Struct schnorrkel::musig::MuSig

source · [−]

pub struct MuSig<T: SigningTranscript + Clone, S> { /* private fields */ }

Expand description

Schnorr multi-signature (MuSig) container generic over its session types

Implementations

source

impl<T: SigningTranscript + Clone, S> MuSig<T, S>

source

pub fn public_keys(
&self,
require_reveal: bool
) -> impl Iterator<Item = &PublicKey>

Iterates over public keys.

If require_reveal=true then we count only public key that revealed their R values.

source

pub fn public_key(&self) -> PublicKey

Aggregate public key given currently revealed R values

source

pub fn expected_public_key(&self) -> PublicKey

Aggregate public key expected if all currently committed nodes fully participate

source

impl<T, S> MuSig<T, S> where
T: SigningTranscript + Clone,
S: TranscriptStages,

source

pub fn transcript(&mut self) -> &mut T

We permit extending the transcript whenever you like, so that say the message may be agreed upon in parallel to the commitments. We advise against doing so however, as this requires absolute faith in your random number generator, usually rand::thread_rng().

source

impl<K, T> MuSig<T, CommitStage<K>> where
K: Borrow<Keypair>,
T: SigningTranscript + Clone,

source

pub fn new(keypair: K, t: T) -> MuSig<T, CommitStage<K>>

Initialize a multi-signature aka cosignature protocol run.

We encurage borrowing the Keypair to minimize copies of the private key, so we provide the Keypair::musig method for the K = &'k Keypair case. You could use Rc or Arc with this MuSig::new method, or even pass in an owned copy.

source

pub fn our_commitment(&self) -> Commitment

Our commitment to our R to send to all other cosigners

source

pub fn add_their_commitment(
 &mut self,
 them: PublicKey,
 theirs: Commitment
) -> SignatureResult<()>

Add a new cosigner’s public key and associated R bypassing our commitmewnt phase.

source

pub fn reveal_stage(self) -> MuSig<T, RevealStage<K>>

Commit to reveal phase transition.

source

impl<K, T> MuSig<T, RevealStage<K>> where
K: Borrow<Keypair>,
T: SigningTranscript + Clone,

source

pub fn our_reveal(&self) -> &Reveal

Reveal our R contribution to send to all other cosigners

source

pub fn add_their_reveal(
 &mut self,
 them: PublicKey,
 theirs: Reveal
) -> SignatureResult<()>

Include a revealed R value from a previously committed cosigner

source

pub fn add_trusted(
 &mut self,
 them: PublicKey,
 theirs: Reveal
) -> SignatureResult<()>

Add a new cosigner’s public key and associated R bypassing our commitmewnt phase.

We implemented defenses that reduce the risks posed by this method, but anyone who wishes provable security should heed the advice below:

Avoid using this due to the attack described in “On the Provable Security of Two-Round Multi-Signatures” by Manu Drijvers, Kasra Edalatnejad, Bryan Ford, and Gregory Neven https://eprint.iacr.org/2018/417 Avoid using this for public keys held by networked devices in particular.

There are however limited scenarios in which using this appears secure, primarily if the trusted device is (a) air gapped, (b) stateful, and (c) infrequently used, via some constrained channel like manually scanning QR code. Almost all hardware wallets designs fail (b), but non-hardware wallets fail (a), with the middle ground being only something like Pairty Signer. Also, any public keys controlled by an organization likely fail (c) too, making this only useful for individuals.

source