Questions tagged [schnorr-signatures]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
50 votes
5 answers

How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
Mine's user avatar
  • 1,416
15 votes
1 answer

What are the advantages of Schnorr vs ECDSA?

I understand that Schnorr signatures provide an improvement on ECDSA in that they are a fixed 64 bytes instead of the longer ECDSA sig format, however, I don't see how this is an advantage over ECDSA ...
Lev Knoblock's user avatar
9 votes
2 answers

Are Schnorr signatures quantum-computer resistant?

Here ( it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?
MCCCS's user avatar
  • 10.1k
6 votes
2 answers

Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?

There is currently a discussion on the mailing list about truncating the 33rd byte from public keys when used in bip-schnorr. Public keys are (x, y) coordinates and compressed public keys simply ...
pinhead's user avatar
  • 4,992
5 votes
3 answers

What are some interesting applications of Taproot "smart contracts"?

From a strictly technical perspective, MAST makes a lot of sense. However, understanding it in the context of Taproot/Tapscript does require prior knowledge in Merkle Trees and hash functions. What ...
metahash's user avatar
26 votes
3 answers

What are the implications of Schnorr signatures?

Adam Back (adam3us) explained in March, 2014, but it is all math. There's another short post with advantages, though. This answer on crypto.SE claims that Bitcoin considered using Ed25519 which is ...
Janus Troelsen's user avatar
14 votes
1 answer

Schnorr's batch validation

In the recent BIP about Schnorr's standardization, Pieter Wuille presents an algorithm for batch validation. In my understanding the most heavy operation is the multiplication by a scalar: to make ...
Jon's user avatar
  • 143
11 votes
1 answer

When Schnorr signatures are part of Bitcoin will it be possible validate each block with only one signature validation?

In a recent talk Pieter Wuille talked about speed up verification when using Schnorr signatures and various algorithms for verifying multiple signatures. Would it really be possible to verify one ...
Rene Pickhardt's user avatar
8 votes
1 answer

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
Saxtheowl's user avatar
  • 2,770
5 votes
1 answer

What makes cross input signature aggregation complicated to implement?

What makes cross input signature aggregation complicated to implement? Other than for design space reasons why didn't it make it into BIP-Taproot? (Key aggregation within one input can be achieved ...
Michael Folkson's user avatar
3 votes
1 answer

Why is the tag repeated twice in a tagged hash?

I noticed that the hash message for the tagged hash in BIP340 is prefixed with SHA256(tag) || SHA256(tag), which also describes the reason Because this is a 64-byte long context-specific constant and ...
sphpmp's user avatar
  • 127
3 votes
1 answer

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
Michael Folkson's user avatar
2 votes
2 answers

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
miketery's user avatar
1 vote
1 answer

I'm digging further into the open Taproot PR. Can you explain the BIP340 test vectors?

I'm digging further into the open Taproot PR. I found these BIP340 test vectors. They have secret keys, public keys, aux_rand (auxiliary randomness), message, signature and whether the signature ...
Michael Folkson's user avatar
0 votes
0 answers

How does tweaking work for x-only keys, and what is not good in the example I gave?

How does normal key tweaking work in case of Schnorr digital signature schemes? For all examples I am using online tool for point multiplication and point addition. (I suggest you to use them if it is ...
LeaBit's user avatar
  • 522
0 votes
1 answer

In MuSig2 how is multiplication of coordinates defined?

In the MuSig2 paper each signer multiplies all the nonces together (in the naive version): R_1 * R_2 * R_3 * .... R_n where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
Michael Folkson's user avatar