1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2025-03-13 19:16:49 +01:00

BIP-0340: note that adapting the spec to other curves is insecure

This commit is contained in:
Jonas Nick 2020-07-18 20:03:17 +00:00
parent 2611302d83
commit 7e9b4dd620

View file

@ -99,7 +99,7 @@ This proposal suggests to include the tag by prefixing the hashed data with ''SH
=== Specification ===
The following conventions are used, with constants as defined for [https://www.secg.org/sec2-v2.pdf secp256k1]:
The following conventions are used, with constants as defined for [https://www.secg.org/sec2-v2.pdf secp256k1]. We note that adapting this specification to other elliptic curves is not straightforward and can result in an insecure scheme<ref>Among other pitfalls, using the specification with a curve whose order is not close to the size of the range of the nonce derivation function is insecure.</ref>.
* Lowercase variables represent integers or byte arrays.
** The constant ''p'' refers to the field size, ''0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F''.
** The constant ''n'' refers to the curve order, ''0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141''.