Schnorr constructions

schnorr_tweaks.md

Pay to Contract

P' = P + H(P||S)G
d' = d + H(P||S)
Examples:

1. P is a public key, S is a bitcoin script with a locktime for a different Key(Q).
   The owner of P can sign for P' and spend the output regularly(by signing with d').
   OR the owner of Q can provide P and S and then get evaluated by S as a regular script. (and if the script evaluates to true he can get the money)

2. S is a hash of a document and this is used to timestamp data, not the best way since you need this to be able to sign on the transaction later and this isn't saved anywhere.

Sign to contract

R' = R + H(R||c)G
k' = k + H(R||c)
Examples:

1. Commit to some data (i.e. timestamps).
2. Use this as auxilary data for a sidechain/payment channel(liquid, lightning etc.).

Adaptor Signatures

s' = k + ed + t
s'G = R(kG) + eP(dG) + T(tG)
This is only useful in MuSig, otherwise the signer can replace R with whatever he wants, rendering t signature useless.
Examples:

1. Atomic Swaps:
   Alice and Bob have a 2-Out-of-2 address on both litecoin and bitcoin. Alice want to sell 10LTC to Bob for 1BTC.
   She provides to bob 2 adaptor signatures with the same T, one for the 10LTC and another for the 1BTC.
   Bob in exchange gives her 2 regular schnorr signatures(partial signatures).
   Alice creates a full signature for the 1BTC and broadcast it.
   Bob sees that signature. subtract from it his signature and the adaptor signature, and from that he gets -t.
   Now he get add that to the adaptor signature for the 10LTC, add his signature and get his money.

2. Same can be done with lightning channels. of course you'll need a TimeLock option to revert the operation in case of non cooperative party.

Math:
Alice1: s_a1 = k_a1 + e₁d_a + t
Alice2: s_a2 = k_a2 + e₂d_a + t

Bob1: s_b1 = k_b1 + e₁d_b
Bob2: s_b2 = k_b2 + e₂d_b

Alice1 Sends: s' = s_a1 + s_b1 - t
Bob calculate: s'- s_a1 - s_b1 == -t

Bob send: s' = s_b2 + s_a2 + (-t)