← Back to Bitcoin Improvement Proposals
BIPinformationalkey-management

BIP-374: Pass G and m to VerifyProof in GenerateProof self-check

Problem: In GenerateProof step 85 the self-check calls VerifyProof(A, B, C, proof) without G and m, but VerifyProof is defined as VerifyProof(A, B, C, proof, G, m). This omission breaks self-check when a non-empty message m is used or when a non-default generator G is passed. Evidence: Spec definition requires G and m: The algorithm ''VerifyProof(A, B, C, proof, G, m)'' is defined as: * Fail if any of ''is_infinite(A)'', ''is_infinite(B)'', ''is_infinite(C)'', ''is_infinite(G)'' *

No reviews
Forostovec·Updated Oct 23, 2025·0 reviews·0 attestations·View source
Collections:BIPs — Merged

Specification

Problem: In GenerateProof step 85 the self-check calls VerifyProof(A, B, C, proof) without G and m, but VerifyProof is defined as VerifyProof(A, B, C, proof, G, m). This omission breaks self-check when a non-empty message m is used or when a non-default generator G is passed.

Evidence: Spec definition requires G and m:

The algorithm ''VerifyProof(A, B, C, proof, G, m)'' is defined as:
* Fail if any of ''is_infinite(A)'', ''is_infinite(B)'', ''is_infinite(C)'', ''is_infinite(G)''
* Let ''e = int(proof[0:32])''.
* Let ''s = int(proof[32:64])''; fail if ''s ≥ n''.

Reference implementation passes G and m in the self-check: bip-0374/reference.py

proof = e.to_bytes(32, \"big\") + s.to_bytes(32, \"big\")
if not dleq_verify_proof(A, B, C, proof, G=G, m=m):
    return None
    

GenerateProof includes m in challenge derivation and treats G as an input, so omitting them in VerifyProof recomputes a different challenge and will fail for non-empty m and non-default G.

Discussion (0 threads)

Loading discussions...