Author: Russell O'Connor 2018-08-05 14:33:52
Published on: 2018-08-05T14:33:52+00:00
The proposed change from "Let R = sG - eP" to "Let R = sG + eP" for the verification equation allows faster verification by avoiding negating a point or coefficient. Computing the non-quadratic residue is not the same cost as computing a quadratic residue, so the revised proposed change makes the verification equation "R + sG + eP = 0," which is suitable for batch verification. For single signature verification, the check becomes computing Q := sG + eP, verifying that Q isn't the point at infinity and Q.x = r, and verifying that Q.y is *not* a quadratic residue. The proposal effectively suggests negating the 's' value in a signature instead of the 'e' value. Changing the verification equation removes one negation operation from the cost of doing verification in either verification procedure.
Updated on: 2023-06-13T03:43:36.836964+00:00