Questions tagged [schnorr-signatures]
The schnorr-signatures tag has no usage guidance.
104
questions
0
votes
1
answer
87
views
How do I tweak the bip340_test_vectors to check that signature verification fails for other test vectors?
I now understand why some of the bip340_test_vectors fail signature verification.
I would like to tweak these test vectors to check that signature verification fails for other test vectors. How do I ...
- 13.8k
1
vote
1
answer
199
views
I'm digging further into the open Taproot PR. Can you explain the bip340_test_vectors?
I'm digging further into the open Taproot PR. I found these bip340_test_vectors.
They have secret keys, public keys, aux_rand (auxiliary randomness), message, signature and whether the signature ...
- 13.8k
2
votes
1
answer
119
views
Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?
Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)?
Who will the first adopters of ...
- 13.8k
0
votes
1
answer
69
views
Two threats to Bitcoin: Quantum Computing and Mining farm seizures - what new BIPs are needed before it is too late? [closed]
How resistant is bitcoin blockchain against physical attacks? Contrary to other consensus mechanisms, Bitcoin's PoW model is dependent on massive Mining Farms with tons of ASIIC hardware. These farms ...
3
votes
1
answer
165
views
Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?
Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
- 13.8k
5
votes
2
answers
259
views
What are "leaf versions" in Taproot?
What are "leaf versions", when do you upgrade a version, how many versions are there and how do they differ from segwit versions?
- 671
0
votes
1
answer
42
views
Is there already reached consensus on network upgrades like Taproot, Submarine Swaps?
I have read about some very interesting new protocol amendments. I am not asking for their explanations, but would be great if anyone explained their current status, if they are still considered to ...
- 827
0
votes
1
answer
83
views
Schnorr without R in the challenge
I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the ...
4
votes
3
answers
1k
views
What are some interesting applications of Taproot "smart contracts"?
From a strictly technical perspective, MAST makes a lot of sense. However, understanding it in the context of Taproot/Tapscript does require prior knowledge in Merkle Trees and hash functions.
What ...
- 43
4
votes
1
answer
559
views
k selection for Schnorr signatures
So i was reading the BIP for Schnorr signatures and I couldn't find any explanation on why the simple RFC6979 Variant wasn't chosen for their nonce generation. Instead, they decided to go with their ...
- 61
3
votes
1
answer
103
views
Is Z-man's PTLC construction implementable using libsecp256k1-zkp?
In a mailing list post Z-man details a PTLC construction which he claims is "is almost entirely a MuSig ritual". My question is whether this MusigTweak is what is called the adaptor (last argument of ...
- 899
3
votes
3
answers
894
views
Could Taproot create larger security risks or even hinder future protocol adjustments re Quantum threats?
I am quoting here a user named "blk014" who responded to Pieter's Taproot tweets from 24JAN. I find this user's comments very interesting and would like to ask a developer expert how much of a ...
- 827
2
votes
1
answer
99
views
Will g'root be included in the Taproot soft-fork?
G'root, which I understands as generalised Taproot, was announced a year and a half ago. I'm wondering what the development is on it and if it is part of the taproot softfork.
- 671
14
votes
1
answer
683
views
Musig Signature Interactivity
2 Questions:
Why is Musig signing always interactive?
Let's say I have a Musig wallet where keys are stored in secure locations with no internet access. What are some methods to sign from these ...
- 567
3
votes
1
answer
290
views
Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?
A P2WPKH PubKey is shorter than a P2WSH PubKey. Would this also be the case that a Taproot PubKey is larger than a Schnorr PubKey?
If so, wouldn't people be incentivised to use the Schnorr PubKey and ...
- 671
2
votes
1
answer
203
views
how difficult is it to generating an ECDSA (or Schnorr) signature with a certain number of leading zeros?
If both the public key and the private key are known ahead of time (public knowledge), and the goal is to choose a message/nonce that generates a signature with, for example, a certain number of ...
- 404
8
votes
1
answer
725
views
Will Schnorr Multi-signatures completely replace ECDSA?
I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP.
Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
- 2,740
2
votes
1
answer
163
views
bip-schnorr and HD Key Derivation
Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key.
It is important to not mix up the 32-byte bip-schnorr public ...
- 21
4
votes
2
answers
298
views
Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?
There is currently a discussion on the mailing list about truncating the 33rd byte from public keys when used in bip-schnorr.
Public keys are (x, y) coordinates and compressed public keys simply ...
- 4,912
2
votes
1
answer
221
views
Why do aggregate Schnorr signatures reverse the hash and the random number
A bitcoin signature has:
z = hash(m)
Using a private key pk we can generate a signature for message m
consisting of two numbers: r (x coordinate of the random point R =
k×G) and s = (z+r⋅pk)/k. Then, ...
2
votes
1
answer
56
views
Is it cryptographically possible to have aggregate signature schemes that can improve privacy in UTXO consolidation?
My understanding of Schnorr signatures, Taproot and Graftroot and how they improve privacy in smart contracts / multi-sig is by allowing users to aggregate signatures so the individual signatures and ...
0
votes
1
answer
226
views
What are the limitations for amortizing the interactive session setup of MuSig?
I'm trying to find a way to amortize the interactive session setup in the MuSig signature aggregation scheme. My motivation is to use signature aggregation between devices communicating using low ...
3
votes
1
answer
314
views
Is the BCH version of Schnorr signatures compatible with taproot?
BCH is going to introduce support for Schnorr signatures on May 15th. One of the most anticipated features for Schnorr signatures on Bitcoin is the introduction of taproot constructions. Will it be ...
- 69.8k
2
votes
0
answers
106
views
Schnorr Fiat Shamir Transformation
In the Schnorr identity protocol, we can transform the interactive ZKP into a non-interactive one by replacing the role of the verifier (i.e. providing a random challenge value) with a hash function ...
- 131
3
votes
1
answer
111
views
What is the current Status of major proposed BTC upgrades like Taproot, MAST, Submarine Swaps?
I have read during the last year about some very interesting BIPs or initiatives. I am not asking for their explanations, just would be great if anyone would know about their simple status as of now, ...
- 827
11
votes
2
answers
1k
views
How could Schnorr signatures be aggregated across the whole transaction?
I am studying the MuSig protocol and am having trouble grasping certain segments. This is my understanding thus far:
In current Bitcoin CHECKMULTISIG format, the size of the signature grows linearly ...
- 131
0
votes
2
answers
454
views
The order of the generator point G used in bitcoin
Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated.
From the specification listed http://www.secg.org/SEC2-Ver-1.0.pdf for secp256k1 I can see ...
- 125
11
votes
1
answer
751
views
When Schnorr signatures are part of Bitcoin will it be possible validate each block with only one signature validation?
In a recent talk Pieter Wuille talked about speed up verification when using Schnorr signatures and various algorithms for verifying multiple signatures.
Would it really be possible to verify one ...
- 11.6k
4
votes
1
answer
117
views
Why is the Schnorr verification formula working and actually verifying the validity of a signature?
Reading the bottom of page 2 of the Musig Paper we can find that a Schnorr Signature for a cyclic Group G of prime order p with generator g is a tuple (R,s) where
R = gr for a random secret r and
s=r+...
- 11.6k
0
votes
1
answer
63
views
Does a blockchain become opaque if it enable's schnorr-signatures, and require trust in the code?
When you sign a transaction with schnorr-signatures, it does not include the pubkey in the transaction data.
1)Does this mean the input addresses become unknown, aka creating a opaque blockchain ? ...
4
votes
1
answer
165
views
Are sipa's standardized schnorr signatures incompatible with blind signatures?
Here, sipa proposes a standardization of schnorr signatures: https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki
For example, sign() returns Sig{R,s} which can be encoded with 64 ...
- 43
3
votes
1
answer
68
views
Would signature aggregation reduce the largest feasible blocksize
If a Schnorr signature aggregation scheme were to be integrated into Bitcoin. Would the reduction in witness data versus non witness data (need less bytes for a signature therefore witness data usage ...
- 671
9
votes
2
answers
667
views
How are scriptless scripts and taproot different?
I recently read Aaron van Wirdum's layman explanation of both scriptless scripts and taproot. I gather that both utilize the aggregation of Schnorr signatures to hide complex scripts (smart contracts) ...
- 193
14
votes
1
answer
764
views
Will a Schnorr soft-fork introduce a new address format (i.e. not bech32)
When we (hopefully) soft-fork to Schnorr signatures will the address be indistinguishable from bech32 addresses?
- 671
1
vote
1
answer
174
views
Can R/r in Musig be derived from only seeds and message hashes?
I am wondering if the first two roundtrips of pre-committing and then revealing R/r in MuSig signing can be moved to the keygen phase and made deterministic. That reduces the amount of messages that ...
- 899
7
votes
1
answer
395
views
Schnorr batch validation speed statistics
In this question What are the advantages of Schnorr vs ECDSA? I see in the Pieter Wuille's answer the following comment about Schnorr signature batch validation: "Improving verification speed, by ...
- 71
14
votes
1
answer
707
views
Schnorr's batch validation
In the recent BIP about Schnorr's standardization, Pieter Wuille presents an algorithm for batch validation. In my understanding the most heavy operation is the multiplication by a scalar: to make ...
- 143
1
vote
0
answers
73
views
What would UTXO consolidation look like in the public ledger with Schnorr signatures?
I am excited about the privacy and optimisations involved with moving from ECDSA to Schnorr signatures. One of the privacy improvements, as I understand it, is that you can aggregate signatures so ...
3
votes
1
answer
405
views
A couple of questions on Schnorr sig
In the BIP by Pieter Wuille it is told that the key prefixed version of Schnorr signature is needed when the scheme is used in combination with BIP32's unhardened derivation. Could someone provide an ...
- 133
1
vote
1
answer
169
views
Could Taproot or Graftroot enable the execution of complex scripts?
From my understanding, Taproot uses a Merkle Tree structure whose root represents the outcome of a script. That representation is in the form of a signature that may unlock the inputs associated with ...
15
votes
1
answer
5k
views
What are the advantages of Schnorr vs ECDSA?
I understand that Schnorr signatures provide an improvement on ECDSA in that they are a fixed 64 bytes instead of the longer ECDSA sig format, however, I don't see how this is an advantage over ECDSA ...
- 253
2
votes
2
answers
449
views
How is the construction of atomic swaps improved by Schnorr?
How does the availability of Schnorr signatures improve the ability to perform cross-chain atomic swaps?
- 69.8k
1
vote
0
answers
41
views
Can you use Schnorr to sign inputs individually?
Can personA build a transaction and sign his inputs, then personB signs his and that be added into one transaction using Schnorr. Or are SIGHASHes still needed?
- 662
6
votes
1
answer
924
views
Why was ECDSA chosen over Schnorr Signatures in the inital design?
Schnorr Signatures and Signature aggregation is in the bitcoin technology roadmap. Schnorr Signatures was around the same time ECDSA is around.
Why wasnt Schnorr Signature Scheme implemented at the ...
- 259
1
vote
0
answers
64
views
How do I explain Schnorr signatures and signature aggregation to 7 year old cousin?
How do I explain Schnorr signatures and signature aggregation to my 7 year old cousin?
Nathan Aw
- 259
3
votes
1
answer
105
views
How do Schnorr signatures impact coin selection and the utxo growth?
Will Schnorr signature incentivise different practices in coin selection? How do they impact the utxo set in the long run?
- 69
1
vote
0
answers
76
views
aggregated signatures for combining payments over a low bandwidth mesh network
Background
I'm researching how in a low bandwidth mesh network payment transactions from nodes can be combined to reduce the bandwidth used for payments. Aggregated signatures seem like a useful ...
8
votes
1
answer
1k
views
Replacing ECDSA (SECP256k1) with Schnorr signatures
On March 23, 2017 the Bitcoin Core team published a technology roadmap, expressing their intent to replace ECDSA (SECP256k1) with Schnorr signatures: https://bitcoincore.org/en/2017/03/23/schnorr-...
- 295
9
votes
2
answers
3k
views
Are Schnorr signatures quantum-computer resistant?
Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?
- 10k
8
votes
1
answer
1k
views
Why was the Schnorr code removed from Bitcoin Core?
I was looking for the Schnorr implementation in Bitcoin Core and was surprised to see that it was removed on Nov 2016 (commit e06e878fd7dcc99825025fa99aedb86bc7d5c29f). Why was the source code ...
- 221