bitcoin/bips
1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2026-04-06 16:16:45 +00:00
Code Issues Releases Wiki Activity

Address sipa's feedback

Browse Source
This commit is contained in:
Jonas Nick
2019-08-21 11:40:42 +00:00
committed by Pieter Wuille
parent a67e5e323c
commit f3bef4f459
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bip-schnorr.mediawiki
View File

@@ -75,7 +75,7 @@ In the case of ''R'' the third option is slower at signing time but a bit faster
for elliptic curve operations). The two other options require a possibly
expensive conversion to affine coordinates first. This would even be the case if the sign or oddness were explicitly coded (option 2 in the previous design choice). We therefore choose option 3.
For ''P'' the speed of signing and verification does not significantly differ between any of the three options because affine coordinates of the point have to computed anyway. We therefore choose the same option as for ''R''. The signing algorithm ensures that the signature is valid under the correct public key by negating the secret key if necessary.
For ''P'' the speed of signing and verification does not significantly differ between any of the three options because affine coordinates of the point have to be computed anyway. For consistency resons we choose the same option as for ''R''. The signing algorithm ensures that the signature is valid under the correct public key by negating the secret key if necessary.
It is important to not mix up the 32-byte bip-schnorr public key format and other existing public key formats (e.g. encodings used in Bitcoin's ECDSA). Concretely, a verifier should only accept 32-byte public keys and not, for example, convert a 33-byte public key by throwing away the first byte. Otherwise, two public keys would be valid for a single signature which can result in subtle malleability issues (although this type of malleability already exists in the case of ECDSA signatures).
@@ -118,6 +118,9 @@ Input:
The public key corresponding to secret key ''d'' is ''bytes(dG)''.
Alternatively, the public key can be created according to [https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki BIP32] which describes the derivation of 33-byte compressed public keys.
In order to translate such public keys into bip-schnorr compatible keys, the first byte must be dropped.
==== Verification ====
Input:
@@ -155,7 +158,7 @@ All provided signatures are valid with overwhelming probability if and only if t
==== Signing ====
Input:
* The secret key ''d' '': an integer in the range ''1..n-1'' chosen uniformly at random.
* The secret key ''d' '': an integer in the range ''1..n-1''
* The message ''m'': a 32-byte array
To sign ''m'' for public key ''bytes(dG)'':