# Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a private exponent.

The signature scheme also requires Positive ECDSA signatures s.t. $$|s|$$ <= $$(q-1)/2$$

The two public keys are of the form $$g^k$$ and $$g^{y*k}$$, and I'm using the Chaum-Pedersen protocol for the consistency proof.

I was concerned about negating $$s$$ during pre-signing, to achieve SUF-CMA security of the signature scheme. However, think I was applying the negation in the wrong place.

Only one version of $$s$$ passes pre-verification, and conditionally negating $$s$$ when adapting the pre-signature $$s = \tilde s * y^{-1}$$ results in a Positive ECDSA scheme. This is currently what the code does.

Here is a link to the relevant code snippets:

This is the paper I'm working from: Generalized Bitcoin-Compatible Channels

Thanks in advance for any help and/or critique

Update:

In an answer to a related question (https://crypto.stackexchange.com/a/89179), Alex Xiong posted about the Chaum-Pedersen protocol for DH-triples. This is actually the primitive I was looking for instead of the modification I made to Schnorr identification.

Many thanks Alex!

Will continue researching, and post updates when/if I have any.