bitcoin-dev

Schnorr signatures BIP

Schnorr signatures BIP

Original Postby Anthony Towns

Posted on: August 6, 2018 08:39 UTC

On August 5, 2018, Russell O'Connor proposed a revision to the verification equation for Bitcoin.

The proposed change would make the equation "R + sG + eP = 0." Another contributor suggested an alternative equation of "R + s(-G) + eP = 0" since -G is a constant. They questioned the performance impact of having to negate "s" when batch verifying around 10,000 signatures. However, it was noted that the impact of negating "s" should be trivially small. The contributor expressed their preference for the formulation "s = r + H(R,P,m)p" because it is the simplest way of describing the setup and optimizes for people being able to understand the process.