From 930bacddcd1c1494eefed084d2755e33366232a2 Mon Sep 17 00:00:00 2001 From: Pieter Wuille Date: Sun, 7 Mar 2021 18:39:09 -0800 Subject: [PATCH] Updated Comments:BIP 0340 (markdown) --- Comments:BIP-0340.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Comments:BIP-0340.md b/Comments:BIP-0340.md index e93aca5..ece9112 100644 --- a/Comments:BIP-0340.md +++ b/Comments:BIP-0340.md @@ -99,4 +99,4 @@ Here is the link to said paper = https://dl.acm.org/doi/10.1145/3372297.3417268 ---- -The comments above appear to be misinformed. Nearly all ECDSA implementations today, including all the ones used in Bitcoin software that I know about, already use derandomized RFC6979 nonce generation for secp256k1. BIP340 too specifies such a nonce generation algorithm - one that is inspired by Ed25519's in fact. It permits adding randomness as research has shown this improves resistance to certain fault & side-channel attacks, but the randomness is not critical for security (it is purely additive). Lastly, the entire nonce generation concern is an implementation aspect that's orthogonal for the signature scheme - it can be done well, or badly, either with ECDSA or Schnorr/BIP340. BIP340 chooses to specify it, in the hope that implementations adopt it as a best practice, but circumstances may call for alternative nonce generation algorithms too. \ No newline at end of file +The comments above appear to be misinformed. Nearly all ECDSA implementations today, including all the ones used in Bitcoin software that I know about, already use derandomized RFC6979 nonce generation for secp256k1. BIP340 too specifies such a nonce generation algorithm - one that is inspired by Ed25519's in fact. It permits adding randomness as research has shown this improves resistance to certain fault & side-channel attacks, but the randomness is not critical for security (it is purely additive). Lastly, the entire nonce generation concern is an implementation aspect that's orthogonal for the signature scheme - it can be done well, or badly, either with ECDSA or Schnorr/BIP340. BIP340 chooses to specify it, in the hope that implementations adopt it as a best practice, but circumstances may call for alternative nonce generation algorithms too. -- Pieter Wuille, 2021 Mar 07. \ No newline at end of file