Implements the SpeedyMuSig protocol; a secure 2-round interactive multisignature scheme whose signature outputs can be verified by a regular Schnorr verification algorithm. More...

#include <multisig.hpp>

Classes
struct	MultiSigPublicKey
	MultiSigPublicKey wraps a signer's public key g1::affine_element along with a proof of posession: a signature whose message is the public key, signed by the corresponding private key. More...

struct	RoundOnePrivateOutput

struct	RoundOnePublicOutput

Public Types
using	Fq = typename G1::Fq

using	Fr = typename G1::Fr

using	affine_element = typename G1::affine_element

using	element = typename G1::element

using	key_pair = crypto::schnorr_key_pair< Fr, G1 >

using	RoundTwoPublicOutput = Fr

Static Public Member Functions
static std::optional< affine_element >	validate_and_combine_signer_pubkeys (const std::vector< MultiSigPublicKey > &signer_pubkeys)
	Computes the sum of all signer pubkeys. Output is the public key of the public-facing schnorr multisig "signer".

static std::pair< RoundOnePublicOutput, RoundOnePrivateOutput >	construct_signature_round_1 ()
	First round of SpeedyMuSig. Signers generate random nonce keypairs R = {r, [R]}, S = {s, [S]}.

static std::optional< RoundTwoPublicOutput >	construct_signature_round_2 (const std::string &message, const key_pair &signer, const RoundOnePrivateOutput &signer_round_1_private_output, const std::vector< MultiSigPublicKey > &signer_pubkeys, const std::vector< RoundOnePublicOutput > &round_1_nonces)
	Second round of SpeedyMuSig. Given the signer pubkeys and the output of round 1, round 2 has each signer compute a share of the Schnorr signature scheme's `s` parameter.

static std::optional< schnorr_signature >	combine_signatures (const std::string &message, const std::vector< MultiSigPublicKey > &signer_pubkeys, const std::vector< RoundOnePublicOutput > &round_1_nonces, const std::vector< RoundTwoPublicOutput > &round_2_signature_shares)
	the final step in the SpeedyMuSig multisig scheme. Can be computed by an untrusted 3rd party. Combines the message, signer pubkeys and round1 outputs to compute the Schnorr signature parameter `e`. Combines the outputs of round 2 to compose the total Schnorr signature parameter `s`

Static Private Member Functions
static bool	valid_round1_nonces (const std::vector< RoundOnePublicOutput > &round1_public_outputs)
	given a list of commitments to nonces produced in round 1, we check that all points are valid and that the list does not contain duplicates

static Fr	generate_nonce_challenge (const std::string &message, const affine_element &aggregate_pubkey, const std::vector< RoundOnePublicOutput > &round_1_nonces)
	Generates the Fiat-Shamir challenge `a` that is used to create a Schnorr signature nonce group element [R], where [R] is a uniformly randomly distributed combination of the signer nonces.

static affine_element	construct_multisig_nonce (const Fr &a, const std::vector< RoundOnePublicOutput > &round_1_nonces)
	Compute the Schnorr signature scheme's nonce group element [R], given each signer's public nonces [R_user], [S_user] and the nonce challenge `a`

template<typename T >
static std::vector< size_t >	duplicated_indices (const std::vector< T > &input)
	Returns a vector of indices of elements in input that are included more than once.

Detailed Description

template<typename G1, typename HashRegNon, typename HashSig = Blake2sHasher>
class bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >

Implements the SpeedyMuSig protocol; a secure 2-round interactive multisignature scheme whose signature outputs can be verified by a regular Schnorr verification algorithm.

Template Parameters

G1	The elliptic curve group being used to generate the multisignature
HashRegNon	Hash function used to model H_reg and H_non. It must be different from H_sig for proper domain separation.
HashSig	Hash function used generate the Fiat-Shamir challenge for the signature (H_sig).

SpeedyMuSig paper at https://eprint.iacr.org/2021/1375.pdf

Definition at line 34 of file multisig.hpp.

Member Typedef Documentation

◆ affine_element

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::affine_element = typename G1::affine_element

Definition at line 44 of file multisig.hpp.

◆ element

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::element = typename G1::element

Definition at line 45 of file multisig.hpp.

◆ Fq

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::Fq = typename G1::Fq

Definition at line 42 of file multisig.hpp.

◆ Fr

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::Fr = typename G1::Fr

Definition at line 43 of file multisig.hpp.

◆ key_pair

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::key_pair = crypto::schnorr_key_pair<Fr, G1>

Definition at line 46 of file multisig.hpp.

◆ RoundTwoPublicOutput

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

using bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::RoundTwoPublicOutput = Fr

Definition at line 115 of file multisig.hpp.

Member Function Documentation

◆ combine_signatures()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static std::optional< schnorr_signature > bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::combine_signatures	(	const std::string &	message,
		const std::vector< MultiSigPublicKey > &	signer_pubkeys,
		const std::vector< RoundOnePublicOutput > &	round_1_nonces,
		const std::vector< RoundTwoPublicOutput > &	round_2_signature_shares
	)

inlinestatic

the final step in the SpeedyMuSig multisig scheme. Can be computed by an untrusted 3rd party. Combines the message, signer pubkeys and round1 outputs to compute the Schnorr signature parameter e. Combines the outputs of round 2 to compose the total Schnorr signature parameter s

Parameters

message
signer_pubkeys
round_1_nonces	The outputs of round 1
round_2_signature_shares	The outputs of round 2

Returns: signature it's a Schnorr signature! Looks identical to a regular non-multisig Schnorr signature.; std::nullopt if any of the signature shares are invalid

Definition at line 400 of file multisig.hpp.

◆ construct_multisig_nonce()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static affine_element bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::construct_multisig_nonce	(	const Fr &	a,
		const std::vector< RoundOnePublicOutput > &	round_1_nonces
	)

inlinestaticprivate

Compute the Schnorr signature scheme's nonce group element [R], given each signer's public nonces [R_user], [S_user] and the nonce challenge a

Parameters

a	the nonce challenge
round_1_nonces	the public outputs of round 1 from all signers

Returns: affine_element Schnorr nonce [R]

Definition at line 216 of file multisig.hpp.

◆ construct_signature_round_1()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static std::pair< RoundOnePublicOutput, RoundOnePrivateOutput > bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::construct_signature_round_1 ( )

inlinestatic

First round of SpeedyMuSig. Signers generate random nonce keypairs R = {r, [R]}, S = {s, [S]}.

Parameters

message

Returns: RoundOnePublicOutput group elements [R_user], [S_user]; RoundOnePrivateOutput field elements [r_user], [s_user]

Definition at line 317 of file multisig.hpp.

◆ construct_signature_round_2()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static std::optional< RoundTwoPublicOutput > bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::construct_signature_round_2	(	const std::string &	message,
		const key_pair &	signer,
		const RoundOnePrivateOutput &	signer_round_1_private_output,
		const std::vector< MultiSigPublicKey > &	signer_pubkeys,
		const std::vector< RoundOnePublicOutput > &	round_1_nonces
	)

inlinestatic

Second round of SpeedyMuSig. Given the signer pubkeys and the output of round 1, round 2 has each signer compute a share of the Schnorr signature scheme's s parameter.

Parameters

message
signer
signer_round_1_private_output	the signer's secreet nonce values r, s
signer_pubkeys
round_1_nonces	the output fro round 1

Returns: std::optional<RoundTwoPublicOutput> signer's share of s, if round 2 succeeds

Definition at line 348 of file multisig.hpp.

◆ duplicated_indices()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

template<typename T >

static std::vector< size_t > bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::duplicated_indices ( const std::vector< T > & input )

inlinestaticprivate

Returns a vector of indices of elements in input that are included more than once.

Warning: The returned list may include an index more than once.

Template Parameters

T	implements operator<

Parameters

input list of elements possibly containing duplicates

Returns: std::vector<size_t> a list of indices of input which are included more than once

Definition at line 238 of file multisig.hpp.

◆ generate_nonce_challenge()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static Fr bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::generate_nonce_challenge	(	const std::string &	message,
		const affine_element &	aggregate_pubkey,
		const std::vector< RoundOnePublicOutput > &	round_1_nonces
	)

inlinestaticprivate

Generates the Fiat-Shamir challenge a that is used to create a Schnorr signature nonce group element [R], where [R] is a uniformly randomly distributed combination of the signer nonces.

N.B. a is message and signer dependent and cannot be pre-generated prior to knowing the message being signed over

Warning: the resulting 'a' suffers from a slight bias as we apply r on the 256 bit hash output.

Parameters

message
aggregate_pubkey	the output of `combine_signer_pubkeys`
round_1_nonces	the public outputs of round 1 from all signers

Returns: Fr the nonce challenge a = int(H_non(G, X_agg, "m_start", m.size(), m, "m_end" {(R1, S1), ..., (Rn, Sn)})) % r where r is the field order

Definition at line 160 of file multisig.hpp.

◆ valid_round1_nonces()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static bool bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::valid_round1_nonces ( const std::vector< RoundOnePublicOutput > & round1_public_outputs )

inlinestaticprivate

given a list of commitments to nonces produced in round 1, we check that all points are valid and that the list does not contain duplicates

Parameters

round1_public_outputs a list of pairs of points {(R1,S1), ...., (Rn,Sn)}

Returns: bool whether or not the list is valid.

Definition at line 125 of file multisig.hpp.

◆ validate_and_combine_signer_pubkeys()

template<typename G1 , typename HashRegNon , typename HashSig = Blake2sHasher>

static std::optional< affine_element > bb::crypto::schnorr_multisig< G1, HashRegNon, HashSig >::validate_and_combine_signer_pubkeys ( const std::vector< MultiSigPublicKey > & signer_pubkeys )

inlinestatic

Computes the sum of all signer pubkeys. Output is the public key of the public-facing schnorr multisig "signer".

Parameters

signer_pubkeys

Returns: std::optional<affine_element> the Schnorr aggregate "signer" public key, if all keys are valid.

Definition at line 271 of file multisig.hpp.

The documentation for this class was generated from the following file:

src/barretenberg/crypto/schnorr/multisig.hpp

Classes

Public Types

Static Public Member Functions

Static Private Member Functions

Detailed Description

Member Typedef Documentation

◆ affine_element

◆ element

◆ Fq

◆ Fr

◆ key_pair

◆ RoundTwoPublicOutput

Member Function Documentation

◆ combine_signatures()

◆ construct_multisig_nonce()

◆ construct_signature_round_1()

◆ construct_signature_round_2()

◆ duplicated_indices()

◆ generate_nonce_challenge()

◆ valid_round1_nonces()

◆ validate_and_combine_signer_pubkeys()