36

Warning: I've never actually worked with the Schnorr signature scheme. The following is my analysis based on reading the Wikipedia article, the ed25519 page, and some discussions between devs in #bitcoin-dev. Likely Changes Changed op code behavior: we will need an op code to check Schnorr signatures. With a hard fork, we can redefine op_checksig and ...


9

Yes you can do public key recovery with EC Schnorr. Consider R = kG, [r = R.x, s = k + H(r, m)d], Q = dG verify: sG = ?R + H(r, m)Q recovery: sG = kG + H(r, m) dG = R + H(r, m)Q so Q = 1 / H(r, m) * (sG - R). (And to compute R from r if R is point-compressed, R = (r,f(r)) R' = (r,-f(r)) and try both R and R' by checking if the signature is valid with ...


3

The primary design goal for DSA was to avoid infringing the Schnorr patent. Now that the patent has expired, there aren't really any good mathematical reasons to go with DSA. With Schnorr, the algorithm and analysis are simpler and often more efficient. It's also easier to split Schnorr private keys, create threshold variants, etc. However, DSA and ECDSA ...


Only top voted, non community-wiki answers of a minimum length are eligible