why does only one of the two nonce points in MuSig2 have the exponent b?

In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b). Why does only one of the nonce points have the ...
0 votes
1 answer
69 views

In MuSig2 how is multiplication of coordinates defined?

In the MuSig2 paper each signer multiplies all the nonces together (in the naive version): R_1 * R_2 * R_3 * .... R_n where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
0 votes
2 answers
139 views

How does SpeedyMuSig compare to MuSig2?

This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
0 votes
1 answer
230 views

How do MuSig2 and FROST compare for multisig key aggregation schemes?

Although FROST is primarily for threshold (k-of-n, k<n) key aggregation schemes (and MuSig2 doesn't support threshold) FROST can support multisig (n-of-n) key aggregation. So what are the upsides ...
2 votes
2 answers
151 views

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
4 votes
1 answer
235 views

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

BIP342 defines OP_CHECKSIGADD as a replacement for OP_CHECKMULTISIG. In the footnote it's mentioned that OP_CHECKMULTISIG is not compatible with batch verification, but I can't understand why and I ...
1 vote
0 answers
79 views

Example of Schnorr signature on a block explorer?

Can somebody link to a Schnorr signed transaction on Mainnet or Testnet? Looking to see how the SCRIPTSIG differs.
  • 11
1 vote
1 answer
78 views

Standard library for schnorr signature algorithm

I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
1 vote
1 answer
50 views

What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks, if we say signature=F(r,s,e)...
2 votes
0 answers
117 views

"Non-mandatory-script-verify-flag (Invalid Schnorr Signature)" on testnet

I'm using the FROST algorithm to create a threshold signature for some taproot output (using this code). When I tried using it on the testnet, it works most of the time but from time to time I would ...
  • 75
3 votes
1 answer
331 views

Support for taproot multisig descriptors

I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr ...
  • 143
4 votes
2 answers
172 views

Is it possible to use a P2PKH output with a schnorr signature?

I know that Bitcoin has many different transaction output types (P2SH, P2WPKH, P2WSH, P2TR, etc). And I know that P2PKH is an old transaction output type that has existed since before Segwit and ...
  • 213
4 votes
2 answers
504 views

What is an adaptor signature?

What is an adaptor signature in Bitcoin? A simple definition with some examples that could be understood without knowing cryptography in detail
user avatar
6 votes
1 answer
310 views

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

The way I've understood Schnorr signatures is that multiple parties can combine their signatures into a one shared signature, thus obfuscating the number of participants involved in the signature ...
  • 173
2 votes
1 answer
115 views

Where can I get some MuSig2 test vectors?

I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
  • 7,699
3 votes
1 answer
517 views

2-of-3 multisig with Schnorr signatures

From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone. Or is it? Suppose we need a 2-of-3 scheme. As far as I ...
3 votes
1 answer
106 views

In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?

BIP340 describes the Schnorr signature scheme that will be implemented with Taproot. The signature scheme involves computing an integer, e, during both signing and verification. Under Default Signing, ...
3 votes
0 answers
84 views

Schnorr signature key storage

So everyone talks about Schnorr signatures and Taproot when talking about Bitcoin. I would like to know if there is any standard that they will use to store the keys used in this algorithm. And also I ...
3 votes
1 answer
385 views

Why is the tag repeated twice in a tagged hash?

I noticed that the hash message for the tagged hash in BIP340 is prefixed with SHA256(tag) || SHA256(tag), which also describes the reason Because this is a 64-byte long context-specific constant and ...
  • 127
5 votes
1 answer
240 views

Are there risks to using the same private key for both ECDSA and Schnorr signatures?

I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms? In this ...
  • 4,892
3 votes
1 answer
339 views

Why Schnorr was added to secp256k1 library instead of a separate library?

Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library? ...
2 votes
0 answers
65 views

Why is adding s values in half aggregation insecure?

Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason) They presented a secure solution which ...
3 votes
1 answer
178 views

Why is full blockwide signature aggregation of schnorr signatures non-interactive?

I can only think of the MuSig paper describing how Rouge attacks are prevented by also committing to the public key of all signers. But as far as I understand the case of multisig is not the same as ...
4 votes
2 answers
264 views

Why does blockwide signature aggregation prevent adaptor signatures?

In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs). I am confused about ...
2 votes
2 answers
129 views

Retweaking other person's or my own taproot address

Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key. This will yield a potentially different public key. ...
5 votes
1 answer
211 views

Are the witnesses segregated with Schnorr signatures?

SegWit fixed transaction malleability by just moving the signature out of the block of data that's being hashed to form the transaction id. However, Schnorr does not suffer from signature malleability ...
7 votes
1 answer
266 views

Possible number of signers with MuSig

With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?). As far as I understand, there should be no hard-coded ...
0 votes
1 answer
78 views

Is ECDSA signing supported from within a Taproot tree or must all signing be Schnorr?

Let's say a server is set up to do ECDSA signing and you want to include the requirement to provide a ECDSA signature within your Taproot tree (script path). Is this supported?
1 vote
1 answer
343 views

Taproot, potential quantum bug, and general clarification

Here seeking information. I have 2 questions marked with parens Would like some clarification pertaining to the Mark Friedenbach article: Why I'm Against Taproot The point of contention with Mark ...
6 votes
1 answer
484 views

What is the difference between key aggregation and signature aggregation?

What is the difference between key aggregation (e.g. MuSig) and signature aggregation? Many people (including myself) have in the past used these terms interchangeably. Why is it important to be ...
0 votes
1 answer
37 views

1 of n Multisig Scriptless Scripts?

I know MuSig makes n of n multisig scriptless. However, can we also aggregate multiple internal public keys in one public key, and unlock funds using either one of the internal public keys?
  • 362
2 votes
1 answer
160 views

Why is Public Key aggregation in MuSig described as a product of the public keys?

In the the MuSig2 paper, it is described that: Each signer randomly generates and communicates to others a nonce Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where ̃X=∏ni=1Xiis the ...
2 votes
1 answer
83 views

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function (PRF)? If the nonce space is big enough it would never be reused. This question was asked by emzy on ...
4 votes
1 answer
971 views

What makes cross input signature aggregation complicated to implement?

What makes cross input signature aggregation complicated to implement? Other than for design space reasons why didn't it make it into BIP-Taproot? (Key aggregation within one input can be achieved ...
0 votes
1 answer
83 views

How do I tweak the bip340_test_vectors to check that signature verification fails for other test vectors?

I now understand why some of the bip340_test_vectors fail signature verification. I would like to tweak these test vectors to check that signature verification fails for other test vectors. How do I ...
1 vote
1 answer
194 views

I'm digging further into the open Taproot PR. Can you explain the bip340_test_vectors?

I'm digging further into the open Taproot PR. I found these bip340_test_vectors. They have secret keys, public keys, aux_rand (auxiliary randomness), message, signature and whether the signature ...
2 votes
1 answer
119 views

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)? Who will the first adopters of ...
0 votes
1 answer
69 views

Two threats to Bitcoin: Quantum Computing and Mining farm seizures - what new BIPs are needed before it is too late? [closed]

How resistant is bitcoin blockchain against physical attacks? Contrary to other consensus mechanisms, Bitcoin's PoW model is dependent on massive Mining Farms with tons of ASIIC hardware. These farms ...