-
Notifications
You must be signed in to change notification settings - Fork 5.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bip Draft: Discrete Log Equality Proofs (DLEQ) #1689
base: master
Are you sure you want to change the base?
Conversation
There was some previous discussion on this gist before making this PR |
* Let ''A = a⋅G''. | ||
* Let ''C = a⋅B''. | ||
* Let ''t'' be the byte-wise xor of ''bytes(32, a)'' and ''hash<sub>BIP?/aux</sub>(r)''. | ||
* Let ''rand = hash<sub>DLEQ</sub>(t || cbytes(A) || cytes(C))''. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
typo
* Let ''rand = hash<sub>DLEQ</sub>(t || cbytes(A) || cytes(C))''. | |
* Let ''rand = hash<sub>DLEQ</sub>(t || cbytes(A) || cbytes(C))''. |
* Let ''s = int(proof[32:64])''; fail if ''s ≥ n''. | ||
* Let ''R<sub>1</sub> = s⋅G - e⋅A''. | ||
* Fail if ''is_infinite(R<sub>1</sub>)''. | ||
* Fail if ''not has_even_y(R<sub>1</sub>)''. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
that seems not necessary and would make roughly every second (valid) proof verification fail (probably a leftover from a previous variant where x-only pubkeys were used?), same as two lines below
* Fail if ''not has_even_y(R<sub>1</sub>)''. |
|
||
TBD | ||
|
||
== Changelog == |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe add a section on backwards compatibility, run git grep -A2 Backward
on the repo root for ideas.
@@ -0,0 +1,90 @@ | |||
<pre> | |||
BIP: ? | |||
Title: Discrete Log Equality Proofs over secp256k1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider adding Layer: Applications
above this line (run git grep -C6 "Layer: Applications"
on the repository for info).
This BIP specifies a standard way to generate and verify DLEQ proofs. This is motivated by sending to silent payments in PSBTs. However, there are also other uses where DLEQs could be useful, so it would be good to have this BIP for others to reference.
This is inspired by https://github.com/discreetlogcontracts/dlcspecs/blob/master/ECDSA-adaptor.md#proof-of-discrete-logarithm-equality, but is a little more specific.
There is an implementation of that already at https://github.com/BlockstreamResearch/secp256k1-zkp/blob/master/src/modules/ecdsa_adaptor/dleq_impl.h, which this BIP attempts to be compatible with.
Inital ML post: https://groups.google.com/g/bitcoindev/c/MezoKV5md7s