Struct Session

Source

pub struct Session(/* private fields */);

Expand description

A musig Signing session.

Implementations§

Source §

impl Session

Source

pub fn new( key_agg_cache: &KeyAggCache, agg_nonce: AggregatedNonce, msg: &[u8; 32], ) -> Session

Creates a new musig signing session.

Takes the public nonces of all signers and computes a session that is required for signing and verification of partial signatures.

§Returns:

A Session that can be later used for signing.

§Arguments:

secp : Secp256k1 context object initialized for signing
key_agg_cache: KeyAggCache to be used for this session
agg_nonce: AggregatedNonce, the aggregate nonce
msg: message that will be signed later on.

Example:


// The session id must be sampled at random. Read documentation for more details.

let msg = b"Public message we want to sign!!";

// Provide the current time for mis-use resistance
let session_secrand1 = SessionSecretRand::from_rng(&mut rand::rng());
let extra_rand1 : Option<[u8; 32]> = None;
let (_sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(session_secrand1, pub_key1, msg, extra_rand1);

// Signer two does the same. Possibly on a different device
let session_secrand2 = SessionSecretRand::from_rng(&mut rand::rng());
let extra_rand2 : Option<[u8; 32]> = None;
let (_sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(session_secrand2, pub_key2, msg, extra_rand2);

let aggnonce = AggregatedNonce::new(&[&pub_nonce1, &pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

Source

pub fn partial_sign( &self, secnonce: SecretNonce, keypair: &Keypair, key_agg_cache: &KeyAggCache, ) -> PartialSignature

Produces a partial signature for a given key pair and secret nonce.

Remember that nonce reuse will immediately leak the secret key!

§Returns:

A PartialSignature that can be later be aggregated into a schnorr::Signature

§Arguments:

secp : Secp256k1 context object initialized for signing
sec_nonce: SecretNonce to be used for this session that has never been used before. For mis-use resistance, this API takes a mutable reference to sec_nonce and sets it to zero even if the partial signing fails.
key_pair: The Keypair to sign the message
key_agg_cache: KeyAggCache containing the aggregate pubkey used in the creation of this session

§Errors:

If the provided SecretNonce has already been used for signing

Source

pub fn partial_verify( &self, key_agg_cache: &KeyAggCache, partial_sig: &PartialSignature, pub_nonce: &PublicNonce, pub_key: PublicKey, ) -> bool

Checks that an individual partial signature verifies

This function is essential when using protocols with adaptor signatures. However, it is not essential for regular MuSig’s, in the sense that if any partial signatures does not verify, the full signature will also not verify, so the problem will be caught. But this function allows determining the specific party who produced an invalid signature, so that signing can be restarted without them.

§Returns:

true if the partial signature successfully verifies, otherwise returns false

§Arguments:

secp : Secp256k1 context object initialized for signing
key_agg_cache: KeyAggCache containing the aggregate pubkey used in the creation of this session
partial_sig: PartialSignature sent by the signer associated with the given pub_nonce and pubkey
pub_nonce: The PublicNonce of the signer associated with the partial_sig and pub_key
pub_key: The XOnlyPublicKey of the signer associated with the given partial_sig and pub_nonce

Example:


// The session id must be sampled at random. Read documentation for more details.

let msg = b"Public message we want to sign!!";

// Provide the current time for mis-use resistance
let session_secrand1 = SessionSecretRand::from_rng(&mut rand::rng());
let (mut sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(session_secrand1, pub_key1, msg, None);

// Signer two does the same. Possibly on a different device
let session_secrand2 = SessionSecretRand::from_rng(&mut rand::rng());
let (_sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(session_secrand2, pub_key2, msg, None);

let aggnonce = AggregatedNonce::new(&[&pub_nonce1, &pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

let keypair = Keypair::from_secret_key(&sk1);
let partial_sig1 = session.partial_sign(
    sec_nonce1,
    &keypair,
    &key_agg_cache,
);

assert!(session.partial_verify(
    &key_agg_cache,
    &partial_sig1,
    &pub_nonce1,
    pub_key1,
));

Source

pub fn partial_sig_agg( &self, partial_sigs: &[&PartialSignature], ) -> AggregatedSignature

Aggregate partial signatures for this session into a single schnorr::Signature

§Returns:

A single schnorr::Signature. Note that this does NOT mean that the signature verifies with respect to the aggregate public key.

§Arguments:

partial_sigs: Array of PartialSignature to be aggregated


let key_agg_cache = KeyAggCache::new(&[pub_key1, pub_key2]);
// The session id must be sampled at random. Read documentation for more details.

let msg = b"Public message we want to sign!!";

// Provide the current time for mis-use resistance
let session_secrand1 = SessionSecretRand::from_rng(&mut rand::rng());
let (mut sec_nonce1, pub_nonce1) = key_agg_cache.nonce_gen(session_secrand1, pub_key1, msg, None)
    .expect("non zero session id");

// Signer two does the same. Possibly on a different device
let session_secrand2 = SessionSecretRand::from_rng(&mut rand::rng());
let (mut sec_nonce2, pub_nonce2) = key_agg_cache.nonce_gen(session_secrand2, pub_key2, msg, None)
    .expect("non zero session id");

let aggnonce = AggregatedNonce::new(&[pub_nonce1, pub_nonce2]);

let session = Session::new(
    &key_agg_cache,
    aggnonce,
    msg,
);

let partial_sig1 = session.partial_sign(
    sec_nonce1,
    &Keypair::from_secret_key(&sk1),
    &key_agg_cache,
).unwrap();

// Other party creates the other partial signature
let partial_sig2 = session.partial_sign(
    sec_nonce2,
    &Keypair::from_secret_key(&sk2),
    &key_agg_cache,
).unwrap();

let partial_sigs = [partial_sign1, partial_sign2];
let partial_sigs_ref: Vec<&PartialSignature> = partial_sigs.iter().collect();
let partial_sigs_ref = partial_sigs_ref.as_slice();

let aggregated_signature = session.partial_sig_agg(partial_sigs_ref);

// Get the final schnorr signature
assert!(aggregated_signature.verify(&agg_pk, &msg_bytes).is_ok());