Add total public excess to Schnorr challenge

[jaspervdm]

Currently a kernel signature is defined as the pair (s,kG), where s=k+ex, with k a nonce and x the (secret) excess. The challenge e is defined as e=SHA256(kG|M). To conform to BIP-schnorr (#1294 and here under "key prefixing") and enable features such as atomic swaps, I propose we modify the challenge to

e = SHA256(kG|xG|M)

Doing so will tie the signature to the excess, meaning the same signature for excess x can't be used to sign a kernel with excess x'=x+a.

I am preparing a PR for the grin fork of libsecp256k1, so that the aggsig module can support both types of challenges. If others agree that this change should be implemented, changes to rust-secp256k1-zkp and grin are necessary as well.

Enabling this feature on T3 will require a hardfork. We might want to consider doing this (together with some other improvements), also to gain some experience in doing hardforks before mainnet launch.

Any comments/suggestions are welcome!

[ignopeverell]

Is this merged? Can we close this now?

[garyyu]

Yes. Closed by #1501 and secp256k1-zkp PR: mimblewimble/secp256k1-zkp#22