<p>If I got your question right, you need to check if someone actually have a scalar <code>s</code> such that <code>s*G == S</code>? If you need to explicitly commit to <code>s</code>, like:</p>
<p><code>&lt;s&gt; OP_ECC_MULL_G &lt;S&gt; OP_CHECK_EQUAL_VERIFY</code></p>
<p>where <code>OP_ECC_MULL_G</code> multiplies a scalar <code>s</code> by secp's generator point. This is impossible to do with script, as it doesn't expose ECC operations directly.</p>
<p>If you just want to check whether the party has the secret, this is just a simple signature:
<code>&lt;S&gt; OP_CHECK_SIG_VERIFY</code>. One can only satisfy this script iff they known <code>s</code></p>

CC BY-SA 4.0
2023-03-02T20:20:23.883Z
Thank you it does make sense to use `OP_CHECK_SIG_VERIFY` the main question now is will the public key for a script that just checks for `OP_CHECK_SIG_VERIFY` on `s` look like `sG` or something similar? If so then that will satisfy the requirements, but if the value can not be represented in a public way like this the other party can't audit the swap which is essential. Is this basically just creating a regular public key? Or would I need to do something else.
Poseidon
CC BY-SA 4.0
2023-03-02T22:04:38.383Z
You have to publish the public key `sG` and the signature. For taproot, the public key will go in the spk, and the signature will be in the witness. The public key will always be available for verification...
Davidson Souza
CC BY-SA 4.0
2023-03-02T18:37:22.193Z
2023-03-02T18:37:22.193Z
Davidson Souza
<p>I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a scalar by the curve generator to check for the correct secret scalar value. Is there a way Bitcoin script can handle this?</p>

<script><secp256k1><atomic-swap>
Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?
Poseidon
# Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?

(Asked by: username_0 on 2023-03-02)

I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a scalar by the curve generator to check for the correct secret scalar value. Is there a way Bitcoin script can handle this?

**Tags:** script, secp256k1, atomic-swap


---

## 1 answers

### Answer by username_1 on 2023-03-02. Score: 1 | Accepted answer

If I got your question right, you need to check if someone actually have a scalar `s` such that `s*G == S`? If you need to explicitly commit to `s`, like:

`<s> OP_ECC_MULL_G <S> OP_CHECK_EQUAL_VERIFY`

where `OP_ECC_MULL_G` multiplies a scalar `s` by secp's generator point. This is impossible to do with script, as it doesn't expose ECC operations directly.

If you just want to check whether the party has the secret, this is just a simple signature:
`<S> OP_CHECK_SIG_VERIFY`. One can only satisfy this script iff they known `s`

> **Comments:**
> **username_0**: Thank you it does make sense to use `OP_CHECK_SIG_VERIFY` the main question now is will the public key for a script that just checks for `OP_CHECK_SIG_VERIFY` on `s` look like `sG` or something similar? If so then that will satisfy the requirements, but if the value can not be represented in a public way like this the other party can't audit the swap which is essential. Is this basically just creating a regular public key? Or would I need to do something else.  
> **username_1**: You have to publish the public key `sG` and the signature. For taproot, the public key will go in the spk, and the signature will be in the witness. The public key will always be available for verification...  

---

