RFC 10: ROAST Schnorr signatures #601
Conversation
| and our implementation must conform to it. | ||
|
|
||
| Schnorr signatures are incompatible with existing Bitcoin scripts, | ||
| requiring the use of taproot scripts instead. |
There was a problem hiding this comment.
I think a link to an explainer of taproot scripts would help
|
Left a few comments around hyperlinking extra info and some state stuff Additionally, I think adding more resources like https://www.youtube.com/watch?v=FVW6Hgt_meg and https://github.com/robot-dreams/roast would be sweet |
|
I'm good here! I think it would be helpful to have someone from @keep-network/go check this out as well |
| and our implementation must conform to it. | ||
|
|
||
| Schnorr signatures are incompatible with existing Bitcoin scripts, | ||
| requiring the use of taproot scripts instead. |
| === DKG | ||
|
|
||
| The (51, 100) secret key for a tBTC-ROAST signing group (aka wallet) | ||
| is produced using GJKR. |
| Because of this, the only solution is to retry the signing | ||
| until a set of signers with no misbehaving participants is stumbled upon. | ||
| This means that even a small group of misbehaving participants | ||
| can cause a dramatic slowdown in signing, |
There was a problem hiding this comment.
I think it's worth noting what the dramatic slowdown means: For 51-of-100 signing and 2 malicious members, we need 5 retries on average.
| already widely used in Bitcoin. | ||
| A signature for message m and public key point P | ||
| is defined as the (point, scalar) pair `(R, s)` | ||
| where `s * G = R + hash(R || P || m) * P`. |
There was a problem hiding this comment.
Is II a byte concatenation or a logical alternative of bytes? I take the former but would be nice to define it in the RFC.
|
|
||
| The algorithm `Verify(pk, m, sig)` is defined as: | ||
|
|
||
| * Let `P = lift_x(int(pk))`; fail if that fails. |
There was a problem hiding this comment.
What is the lift_x function doing?
There was a problem hiding this comment.
Created a follow up issue
Using ROAST and Schnorr signatures, we can significantly simplify threshold signing while achieving attributability of misbehaviour.