From 0940575215f282456d689e7ce2c83a1c40a9c86b Mon Sep 17 00:00:00 2001 From: Elliott Jin Date: Tue, 5 Apr 2022 12:23:36 -0400 Subject: [PATCH] musig-spec: Clarify negation for signing and verification --- doc/musig-spec.mediawiki | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/doc/musig-spec.mediawiki b/doc/musig-spec.mediawiki index fe8e05dc..26c2417f 100644 --- a/doc/musig-spec.mediawiki +++ b/doc/musig-spec.mediawiki @@ -426,27 +426,28 @@ Input: In order to produce a partial signature for an X-only public key that is an aggregate of ''u'' X-only keys and tweaked ''v'' times (X-only or ordinarily), the ''[[#Sign negation|Sign]]'' algorithm may need to negate the secret key during the signing process. -The following public keys arise as intermediate steps in the MuSig2 protocol: -• ''Pi'' as computed in ''KeyAggInternal'' is the point corresponding to the ''i''-th signer's X-only public key. Defining ''d'i'' to be the ''d' '' value as computed in the ''Sign'' algorithm of the ''i''-th signer, we have +The following elliptic curve points arise as intermediate steps in the MuSig2 protocol: +• ''Pi'' as computed in ''KeyAggInternal'' is the point corresponding to the ''i''-th signer's X-only public key. Defining ''d'i'' to be the ''i''-th signer's secret key as an integer, i.e. the ''d' '' value as computed in the ''Sign'' algorithm of the ''i''-th signer, we have ''Pi = with_even_y(d'i⋅G) ''. • ''Q0'' is an aggregate of the signer's public keys and defined in ''KeyAggInternal'' as ''Q0 = a1⋅P1 + a2⋅P1 + ... + au⋅Pu''. • ''Qi'' as computed in ''Tweak'' for ''1 ≤ i ≤ v'' is the tweaked public key after the ''i''-th tweaking operation. It holds that ''Qi = f(i-1) + ti⋅G'' for ''i = 1, ..., v'' where - ''f(i) := with_even_y(Qi)'' if ''is_xonly_ti+1'' and - ''f(i) := Qi'' otherwise. + ''f(i-1) := with_even_y(Qi-1)'' if ''is_xonly_ti'' and + ''f(i-1) := Qi-1'' otherwise. +• ''with_even_y(Qv)'' is the final result of ''KeyAgg''. -The goal is to produce a partial signature corresponding to the output of ''KeyAgg'', i.e., the final (X-only) public key point after ''v'' tweaking operations ''with_even_y(Qv)''. +The signer's goal is to produce a partial signature corresponding to the final result of ''KeyAgg'', i.e. the X-only public key ''with_even_y(Qv)''. -We define ''gpi'' for ''1 ≤ i ≤ u'' to be ''gp '' as computed in the ''Sign'' algorithm of the ''i''-th signer. It holds that +We define ''gpi'' for ''1 ≤ i ≤ u'' to be ''gp '' as computed in the ''Sign'' algorithm of the ''i''-th signer. Note that ''gpi'' indicates whether the ''i''-th signer needed to negate their secret key to produce an X-only public key. In particular, ''Pi = gpi⋅d'i⋅G''. -For ''0 ≤ i ≤ v-1'', the ''Tweak'' algorithm called from ''KeyAggInternal'' sets ''gi'' to ''-1 mod n'' if and only if ''is_xonly_ti+1'' is true and ''Qi'' has an odd Y coordinate. Therefore, we have +For ''0 ≤ i ≤ v-1'', the ''Tweak'' algorithm called from ''KeyAggInternal'' sets ''gi'' to ''-1 mod n'' if and only if ''is_xonly_ti+1'' is true and ''Qi'' has an odd Y coordinate. In other words, ''gi'' indicates whether ''Qi'' needed to be negated to apply an X-only tweak: ''f(i) = gi⋅Qi'' for ''0 ≤ i ≤ v - 1''. -Furthermore, the ''Sign'' and ''PartialSigVerify'' algorithms set ''gv'' such that +Furthermore, the ''Sign'' and ''PartialSigVerify'' algorithms set ''gv'' depending on whether ''Qv'' needed to be negated to produce the (X-only) final output of ''KeyAgg': ''with_even_y(Qv) = gv⋅Qv''. @@ -483,7 +484,7 @@ Then we have = sumi=1..u(gv⋅gaccv⋅gpi⋅ai⋅d'i)*G''. -Thus, signer ''i'' multiplies its secret key ''d'i'' with ''gv⋅gaccv⋅gpi'' in the ''[[#Sign negation|Sign]]'' algorithm. +Intuitively, ''gacci'' tracks accumulated sign flipping and ''tacci'' tracks the accumulated tweak value after applying the first ''i'' individual tweaks. Additionally, ''gv'' indicates whether ''Qv'' needed to be negated to produce the final X-only result, and ''gpi'' indicates whether ''d'i'' needs to be negated to produce the initial X-only key ''Pi''. Thus, signer ''i'' multiplies its secret key ''d'i'' with ''gv⋅gaccv⋅gpi'' in the ''[[#Sign negation|Sign]]'' algorithm. ==== Negation Of The Public Key When Partially Verifying ==== @@ -503,6 +504,7 @@ The verifier doesn't have access to ''d⋅G'', but can construct it using the xo ''d⋅G = gv⋅gaccv⋅gp⋅d'⋅G = gv⋅gaccv⋅point(pk*)'' +Note that the aggregate public key and list of tweaks are inputs to partial signature verification, so the verifier can also construct ''gv'' and ''gaccv''. === Dealing with Infinity in Nonce Aggregation ===