MIME-Version: 1.0
From: =?UTF-8?B?0JDRgNGC0ZHQvCDQm9C40YLQstC40L3QvtCy0LjRhw==?=
	<theartlav@gmail.com>
Date: Sat, 7 Jul 2018 05:47:40 +0300
Message-ID: <CAJRVQkD_oTZ_A_eFrX8TjbNFaQpFK1NYc+YkgKx3CRjCFPV9VQ@mail.gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary="000000000000d8ce4305705fcdf9"
Subject: Re: [bitcoin-dev] Schnorr signatures BIP
Precedence: list

--000000000000d8ce4305705fcdf9
Content-Type: text/plain; charset="UTF-8"

Neat.

Some minor notes as an outsider who just spent an hour implementing and
playing with this:

-In several places you have things like "Let k = int(hash(bytes(d) || m))
mod n", but reference code says things like "e = sha256(R[0].to_bytes(32,
byteorder="big") + bytes_point(point_mul(G, seckey)) + msg)", no modulo.
Confusing.

-x is not defined in "The signature is *bytes(x(R)) || bytes(k + ex mod n)*",
apparently it's the private key.

-jacobi function is great at exposing bugs in divmod implementations, due
to the full 256 bit exponent. Add a line about it being something to watch
for?

-"bytes" notation is defined as "turn to bytes" for an integer, but the
same for a point is "take X with prefix and turn to bytes". Confusing,
might be a good idea to name it differently?

-Finally, it would have been nice to have a larger set of test vectors in a
JSON or CSV file, covering all the edge cases.


Artem

--000000000000d8ce4305705fcdf9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Neat.</div><div><br></div><div>Some minor notes as an=
 outsider who just spent an hour implementing and playing with this:</div><=
div><br></div><div>-In several places you have things like &quot;Let k =3D =
int(hash(bytes(d) || m)) mod n&quot;, but reference code says things like &=
quot;e =3D sha256(R[0].to_bytes(32, byteorder=3D&quot;big&quot;) + bytes_po=
int(point_mul(G, seckey)) + msg)&quot;, no modulo. Confusing.<br></div><div=
><br></div><div>-x is not defined in &quot;The signature is <i>bytes(x(R)) =
|| bytes(k + ex mod n)</i>&quot;, apparently it&#39;s the private key.</div=
><div><br></div><div>-jacobi function is great at exposing bugs in divmod i=
mplementations, due to the full 256 bit exponent. Add a line about it being=
 something to watch for?</div><div><br></div><div>-&quot;bytes&quot; notati=
on is defined as &quot;turn to bytes&quot; for an integer, but the same for=
 a point is &quot;take X with prefix and turn to bytes&quot;. Confusing, mi=
ght be a good idea to name it differently?<br></div><div><br></div><div>-Fi=
nally, it would have been nice to have a larger set of test vectors in a JS=
ON or CSV file, covering all the edge cases.<br></div><div><br></div><div><=
br></div><div>Artem<br></div></div>

--000000000000d8ce4305705fcdf9--