bip-taproot: Publick key tweak resulting in point-at-infinity about bips HOT 5 CLOSED

Not sure about documenting, but unlike tweak_add which you can easily pass the inversion of the point.
Here to commitment includes the point you're adding to, so you can't manufacture an inversion.
And assuming SHA256 is random then the probability of that happening is 1 over the group order

from bips.

I do not see that this tweak function does it. It usually happens inside the function that utilizes this one for the actual commitment procedure.

from bips.

As you can see there's an if, it can definitely fail.

https://github.com/bitcoin-core/secp256k1/blob/master/src/secp256k1.c#L596

https://github.com/bitcoin-core/secp256k1/blob/master/src/eckey_impl.h#L63

from bips.

My comment was related to this:

Here to commitment includes the point you're adding to, so you can't manufacture an inversion.

meaning that the ecp256k1_ec_pubkey_tweak_add does not commit to the original untweaked value of the public key (which, as far as I have understood, is what you meant in your comment).

Thanks for the links, I have figured out that also b/c of Sipa comment here: bitcoin-core/secp256k1#697

from bips.

Is this resolved?

from bips.