search

rust-bitcoin / rust-secp256k1

Rust language bindings for Bitcoin secp256k1 library.
Creative Commons Zero v1.0 Universal
341 stars 262 forks source link

Make schnorr sign/verify accept a message slice instead of 32 bytes `Message` #706

Closed elichai closed 3 months ago

elichai commented 3 months ago

As discussed on https://github.com/rust-bitcoin/rust-secp256k1/issues/702 and on IRC, BIP340 has evolved from supporting only "pre-hashed" 32 byte messages, to supporting messages of "any length" and as such we should allow the users to pass a message of any length. Note that passing exactly 32 bytes will make the API behave exactly as before (ie it will produce the same signatures).

I added all the test vectors from: https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv To make sure the API is correct even for empty messages and shorter/longer ones :)

apoelstra commented 3 months ago

Can you rebase to get CI passing?

elichai commented 3 months ago

Can you rebase to get CI passing?

Done :)

apoelstra commented 3 months ago

Ok, now the CI failures look real -- formatting and MSRV.

Kixunil commented 3 months ago

I've realized that this adds another reason to have a first-class signing API in bitcoin since this double hashing is not intuitive.

apoelstra commented 3 months ago

For sure -- in Bitcoin we want a signing API that takes the sighash types (or something equivalent) and does the right thing. And which doesn't let you sign arbitrary crap, at least not without first extracting a rust-secp key.

wolfmcnally commented 2 weeks ago

Looking forward to seeing this released! @christophera