bitcoin-dev

Schnorr signatures BIP

Schnorr signatures BIP

Original Postby Russell O'Connor

Posted on: August 5, 2018 14:33 UTC

The proposed change from "Let R = sG - eP" to "Let R = sG + eP" for the verification equation allows faster verification by avoiding negating a point or coefficient.

Computing the non-quadratic residue is not the same cost as computing a quadratic residue, so the revised proposed change makes the verification equation "R + sG + eP = 0," which is suitable for batch verification. For single signature verification, the check becomes computing Q := sG + eP, verifying that Q isn't the point at infinity and Q.x = r, and verifying that Q.y is not a quadratic residue. The proposal effectively suggests negating the 's' value in a signature instead of the 'e' value. Changing the verification equation removes one negation operation from the cost of doing verification in either verification procedure.