Pieter Wuille
f429750036
Update authors
2020-01-19 14:47:33 -08:00
Pieter Wuille and Tim Ruffing
2c8feb1cbb
Update bip-schnorr.mediawiki
...
Co-Authored-By: Tim Ruffing <crypto@timruffing.de >
2020-01-19 14:47:33 -08:00
Pieter Wuille
9c76bb457f
Linearity makes sign-for-sum-of-keys easier, not possible entirely.
...
I'm sure it's possible to construct a complex MPC that can sign for the
sum of keys under ECDSA as well.
2020-01-19 14:47:33 -08:00
Tim Ruffing
0dd7489dfd
Update bip-schnorr.mediawiki
2020-01-19 14:47:33 -08:00
Tim Ruffing
3cc2d8ed6d
Mention that we don't change the hash function
2020-01-19 14:47:33 -08:00
Pieter Wuille
3c1f466372
Completely specified
2020-01-19 14:47:33 -08:00
Pieter Wuille
687ec4ba8e
Low-S ECDSA is non-malleable under nonstandard assumptions
2020-01-19 14:47:33 -08:00
Jonas Nick
d199b6dff6
Replace private key with secret key
2020-01-19 14:47:33 -08:00
Tim Ruffing
ad6bb6c1ff
Clarify why we don't want short hashes
...
This is supposed to supersede https://github.com/sipa/bips/pull/158.
I tried to say this carefully. I don't think that multiparty signing is in general broken with short hashes. For example the attack in #158 could be avoided by letting everybody not only commit to the nonce but also to the message. It's just that using a collision-resistant hash just eliminates the problem entirely...
2020-01-19 14:47:33 -08:00
Hennadii Stepanov
966eadca3a
Fix reference formatting
2020-01-19 14:47:33 -08:00
Orfeas Stefanos Thyfronitis Litos
37bf225ea4
Replace BIP66 link with BIP146
...
BIP66 does not mention the inherent ECDSA malleability, but BIP146 does
2020-01-19 14:47:33 -08:00
Orfeas Stefanos Thyfronitis Litos
79738f2410
Link to proof sketch of security of implicit Y
...
Thanks to @ajtowns for providing the link
2020-01-19 14:47:33 -08:00
Jonas Nick
1f5bdb304e
Improve clarity of footnotes for lift_x
2020-01-19 14:47:33 -08:00
Jonas Nick
708aeadf85
Replace references to Euler's criterion with Legendre symbol in bip-schnorr
2020-01-19 14:47:33 -08:00
Jonas Nick
5a25adc490
Fix bip-schnorr footnote 7 by specifying that we're referring to P's y coordinate and not some undefined 'x'
2020-01-19 14:47:33 -08:00
Kalle Rosenbaum
18d1774d81
Nits
2020-01-19 14:47:33 -08:00
Hennadii Stepanov
fe03882a72
Fix paragraph naming and typo
2020-01-19 14:47:33 -08:00
Orfeas Stefanos Thyfronitis Litos
55a31518b9
Rephrase "previous design choice" to "list above"
2020-01-19 14:47:33 -08:00
stefanwouldgo
79c515eb9e
grammar typo fix: inserted "be"
2020-01-19 14:47:33 -08:00
Dmitry Petukhov
7a434d4d76
Add missing dots that denote multiplication
...
Throughout the document, elliptic curve multiplication is denoted with dots,
as in `d'⋅G` as opposed to `d'G`.
This is not the case in one place in the 'Default Signing' section,
and one place in 'Adaptor Signatures' section
Missing dots are added for consistency.
2020-01-19 14:47:33 -08:00
Orfeas Stefanos Thyfronitis Litos
1661efc999
Add missing quote
2020-01-19 14:47:33 -08:00
Orfeas Stefanos Thyfronitis Litos
e72fffa028
Fix typo in schnorr, footnote 2
2020-01-19 14:47:33 -08:00
Hennadii Stepanov
ba7dd57697
G refers to secp256k1 base point rather generator
2020-01-19 14:47:33 -08:00
Tim Ruffing
9b5ba158c1
improve rationale for key prefixing
2020-01-19 14:47:33 -08:00
Pieter Wuille
ae7122822a
Settle on notation: is_square(y), has_square_y(P)
2020-01-19 14:47:33 -08:00
Tim Ruffing
7c00346cf2
typos
2020-01-19 14:47:33 -08:00
Pieter Wuille and Tim Ruffing
9c1670f345
Update bip-schnorr.mediawiki
...
Co-Authored-By: Tim Ruffing <tim@timruffing.de >
2020-01-19 14:47:33 -08:00
Pieter Wuille and Tim Ruffing
83cebb5326
Update bip-schnorr.mediawiki
...
Co-Authored-By: Tim Ruffing <tim@timruffing.de >
2020-01-19 14:47:33 -08:00
Pieter Wuille
1695f073d3
Elaborate on default and alternative signing
2020-01-19 14:47:33 -08:00
Tim Ruffing
09e3f637b5
Change reference for ECDSA proofs
...
Refer to Manuel Fersch's dissertation for provable security of ECDSA. It's freely accessible and multiple results put well in context.
2020-01-19 14:47:33 -08:00
Pieter Wuille
23c1c3ed8b
More on key generation
2020-01-19 14:47:33 -08:00
Pieter Wuille
7a7ab111c9
Clarify interaction x-only keys with verification
2020-01-19 14:47:33 -08:00
Pieter Wuille and Tim Ruffing
20f9901809
Update bip-schnorr.mediawiki
...
Co-Authored-By: Tim Ruffing <tim@timruffing.de >
2020-01-19 14:47:33 -08:00
Pieter Wuille
aef148ffc6
Explain that MuSig needs key prefixing
2020-01-19 14:47:33 -08:00
Tim Ruffing
a7ee6c30fa
bip-schnorr: more on (e,s)
2020-01-19 14:47:33 -08:00
Tim Ruffing
bc4e8f28b8
bip-schnorr: more on provable security
...
I'll try to get a link to the CCS paper that does not have a paywall...
2020-01-19 14:47:33 -08:00
Pieter Wuille
565ac4f717
Typo
2020-01-19 14:47:33 -08:00
Pieter Wuille
96a199ac8c
Drop other curve comment
2020-01-19 14:47:33 -08:00
Pieter Wuille
281df660b9
Prefix infinite with is_
2020-01-19 14:47:33 -08:00
Pieter Wuille and Tim Ruffing
e29d82dc88
Apply suggestions from code review
...
Co-Authored-By: Tim Ruffing <tim@timruffing.de >
2020-01-19 14:47:33 -08:00
Pieter Wuille
0d4191bae5
Formulate claims about BatchVerify more accurately
2020-01-19 14:47:33 -08:00
Pieter Wuille
7f5926703a
Use is_square/is_positive and introduce algorithm names
2020-01-19 14:47:33 -08:00
Pieter Wuille
9b9fab9a03
HTTPS links where possible
2020-01-19 14:47:33 -08:00
Pieter Wuille
406bc17c16
Small fixes from review with real-or-random
2020-01-19 14:47:33 -08:00
Tim Ruffing
e0e422a5ca
Link to Schnorr's paper instead of Wikipedia
2020-01-19 14:47:33 -08:00
Jonas Nick
fe8f5f68ca
Standardize on secret key in bip-schnorr
2020-01-19 14:47:33 -08:00
Elichai Turkel
8ea6798a9d
Euler's Criterion prime only nit
2020-01-19 14:47:33 -08:00
Jonas Nick
65a4f1deb8
Mention SHA256 block size
...
Rebased by Pieter Wuille
2020-01-19 14:47:33 -08:00
Pieter Wuille
8886eb4071
Address some nits
2020-01-19 14:47:33 -08:00
Tim Ruffing
2b987b5711
Rework Applications section
2020-01-19 14:47:33 -08:00
Pieter Wuille
Jonas Nick
Hennadii Stepanov
Orfeas Stefanos Thyfronitis Litos
Kalle Rosenbaum
stefanwouldgo
Dmitry Petukhov
Elichai Turkel