Crate frostito 

frostito — threshold Schnorr for custodial groups.

Distributed key generation, FROST signing, nested FROST, and proactive resharing, over ristretto255, Pallas, secp256k1 and decaf377.

What is here, and what is not

The signing math is being rooted in ZF frost-core, which implements RFC 9591 and has been audited. What this crate adds is the part frost-core deliberately leaves to the caller:

• sealed — confidential, authenticated DKG round 2 over Noise_K. frost_core::keys::dkg::part2 requires the caller to supply that channel and provides none.
• dkg — an echo round over the round-1 set, so an equivocating dealer cannot hand two participants different commitments, plus signed, ceremony-bound complaints and a quorum-gated tally.
• reshare — dealerless rotation to a different committee with a different threshold, group key preserved. frost_core::keys::refresh is trusted-dealer, cannot grow the set, and cannot change the threshold.
• nested — one outer FROST position held distributively by an inner group, the outer share never materialized as a scalar.

Curve backends

ristretto255 (default), pallas (including the Orchard spend-auth group), secp256k1, decaf377. ZF ships FROST ciphersuites for the first three; zf supplies the fourth.

Caller obligations

Three things this crate cannot do for you, each of which has been got wrong in practice: reliable broadcast (the echo round compares digests, it does not deliver them), agreement on complaints across nodes, and durable spent-nonce state. See the module docs for each.

Re-exports

pub use context::SigningContext;

pub use context::SIGNING_CONTEXT_DOMAIN;

pub use curve::Curve;

pub use curve::CurvePoint;

pub use curve::CurveScalar;

pub use curve::ristretto::Ristretto255;

pub use curve::pallas::OrchardSpendAuthCurve;

pub use curve::pallas::PallasCurve;

pub use curve::secp256k1::Secp256k1Curve;

pub use curve::decaf377::Decaf377Curve;

Modules

context

Epoch-bound signing contexts.

curve

Curve abstraction

dkg

Distributed key generation (Feldman VSS)

frost

FROST: Flexible Round-Optimized Schnorr Threshold signatures

liveness

Liveness proofs for custodian participation

nested

nested FROST: one outer share controlled by an inner threshold group

reshare

Proactive secret sharing reshare protocol

sealed

Confidential, authenticated delivery of DKG round-2 sub-shares.

zf

ZF frost-core integration.

Structs

SecretShare

A secret share from DKG

Enums

Error

Errors returned by this crate

Functions

compute_lagrange_coefficients

Compute Lagrange interpolation coefficients for a set of indices.

random_scalar

Sample a uniform scalar for any backend curve, from a rand_core 0.6 RNG.