Hello list, Despite saying earlier that I expected no further semantical changes to BIP 340-342, I've just opened https://github.com/bitcoin/bips/pull/893 to make a number of small changes that I believe are still worth making.
1. Even public keys Only one change affects the validation rules: the Y coordinate of 32-byte public keys is changed from implicitly square to implicitly even. This makes signing slightly faster (in the microsecond range), though also verification negligibly slower (in the nanosecond range). It also simplifies integration with existing key generation infrastructure. For example BIP32 produces public keys with known even/oddness, but squaredness would need to be computed separately. Similar arguments hold for PSBT and probably many other things. Note that the Y coordinate of the internal R point in the signature remains implicitly square: for R the squaredness gives an actual performance gain at validation time, but this is not true for public keys. Conversely, for public keys integration with existing infrastructure matters, but R points are purely internal. This affects BIP 340 and 341. 2. Nonce generation All other semantical changes are around more secure nonce generation in BIP 340, dealing with various failure cases: * Since the public key signed for is included in the signature challenge hash, implementers will likely be eager to use precomputed values for these (otherwise an additional EC multiplication is necessary at signing time). If that public key data happens to be gathered from untrusted sources, it can lead to trivial leakage of the private key - something that Greg Maxwell started a discussion about on the moderncrypto curves list: https://moderncrypto.org/mail-archive/curves/2020/001012.html. We believe it should therefore be best practice to include the public key also in the nonce generation, which largely mitigates this problem. * To protect against fault injection attacks it is recommended to include actual signing-time randomness into the nonce generation process. This was mentioned already, but the update elaborates much more about this, and integrates this randomness into the standard signing process. * To protect against differential power analysis, a different way of mixing in this randomness is used (masking the private key completely with randomness before continuing, rather than hashing them together, which is known in the literature to be vulnerable to DPA in some scenarios). 3. New tagged hash tags To make sure that any code written for the earlier BIP text fails consistently, the tags used in the tagged hashes in BIP 340 are changed as well. What do people think? -- Pieter _______________________________________________ bitcoin-dev mailing list bitcoin-dev@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
