New answers tagged schnorr-signatures
5
To add to Michael Folkson's answer, a question one may have is what the differences are between witness versions and leaf versions. Why do we need both?
Leaf versions are not revealed until an output is spent, and thus is not known in general to the payer (who is only given an address). For native witness outputs, the witness version is visible from the the ...
5
SegWit introduced versioned witness programs. When satisfying a script to spend coins you need to provide a redeem script consisting of a version byte and a witness program. The version introduced with SegWit was version 0 (zero).
The Taproot proposal uses this SegWit versioning system by introducing spending rules for version 1. The witness program to ...
3
MAST/TAPROOT
SCHNORR
These improvements are specified in BIP340, BIP341, and BIP342. These documents are fairly mature, and there seems to be community traction for them (though, disclaimer: I may be biased as I'm a co-author), but it's inherently hard to predict when activation will happen.
Submarine Swaps
This is a Lightning feature, as far as I know. ...
1
So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message.
Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid signature for P, without knowing the corresponding private key. So this is a trivially forgeable signature scheme.
In ECDSA, the extraction of R's x coordinate, ...
Top 50 recent answers are included
