bitcoin-dev

Lamport scheme (not signature) to economize on L1

Lamport scheme (not signature) to economize on L1

Original Postby Nagaev Boris

Posted on: December 19, 2023 17:08 UTC

In an analysis of cryptographic signature schemes and their relative on-chain footprints, a comparison was made between the proposed Lamport scheme without the publication of an ECC signature and the Schnorr keys as utilized in Taproot.

The findings indicate that the Lamport scheme results in an output of 20 bytes, derived from hashing both the ECC public key and the Lamport public key to create an address. Additionally, two inputs are required: the Lamport signature at 14 bytes, and the combination of the ECC public key with the Lamport private key totaling 46 bytes. This brings the total on-chain footprint for the Lamport scheme to 80 bytes.

On the other hand, the Taproot scheme using Schnorr keys has a different structure. The output consists of a 32-byte Schnorr public key while the input is a 64-byte Schnorr signature. This leads to a total of 96 bytes for the Taproot scheme.

However, it's noted that additional space may be necessary for the Lamport scheme to differentiate between T0 and T1 and to establish T1 initially. An estimated transaction overhead is about 10 bytes with an additional 6 bytes for references. Taking these into consideration, it appears that the on-chain footprints of the two schemes could ultimately be comparable in size.