Skip to content

Commit 05a03f2

Browse files
authored
Merge pull request bitcoin#209 from real-or-random/patch-17
BIP340: Fix typo
2 parents e331aad + e988883 commit 05a03f2

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

bip-0340.mediawiki

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ The algorithm ''Sign(sk, m)'' is defined as:
158158
* Fail if ''d' = 0'' or ''d' ≥ n''
159159
* Let ''P = d'⋅G''
160160
* Let ''d = d' '' if ''has_even_y(P)'', otherwise let ''d = n - d' ''.
161-
* Let ''t'' be the byte-wise xor of ''bytes(d)'' and ''H<sub>BIP340/aux</sub>(a)''<ref>The auxiliary random data is hashed (with a unique tag) as a precaution against situations where the randomness may be correlated with the private key itself. It is xored with the private key (rather than combined with it in a hash) to reduce the number of operations exposed to the actual secret key.</ref>.
161+
* Let ''t'' be the byte-wise xor of ''bytes(d)'' and ''hash<sub>BIP340/aux</sub>(a)''<ref>The auxiliary random data is hashed (with a unique tag) as a precaution against situations where the randomness may be correlated with the private key itself. It is xored with the private key (rather than combined with it in a hash) to reduce the number of operations exposed to the actual secret key.</ref>.
162162
* Let ''rand = hash<sub>BIP340/nonce</sub>(t || bytes(P) || m)''<ref>Including the [https://moderncrypto.org/mail-archive/curves/2020/001012.html public key as input to the nonce hash] helps ensure the robustness of the signing algorithm by preventing leakage of the secret key if the calculation of the public key ''P'' is performed incorrectly or maliciously, for example if it is left to the caller for performance reasons.</ref>.
163163
* Let ''k' = int(rand) mod n''<ref>Note that in general, taking a uniformly random 256-bit integer modulo the curve order will produce an unacceptably biased result. However, for the secp256k1 curve, the order is sufficiently close to ''2<sup>256</sup>'' that this bias is not observable (''1 - n / 2<sup>256</sup>'' is around ''1.27 * 2<sup>-128</sup>'').</ref>.
164164
* Fail if ''k' = 0''.

0 commit comments

Comments
 (0)