Add Schnorr wizardry cheat sheet #15
Conversation
t-bast
commented
Oct 21, 2021
t-bast
commented
- Schnorr signatures
- Adaptor signatures
- Musig2
* Schnorr signatures * Adaptor signatures * Musig2
schnorr.md
Outdated
| PA = pa*G -> public key of participant A | ||
| PB = pb*G -> public key of participant B | ||
| L = sorted(PA, PB) -> sorted list of participants public keys | ||
| P = H(L || PA)*PA + H(L || PB)*PB -> combined public key |
There was a problem hiding this comment.
Looking at BlockstreamResearch/secp256k1-zkp#131, it looks like the public key coefficients aren't what I use (which I took from the Musig2 paper).
@jonasnick could you briefly explain why that changed and provide the formula that's currently used?
There was a problem hiding this comment.
You can find the formula being used in the key aggregation spec draft. There's no material difference to what you use, but according to the spec draft the combined public key would be
P = H(H(L) || PA)*PA + PB
Hashing the set L first is an optimization when this hash is used multiple times to compute a key aggregation coefficient. The second public key gets coefficient 1 which is another optimization. This is described in the MuSig2* section in the appendix of the MuSig2 paper.
There was a problem hiding this comment.
Thanks, I did miss that section of the paper indeed!
I now see the corresponding code here, all good.
