BIP-340 signature verification #10

This is a draft implementation. The remaining BIP-340 test vectors need to be added, TODOs need to be addressed, and one failing test needs to be fixed. The VerifySignature verifies the provided BIP-340 signature for the message against the group public key. The function returns true and nil error when the signature is valid. The function returns false and an error when the signature is invalid. The error provides a detailed explanation on why the signature verification failed. VerifySignature implements Verify(pk, m, sig) function as defined in BIP-340. One important design decision is to accept *Signature and *Point into Verify function instead of bytes, as in the prototype. This has the implication. To ensure consistency and that we'll not return positive verification result for (x,y) that is not on the curve, we need to verify y coordinate even though BIP-340 verification is not really interested in it. I think this is acceptable given the complexity of byte operations is hidden behind a ciphersuite and inside the protocol code, we'll operate on known domain objects.

Added missing test vectors with one test vector failing - this requires further investigation. Explained why we accept public key's Y coordinate in parameters as opposed to what is proposed in BIP-340. tl;dr; support for other ciphersuites and in FROST it does not matter where we strip Y coordinate information: after aggregate and before the verification or inside the verification.

EncodePoint is important for hashing, especially H2. It is not important for the signature verification calls (in our current model) or for the curve operations.

This test was previously failing. The signature verification algorithm in BIP-340 does not check that the 32 public key bytes in the signature match a valid point on the curve. This check is effectively implicit in the algorithm later, because G and P are known valid curve points, so the point R that is calculated is also a valid point. Thus, if r is not a valid point's X-coordinate, R.X != r.

This does not make any difference to the result but it is preferable to stay in the field order for the clarity's sake.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BIP-340 signature verification #10

BIP-340 signature verification #10

Commits on Jan 8, 2024