<p>The <code>bytes()</code> function is defined in <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#specification" rel="nofollow noreferrer">BIP 340</a> as:</p>
<blockquote>
<p>The function bytes(x), where x is an integer, returns the 32-byte
encoding of x, most significant byte first.</p>
<p>The function bytes(P), where P is a point, returns bytes(x(P)).</p>
</blockquote>
<p>Hence the <code>bytes()</code> function of a point is defined to return the same as the <code>bytes()</code> function of the x coordinate. The y coordinate is thrown away in the case that a point is fed into the <code>bytes()</code> function.</p>

CC BY-SA 4.0
2021-09-27T13:58:43.710Z
This clarifies it. Thank you!
Morten Schaiffel-Nielsen
CC BY-SA 4.0
2021-09-17T10:32:41.657Z
2021-09-17T10:48:50.270Z
2021-09-17T10:48:50.270Z
Michael Folkson
<p>BIP340 describes the Schnorr signature scheme that will be implemented with Taproot.</p>
<p>The signature scheme involves computing an integer, e, during both signing and verification.</p>
<p>Under Default Signing, e is defined as</p>
<blockquote>
<p>Let e = int(hashBIP0340/challenge(bytes(<strong>R</strong>) || bytes(P) || m)) mod n.</p>
</blockquote>
<p>Under Verification, it is defined as</p>
<blockquote>
<p>Let e = int(hashBIP0340/challenge(bytes(<strong>r</strong>) || bytes(P) || m)) mod n.</p>
</blockquote>
<p>It seems to me that a the signature is valid only if e has an unambiguous definition.</p>
<p>Does it use the curve point, R, or its x-coordinate, r?</p>
<p>Link to the BIP340-documentation: <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki" rel="nofollow noreferrer">https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki</a></p>

<bitcoin-core><taproot><schnorr-signatures>
In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?
Morten Schaiffel-Nielsen
# In the Taproot implementation of Schnorr signatures, is "e" the hash of R or r?

(Asked by: username_0 on 2021-09-17)

BIP340 describes the Schnorr signature scheme that will be implemented with Taproot.

The signature scheme involves computing an integer, e, during both signing and verification.

Under Default Signing, e is defined as

> Let e = int(hashBIP0340/challenge(bytes(**R**) || bytes(P) || m)) mod n.

Under Verification, it is defined as

> Let e = int(hashBIP0340/challenge(bytes(**r**) || bytes(P) || m)) mod n.

It seems to me that a the signature is valid only if e has an unambiguous definition.

Does it use the curve point, R, or its x-coordinate, r?

Link to the BIP340-documentation: <https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki>

**Tags:** bitcoin-core, taproot, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2021-09-17. Score: 3

The `bytes()` function is defined in [BIP 340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#specification) as:

> The function bytes(x), where x is an integer, returns the 32-byte
> encoding of x, most significant byte first.
>
> The function bytes(P), where P is a point, returns bytes(x(P)).

Hence the `bytes()` function of a point is defined to return the same as the `bytes()` function of the x coordinate. The y coordinate is thrown away in the case that a point is fed into the `bytes()` function.

> **Comments:**
> **username_0**: This clarifies it. Thank you!  

---

