Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

P2tr transaction with musig2 rust

I'm trying to build a p2tr that spends a 2-2 musig aggregated address. My process is as follow: Create SecretKey, PublicKey pair from each party Aggregate those 2 public keys Create and publish a ...
Trí Lương's user avatar
0 votes
0 answers
35 views

Got non-mandatory-script-verify-flag (Invalid Schnorr signature) error message when spend a taproot transation

I'm trying to spend an Taproot address via a key spend path with musig2 lib in Rust. This address is aggregated with 2 owners. But I still got this message when I broadcast the hex transaction to ...
Trí Lương's user avatar
2 votes
0 answers
75 views

What is the byte-wise xor operation mentioned in bip 340?

Let t be the byte-wise xor of bytes(d) and hash_BIP0340/aux(a) Link: bip-0340 Actually, I think it means bitwise xor, not bytewise xor, but for the sake of clarity, I ask: What is the difference ...
Gildong.Hong's user avatar
4 votes
1 answer
378 views

Why does BIP-340 use secp256k1?

If the entire Taproot/Schnorr soft-fork was going to implement an entirely new signing scheme anyway that was completely independent from the previous ECDSA scheme, why did it use secp256k1? Couldn't ...
fiatjaf's user avatar
  • 611
1 vote
1 answer
47 views

BTC multisig wallet with rekeying

I'm trying to create a Bitcoin multisig wallet. At this point, the wallet must meet the following conditions must be capable of k-of-n threshold signatures (schnorr, musig, etc.) it should be ...
dohyeon.eth's user avatar
2 votes
1 answer
177 views

Why is the challenge scalar multiplied with the private key scalar In the Schnorr identification protocol?

If Alice wants to prove to Bob she is the holder of private key x, without exposing x, they can use the Schnorr identification protocol which has the public function sG = kG + exG and the private ...
yonson's user avatar
  • 43
0 votes
1 answer
55 views

Is atomic swap flawed?

I'm reading this paper on atomic swap between BTC and XMR: https://arxiv.org/pdf/2101.12332.pdf and wonder if atomic swap with BTC is flawed by design. My understanding is that, if Alice locks up XMR ...
John M.'s user avatar
  • 121
2 votes
1 answer
147 views

non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output

I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this "Invalid Schnorr signature" error from my RPC node: { "...
Sherwin Li's user avatar
0 votes
0 answers
121 views

How does tweaking work for x-only keys, and what is not good in the example I gave?

How does normal key tweaking work in case of Schnorr digital signature schemes? For all examples I am using online tool for point multiplication and point addition. (I suggest you to use them if it is ...
LeaBit's user avatar
  • 950
0 votes
2 answers
282 views

How to get x-only public key from the private key, and what does the obtained value represent?

In ECDSA, the public key is the result of multiplying the private key (some random 256-bit value) with a generic point (G). So the public key would be one of the points (X,Y) of the elliptic curve ...
LeaBit's user avatar
  • 950
4 votes
1 answer
373 views

Is the Schnorr digital signature scheme a multisignature interactive scheme, and also not an aggregated non-interactive scheme?

In his answer Pieter Wuille defined a concepts of multisignature scheme and aggregated signature scheme as follows: A multisignature scheme is a scheme where multiple parties jointly produce a ...
LeaBit's user avatar
  • 950
0 votes
1 answer
108 views

What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?

Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms: (key generation, signing, verification) Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
LeaBit's user avatar
  • 950
0 votes
2 answers
140 views

Example of key-path BIP-0341 signature message computation

Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please? deriveaddresses "rawtr(...
Greg Tonoski's user avatar
0 votes
1 answer
62 views

Do we pay cheaper fees for less security in P2TR rather than P2PKH?

Answer quote: P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds. If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
Mercedes's user avatar
  • 804
3 votes
0 answers
34 views

Should an even Y coordinate be enforced after every key-tweak operation, or only at the end?

This is a very niche question regarding BIP340 and key tweaking with even-only public keys. I feel my question may be a matter of opinion, since there doesn't appear to be an accepted right / wrong ...
cmdruid's user avatar
  • 31
1 vote
1 answer
95 views

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
AncientTides's user avatar
8 votes
1 answer
153 views

Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?

BIP340 recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows: Using unpredictable randomness additionally increases protection against other side-channel ...
Matthew Leon's user avatar
6 votes
0 answers
158 views

Which wallets are spending P2TR with SIGHASH_ALL?

I noticed there are quite a lot of transactions spending taproot key path inputs that use SIGHASH_ALL instead of SIGHASH_DEFAULT in signatures (around 20% in the last two weeks). Recall that ...
Vojtěch Strnad's user avatar
3 votes
1 answer
377 views

taproot script spending issue

I have been working in a bitcoin library for educational purposes (being taught in courses/meetups/etc.). I had quite some time to work on it and decided it was about time to support taproot. I have ...
karask's user avatar
  • 2,540
2 votes
1 answer
212 views

Taproot Script Path Spending can't pass signature verification

I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help? The raw transaction: ...
lj zn's user avatar
  • 31
3 votes
1 answer
145 views

Questions wrt taproot's message digest signing

BIP-341 describes how to construct the message to be signed for taproot (subsection Common signature message). It mostly makes sense but I have a couple of quick questions: Is the ext_flag 0 when ...
karask's user avatar
  • 2,540
3 votes
1 answer
62 views

Are there CoinSwap-like protocols that don't need access to raw private keys?

Say you would like to atomically swap Bitcoins with a counterparty, without an obvious on-chain link such as a hash pre-image used in an HTLC-like Bitcoin Script. The constructions I am aware of ...
Dominik Spicher's user avatar
2 votes
1 answer
72 views

How can I store a file hash in a Schnorr signature? Or something other than an OP_RETURN?

I have this python script that puts file hashes on the bitcoin blockchain: from bitcoinutils.utils import to_satoshis from bitcoinutils.setup import setup from bitcoinutils.transactions import ...
ChristianOConnor's user avatar
2 votes
1 answer
105 views

Is it safe to reveal the private key that generates the R nonce in schnorr sigs?

I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce. Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th". I want to ...
Kaizen's user avatar
  • 331
0 votes
1 answer
52 views

Looking for resources on doing Schnorr signatures in Bitcoin transactions

Please leave any resources you think will help, thank you.
Poseidon's user avatar
  • 643
1 vote
0 answers
150 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
Son Kaos999's user avatar
6 votes
1 answer
715 views

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? Is it faster to verify, say 100 (non-interactively) aggregated BLS ...
Son Kaos999's user avatar
0 votes
2 answers
266 views

Is Taproot the best address against quantum computers attack?

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit. Another question I have about Taproot, is that if ...
Dodi Alf's user avatar
2 votes
1 answer
85 views

Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?

Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
user77340's user avatar
  • 131
4 votes
1 answer
189 views

How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
Kaizen's user avatar
  • 331
1 vote
1 answer
246 views

What would happen if you tweaked a public key with an odd y-coordinate?

From BIP341 this example code shows how you can tweak an x-only pubkey: def taproot_tweak_pubkey(pubkey, h): t = int_from_bytes(tagged_hash("TapTweak", pubkey + h)) if t >= ...
Darius's user avatar
  • 789
2 votes
2 answers
478 views

How do you calculate a taproot sighash?

I'm having trouble manually recreating the taproot sighash from the example below. I used btcdeb to pass in an input transaction (with a P2TR output), and a valid tx that spends from it. In the logs ...
Darius's user avatar
  • 789
0 votes
1 answer
161 views

To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?

I have seen it discussed in various places (e.g. 1, 2) that using BIP32 key derivation impacts the design of secure key aggregation multisig and threshold schemes like MuSig(2) and FROST. What are the ...
Michael Folkson's user avatar
1 vote
0 answers
30 views

What is the argument for not using proofs of possession in Bitcoin multisig and threshold key aggregation schemes?

A number of multisig and threshold sig key aggregation schemes developed outside of the Bitcoin ecosystem (e.g. SpeedyMuSig, FROST) use proofs of possession yet those developed in the Bitcoin ...
Michael Folkson's user avatar
2 votes
0 answers
255 views

How does OP_CHECKSIG work for Taproot script path spending?

I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is ...
Zephyrus's user avatar
  • 782
0 votes
1 answer
78 views

Why does only one of the two nonce points in MuSig2 have the exponent b?

In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b). Why does only one of the nonce points have the ...
Michael Folkson's user avatar
0 votes
1 answer
94 views

In MuSig2 how is multiplication of coordinates defined?

In the MuSig2 paper each signer multiplies all the nonces together (in the naive version): R_1 * R_2 * R_3 * .... R_n where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
Michael Folkson's user avatar
0 votes
2 answers
182 views

How does SpeedyMuSig compare to MuSig2?

This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
Michael Folkson's user avatar
1 vote
1 answer
814 views

How do MuSig2 and FROST compare for multisig key aggregation schemes?

Although FROST is primarily for threshold (k-of-n, k<n) key aggregation schemes (and MuSig2 doesn't support threshold) FROST can support multisig (n-of-n) key aggregation. So what are the upsides ...
Michael Folkson's user avatar
2 votes
2 answers
242 views

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
miketery's user avatar
4 votes
1 answer
267 views

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

BIP342 defines OP_CHECKSIGADD as a replacement for OP_CHECKMULTISIG. In the footnote it's mentioned that OP_CHECKMULTISIG is not compatible with batch verification, but I can't understand why and I ...
David A. Harding's user avatar
1 vote
0 answers
155 views

Example of Schnorr signature on a block explorer?

Can somebody link to a Schnorr signed transaction on Mainnet or Testnet? Looking to see how the SCRIPTSIG differs.
Hemphta's user avatar
  • 11
1 vote
1 answer
242 views

Standard library for schnorr signature algorithm

I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
rafael__bg's user avatar
1 vote
1 answer
63 views

What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks, if we say signature=F(r,s,e)...
Prasanth Vuppala's user avatar
2 votes
0 answers
302 views

"Non-mandatory-script-verify-flag (Invalid Schnorr Signature)" on testnet

I'm using the FROST algorithm to create a threshold signature for some taproot output (using this code). When I tried using it on the testnet, it works most of the time but from time to time I would ...
sa8's user avatar
  • 75
4 votes
1 answer
680 views

Support for taproot multisig descriptors

I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr ...
Alex's user avatar
  • 163
4 votes
2 answers
242 views

Is it possible to use a P2PKH output with a schnorr signature?

I know that Bitcoin has many different transaction output types (P2SH, P2WPKH, P2WSH, P2TR, etc). And I know that P2PKH is an old transaction output type that has existed since before Segwit and ...
yzernik's user avatar
  • 223
5 votes
2 answers
970 views

What is an adaptor signature?

What is an adaptor signature in Bitcoin? A simple definition with some examples that could be understood without knowing cryptography in detail
user avatar
6 votes
1 answer
428 views

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

The way I've understood Schnorr signatures is that multiple parties can combine their signatures into a one shared signature, thus obfuscating the number of participants involved in the signature ...
max's user avatar
  • 255
2 votes
1 answer
136 views

Where can I get some MuSig2 test vectors?

I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
Jimmy Song's user avatar
  • 7,759