BIP340Signer (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.signers

## Class BIP340Signer

- java.lang.Object
- - org.bouncycastle.crypto.signers.BIP340Signer

- All Implemented Interfaces:
    Signer

      public class BIP340Signer
      extends java.lang.Object
      implements Signer

  Schnorr signatures for secp256k1 per BIP-340 (with the BIP-340bis variable-length-message extension).

  Public keys are the 32-byte big-endian X coordinate of the unique even-Y curve point with that X. Signatures are the fixed 64-byte concatenation `bytes(R) || bytes(s)` — neither encoding matches BC's ECDSA defaults.

  Auxiliary randomness follows the usual BC low-level signer convention: the signer is randomized by default. A `ParametersWithRandom` on `init(boolean, org.bouncycastle.crypto.CipherParameters)` supplies the source for the fresh 32-byte `aux_rand` drawn per `generateSignature()` call (BIP-340 §3.2, recommended for side-channel hardening); when none is supplied the default `CryptoServicesRegistrar` source is substituted, as for `SM2Signer` / `ECDSASigner`. Deterministic Schnorr (aux_rand = 0^32) is BIP-340 compliant but must be requested explicitly via `BIP340Signer(boolean)` — the absence of a supplied SecureRandom does not silently select it.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `BIP340Signer()` Create a randomized BIP-340 signer: a per-signature `aux_rand` is drawn from the supplied `ParametersWithRandom` source, or the default `CryptoServicesRegistrar` source when none is supplied.
    `BIP340Signer(boolean deterministic)`

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static ECPublicKeyParameters` | `decodePublicKey(byte[] xOnly)` Lift a 32-byte x-only BIP-340 public key to an `ECPublicKeyParameters` carrying the unique even-Y secp256k1 point with that X.
    `byte[]` | `generateSignature()` generate a signature for the message we've been loaded with using the key we were initialised with.
    `static ECDomainParameters` | `getDomain()` secp256k1 domain parameters.
    `void` | `init(boolean forSigning, CipherParameters parameters)` Initialise the signer for signing or verification.
    `void` | `reset()` reset the internal state
    `void` | `update(byte b)` update the internal digest with the byte b
    `void` | `update(byte[] in, int off, int len)` update the internal digest with the byte array in
    `boolean` | `verifySignature(byte[] signature)` return true if the internal state represents the signature described in the passed in array.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### BIP340Signer

          public BIP340Signer()

      Create a randomized BIP-340 signer: a per-signature `aux_rand` is drawn from the supplied `ParametersWithRandom` source, or the default `CryptoServicesRegistrar` source when none is supplied.

    - #### BIP340Signer

          public BIP340Signer(boolean deterministic)

      Parameters:
        `deterministic` - when `true`, sign deterministically with `aux_rand = 0^32` (BIP-340 §3.3 default signing with empty auxiliary randomness) and ignore any supplied SecureRandom; when `false` (the usual case) draw a per-signature 32-byte `aux_rand` from the supplied or default SecureRandom.

  - ### Method Detail

    - #### getDomain

          public static ECDomainParameters getDomain()

      secp256k1 domain parameters. Use to construct `ECPrivateKeyParameters` / call an `ECKeyPairGenerator` for BIP-340.

    - #### decodePublicKey

          public static ECPublicKeyParameters decodePublicKey(byte[] xOnly)

      Lift a 32-byte x-only BIP-340 public key to an `ECPublicKeyParameters` carrying the unique even-Y secp256k1 point with that X. Returns `null` for the cases BIP-340 §3.1 defines as verification failures: wrong length, X out of `[0, p)`, or no curve point with that X.

    - #### init

          public void init(boolean forSigning,
                           CipherParameters parameters)

      Description copied from interface: `Signer`
      Initialise the signer for signing or verification.
      Specified by:
        `init` in interface `Signer`
      Parameters:
        `forSigning` - true if for signing, false otherwise
        `parameters` - necessary parameters.

    - #### update

          public void update(byte b)

      Description copied from interface: `Signer`
      update the internal digest with the byte b
      Specified by:
        `update` in interface `Signer`

    - #### update

          public void update(byte[] in,
                             int off,
                             int len)

      Description copied from interface: `Signer`
      update the internal digest with the byte array in
      Specified by:
        `update` in interface `Signer`

    - #### generateSignature

          public byte[] generateSignature()

      Description copied from interface: `Signer`
      generate a signature for the message we've been loaded with using the key we were initialised with.
      Specified by:
        `generateSignature` in interface `Signer`

    - #### verifySignature

          public boolean verifySignature(byte[] signature)

      Description copied from interface: `Signer`
      return true if the internal state represents the signature described in the passed in array.
      Specified by:
        `verifySignature` in interface `Signer`

    - #### reset

          public void reset()

      Description copied from interface: `Signer`
      reset the internal state
      Specified by:
        `reset` in interface `Signer`