From 3aec4332b59d496b24ecca42d076f96d36121908 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Mon, 21 Mar 2022 19:49:43 +0000 Subject: [PATCH] musig-spec: move remarks on spec below specification section We will need more of these explanations and it's better if they do not interfere the specification section. The remarks section is intended for content that's not required for implementing the spec. --- doc/musig-spec.mediawiki | 44 +++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/doc/musig-spec.mediawiki b/doc/musig-spec.mediawiki index b3f967bb..d042363f 100644 --- a/doc/musig-spec.mediawiki +++ b/doc/musig-spec.mediawiki @@ -123,29 +123,9 @@ The algorithm '''''NonceAgg(pubnonce1..u)''''' is defined as: ** For ''j = 1 .. u'': *** Let ''Ri,j = pointc(pubnoncej[(i-1)*33:i*33])''; fail if that fails ** Let ''R'i = Ri,1 + Ri,2 + ... + Ri,u'' -** Let ''Ri = R'i'' if not ''is_infinite(R'i)'', otherwise let Ri = G'' +**
Let ''Ri = R'i'' if not ''is_infinite(R'i)'', otherwise let Ri = G'' (see [[#dealing-with-infinity-in-nonce-aggregation|Dealing with Infinity in Nonce Aggregation]]) * Return ''aggnonce = cbytes(R1) || cbytes(R2)'' -===== Note on ''is_infinite(R'i)'' ===== - -If ''is_infinite(R'i)'' there is at least one dishonest signer (except with negligible probability). -If we fail here, we will never be able to determine who it is. -Therefore, we continue so that the culprit is revealed when collecting and verifying partial signatures. - -However, dealing with the point at infinity requires defining a serialization and may require extra code complexity in implementations. -Instead of incurring this complexity, we make two modifications (compared to the MuSig2* appendix in the [https://eprint.iacr.org/2020/1261 MuSig2 paper]) to avoid infinity while still allowing us to detect the dishonest signer: -* In ''NonceAgg'', if an output ''R'i'' would be infinity, instead output the generator (an arbitrary choice). -* In ''Sign'', implicitly disallow the input ''aggnonce'' to contain infinity (since the serialization format doesn't support it). - -The entire ''NonceAgg'' function (both the original and modified version) only depends on publicly available data (the set of public pre-nonces from every signer). -In the unforgeability proof, ''NonceAgg'' is considered to be performed by an untrusted party; thus modifications to ''NonceAgg'' do not affect the unforgeability of the scheme. - -The (implicit) modification to ''Sign'' is equivalent to adding a clause, "abort if the input ''aggnonce'' contained infinity". -This modification only depends on the publicly available ''aggnonce''. -Given a successful adversary against the security game (EUF-CMA) for the modified scheme, a reduction can win the security game for the original scheme by simulating the modification (i.e. checking whether to abort) towards the adversary. - -We conclude that these two modifications preserve the security of the MuSig2* scheme. - ==== Signing ==== Input: @@ -248,6 +228,28 @@ Otherwise, it is possible to extract the secret signing key from the partial sig An implementation may invalidate the secnonce argument after ''Sign'' to avoid any reuse. Avoiding reuse also implies that the ''NonceGen'' algorithm must compute unbiased, uniformly random values ''k1'' and ''k2''. +=== Remarks on Security and Correctness === + +==== Dealing with Infinity in Nonce Aggregation ==== + +If it happens that ''is_infinite(R'i)'' inside ''[[#NonceAgg infinity|NonceAgg]]'' there is at least one dishonest signer (except with negligible probability). +If we fail here, we will never be able to determine who it is. +Therefore, we continue so that the culprit is revealed when collecting and verifying partial signatures. + +However, dealing with the point at infinity requires defining a serialization and may require extra code complexity in implementations. +Instead of incurring this complexity, we make two modifications (compared to the MuSig2* appendix in the [https://eprint.iacr.org/2020/1261 MuSig2 paper]) to avoid infinity while still allowing us to detect the dishonest signer: +* In ''NonceAgg'', if an output ''R'i'' would be infinity, instead output the generator (an arbitrary choice). +* In ''Sign'', implicitly disallow the input ''aggnonce'' to contain infinity (since the serialization format doesn't support it). + +The entire ''NonceAgg'' function (both the original and modified version) only depends on publicly available data (the set of public pre-nonces from every signer). +In the unforgeability proof, ''NonceAgg'' is considered to be performed by an untrusted party; thus modifications to ''NonceAgg'' do not affect the unforgeability of the scheme. + +The (implicit) modification to ''Sign'' is equivalent to adding a clause, "abort if the input ''aggnonce'' contained infinity". +This modification only depends on the publicly available ''aggnonce''. +Given a successful adversary against the security game (EUF-CMA) for the modified scheme, a reduction can win the security game for the original scheme by simulating the modification (i.e. checking whether to abort) towards the adversary. + +We conclude that these two modifications preserve the security of the MuSig2* scheme. + == Applications == == Test Vectors and Reference Code ==