<blockquote>
  <p>Is it safe to use HD Key Derivation with bip-schnorr?</p>
</blockquote>

<p>Yes, it is designed to be.</p>

<blockquote>
  <p>The bip mentions that you should not throw away the first byte of a generated key.</p>
</blockquote>

<p>Perhaps this is worded confusingly.</p>

<p>It means that you can't use a variant of the signature scheme, which uses full public keys, but then throws away one byte of the public key at verification time. Doing so would just result in 50% of the signatures being rejected (because the public key wouldn't match what was used at signing time).</p>

<blockquote>
  <p>It sounds like its safe for the prover to drop the extra byte but not the verifier. </p>
</blockquote>

<p>This has nothing to do with safety, but about correctness.</p>

CC BY-SA 4.0
2019-09-20T19:42:11.963Z
2019-09-20T19:42:11.963Z
Pieter Wuille
<p>Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key.</p>

<blockquote>
  <p>It is important to not mix up the 32-byte bip-schnorr public key format and other existing public key formats (e.g. encodings used in Bitcoin's ECDSA). Concretely, a verifier should only accept 32-byte public keys and not, for example, convert a 33-byte public key by throwing away the first byte.</p>
</blockquote>

<p>Later in the bip, it mentions that you should do this when doing HD key derivation.</p>

<p>Link: <a href="https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#public-key-generation" rel="nofollow noreferrer">https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#public-key-generation</a></p>

<blockquote>
  <p>Alternatively, the public key can be created according to BIP32 which describes the derivation of 33-byte compressed public keys. In order to translate such public keys into bip-schnorr compatible keys, the first byte must be dropped.</p>
</blockquote>

<p>It sounds like its safe for the prover to drop the extra byte but not the verifier. Is this correct?</p>

<bip32-hd-wallets><bip><schnorr-signatures>
bip-schnorr and HD Key Derivation
Mark Tyneway
# bip-schnorr and HD Key Derivation

(Asked by: username_0 on 2019-09-20)

Is it safe to use HD Key Derivation with bip-schnorr? The bip mentions that you should not throw away the first byte of a generated key.

> It is important to not mix up the 32-byte bip-schnorr public key format and other existing public key formats (e.g. encodings used in Bitcoin's ECDSA). Concretely, a verifier should only accept 32-byte public keys and not, for example, convert a 33-byte public key by throwing away the first byte.

Later in the bip, it mentions that you should do this when doing HD key derivation.

Link: <https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#public-key-generation>

> Alternatively, the public key can be created according to BIP32 which describes the derivation of 33-byte compressed public keys. In order to translate such public keys into bip-schnorr compatible keys, the first byte must be dropped.

It sounds like its safe for the prover to drop the extra byte but not the verifier. Is this correct?

**Tags:** bip32-hd-wallets, bip, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2019-09-20. Score: 1

> Is it safe to use HD Key Derivation with bip-schnorr?

Yes, it is designed to be.

> The bip mentions that you should not throw away the first byte of a generated key.

Perhaps this is worded confusingly.

It means that you can't use a variant of the signature scheme, which uses full public keys, but then throws away one byte of the public key at verification time. Doing so would just result in 50% of the signatures being rejected (because the public key wouldn't match what was used at signing time).

> It sounds like its safe for the prover to drop the extra byte but not the verifier.

This has nothing to do with safety, but about correctness.


---

