Date: Thu, 28 Jul 2022 15:27:05 +0000
To: Ali Sherief <ali@notatether.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: Pieter Wuille <bitcoin-dev@wuille.net>
Reply-To: Pieter Wuille <bitcoin-dev@wuille.net>
Message-ID: <BQZI2zpZwzJcXi_Gxr0f1wg9ZD6U5nb0HTOfIu4i50nM6FqFNqFjfm4DbOIxg94IwZQ4pHAthUNeGUkwHENJwAhap-bIkuKRN8ErZyFeR-o=@wuille.net>
In-Reply-To: <bG2Fk0bM_4lbwijBwZRiGgCAmktVOFSY5vR5k1D7QSc8imn9NWXxfOLPgMl5p22vfAPDHeuEA_p6TDhU7qGFoVmZok57RzA9rEV1LJzHpsM=@notatether.com>
References: <bG2Fk0bM_4lbwijBwZRiGgCAmktVOFSY5vR5k1D7QSc8imn9NWXxfOLPgMl5p22vfAPDHeuEA_p6TDhU7qGFoVmZok57RzA9rEV1LJzHpsM=@notatether.com>
Feedback-ID: 19463299:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Zero-knowledge proofs e.g. Schnorr are
	incompatible with address signing without compromise
Precedence: list

------- Original Message -------
On Thursday, July 28th, 2022 at 3:27 AM, Ali Sherief via bitcoin-dev <bitco=
in-dev@lists.linuxfoundation.org> wrote:

> Essentially, zero-knowledge proofs such as Schnorr are not compatible wit=
h address message signing - the public key cannot be retrieved from the add=
ress or the signature, so the address does not actually prove the authentic=
ity of a Schnorr signature. That's why the public key is required as an inp=
ut in the first place.

Yes, that's an intentional design choice in BIP340, see note 5: https://git=
hub.com/bitcoin/bips/blob/master/bip-0340.mediawiki#cite_ref-5-0. The choic=
e is either batch verifiability or public key recovery.

I regret ever using public key recovery when introducing the old legacy mes=
sage signing scheme. It should just have used script signatures like BIP322=
 proposes.

> In order to make it compatible with the address signing mechanism, the ze=
ro-knowledge part would have to be sacrificed in my BIP, or else a complete=
ly separate message signing format just for Taproot would be required

You can avoid relying on public key recovery, and include the public key + =
BIP340 signature in the encoded signature.

> (which, in my view, is redundant - there is already the draft BIP322 whic=
h can verify anything and everything, but nobody is implementing that

I think it would be much better if people would cooperate to get BIP322 to =
move forward than to keep inventing other formats. It's the obvious solutio=
n in my opinion: not restricted to single-key policies, compatible with eve=
ry script type, and trivially extensible to future schemes.

> , just like BIP340).

How so? Every taproot compatible wallet has a BIP340 implementation.

Cheers,

--
Pieter