Questions tagged [schnorr-signatures]
The schnorr-signatures tag has no usage guidance.
116
questions
2
votes
1
answer
41
views
non-mandatory-script-verify-flag (Invalid Schnorr signature) when trying to reveal a TR output
I'm building a Bitcoin wallet, and I'm trying to spend a Taproot output via a script spend path, but I keep running into this "Invalid Schnorr signature" error from my RPC node:
{
"...
0
votes
0
answers
80
views
How does tweaking work for x-only keys, and what is not good in the example I gave?
How does normal key tweaking work in case of Schnorr digital signature schemes?
For all examples I am using online tool for point multiplication and point addition. (I suggest you to use them if it is ...
- 478
0
votes
2
answers
99
views
How to get x-only public key from the private key, and what does the obtained value represent?
In ECDSA, the public key is the result of multiplying the private key (some random 256-bit value) with a generic point (G). So the public key would be one of the points (X,Y) of the elliptic curve ...
- 478
4
votes
1
answer
240
views
Is the Schnorr digital signature scheme a multisignature interactive scheme, and also not an aggregated non-interactive scheme?
In his answer Pieter Wuille defined a concepts of multisignature scheme and aggregated signature scheme as follows:
A multisignature scheme is a scheme where multiple parties jointly produce a ...
- 478
0
votes
1
answer
98
views
What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?
Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms:
(key generation, signing, verification)
Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
- 478
0
votes
2
answers
104
views
Example of key-path BIP-0341 signature message computation
Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please?
deriveaddresses "rawtr(...
- 317
0
votes
1
answer
44
views
Do we pay cheaper fees for less security in P2TR rather than P2PKH?
Answer quote:
P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds.
If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
- 797
3
votes
0
answers
26
views
Should an even Y coordinate be enforced after every key-tweak operation, or only at the end?
This is a very niche question regarding BIP340 and key tweaking with even-only public keys.
I feel my question may be a matter of opinion, since there doesn't appear to be an accepted right / wrong ...
- 31
1
vote
1
answer
59
views
What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p
Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
- 97
8
votes
1
answer
125
views
Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?
BIP340 recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows:
Using unpredictable randomness additionally increases protection against other side-channel ...
- 81
5
votes
0
answers
76
views
Which wallets are spending P2TR with SIGHASH_ALL?
I noticed there are quite a lot of transactions spending taproot key path inputs that use SIGHASH_ALL instead of SIGHASH_DEFAULT in signatures (around 20% in the last two weeks). Recall that ...
- 6,668
3
votes
1
answer
130
views
taproot script spending issue
I have been working in a bitcoin library for educational purposes (being taught in courses/meetups/etc.). I had quite some time to work on it and decided it was about time to support taproot.
I have ...
- 2,520
2
votes
1
answer
112
views
Taproot Script Path Spending can't pass signature verification
I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?
The raw transaction:
...
- 31
3
votes
1
answer
94
views
Questions wrt taproot's message digest signing
BIP-341 describes how to construct the message to be signed for taproot (subsection Common signature message). It mostly makes sense but I have a couple of quick questions:
Is the ext_flag 0 when ...
- 2,520
3
votes
1
answer
59
views
Are there CoinSwap-like protocols that don't need access to raw private keys?
Say you would like to atomically swap Bitcoins with a counterparty, without an obvious on-chain link such as a hash pre-image used in an HTLC-like Bitcoin Script.
The constructions I am aware of ...
- 205
2
votes
1
answer
68
views
How can I store a file hash in a Schnorr signature? Or something other than an OP_RETURN?
I have this python script that puts file hashes on the bitcoin blockchain:
from bitcoinutils.utils import to_satoshis
from bitcoinutils.setup import setup
from bitcoinutils.transactions import ...
- 243
2
votes
1
answer
80
views
Is it safe to reveal the private key that generates the R nonce in schnorr sigs?
I'm curious about stuffing data in the auxiliary parameter of generating the schnorr nonce.
Something like "Alice agrees to pay 1 BTC to Bob within 5 days of Monday March 20th".
I want to ...
- 331
0
votes
1
answer
52
views
Looking for resources on doing Schnorr signatures in Bitcoin transactions
Please leave any resources you think will help, thank you.
- 633
1
vote
0
answers
115
views
Is Curve25519 better option than Secp256k1?
Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks?
How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
- 449
6
votes
1
answer
553
views
BLS signatures vs Schnorr
How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions?
Is it faster to verify, say 100 (non-interactively) aggregated BLS ...
- 449
0
votes
2
answers
190
views
Is Taproot the best address against quantum computers attack?
I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit.
Another question I have about Taproot, is that if ...
- 1
2
votes
1
answer
71
views
Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?
Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
- 131
4
votes
1
answer
160
views
How does the BIP340 lift_x algorithm work?
Couple questions of code that I'm reviewing trying to learn schnorr sigs.
Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
- 331
1
vote
1
answer
161
views
What would happen if you tweaked a public key with an odd y-coordinate?
From BIP341 this example code shows how you can tweak an x-only pubkey:
def taproot_tweak_pubkey(pubkey, h):
t = int_from_bytes(tagged_hash("TapTweak", pubkey + h))
if t >= ...
- 779
2
votes
2
answers
313
views
How do you calculate a taproot sighash?
I'm having trouble manually recreating the taproot sighash from the example below.
I used btcdeb to pass in an input transaction (with a P2TR output), and a valid tx that spends from it. In the logs ...
- 779
0
votes
1
answer
126
views
To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?
I have seen it discussed in various places (e.g. 1, 2) that using BIP32 key derivation impacts the design of secure key aggregation multisig and threshold schemes like MuSig(2) and FROST.
What are the ...
- 14.7k
1
vote
0
answers
27
views
What is the argument for not using proofs of possession in Bitcoin multisig and threshold key aggregation schemes?
A number of multisig and threshold sig key aggregation schemes developed outside of the Bitcoin ecosystem (e.g. SpeedyMuSig, FROST) use proofs of possession yet those developed in the Bitcoin ...
- 14.7k
2
votes
0
answers
186
views
How does OP_CHECKSIG work for Taproot script path spending?
I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is ...
- 658
0
votes
1
answer
70
views
Why does only one of the two nonce points in MuSig2 have the exponent b?
In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b).
Why does only one of the nonce points have the ...
- 14.7k
0
votes
1
answer
89
views
In MuSig2 how is multiplication of coordinates defined?
In the MuSig2 paper each signer multiplies all the nonces together (in the naive version):
R_1 * R_2 * R_3 * .... R_n
where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
- 14.7k
0
votes
2
answers
177
views
How does SpeedyMuSig compare to MuSig2?
This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
- 14.7k
1
vote
1
answer
624
views
How do MuSig2 and FROST compare for multisig key aggregation schemes?
Although FROST is primarily for threshold (k-of-n, k<n) key aggregation schemes (and MuSig2 doesn't support threshold) FROST can support multisig (n-of-n) key aggregation. So what are the upsides ...
- 14.7k
2
votes
2
answers
210
views
Can you do P2WSH / P2SH on Lightning Network (LN)?
I understand that a channel is a 2 of 2 multisig:
1 && 1
Is it possible that one side of this channel is a multisig wallet?
So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
- 82
4
votes
1
answer
254
views
Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?
BIP342 defines OP_CHECKSIGADD as a replacement for OP_CHECKMULTISIG. In the footnote it's mentioned that OP_CHECKMULTISIG is not compatible with batch verification, but I can't understand why and I ...
- 11.8k
1
vote
0
answers
134
views
Example of Schnorr signature on a block explorer?
Can somebody link to a Schnorr signed transaction on Mainnet or Testnet?
Looking to see how the SCRIPTSIG differs.
- 11
1
vote
1
answer
158
views
Standard library for schnorr signature algorithm
I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
- 11
1
vote
1
answer
56
views
What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification
We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,
if we say
signature=F(r,s,e)...
2
votes
0
answers
238
views
"Non-mandatory-script-verify-flag (Invalid Schnorr Signature)" on testnet
I'm using the FROST algorithm to create a threshold signature for some taproot output (using this code).
When I tried using it on the testnet, it works most of the time but from time to time I would ...
- 75
4
votes
1
answer
520
views
Support for taproot multisig descriptors
I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr ...
- 163
4
votes
2
answers
224
views
Is it possible to use a P2PKH output with a schnorr signature?
I know that Bitcoin has many different transaction output types (P2SH, P2WPKH, P2WSH, P2TR, etc).
And I know that P2PKH is an old transaction output type that has existed since before Segwit and ...
- 223
4
votes
2
answers
796
views
What is an adaptor signature?
What is an adaptor signature in Bitcoin? A simple definition with some examples that could be understood without knowing cryptography in detail
user103136
6
votes
1
answer
373
views
Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?
The way I've understood Schnorr signatures is that multiple parties can combine their signatures into a one shared signature, thus obfuscating the number of participants involved in the signature ...
- 173
2
votes
1
answer
131
views
Where can I get some MuSig2 test vectors?
I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
- 7,749
3
votes
1
answer
600
views
2-of-3 multisig with Schnorr signatures
From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone.
Or is it?
Suppose we need a 2-of-3 scheme. As far as I ...
- 6,668
3
votes
1
answer
123
views
In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?
BIP340 describes the Schnorr signature scheme that will be implemented with Taproot.
The signature scheme involves computing an integer, e, during both signing and verification.
Under Default Signing, ...
3
votes
0
answers
95
views
Schnorr signature key storage
So everyone talks about Schnorr signatures and Taproot when talking about Bitcoin. I would like to know if there is any standard that they will use to store the keys used in this algorithm. And also I ...
3
votes
1
answer
486
views
Why is the tag repeated twice in a tagged hash?
I noticed that the hash message for the tagged hash in BIP340 is prefixed with SHA256(tag) || SHA256(tag), which also describes the reason
Because this is a 64-byte long context-specific constant and ...
- 127
5
votes
1
answer
310
views
Are there risks to using the same private key for both ECDSA and Schnorr signatures?
I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms?
In this ...
- 4,992
3
votes
1
answer
526
views
Why Schnorr was added to secp256k1 library instead of a separate library?
Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library?
...
- 45
2
votes
0
answers
70
views
Why is adding s values in half aggregation insecure?
Jonas Nick an Tim Ruffing discussed in a presentation that summing up the s values in signature half aggregation would be insecure (without giving the reason)
They presented a secure solution which ...
- 11.8k