Struct Session

Source

pub struct Session(/* private fields */);

Expand description

A musig Signing session.

Implementations§

Source §

impl Session

Source

pub fn new( key_agg_cache: &KeyAggCache, agg_nonce: AggregatedNonce, msg: &[u8; 32], ) -> Session

Creates a new musig signing session.

Takes the public nonces of all signers and computes a session that is required for signing and verification of partial signatures.

§Returns

A Session that can be later used for signing.

§Arguments

key_agg_cache: KeyAggCache to be used for this session.
agg_nonce: AggregatedNonce, the aggregate nonce.
msg: message that will be signed later on.

§Examples


// The counter must never repeat for a given keypair.
// Read documentation for more details.

let msg = b"Public message we want to sign!!";

let keypair1 = Keypair::from_secret_key(&sk1);
let (_sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(0, &keypair1, msg, None);

// Signer two does the same. Possibly on a different device
let keypair2 = Keypair::from_secret_key(&sk2);
let (_sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(0, &keypair2, msg, None);

let aggnonce = AggregatedNonce::new(&[&pub_nonce1, &pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

Source

pub fn partial_sign( &self, secnonce: SecretNonce, keypair: &Keypair, key_agg_cache: &KeyAggCache, ) -> PartialSignature

Produces a partial signature for a given key pair and secret nonce.

Remember that nonce reuse will immediately leak the secret key!

§Returns

A PartialSignature that can later be aggregated into a schnorr::Signature

§Arguments

secnonce: SecretNonce to be used for this session that has never been used before. For mis-use resistance, this API takes ownership of secnonce, and sets it to zero even if the partial signing fails.
keypair: The Keypair to sign the message with.
key_agg_cache: KeyAggCache containing the aggregate pubkey used in the creation of this session.

§Panics

If the provided SecretNonce has already been used for signing.

Source

pub fn partial_verify( &self, key_agg_cache: &KeyAggCache, partial_sig: &PartialSignature, pub_nonce: &PublicNonce, pub_key: PublicKey, ) -> bool

Checks that an individual partial signature verifies.

This function is essential when using protocols with adaptor signatures. However, it is not essential for regular MuSig’s, in the sense that if any partial signature does not verify, the full signature will also not verify, so the problem will be caught. But this function allows determining the specific party who produced an invalid signature, so that signing can be restarted without them.

§Returns

true if the partial signature successfully verifies, otherwise returns false.

§Arguments

key_agg_cache: KeyAggCache containing the aggregate pubkey used in the creation of this session.
partial_sig: PartialSignature sent by the signer associated with the given pub_nonce and pub_key.
pub_nonce: The PublicNonce of the signer associated with the partial_sig and pub_key.
pub_key: The PublicKey of the signer associated with the given partial_sig and pub_nonce.

§Examples


// The counter must never repeat for a given keypair.
// Read documentation for more details.

let msg = b"Public message we want to sign!!";

let keypair1 = Keypair::from_secret_key(&sk1);
let (sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(0, &keypair1, msg, None);

// Signer two does the same. Possibly on a different device
let keypair2 = Keypair::from_secret_key(&sk2);
let (_sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(0, &keypair2, msg, None);

let aggnonce = AggregatedNonce::new(&[&pub_nonce1, &pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

let partial_sig1 = session.partial_sign(
    sec_nonce1,
    &keypair1,
    &key_agg_cache,
);

assert!(session.partial_verify(
    &key_agg_cache,
    &partial_sig1,
    &pub_nonce1,
    pub_key1,
));

Source

pub fn partial_sig_agg( &self, partial_sigs: &[&PartialSignature], ) -> AggregatedSignature

Aggregates partial signatures for this session into a single AggregatedSignature.

§Returns

A single AggregatedSignature. Note that this does NOT mean that the signature verifies with respect to the aggregate public key.

§Arguments

partial_sigs: Array of PartialSignature to be aggregated.

§Examples


let key_agg_cache = KeyAggCache::new(&[&pub_key1, &pub_key2]);
// The counter must never repeat for a given keypair.
// Read documentation for more details.

let msg = b"Public message we want to sign!!";

let keypair1 = Keypair::from_secret_key(&sk1);
let (sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(0, &keypair1, msg, None);

// Signer two does the same. Possibly on a different device
let keypair2 = Keypair::from_secret_key(&sk2);
let (sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(0, &keypair2, msg, None);

let aggnonce = AggregatedNonce::new(&[&pub_nonce1, &pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

let partial_sig1 = session.partial_sign(
    sec_nonce1,
    &keypair1,
    &key_agg_cache,
);

// Other party creates the other partial signature
let partial_sig2 = session.partial_sign(
    sec_nonce2,
    &keypair2,
    &key_agg_cache,
);

let partial_sigs = [partial_sig1, partial_sig2];
let partial_sigs_ref: Vec<&PartialSignature> = partial_sigs.iter().collect();
let partial_sigs_ref = partial_sigs_ref.as_slice();

let aggregated_signature = session.partial_sig_agg(partial_sigs_ref);

// Get the final schnorr signature
assert!(aggregated_signature.verify(&key_agg_cache.agg_pk(), msg.as_slice()).is_ok());