I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a private exponent.

The signature scheme also requires Positive ECDSA signatures s.t. $|s|$ <= $(q-1)/2$

The two public keys are of the form $g^k$ and $g^{y*k}$, and I'm using the Chaum-Pedersen protocol for the consistency proof.

I was concerned about negating $s$ during pre-signing, to achieve SUF-CMA security of the signature scheme. However, think I was applying the negation in the wrong place.

Only one version of $s$ passes pre-verification, and conditionally negating $s$ when adapting the pre-signature $s = \tilde s * y^{-1}$ results in a Positive ECDSA scheme. This is currently what the code does.

Here is a link to the relevant code snippets:

This is the paper I'm working from: Generalized Bitcoin-Compatible Channels

Thanks in advance for any help and/or critique


In an answer to a related question (https://crypto.stackexchange.com/a/89179), Alex Xiong posted about the Chaum-Pedersen protocol for DH-triples. This is actually the primitive I was looking for instead of the modification I made to Schnorr identification.

Many thanks Alex!

Will continue researching, and post updates when/if I have any.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.