|
| 1 | +#ifndef _SECP256K1_SCHNORR_ |
| 2 | +# define _SECP256K1_SCHNORR_ |
| 3 | + |
| 4 | +# include "secp256k1.h" |
| 5 | + |
| 6 | +# ifdef __cplusplus |
| 7 | +extern "C" { |
| 8 | +# endif |
| 9 | + |
| 10 | +/** Create a signature using a custom EC-Schnorr-SHA256 construction. It |
| 11 | + * produces non-malleable 64-byte signatures which support public key recovery |
| 12 | + * batch validation, and multiparty signing. |
| 13 | + * Returns: 1: signature created |
| 14 | + * 0: the nonce generation function failed, or the private key was |
| 15 | + * invalid. |
| 16 | + * In: ctx: pointer to a context object, initialized for signing |
| 17 | + * (cannot be NULL) |
| 18 | + * msg32: the 32-byte message hash being signed (cannot be NULL) |
| 19 | + * seckey: pointer to a 32-byte secret key (cannot be NULL) |
| 20 | + * noncefp:pointer to a nonce generation function. If NULL, |
| 21 | + * secp256k1_nonce_function_default is used |
| 22 | + * ndata: pointer to arbitrary data used by the nonce generation |
| 23 | + * function (can be NULL) |
| 24 | + * Out: sig64: pointer to a 64-byte array where the signature will be |
| 25 | + * placed (cannot be NULL) |
| 26 | + */ |
| 27 | +int secp256k1_schnorr_sign( |
| 28 | + const secp256k1_context_t* ctx, |
| 29 | + const unsigned char *msg32, |
| 30 | + unsigned char *sig64, |
| 31 | + const unsigned char *seckey, |
| 32 | + secp256k1_nonce_function_t noncefp, |
| 33 | + const void *ndata |
| 34 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); |
| 35 | + |
| 36 | +/** Verify a signature created by secp256k1_schnorr_sign. |
| 37 | + * Returns: 1: correct signature |
| 38 | + * 0: incorrect signature |
| 39 | + * In: ctx: a secp256k1 context object, initialized for verification. |
| 40 | + * msg32: the 32-byte message hash being verified (cannot be NULL) |
| 41 | + * sig64: the 64-byte signature being verified (cannot be NULL) |
| 42 | + * pubkey: the public key to verify with (cannot be NULL) |
| 43 | + */ |
| 44 | +SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_verify( |
| 45 | + const secp256k1_context_t* ctx, |
| 46 | + const unsigned char *msg32, |
| 47 | + const unsigned char *sig64, |
| 48 | + const secp256k1_pubkey_t *pubkey |
| 49 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); |
| 50 | + |
| 51 | +/** Recover an EC public key from a Schnorr signature created using |
| 52 | + * secp256k1_schnorr_sign. |
| 53 | + * Returns: 1: public key successfully recovered (which guarantees a correct |
| 54 | + * signature). |
| 55 | + * 0: otherwise. |
| 56 | + * In: ctx: pointer to a context object, initialized for |
| 57 | + * verification (cannot be NULL) |
| 58 | + * msg32: the 32-byte message hash assumed to be signed (cannot |
| 59 | + * be NULL) |
| 60 | + * sig64: signature as 64 byte array (cannot be NULL) |
| 61 | + * Out: pubkey: pointer to a pubkey to set to the recovered public key |
| 62 | + * (cannot be NULL). |
| 63 | + */ |
| 64 | +int secp256k1_schnorr_recover( |
| 65 | + const secp256k1_context_t* ctx, |
| 66 | + const unsigned char *msg32, |
| 67 | + const unsigned char *sig64, |
| 68 | + secp256k1_pubkey_t *pubkey |
| 69 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); |
| 70 | + |
| 71 | +/** Generate a nonce pair deterministically for use with |
| 72 | + * secp256k1_schnorr_partial_sign. |
| 73 | + * Returns: 1: valid nonce pair was generated. |
| 74 | + * 0: otherwise (nonce generation function failed) |
| 75 | + * In: ctx: pointer to a context object, initialized for signing |
| 76 | + * (cannot be NULL) |
| 77 | + * msg32: the 32-byte message hash assumed to be signed (cannot |
| 78 | + * be NULL) |
| 79 | + * sec32: the 32-byte private key (cannot be NULL) |
| 80 | + * noncefp: pointer to a nonce generation function. If NULL, |
| 81 | + * secp256k1_nonce_function_default is used |
| 82 | + * noncedata: pointer to arbitrary data used by the nonce generation |
| 83 | + * function (can be NULL) |
| 84 | + * Out: pubnonce: public side of the nonce (cannot be NULL) |
| 85 | + * privnonce32: private side of the nonce (32 byte) (cannot be NULL) |
| 86 | + * |
| 87 | + * Do not use the output as a private/public key pair for signing/validation. |
| 88 | + */ |
| 89 | +int secp256k1_schnorr_generate_nonce_pair( |
| 90 | + const secp256k1_context_t* ctx, |
| 91 | + const unsigned char *msg32, |
| 92 | + const unsigned char *sec32, |
| 93 | + secp256k1_nonce_function_t noncefp, |
| 94 | + const void* noncedata, |
| 95 | + secp256k1_pubkey_t *pubnonce, |
| 96 | + unsigned char *privnonce32 |
| 97 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7); |
| 98 | + |
| 99 | +/** Produce a partial Schnorr signature, which can be combined using |
| 100 | + * secp256k1_schnorr_partial_combine, to end up with a full signature that is |
| 101 | + * verifiable using secp256k1_schnorr_verify. |
| 102 | + * Returns: 1: signature created succesfully. |
| 103 | + * 0: no valid signature exists with this combination of keys, nonces |
| 104 | + * and message (chance around 1 in 2^128) |
| 105 | + * -1: invalid private key, nonce, or public nonces. |
| 106 | + * In: ctx: pointer to context object, initialized for signing (cannot |
| 107 | + * be NULL) |
| 108 | + * msg32: pointer to 32-byte message to sign |
| 109 | + * sec32: pointer to 32-byte private key |
| 110 | + * secnonce32: pointer to 32-byte array containing our nonce |
| 111 | + * pubnonce_others: pointer to pubkey containing the sum of the other's |
| 112 | + * nonces (see secp256k1_ec_pubkey_combine) |
| 113 | + * Out: sig64: pointer to 64-byte array to put partial signature in |
| 114 | + * |
| 115 | + * The intended procedure for creating a multiparty signature is: |
| 116 | + * - Each signer S[i] with private key x[i] and public key Q[i] runs |
| 117 | + * secp256k1_schnorr_generate_nonce_pair to produce a pair (k[i],R[i]) of |
| 118 | + * private/public nonces. |
| 119 | + * - All signers communicate their public nonces to each other (revealing your |
| 120 | + * private nonce can lead to discovery of your private key, so it should be |
| 121 | + * considered secret). |
| 122 | + * - All signers combine all the public nonces they received (excluding their |
| 123 | + * own) using secp256k1_ec_pubkey_combine to obtain an |
| 124 | + * Rall[i] = sum(R[0..i-1,i+1..n]). |
| 125 | + * - All signers produce a partial signature using |
| 126 | + * secp256k1_schnorr_partial_sign, passing in their own private key x[i], |
| 127 | + * their own private nonce k[i], and the sum of the others' public nonces |
| 128 | + * Rall[i]. |
| 129 | + * - All signers communicate their partial signatures to each other. |
| 130 | + * - Someone combines all partial signatures using |
| 131 | + * secp256k1_schnorr_partial_combine, to obtain a full signature. |
| 132 | + * - The resulting signature is validatable using secp256k1_schnorr_verify, with |
| 133 | + * public key equal to the result of secp256k1_ec_pubkey_combine of the |
| 134 | + * signers' public keys (sum(Q[0..n])). |
| 135 | + * |
| 136 | + * Note that secp256k1_schnorr_partial_combine and secp256k1_ec_pubkey_combine |
| 137 | + * function take their arguments in any order, and it is possible to |
| 138 | + * pre-combine several inputs already with one call, and add more inputs later |
| 139 | + * by calling the function again (they are commutative and associative). |
| 140 | + */ |
| 141 | +SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_sign( |
| 142 | + const secp256k1_context_t* ctx, |
| 143 | + const unsigned char *msg32, |
| 144 | + unsigned char *sig64, |
| 145 | + const unsigned char *sec32, |
| 146 | + const unsigned char *secnonce32, |
| 147 | + const secp256k1_pubkey_t *pubnonce_others |
| 148 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6); |
| 149 | + |
| 150 | +/** Combine multiple Schnorr partial signatures. |
| 151 | + * Returns: 1: the passed signatures were succesfully combined. |
| 152 | + * 0: the resulting signature is not valid (chance of 1 in 2^256) |
| 153 | + * -1: some inputs were invalid, or the signatures were not created |
| 154 | + * using the same set of nonces |
| 155 | + * In: ctx: pointer to a context object |
| 156 | + * sig64: pointer to a 64-byte array to place the combined signature |
| 157 | + * (cannot be NULL) |
| 158 | + * n: the number of signatures to combine (at least 1) |
| 159 | + * Out: sig64sin: pointer to an array of n pointers to 64-byte input |
| 160 | + * signatures |
| 161 | + */ |
| 162 | +SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_partial_combine( |
| 163 | + const secp256k1_context_t* ctx, |
| 164 | + unsigned char *sig64, |
| 165 | + int n, |
| 166 | + const unsigned char * const * sig64sin |
| 167 | +) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4); |
| 168 | + |
| 169 | +# ifdef __cplusplus |
| 170 | +} |
| 171 | +# endif |
| 172 | + |
| 173 | +#endif |
0 commit comments