antiklepto / anti-exfil protocol for Schnorr sigs

[benma]

https://github.com/ElementsProject/secp256k1-zkp/blob/725d895fc54cf82da1c2a9c69048656405da556d/include/secp256k1_ecdsa_s2c.h#L100

Is anyone working on implementing this protocol for Schnorr signatures? Since Taproot is now active, it would be great to have this available to implement in hardware wallets.

@jonasnick @apoelstra

[jonasnick]

All I know is that @dr-orlovsky opened issue #154 for adding sign-to-contract and opened PR bitcoin-core/secp256k1#1018 with an implementaion.

[real-or-random]

What about bitcoin-core/secp256k1#590 ?

[dr-orlovsky]

Yes, I had a plan to work on that, but it could take more time than I originally expected - got really overflow by all the problems during the last months since the war began.

Still pan to work on it one the load will decrease - but if there will be anyone willing to work on it now - I will not object.

[benma]

#154 is a prerequisite for antiklepto - I will work on it.

[benma]

I opened a draft implementation here: bitcoin-core/secp256k1#1140