bip340: Add subsection on Domain Separation

Author: real-or-random

bip-0340.mediawiki

@@ -237,6 +237,25 @@ the algorithms of the signature scheme will perform more hashing internally.
 In particular, the hashing performed by the signing algorithm will process the message twice,
 which leads to performance penalties for large messages.
 
+==== Domain Separation ====
+
+It is good cryptographic practice to use a key pair only for a single purpose.
+Nevertheless, there may be situations in which it may be desirable to use the same key pair in multiple contexts,
+i.e., to sign different types of messages within the same application
+or even messages in entirely different applications
+(e.g., a secret key may be used to sign Bitcoin transactions as well plain text messages).
+
+As a consequence, applications should ensure that a signed application message intended for one context is never deemed valid in a different context
+(e.g., a signed plain text message should never be misinterpreted as a signed Bitcoin transaction, because this could cause unintended loss of funds).
+This is called "domain separation" and it is typically realized by partitioning the message space.
+Even if key pairs are intended to be used only within a single context,
+domain separation is a good idea because it makes it easy to add more contexts later.
+
+As a best practice, we recommend to pre-process application messages before passing it the signature scheme as follows:
+* Either, pre-hash the application message using ''hash<sub>tag</sub>'', where the ''tag'' is a byte string that identifies the context uniquely (e.g., "my-fancy-application/signing-foo-messages"),
+* or prefix the actual message with a 64-byte string that identifies the context uniquely (e.g. "my-fancy-application/signing-foo-messages", padded with null bytes to 64 bytes).
+As the two pre-processing methods yield different sizes (32 bytes vs. at least 64 bytes), there is no risk of collision between them.
+
 == Applications ==
 
 There are several interesting applications beyond simple signatures.