<p>As with any open source project, if no one cares enough to implement it, it doesn't get implemented. Providing no auxiliary randomness is still safe as the deterministic nonce generation algorithm includes the private key. This is enough entropy for it to be safe, so there isn't any need to provide any auxiliary randomness, although it would probably be nice to do so.</p>
<p>Additionally, we like deterministic signatures, so if auxiliary randomness were to be provided, it would need to be generated in a deterministic way so that all attempts to make a signature over the same message with the same private key always results in the same signature. Implementing that was presumably more effort than it was worth.</p>

CC BY-SA 4.0
2023-08-03T04:41:03.210Z
If it's deterministic, it's not random. The advice in BIP340 is to actually use random auxiliary data - that implies that re-signing the same message with the same key won't be the same.
Pieter Wuille
CC BY-SA 4.0
2023-08-03T02:19:20.843Z
2023-08-03T02:19:20.843Z
Ava Chow
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki" rel="noreferrer">BIP340</a> recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows:</p>
<blockquote>
<p>Using unpredictable randomness additionally increases protection against other side-channel attacks, and is recommended whenever available.</p>
</blockquote>
<p>However, Core always seems to provide a zeroed vector for auxiliary randomness. There's a relevant <a href="https://github.com/bitcoin/bitcoin/commit/2478c6730a81dda3c56cb99087caf6abe49c85f5" rel="noreferrer">commit</a>.</p>
<p>Given that Core uses randomness in generation of private keys, shouldn't it be using randomness in performance of Schnorr signatures as well?</p>

<bitcoin-core><bitcoin-core-development><cryptography><schnorr-signatures><random>
Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?
Matthew Leon
# Why doesn't Bitcoin Core use auxiliary randomness when performing Schnorr signatures?

(Asked by: username_0 on 2023-07-23)

[BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) recommends using auxiliary randomness in generation of the Schnorr signature nonce, as follows:

> Using unpredictable randomness additionally increases protection against other side-channel attacks, and is recommended whenever available.

However, Core always seems to provide a zeroed vector for auxiliary randomness. There's a relevant [commit](https://github.com/bitcoin/bitcoin/commit/2478c6730a81dda3c56cb99087caf6abe49c85f5).

Given that Core uses randomness in generation of private keys, shouldn't it be using randomness in performance of Schnorr signatures as well?

**Tags:** bitcoin-core, bitcoin-core-development, cryptography, schnorr-signatures, random


---

## 1 answers

### Answer by username_1 on 2023-08-03. Score: 6

As with any open source project, if no one cares enough to implement it, it doesn't get implemented. Providing no auxiliary randomness is still safe as the deterministic nonce generation algorithm includes the private key. This is enough entropy for it to be safe, so there isn't any need to provide any auxiliary randomness, although it would probably be nice to do so.

Additionally, we like deterministic signatures, so if auxiliary randomness were to be provided, it would need to be generated in a deterministic way so that all attempts to make a signature over the same message with the same private key always results in the same signature. Implementing that was presumably more effort than it was worth.

> **Comments:**
> **username_2**: If it's deterministic, it's not random. The advice in BIP340 is to actually use random auxiliary data - that implies that re-signing the same message with the same key won't be the same.  

---

