Not possible with the current design.
The non-batch validation (secp256k1_schnorrsig_verify) logic looks something like this:
- calc
rj using secp256k1_ecmult: Rj = sG - eP
- convert
rj (gej) to r (ge)
- check if the
r.x = sig[0:32] and r.y = even
one schnorrsig occupies two points in the batch, and one tweak check occupies one point in the batch. If a batch contains two points, there is no guarantee that they are from a schnorrsig (R, P). It could be from two tweak checks. So, we can’t use the r.y = even check.
Hence, I tried implementing a slightly modified schnorrsig_verify logic (not implement in this PR):
- calc
neg_rj using secp256k1_ecmult: neg_Rj = -s*G + batch.scalars[1]*batch.points[1]
- check if
neg_rj + batch.points[0] == inf using _gej_add_var
batch.scalars[0] = 1 always. So, we don’t need to use ecmult again
This gives somewhat better benchmarks than before:
0Benchmark , Min(us) , Avg(us) , Max(us)
1
2schnorrsig_sign , 49.1 , 50.1 , 53.4
3schnorrsig_verify , 86.6 , 87.2 , 88.4
4schnorrsig_batch_verify_1 , 94.7 , 95.0 , 95.2
But schnorrsig_batch_verify_1 is still slower than schnorrsig_verify.
