From e80c8549a15ec97d000d05dfc42ec15d3205cebf Mon Sep 17 00:00:00 2001 From: ViniciusCestarii Date: Tue, 20 Oct 2026 10:13:45 -0300 Subject: [PATCH 1/2] bip374: justify G as input with a better reasoning --- bip-0374.mediawiki | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bip-0374.mediawiki b/bip-0374.mediawiki index 7e3bdffb..03a38b4c 100644 --- a/bip-0374.mediawiki +++ b/bip-0374.mediawiki @@ -64,7 +64,7 @@ Input: * The secret key ''a'': a 256-bit unsigned integer * The public key ''B'': a point on the curve * Auxiliary random data ''r'': a 32-byte array ''' Why include auxiliary random data?''' The auxiliary random data should be set to fresh randomness for each proof. The same rationale and recommendations from [https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#default-signing BIP340] should be applied. -* The generator point ''G'': a point on the curve ''' Why include the generator point G as an input?''' While all other BIPs have used the generator point from secp256k1, passing it as an input here lets this algorithm be used for other curves. +* The generator point ''G'': a point on the curve ''' Why include the generator point G as an input?''' While all other BIPs have used the generator point from secp256k1, passing it as an input here lets this algorithm be used for other generators on secp256k1. * An optional message ''m'': a 32-byte array ''' Why include a message as an input?''' This could be useful for protocols that want to authorize on a compound statement, not just knowledge of a scalar. This allows the protocol to combine knowledge of the scalar and the statement. The algorithm ''GenerateProof(a, B, r, G, m)'' is defined as: @@ -94,8 +94,8 @@ Input: * The public key used in the proof generation ''B'': a point on the curve * The result of multiplying the secret and public keys used in the proof generation ''C'': a point on the curve * A proof ''proof'': a 64-byte array -* The generator point used in the proof generation ''G'': a point on the curve ''' Why include the generator point G as an input?''' While all other BIPs have used the generator point from Secp256k1, passing it as an input here lets this algorithm be used for other curves. -* An optional message ''m'': a 32-byte array ''' Why include a message as an input?''' This could be useful for protocols that want to authorize on a compound statement, not just knowledge of a scalar. This allows the protocol to combine knowledge of the scalar and the statement. +* The generator point used in the proof generation ''G'': a point on the curve +* An optional message ''m'': a 32-byte array The algorithm ''VerifyProof(A, B, C, proof, G, m)'' is defined as: * Fail if any of ''is_infinite(A)'', ''is_infinite(B)'', ''is_infinite(C)'', ''is_infinite(G)'' From af1e6e27c772310c642cfff80c4f04b58b63a439 Mon Sep 17 00:00:00 2001 From: ViniciusCestarii Date: Tue, 20 Oct 2026 10:14:11 -0300 Subject: [PATCH 2/2] bip374: clarify DLEQ verification wording --- bip-0374.mediawiki | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bip-0374.mediawiki b/bip-0374.mediawiki index 03a38b4c..50a9b583 100644 --- a/bip-0374.mediawiki +++ b/bip-0374.mediawiki @@ -87,7 +87,7 @@ The algorithm ''GenerateProof(a, B, r, G, m)'' is defined as: === DLEQ Proof Verification === -The following verifies the proof generated in the previous section. If the following algorithm succeeds, the points ''A'' and ''C'' were both generated from the same scalar. The former from multiplying by ''G'', and the latter from multiplying by ''B''. +The following verifies the proof generated in the previous section. If the following algorithm succeeds, the points ''A'' and ''C'' were both generated from the same scalar ''a'', i.e. ''A = a⋅G'' and ''C = a⋅B''. Input: * The public key of the secret key used in the proof generation ''A'': a point on the curve