/***********************************************************************
 * Distributed under the MIT software license, see the accompanying    *
 * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
 ***********************************************************************/

#ifndef SECP256K1_MODULE_CHILLDKG_CERTEQ_H
#define SECP256K1_MODULE_CHILLDKG_CERTEQ_H

#include "../../../include/secp256k1.h"

#include "util.h"

/* This file contains the internal CertEq equality-check sub-protocol of the
 * ChillDKG module, mirroring the certeq_* functions of
 * chilldkg_ref/chilldkg.py of the bip-frost-dkg reference implementation.
 *
 * The CertEq message of participant i is
 *   pad33("BIP DKG/certeq message") || u32be(i) || eq_input
 * signed with plain BIP 340 (tag prefix "BIP0340") under the participant's
 * host key. */

/* Produce the CertEq signature of the given participant over eq_input
 * (certeq_participant_step). Returns 1 on success and 0 if hostseckey32 is
 * invalid. On failure, sig64 is set to zero. */
static int secp256k1_chilldkg_certeq_participant_step(const secp256k1_context *ctx, unsigned char *sig64, const unsigned char *hostseckey32, uint32_t participant_id, const unsigned char *eq_input, size_t eq_input_len, const unsigned char *aux_rand32);

/* Verify all n CertEq signatures of a certificate (64 bytes per participant)
 * against the host public keys (certeq_verify). The signature of participant
 * i is verified against the x-only encoding of hostpubkeys33[i]; the message
 * commits to the full 33-byte key via eq_input, so dropping the sign byte is
 * okay (see the reference). Returns 1 if all signatures are valid and 0
 * otherwise; in the latter case *fault_index receives the index of the first
 * invalid signature. */
static int secp256k1_chilldkg_certeq_verify(const secp256k1_context *ctx, const unsigned char *hostpubkeys33, size_t n, const unsigned char *eq_input, size_t eq_input_len, const unsigned char *cert, uint32_t *fault_index);

#endif
