Skip to content

feat: prove Batch verify in bip340 - #1

Merged
dni merged 6 commits into
mainfrom
batch-verify
Oct 29, 2026
Merged

dni merged 6 commits into
mainfrom
batch-verify

Conversation

@dni

@dni dni commented Oct 29, 2026

Copy link
Copy Markdown
Owner

No description provided.

dni and others added 6 commits October 13, 2026 09:00
- batchVerify_sound_bits: b-bit coefficients (2^b ≤ n) catch an invalid
  signature except with probability 2^-b
- BIP340Batch: incremental coefficient derivation as a random oracle;
  batch_incremental_sound bounds acceptance of an invalid batch by
  (q + ℓ)/2^b, via a potential-based bad-event lemma (prEvent_bad_le)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- generalize the verifier, game and query bounds over the hash input
  (key L i), shared by both derivations
- batch_indexed_sound: coefficients hashed from (batch, index), as in the
  BIP340 text; same (q + ℓ)/2^b bound
- secp256k1 versions of both bounds with 128-bit coefficients

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
batch_indexed_grind: from one valid signature, an explicit attacker
making q hash queries gets an invalid 2-signature batch accepted with
probability at least 1 - (1 - 2^-b)^q, matching the (q + 2)/2^b upper
bound of batch_indexed_sound up to the ℓ term.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dni
dni merged commit cd949af into main Oct 29, 2026
0 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant