Adaptor Signatures FtW

[!NOTE] I am not a cryptographer, nor a mathematician. This article is the result of my own research and understanding of the subject. If you find any mistakes, please let me know!

The vast majority of what is written here is taken from various sources, which are listed at the end of this article. I highly recommend you to read them if you want to dive deeper into the subject.

When we compute and share a Schnorr signature, anyone can directly verify if it is valid for the attached message and signer. But what if we wanted to defer revealing the full signature while already emitting it to other people? We can produce such a signature by encrypting the nonce it contains with an additional scalar $𝑦$ .

This scalar will be published “along” with the signature in its public form $𝑌 = 𝑦 \cdot 𝐺$ . The basic signing process is the following:

Sample the random nonce $\hat{𝑟} \leftarrow 𝔽_{𝑞}$ , along with the locking scalar $𝑦 \leftarrow 𝔽_{𝑞}$
Compute their public versions $\hat{𝑅} = \hat{𝑟} \cdot 𝐺$ and $𝑌 = 𝑦 \cdot 𝐺$
Compute the aggregated public nonce $𝑅 = \hat{𝑅} + 𝑌$ .
Hash the challenge $𝑒 = 𝐻 (𝑅 ‖ 𝑃 ‖ 𝑚)$ using the aggregated nonce $𝑅$ and $𝑃 = 𝑝 \cdot 𝐺$ , where $𝑝$ is the private key of the signer.
Compute and publish the (encrypted) locked signature $\hat{𝑠} = \hat{𝑟} + 𝑒 𝑝$

[!NOTE] You may notice that we’re never actually using $𝑦$ in the signing process. This is a feature, not a bug! We can also generate this locked signature only knowing $𝑌$ .

The final published data should be $(𝑅, \hat{𝑠}, 𝑌)$ (along with the message $𝑚$ of course).

Anyone with $𝑦$ will now be able to get the “decrypted” signature $𝑠$ , which is behind the locking point $𝑌$ .

With $𝑟 = \hat{𝑟} + 𝑦$ , we will define $𝑠$ as follows:

\begin{aligned} 𝑠 & = 𝑟 + 𝑒 𝑝 \\ = (\hat{𝑟} + 𝑦) + 𝑒 𝑝 \\ = (\hat{𝑟} + 𝑒 𝑝) + 𝑦 \\ = \hat{𝑠} + 𝑦 \end{aligned}

Likewise, if someone had both $𝑠$ and $\hat{𝑠}$ , they would also be able to recover $𝑦$ :

\begin{aligned} 𝑠 = \hat{𝑠} + 𝑦 \\ ⟺ & 𝑦 = 𝑠 - \hat{𝑠} \end{aligned}

While $\hat{𝑠}$ isn’t a valid Schnorr signature by itself:

\begin{matrix} 𝑒 = 𝐻 (𝑅 ‖ 𝑃 ‖ 𝑚) \end{matrix}

\begin{aligned} \hat{𝑠} \cdot 𝐺 & \overset{?}{=} 𝑅 + 𝑒 𝑃 \\ = (\hat{𝑅} + 𝑌) + 𝑒 𝑃 \\ = (\hat{𝑟} + 𝑦) \cdot 𝐺 + 𝑒 𝑝 \cdot 𝐺 \\ = (\hat{𝑟} + 𝑦 + 𝑒 𝑝) \cdot 𝐺 \\ = (\hat{𝑟} + 𝑒 𝑝) \cdot 𝐺 + 𝑌 \\ = \hat{𝑠} \cdot 𝐺 + 𝑌 \neq \hat{𝑠} \cdot 𝐺 \end{aligned}

We notice we can make the verification equation work if we add the public locking point $𝑌$ :

\hat{𝑠} \cdot 𝐺 + 𝑌 \overset{?}{=} 𝑅 + 𝑒 𝑃

While this doesn’t give us $𝑠$ , we can confirm that by adding $𝑦$ to $\hat{𝑠}$ , the resulting signature will be the one we’re expecting!

\begin{aligned} (\hat{𝑠} + 𝑦) \cdot 𝐺 & \overset{?}{=} 𝑅 + 𝑒 𝑃 \\ = (𝑅 + 𝑌) + 𝑒 𝑃 \\ = (𝑟 + 𝑦) \cdot 𝐺 + 𝑒 𝑝 \cdot 𝐺 \\ = ((𝑟 + 𝑒 𝑝) + 𝑦) \cdot 𝐺 \\ = (\hat{𝑠} + 𝑦) \cdot 𝐺 ✓ \end{aligned}

Atomic Swaps

Exchanging cryptocurrencies between different blockchains is hard. Typically, you’d need a trusted third party to act as a middleman, which would obviously need to be compensated financially for his work. Doing things this way is costly and pretty inefficient. Instead, we can leverage Adaptor Signatures to ensure that either both parties get what they expected, either both get nothing.

We have Alice, holder of $1 ♣︎$ , and Bob, holder of $1 ♥︎$ . They want to exchange both their balances, and we assume they already know each other’s addresses on both chains.

Alice starts by sampling ${\hat{𝑟}}_{𝐴}, 𝑦 \leftarrow 𝔽_{𝑞}$ , and computes an adaptor signature as usual, on a message $𝑚$ that attests the transaction of her $1 ♣︎$ to Bob’s address:

\begin{matrix} {\hat{𝑅}}_{𝐴} = {\hat{𝑟}}_{𝐴} \cdot 𝐺, 𝑌 = 𝑦 \cdot 𝐺 \\ 𝑅_{𝐴} = {\hat{𝑅}}_{𝐴} + 𝑌 \\ 𝑒_{𝐴} = 𝐻 (𝑅_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) \\ {\hat{𝑠}}_{𝐴} = {\hat{𝑟}}_{𝐴} + 𝑒_{𝐴} 𝑝_{𝐴} \end{matrix}

The BIP340 standard expects to receive a signature pair in the form $(𝑂, 𝜎)$ , on which the following check is performed:

𝜎 \cdot 𝐺 \overset{?}{=} 𝑂 + 𝐻 (𝑂 ‖ 𝑃 ‖ 𝑚) 𝑃

If Bob was to try to give in $𝑂 = {\hat{𝑅}}_{𝐴}$ and $𝜎 = {\hat{𝑠}}_{𝐴}$ :

\begin{aligned} {\hat{𝑠}}_{𝐴} \cdot 𝐺 & \overset{?}{=} {\hat{𝑅}}_{𝐴} + 𝐻 ({\hat{𝑅}}_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) 𝑃_{𝐴} \\ \neq \underset{{\hat{𝑠}}_{𝐴} \cdot 𝐺}{\underset{⏟}{{\hat{𝑅}}_{𝐴} + 𝐻 (𝑅_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) 𝑃_{𝐴}}} \end{aligned}

Or $𝑂 = 𝑅_{𝐴}$ and $𝜎 = {\hat{𝑠}}_{𝐴}$ :

\begin{aligned} {\hat{𝑠}}_{𝐴} \cdot 𝐺 & \overset{?}{=} 𝑅_{𝐴} + 𝐻 (𝑅_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) 𝑃_{𝐴} \\ \neq \underset{{\hat{𝑠}}_{𝐴} \cdot 𝐺}{\underset{⏟}{{\hat{𝑅}}_{𝐴} + 𝐻 (𝑅_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) 𝑃_{𝐴}}} \end{aligned}

You could say that he cannot satisfy both the challenge $𝑒$ and the nonce $𝑂$ . To do so, he needs to know $𝑦$ to compute $𝑠_{𝐴} = {\hat{𝑠}}_{𝐴} + 𝑦$ so that when he gives in $𝑂 = 𝑅_{𝐴}$ and $𝜎 = 𝑠_{𝐴}$ :

\begin{aligned} ({\hat{𝑠}}_{𝐴} + 𝑦) \cdot 𝐺 & \overset{?}{=} 𝑅_{𝐴} + 𝐻 (𝑅_{𝐴} ‖ 𝑃_{𝐴} ‖ 𝑚) 𝑃_{𝐴} \\ = (𝑟_{𝐴} + 𝑒_{𝐴} 𝑝_{𝐴}) \cdot 𝐺 \\ = 𝑠_{𝐴} \cdot 𝐺 ✓ \end{aligned}

Back to our stuff, when Bob receives the adaptor signature $(𝑅, \hat{𝑠}, 𝑌)$ from Alice, after having carefully verified that the given data is correct, he can also generate his own adaptor signature $𝑠_{𝐵}$ on Alice’s $𝑦$ by using $𝑌$ :

\begin{matrix} {\hat{𝑟}}_{𝐵} \leftarrow 𝔽_{𝑞} \\ 𝑅_{𝐵} = {\hat{𝑟}}_{𝐵} \cdot 𝐺 + 𝑌 \\ {\hat{𝑠}}_{𝐵} = {\hat{𝑟}}_{𝐵} + 𝐻 (𝑅_{𝐵} ‖ 𝑃_{𝐵} ‖ 𝑚) 𝑝_{𝐵} \end{matrix}

After he sends it to Alice, she can claim the transaction linked to the signature ${\hat{𝑠}}_{𝐵}$ by unlocking it with her $𝑦$ and publishing it to the blockchain. By doing so, everyone will be able to see the transaction and the associated decrypted signature $𝑠_{𝐵} = {\hat{𝑠}}_{𝐵} + 𝑦$ .

After this publication, Bob will also be able to compute $𝑦$ and unlock Alice’s ${\hat{𝑠}}_{𝐴}$ :

\begin{matrix} 𝑦 = 𝑠_{𝐵} - {\hat{𝑠}}_{𝐵} \\ 𝑠_{𝐴} = {\hat{𝑠}}_{𝐴} + 𝑦 \end{matrix}

Nullifying Adaptor Signatures

In the previous case, we saw how two parties could jointly sign a transaction without the need for a trusted third party. But what if one of the parties wanted to cancel the transaction?

If Alice wants to cancel the transaction, she can simply discard her $𝑦$ and never publish it. Bob will then be unable to unlock the signature ${\hat{𝑠}}_{𝐴}$ and claim the transaction.

However, if Bob wants to cancel the transaction, how can Alice confirm that she will never publish $𝑠_{𝐵}$ ? There needs to be some sort of threat against Alice to ensure that she will not publish $𝑠_{𝐵}$ .

Private Key Exposure Threat

By publishing her random nonce ${\hat{𝑟}}_{𝐴}$ , Alice guarantees that she will never publish $𝑠_{𝐵}$ . Otherwise, Bob will be able to recover $𝑦 = 𝑠_{𝐵} - {\hat{𝑠}}_{𝐵}$ and thus compute Alice’s private key $𝑝_{𝐴}$ :

\begin{aligned} 𝑠_{𝐴} & = {\hat{𝑠}}_{𝐴} + 𝑦 \\ = \underset{known}{\underset{⏟}{{\hat{𝑟}}_{𝐴} + 𝑦 + 𝑒}} \cdot 𝑝_{𝐴} \\ ⟺ 𝑝_{𝐴} & = 𝑒^{- 1} (𝑠_{𝐴} - (\hat{𝑟} + 𝑦)) \end{aligned}

Bob can also verify that the nonce ${\hat{𝑟}}_{𝐴}$ published by Alice is authentic:

𝑅_{𝐴} = {\hat{𝑟}}_{𝐴} \cdot 𝐺 + 𝑌

One cool feature of $𝑘$ -of- $𝑛$ treshold schemes, such as Shamir’s Secret Sharing, is that they can be integrated into pretty much anything that has a secret in it. This includes Adaptor signatures locking scalars!

By defining our polynomial $𝑓 (𝑥)$ as follows:

𝑓 (𝑥) = 𝑦 + 𝑎_{1} 𝑥 + 𝑎_{2} 𝑥^{2} + \dots + 𝑎_{𝑘 - 1} 𝑥^{𝑘 - 1}

We can split our locking scalar $𝑦$ into $𝑛$ shares $𝑦_{𝑖} | 1 \leq 𝑖 \leq 𝑛$ :

𝑦_{𝑖} = 𝑓 (𝑖)

With $𝑘$ shareholders forming the recovery group $𝑅$ , we can then collectively reconstruct $𝑦$ with Lagrange interpolation (or any other similar interpolation method):

𝑦 = 𝑓 (0) = \sum_{𝑖 \in 𝑅} 𝑦_{𝑖} \cdot \prod_{𝑗 \in 𝑅, 𝑗 \neq 𝑖} \frac{0 - 𝑗}{𝑖 - 𝑗}

And unlock the adaptor signature!

𝑠 = \hat{𝑠} + 𝑦

References and Suggested readings

The Riddles of Adaptor Signatures
conduition.io
Bitcoin Optech - Adaptor Signatures
bitcoinops.org
Adaptor Signatures: New Security Definition and A Generic Construction for NP Relations⋆
Xiangyu Liu, Ioannis Tzannetos, and Vassilis Zikas
eprint.iacr.org [PDF]
OlderElliptic Curves for Sane People NewerSquarePants Sponge Hashing
© 2026 cstef
Tags Now UsesRSS Atom JSON

Atomic Swaps

Nullifying Adaptor Signatures

Private Key Exposure Threat

Secret Sharing + Adaptor Signatures = ?

References and Suggested readings