The current implementation of BIP340Signer.sign() must calculate pBytes with a point multiply.
In libsecp256k1 this multiply operation is avoided by passing a secp256k1_keypair to secp256k1_schnorrsig_sign32().
BIP340Signer could potentially be optimized by creating a subclass of ECPrivateKeyParameters (or maybe ParametersWithRandom?) that contains the x-only pubkey. If BIP340Signer.sign() checks for the subclass it could use the x-only pub-key to avoid this multiplication.
This should speed up signing by approximately 2x.
The current implementation of
BIP340Signer.sign()must calculatepByteswith a point multiply.In libsecp256k1 this multiply operation is avoided by passing a
secp256k1_keypairtosecp256k1_schnorrsig_sign32().BIP340Signercould potentially be optimized by creating a subclass ofECPrivateKeyParameters(or maybeParametersWithRandom?) that contains the x-only pubkey. IfBIP340Signer.sign()checks for the subclass it could use the x-only pub-key to avoid this multiplication.This should speed up signing by approximately 2x.