provoost on Nostr: Thanks for your thoughts! By commitment I indeed meant the point, not the hash of a ...
Thanks for your thoughts!
By commitment I indeed meant the point, not the hash of a point. Since that commits to a secret. But in the context of how musig1 worked, that's probably not the best term.
I'm a bit confused by what R_{...} means in this notation: R_{A1}+R_{B1})
Did you mean to add an extra closing curly bracket here: b * (R_{A2 + R_{B2})
So: b * (R_{A2 + R_{B2}})
Or did you mean: b * (R_{A2 + B2})
What I was wondering about is what happens if B1 = -A1 and B2 = -A2, and then Alice goes ahead and produces a partial signature. In the case of b * (R_{A2 + R_{B2}) the aggregate nonce would be zero, but in the case of b * (R_{A2 + R_{B2}) the aggregate nonce can't be zero.
IIUC if Alice were to provide a partial signature with an aggregate nonce of 0 she'd reveal her private key? But if the aggregate can't be zero then that's not a concern. Or if the partial signature doesn't use the aggregate key, I guess it's also not a concern.
By commitment I indeed meant the point, not the hash of a point. Since that commits to a secret. But in the context of how musig1 worked, that's probably not the best term.
I'm a bit confused by what R_{...} means in this notation: R_{A1}+R_{B1})
Did you mean to add an extra closing curly bracket here: b * (R_{A2 + R_{B2})
So: b * (R_{A2 + R_{B2}})
Or did you mean: b * (R_{A2 + B2})
What I was wondering about is what happens if B1 = -A1 and B2 = -A2, and then Alice goes ahead and produces a partial signature. In the case of b * (R_{A2 + R_{B2}) the aggregate nonce would be zero, but in the case of b * (R_{A2 + R_{B2}) the aggregate nonce can't be zero.
IIUC if Alice were to provide a partial signature with an aggregate nonce of 0 she'd reveal her private key? But if the aggregate can't be zero then that's not a concern. Or if the partial signature doesn't use the aggregate key, I guess it's also not a concern.