From cdf7dd8cca5178dcdf998d0e931ab9c51b8aacd8 Mon Sep 17 00:00:00 2001 From: Pieter Wuille Date: Tue, 15 Oct 2019 12:26:21 -0700 Subject: [PATCH] Drop other curve comment --- bip-schnorr.mediawiki | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bip-schnorr.mediawiki b/bip-schnorr.mediawiki index dbc474b4..5dd5305f 100644 --- a/bip-schnorr.mediawiki +++ b/bip-schnorr.mediawiki @@ -150,7 +150,7 @@ The algorithm ''Sign(sk, m)'' is defined as: * Let ''e = int(hashBIPSchnorr(bytes(R) || bytes(P) || m)) mod n''. * Return the signature ''bytes(R) || bytes((k + ed) mod n)''. -'''Above deterministic derivation of ''R'' is designed specifically for this signing algorithm and may not be secure when used in other signature schemes or for other curves.''' +'''Above deterministic derivation of ''R'' is designed specifically for this signing algorithm and may not be secure when used in other signature schemes.''' For example, using the same derivation in the MuSig multi-signature scheme leaks the secret key (see the [https://eprint.iacr.org/2018/068 MuSig paper] for details). Note that this is not a ''unique signature'' scheme: while this algorithm will always produce the same signature for a given message and public key, ''k'' (and hence ''R'') may be generated in other ways (such as by a CSPRNG) producing a different, but still valid, signature.