Date: Thu, 28 Jul 2022 15:58:03 +0000
To: Ali Sherief <ali@notatether.com>
From: Pieter Wuille <bitcoin-dev@wuille.net>
Reply-To: Pieter Wuille <bitcoin-dev@wuille.net>
Message-ID: <3CQzcfbQ1qjdBAAViGbW7aXwJBWv3uov0YNHAHS0xtMCLxodi6veZDTIygYXj_P8JrT15hgupZUBah0HLw3B6GjvegZYv52gHUSBy8tCk-E=@wuille.net>
In-Reply-To: <ltMy8y1N-J_DQ0rQiKcb1fkiBkd9PcLX6B4W_TZ6i7bdmNWQMXJ0h2fet6DFKvllyH0QNzzVnqMpxT3vMgxdwJKOfsUKf8lS5P5sTC4-3j8=@notatether.com>
References: <bG2Fk0bM_4lbwijBwZRiGgCAmktVOFSY5vR5k1D7QSc8imn9NWXxfOLPgMl5p22vfAPDHeuEA_p6TDhU7qGFoVmZok57RzA9rEV1LJzHpsM=@notatether.com>
 <BQZI2zpZwzJcXi_Gxr0f1wg9ZD6U5nb0HTOfIu4i50nM6FqFNqFjfm4DbOIxg94IwZQ4pHAthUNeGUkwHENJwAhap-bIkuKRN8ErZyFeR-o=@wuille.net>
 <ltMy8y1N-J_DQ0rQiKcb1fkiBkd9PcLX6B4W_TZ6i7bdmNWQMXJ0h2fet6DFKvllyH0QNzzVnqMpxT3vMgxdwJKOfsUKf8lS5P5sTC4-3j8=@notatether.com>
Feedback-ID: 19463299:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: "bitcoin-dev@lists.linuxfoundation.org"
 <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Zero-knowledge proofs e.g. Schnorr are
	incompatible with address signing without compromise
Precedence: list

------- Original Message -------
On Thursday, July 28th, 2022 at 11:51 AM, Ali Sherief <ali@notatether.com> =
wrote:

> The way I understood the BIP, was that a user can do batch recovery or si=
ngle-key recovery. Can you explain how it is possible to recover a public k=
ey from a single-key signature, because a few days earlier on the BIP-notat=
ether-messageverify thread I was told (I think it was achow) that Schnorr d=
oesn't allow for public key recovery.

No, BIP340, in its design decisions, had to choice to either support public=
 key recovery, or support batch validation. We chose to support batch valid=
ation for a variety of reason. BIP340 does not in any way support key recov=
ery.

> > > , just like BIP340).
> >
> > How so? Every taproot compatible wallet has a BIP340 implementation.
>
>
> I guess I made an assumption, since almost all of the wallets I have seen=
 did not have a sign message feature, not even for legacy addresses.

I'm not talking about sign message, I'm talking about BIP340 for the purpos=
e of transaction signing, as it's the signature scheme used in BIP341/BIP34=
2.

My point being: for any prospective message signing feature, if the wallet =
supports taproot signing, they inevitably already have code to produce BIP3=
40 signatures. If they don't support taproot signing, then message signing =
for it is irrelevant.

Cheers,

--
Pieter