BIP340 updates: even R, new tags, small fixups, clarifications #982

pull sipa wants to merge 15 commits into bitcoin:master from sipa:bip-taproot changing 5 files +89 −106

sipa commented at 12:55 AM on August 27, 2020: member
Two semantics changes:
- Change the R point to be implicitly even (rather than implicitly square; see https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-August/018081.html for discussion)
- Change the tags for hashing from "BIP340/" to "BIP0340/", to guarantee no collisions with the previous draft.
There are also a number of changes to the document that do not change semantics, but just improve clarity, or fix typos.

BIP-0340: small fixups

- key prefixing means prefixing the message
- array indexing starts with 0
- 'Gennaro' is spelled with two n's
- has_even_y definition takes P as argument

Thanks to Alan Szepieniec for pointing out these issues.

804538f141

BIP-0340: Remove last remaining mention of Jacobi symbol

Jacobi symbol can be confusing because it may suggest that the modulus is
composite.

Thanks to Alan Szepieniec for pointing out this issue.

2611302d83

Clarify security argument of x-only pubkeys better 005586d2fd
BIP-0340: note that adapting the spec to other curves is insecure 7e9b4dd620
Merge pull request #208 from sipa/202007_nobitloss
Clarify security argument of x-only pubkeys
1e2d05609f
Merge pull request #206 from jonasnick/some-fixups
BIP-0340: Miscellaneous fixups
e331aadf92
BIP340: Fix typo e98888322f
Merge pull request #209 from real-or-random/patch-17
BIP340: Fix typo
05a03f2d61
Switch to even tiebreaker for R 968096c451
Change tags to avoid collisions with earlier draft 5dadeb3e1c
Rename lift_x_even_y to lift_x 8a3db73a84
Update test vectors and generation script afa13249ed
Merge pull request #210 from sipa/202008_even_r_tiebreaker
Switch BIP340 to even R tiebreaker
bf106b05ca
Clarify that Jacobian coordinates are the optimization, not the Legendre symbol b6b0715c28
Merge pull request #212 from sipa/202008_evenr_clarify
Clarify that Jacobian coordinates are the optimization
5f4d3b45c6
sipa commented at 12:56 AM on August 27, 2020: member

@luke-jr I'm happy to rebase this to remove merge commits, but I believe you prefer it in this form?
luke-jr merged this on Aug 27, 2020
luke-jr closed this on Aug 27, 2020
luke-jr commented at 2:11 AM on August 27, 2020: member

Yes, thanks
sipa cross-referenced this on Aug 27, 2020 from issue Add schnorrsig module which implements BIP-340 compliant signatures by jonasnick

Contributors

sipa

luke-jr