Quote from: kzv on April 02, 2022, 08:32:48 AM

I don't think the article is wrong. Most likely I'm missing something. Can anyone help with understanding these formulas?

It is possible; I'm not sure that the blog post is actually accurate.

The paper I knew about adaptor signatures is this one: https://github.com/LLFourn/one-time-VES/blob/master/main.pdf
I haven't gone through it completely so far, but it seems more 'complete' to say the least.

To be honest, now that we do have Schnorr signatures in Bitcoin, spending too much time on ECDSA doesn't make too much sense anyway.
Rene Pickhardt made a pretty good video about Adaptor Signatures in Schnorr: https://www.youtube.com/watch?v=a8Pdpz_Jzok
I really like how he intuitively explains the concept and proves it in program code afterwards.

There is also a presentation by Conner Formknecht from Lightning Labs about 'Scriptless 2P-ECDSA', but while he does explain the concept and signature process, he doesn't show the decryption.

My blind guess would be that the blog post equations don't add up because the whole thing was over-simplified. They also use very weird notation, which may confuse the both of us, like not defining R=rG and stuff like this.