ECDSA adaptor signing and decryption

[kzv]

Hi

I am trying to understand this article. Can someone explain to me how the ECDSA adaptor signing is work?

From the article:

1.
ECDSA adaptor signing
s' = (H(m) + R t p)r^-1

As I understand this is standard formula where x = t p - is a private key for the signature s'. So public key is P = t p G

2.
Decryption ECDSA adaptor signature:
s = s' t^-1 =  (H(m) + R t p)(rt)^-1

I can't understand this. Because it follows that:
s = s' t^-1 =  (H(m) + R t p)(rt)^-1 = (H(m) t^-1 + R p)r^-1

But this is not standart formula for ECDSA signature ((
It should be
s = (H(m) + R p)r^-1

I don't think the article is wrong. Most likely I'm missing something. Can anyone help with understanding these formulas?

[n0nce]

I don't think the article is wrong. Most likely I'm missing something. Can anyone help with understanding these formulas?

It is possible; I'm not sure that the blog post is actually accurate.

The paper I knew about adaptor signatures is this one: https://github.com/LLFourn/one-time-VES/blob/master/main.pdf
I haven't gone through it completely so far, but it seems more 'complete' to say the least.

To be honest, now that we do have Schnorr signatures in Bitcoin, spending too much time on ECDSA doesn't make too much sense anyway.
Rene Pickhardt made a pretty good video about Adaptor Signatures in Schnorr: https://www.youtube.com/watch?v=a8Pdpz_Jzok
I really like how he intuitively explains the concept and proves it in program code afterwards.

There is also a presentation by Conner Formknecht from Lightning Labs about 'Scriptless 2P-ECDSA', but while he does explain the concept and signature process, he doesn't show the decryption.

Okay, yes, it's all so confusing because of the blog post's notation. Read through page 12 of the above linked paper and it becomes crystal clear. Here a short explanation (replaced s^ with s').

Blog post says that you sign like this:
s=(H(m)+R*p)*r^-1
Paper uses this notation:
s=(H(m)+R_x*x)*r^-1
= (H(m)+f(g^r)*x)*r^-1

Blog post says that you tweak like this:
s'=(H(m)+R*p*t)*r^-1

Paper says you tweak like this:
s'=(H(m)+R_x*x)*r^-1, but with a different R_x (see below).
= (H(m)+f(g^y*r)*x)*r^-1

Both agree that you just multiply by y^-1 or t^-1 to decrypt the signature. However, only in the notation of the paper it becomes easy to understand, why.

s=s'*y^-1
= (H(m)+f(g^y*r)*x)*r^-1*y^-1
= (H(m)+f(g^y*r)*x)*(r*y)^-1

Basically, s is a signature under the secret key y*r.
So it 100% works if following the paper.


I'm not 100% sure that R*t == f(g^r*y), though. I believe that R*t would correspond to f(g^r)*y, which would not be the same thing, right?

For ease of reading:
private key p=x
tweak t=y
x-coordinate of public randomness R=f(g^r)