I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a private exponent.
The signature scheme also requires Positive ECDSA signatures s.t. $|s|$ <= $(q-1)/2$
The two public keys are of the form $g^k$ and $g^{y*k}$, and I'm using the Chaum-Pedersen protocol for the consistency proof.
I was concerned about negating $s$ during pre-signing, to achieve SUF-CMA security of the signature scheme. However, think I was applying the negation in the wrong place.
Only one version of $s$ passes pre-verification, and conditionally negating $s$ when adapting the pre-signature $s = \tilde s * y^{-1}$ results in a Positive ECDSA scheme. This is currently what the code does.
Here is a link to the relevant code snippets:
- https://github.com/GeneFerneau/adaptor/blob/main/src/chaum_pedersen.rs
- https://github.com/GeneFerneau/adaptor/blob/main/src/lib.rs
This is the paper I'm working from: Generalized Bitcoin-Compatible Channels
Thanks in advance for any help and/or critique
Update:
In an answer to a related question (https://crypto.stackexchange.com/a/89179), Alex Xiong posted about the Chaum-Pedersen protocol for DH-triples. This is actually the primitive I was looking for instead of the modification I made to Schnorr identification.
Many thanks Alex!
Will continue researching, and post updates when/if I have any.
