Bitcoin Forum
March 28, 2024, 07:47:27 PM *
News: Latest Bitcoin Core release: 26.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Schnorr signatures for dummies  (Read 432 times)
Husires (OP)
Legendary
*
Offline Offline

Activity: 1554
Merit: 1278



View Profile WWW
July 08, 2020, 11:59:11 AM
Last edit: July 10, 2020, 10:49:00 AM by Husires
Merited by AB de Royse777 (5), tyz (2), Heisenberg_Hunter (2), OgNasty (1), NeuroticFish (1), pooya87 (1), ABCbits (1), mk4 (1), webtricks (1), SquirrelJulietGarden (1)
 #1


Disclaimer: The information contained in this explanation is the result of my understanding of Schnorr Signatures and may contain some errors. Search and confirm the information.


Table of contents

      1. Introduction
      2. What are Schnorr signatures?
      3. A comparison of Schnorr signatures and ECDSA?
      4. Can it be applied to the Bitcoin network?


Introduction

Humans knew signatures as a way to prove ownership, as you need a unique paper, pen and signature that is difficult for everyone to emulate.
Science evolved and evolved until we became in the digital age, so signatures evolved with it to become digital, but instead of being based on paper and pen, we became dependent on the strong digital signature scheme.

Bitcoin is a digital coin and therefore it is based on a digital signature but instead of the paper and pen model we can do this by performing some great math on the secp256k1 curve called Elliptic Curve Digital Signature Algorithm (or ECDSA). The algorithm allows you to take one number (i.e. a private key) and derive a public key from it.

Well that's good, but how does that algorithm work? You will get all your answers on this topic. Read it and then return here.

What is Elliptic Curve Cryptography? Understand how is it related to Bitcoin Thanks webtricks

It is beautiful now that we have a public key, you can show your public key to anyone. You can add it to your website and share your public addresses with others so they can send you Bitcoin.
We have a private key, when currencies are sent, they can check that the ECDSA signature matches the message. If not, they will only reject it

What are Schnorr signatures?

Schnorr signatures are quite simple compared to ECDSA signature, more secure with powerful property: linearity.
Historically: Schnorr's signatures are already ahead of ECDSA, but why haven't they been integrated into Bitcoin from the start ?!

There are many interpretations that answer this question, but the most reasonable one is that the patents expired in early 2008, before the release of the Bitcoin white paper, and scheme did not have standardization across the board. As such, Satoshi Nakamoto chose the most acceptable (and open source) ECDSA.


A comparison of Schnorr signatures and ECDSA?

We all know that Bitcoin already supports multisig, it's good and providing privacy, nobody knows the specific conditions for spending from inputs or sometimes they don't know it's a multi-signature address (although it starts with 3)

However, when you want to send currencies, the problems begin: let us assume that you set conditions for spending that are 3 out of 5, so public keys and valid signatures must be available. When transferring money outside the address. Everyone can find out.
The more people, the higher the number of bytes in your transaction, and the higher the fee accordingly.


Solutions provided by Schnorr Signatures

Schnorr Signatures can be a solution to the problems of privacy and scalability, as it allows some features, the most prominent of which is the collection of the signature, which works to collect many signatories in one signature, so that the final signature is the same length as the signature of one person and thus you will not even be able to distinguish between normal transactions and multisig transactions.
also has some advantages that can be used in the lightning network.


Can it be applied to the Bitcoin network?

Schnorr signatures does not need a hard fork, so the change can take place without the fear of network splitting. But adoption may take some time.
Bitcoin Improvement Proposal (BIP 0340) has been submitted by Peter & Will, Jonas Nick and Tim Roving.

https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki

.BEST..CHANGE.███████████████
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
███████████████
..BUY/ SELL CRYPTO..
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
OcTradism
Hero Member
*****
Offline Offline

Activity: 1694
Merit: 794



View Profile WWW
July 08, 2020, 12:15:57 PM
 #2

You can get some helpful things from the [Education] Bitcoin Privacy and Anonymity. The point 11 is for Schnorr Signature

.
.Duelbits.
█▀▀▀▀▀











█▄▄▄▄▄
TRY OUR
  NEW  UNIQUE
GAMES!
.
..DICE...
███████████████████████████████
███▀▀                     ▀▀███
███    ▄▄▄▄         ▄▄▄▄    ███
███   ██████       ██████   ███
███   ▀████▀       ▀████▀   ███
███                         ███
███                         ███
███                         ███
███   ▄████▄       ▄████▄   ███
███   ██████       ██████   ███
███    ▀▀▀▀         ▀▀▀▀    ███
███▄▄                     ▄▄███
███████████████████████████████
.
.MINES.
███████████████████████████████
████████████████████████▄▀▄████
██████████████▀▄▄▄▀█████▄▀▄████
████████████▀ █████▄▀████ █████
██████████      █████▄▀▀▄██████
███████▀          ▀████████████
█████▀              ▀██████████
█████                ██████████
████▌                ▐█████████
█████                ██████████
██████▄            ▄███████████
████████▄▄      ▄▄█████████████
███████████████████████████████
.
.PLINKO.
███████████████████████████████
█████████▀▀▀       ▀▀▀█████████
██████▀  ▄▄███ ███      ▀██████
█████  ▄▀▀                █████
████  ▀                    ████
███                         ███
███                         ███
███                         ███
████                       ████
█████                     █████
██████▄                 ▄██████
█████████▄▄▄       ▄▄▄█████████
███████████████████████████████
10,000x
MULTIPLIER
NEARLY UP TO
.50%. REWARDS
▀▀▀▀▀█











▄▄▄▄▄█
pooya87
Legendary
*
Offline Offline

Activity: 3402
Merit: 10433



View Profile
August 24, 2020, 04:51:58 AM
Merited by webtricks (1)
 #3

math on the secp256k1 curve called Elliptic Curve Digital Signature Algorithm (or ECDSA). The algorithm allows you to take one number (i.e. a private key) and derive a public key from it.
ECDSA algorithm allows you to take a private key and a message and produce a signature.
the algorithm involving computation of public keys from private keys is simply the elliptic curve math that is used in elliptic curve cryptography in general.

Quote
We have a privatepublic key, when currencies are sent, they can check that the ECDSA signature matches the message.
typo?

Quote
Schnorr signatures are quite simple compared to ECDSA signature, more secure with powerful property: linearity.
i don't think this is correct (unless you have a reference for it). both ECDSA and ECSDSA are similarly secure. the only difference is that ECSDSA algorithm is easily verifiable to be secure.

Quote
Schnorr's signatures are already ahead of ECDSA,
"ahead" is very vague.
as far as usage goes, Schnorr is not used that much (because of the patent and the fact that an alternative EdDSA was introduced which was similar and quite fast) but ECDSA is very popular and used a lot.
as for creation dates Schnorr was introduced in 1989 while ECDSA was introduced in 1992 so both are nearly equally old.

Quote
A comparison of Schnorr signatures and ECDSA?
you only focused on one characteristic of ECSDSA (public key aggregation) but Schnorr has more characteristics. for example it is a lot faster to verify compared to ECDSA because of its algorithm.

in bitcoin the proposal is also introducing additional steps that removes some extra bytes (DER encoding and pubkey starting byte) which shrinks each signature in size.

..JAMBLER.io..Create Your Bitcoin Mixing
Business Now for   F R E E 
▄█████████████████████████████
█████████████████████████
████▀████████████████████
███▀█████▄█▀███▀▀▀██████
██▀█████▄█▄██████████████
██▄▄████▀▄▄▄▀▀▀▀▀▄▄██████
█████▄▄▄██████████▀▄████
█████▀▄█▄██████▀█▄█████
███████▀▄█▀█▄██▀█▄███████
█████████▄█▀▄█▀▄█████████
█████████████████████████
█████████████████████████
▀█████████████████████████████
█████████████████████████████████████████████████
.
      OUR      
PARTNERS

.
█████████████████████████████████████████████████
████▄
██
██
██
██
██
██
██
██
██
██
██
████▀
▄█████████████████████████████
████████▀▀█████▀▀████████
█████▀█████████████▀█████
████████████████████████
███████████████▄█████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████▀█████████
████████████████████████
█████▄█████████████▄█████
████████▄▄█████▄▄████████
▀█████████████████████████████
█████████████████████████████████████████████████
.
   INVEST   
BITCOIN

.
█████████████████████████████████████████████████
████▄
██
██
██
██
██
██
██
██
██
██
██
████▀
Husires (OP)
Legendary
*
Offline Offline

Activity: 1554
Merit: 1278



View Profile WWW
September 02, 2020, 02:42:41 PM
 #4

Quote
Schnorr signatures are quite simple compared to ECDSA signature, more secure with powerful property: linearity.
i don't think this is correct (unless you have a reference for it). both ECDSA and ECSDSA are similarly secure. the only difference is that ECSDSA algorithm is easily verifiable to be secure.

Sorry for the late response, the answer is yes, Schnorr signatures are safer because they contain the linear property (you add more than two public keys to jointly produce a signature.

Source: https://bitcoin.stackexchange.com/questions/77234/schnorr-vs-ecdsa


More  
Quote
Instead of two scalars (r,s) we use a point R and a scalar s. Similar to ECDSA, R is a random point on elliptic curve (R = k×G). Second part of the signature is calculated slightly differently: s = k + hash(P,R,m) ⋅ pk. Here pk is your private key, P = pk×G is your public key, m is the message. Then one can verify this signature by checking that s×G = R + hash(P,R,m)×P.


Source: https://medium.com/cryptoadvance/how-schnorr-signatures-may-improve-bitcoin-91655bcb4744


in bitcoin the proposal is also introducing additional steps that removes some extra bytes (DER encoding and pubkey starting byte) which shrinks each signature in size.

I tried to make it simpler because it is for dummies without going into too much detail.



if you have time read this Simple Schnorr Multi-Signatures with Applications to Bitcoin

.BEST..CHANGE.███████████████
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
██
███████████████
..BUY/ SELL CRYPTO..
pooya87
Legendary
*
Offline Offline

Activity: 3402
Merit: 10433



View Profile
September 03, 2020, 05:28:42 AM
 #5

Quote
Schnorr signatures are quite simple compared to ECDSA signature, more secure with powerful property: linearity.
i don't think this is correct (unless you have a reference for it). both ECDSA and ECSDSA are similarly secure. the only difference is that ECSDSA algorithm is easily verifiable to be secure.

Sorry for the late response, the answer is yes, Schnorr signatures are safer because they contain the linear property (you add more than two public keys to jointly produce a signature.

Source: https://bitcoin.stackexchange.com/questions/77234/schnorr-vs-ecdsa

i think you are confusing Schnorr signatures with signature aggregation using Schnorr algorithm (eg. the algorithm used in musig).
there is no joining public keys in Schnorr itself. it is the same thing as ECDSA with a different formula. you have a single private key (d), a single message which you hash (e) and produce a single signature (r,s) using an ephemeral key (k).

ECDSA:  s = k−1(e + r*d) mod n
ECSDSA: s = (k + e*d) mod n[1]

[1] Schnorr paper defines this as k-e*d and there are slight differences in selecting k and computing R.

the link you posted is also saying the same thing as my comment above in its third bullet point
Quote
Switching to a provably secure construction, perhaps preventing an exploit against ECDSA in the future.
in other words the Schnorr algorithm (ECSDSA) is easier to prove to be secure whereas in ECDSA we don't have the same easy verification.

..JAMBLER.io..Create Your Bitcoin Mixing
Business Now for   F R E E 
▄█████████████████████████████
█████████████████████████
████▀████████████████████
███▀█████▄█▀███▀▀▀██████
██▀█████▄█▄██████████████
██▄▄████▀▄▄▄▀▀▀▀▀▄▄██████
█████▄▄▄██████████▀▄████
█████▀▄█▄██████▀█▄█████
███████▀▄█▀█▄██▀█▄███████
█████████▄█▀▄█▀▄█████████
█████████████████████████
█████████████████████████
▀█████████████████████████████
█████████████████████████████████████████████████
.
      OUR      
PARTNERS

.
█████████████████████████████████████████████████
████▄
██
██
██
██
██
██
██
██
██
██
██
████▀
▄█████████████████████████████
████████▀▀█████▀▀████████
█████▀█████████████▀█████
████████████████████████
███████████████▄█████████
█████████████████████████
█████████████████████████
█████████████████████████
███████████████▀█████████
████████████████████████
█████▄█████████████▄█████
████████▄▄█████▄▄████████
▀█████████████████████████████
█████████████████████████████████████████████████
.
   INVEST   
BITCOIN

.
█████████████████████████████████████████████████
████▄
██
██
██
██
██
██
██
██
██
██
██
████▀
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!