chilldkg: Phase 0 - module scaffolding and build wiring

Add an empty, experimental `chilldkg` module as the foundation for a
ChillDKG implementation (distributed key generation for FROST) per the
bip-frost-dkg BIP draft (v0.3.0-dev):
https://github.com/BlockstreamResearch/bip-frost-dkg

The module lives in src/modules/chilldkg/ (separate from the frost
module, per the implementation plan in .idea/docs/
chilldkg-implementation-plan.md: FROST signing (BIP 445) and ChillDKG
are separate BIPs with separate reference repos, test vectors and
review cycles; the dependency between them is one-way bytes).

New files:
- include/secp256k1_chilldkg.h: public header skeleton with the same
  "EXTREMELY DANGEROUS / work in progress" warning style as
  secp256k1_frost.h, plus a note that the BIP is a draft and tagged
  hashes/wire formats may change. No API yet (Phase 3+).
- src/modules/chilldkg/main_impl.h: implementation skeleton including
  the public header.
- src/modules/chilldkg/tests_impl.h: trivial scaffolding unit test
  (chilldkg_scaffolding_test) registered via the tests_chilldkg[]
  CASE1 array used by this repo's unit-test framework.
- src/modules/chilldkg/Makefile.am.include: autotools file list,
  mirroring the frost module's.
- src/modules/chilldkg/chilldkg.md: module doc stub (purpose, draft
  status, dependency on the schnorrsig and ecdh modules).

Build wiring (mirrors the frost module exactly):
- configure.ac: --enable-module-chilldkg (default no, experimental
  gate), dependency errors when schnorrsig or ecdh are explicitly
  disabled, AM_CONDITIONAL(ENABLE_MODULE_CHILLDKG), summary line.
- Makefile.am: include src/modules/chilldkg/Makefile.am.include under
  ENABLE_MODULE_CHILLDKG.
- src/secp256k1.c: guarded include of modules/chilldkg/main_impl.h
  after the frost module.
- src/tests.c: guarded include of tests_impl.h and
  MAKE_TEST_MODULE(chilldkg) registration.
- CMakeLists.txt: SECP256K1_ENABLE_MODULE_CHILLDKG option (OFF) +
  summary line.
- src/CMakeLists.txt: dependency checks on
  SECP256K1_ENABLE_MODULE_SCHNORRSIG and SECP256K1_ENABLE_MODULE_ECDH,
  ENABLE_MODULE_CHILLDKG=1 compile definition, public header export.

Verified:
- ./autogen.sh && ./configure --enable-experimental
  --enable-module-chilldkg --enable-module-schnorrsig
  --enable-module-ecdh && make check: PASS 3/3 (tests, noverify_tests,
  exhaustive_tests).
- configure fails with a clear error when schnorrsig or ecdh are
  disabled, or when experimental is not enabled.
- CMake build with SECP256K1_ENABLE_MODULE_CHILLDKG=ON: ctest 345/345
  passed; dependency errors fire correctly when schnorrsig/ecdh OFF.

CMakeLists.txt

@@ -52,6 +52,7 @@ option(SECP256K1_ENABLE_MODULE_EXTRAKEYS "Enable extrakeys module." ON)
 option(SECP256K1_ENABLE_MODULE_SCHNORRSIG "Enable schnorrsig module." ON)
 option(SECP256K1_ENABLE_MODULE_MUSIG "Enable musig module." ON)
 option(SECP256K1_ENABLE_MODULE_FROST "Enable FROST module (experimental)." OFF)
+option(SECP256K1_ENABLE_MODULE_CHILLDKG "Enable ChillDKG module (experimental)." OFF)
 option(SECP256K1_ENABLE_MODULE_ELLSWIFT "Enable ElligatorSwift module." ON)
 
 option(SECP256K1_ENABLE_MODULE_GENERATOR "Enable NUMS generator module." ON)
@@ -299,6 +300,7 @@ message("  extrakeys ........................... ${SECP256K1_ENABLE_MODULE_EXTRA
 message("  schnorrsig .......................... ${SECP256K1_ENABLE_MODULE_SCHNORRSIG}")
 message("  musig ............................... ${SECP256K1_ENABLE_MODULE_MUSIG}")
 message("  frost ............................... ${SECP256K1_ENABLE_MODULE_FROST}")
+message("  chilldkg ............................ ${SECP256K1_ENABLE_MODULE_CHILLDKG}")
 message("  ElligatorSwift ...................... ${SECP256K1_ENABLE_MODULE_ELLSWIFT}")
 message("  generator ........................... ${SECP256K1_ENABLE_MODULE_GENERATOR}")
 message("  rangeproof .......................... ${SECP256K1_ENABLE_MODULE_RANGEPROOF}")

Makefile.am

@@ -363,3 +363,7 @@ endif
 if ENABLE_MODULE_FROST
 include src/modules/frost/Makefile.am.include
 endif
+
+if ENABLE_MODULE_CHILLDKG
+include src/modules/chilldkg/Makefile.am.include
+endif

configure.ac

@@ -245,6 +245,11 @@ AC_ARG_ENABLE(module_frost,
     [],
     [SECP_SET_DEFAULT([enable_module_frost], [no], [yes])])
 
+AC_ARG_ENABLE(module_chilldkg,
+    AS_HELP_STRING([--enable-module-chilldkg],[enable ChillDKG module (experimental)]),
+    [],
+    [SECP_SET_DEFAULT([enable_module_chilldkg], [no], [yes])])
+
 # Test-only override of the (autodetected by the C code) "widemul" setting.
 # Legal values are:
 #  * int64 (for [u]int64_t),
@@ -551,6 +556,18 @@ if test x"$enable_module_frost" = x"yes"; then
   enable_module_schnorrsig=yes
 fi
 
+if test x"$enable_module_chilldkg" = x"yes"; then
+  if test x"$enable_module_schnorrsig" = x"no"; then
+    AC_MSG_ERROR([Module dependency error: You have disabled the schnorrsig module explicitly, but it is required by the chilldkg module.])
+  fi
+  if test x"$enable_module_ecdh" = x"no"; then
+    AC_MSG_ERROR([Module dependency error: You have disabled the ecdh module explicitly, but it is required by the chilldkg module.])
+  fi
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_CHILLDKG=1"
+  enable_module_schnorrsig=yes
+  enable_module_ecdh=yes
+fi
+
 if test x"$enable_external_default_callbacks" = x"yes"; then
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1"
 fi
@@ -598,6 +615,9 @@ if test x"$enable_experimental" = x"no"; then
   if test x"$enable_module_frost" = x"yes"; then
     AC_MSG_ERROR([FROST module is experimental. Use --enable-experimental to allow.])
   fi
+  if test x"$enable_module_chilldkg" = x"yes"; then
+    AC_MSG_ERROR([ChillDKG module is experimental. Use --enable-experimental to allow.])
+  fi
 fi
 
 # Check for concurrency support (tests only)
@@ -636,6 +656,7 @@ AM_CONDITIONAL([ENABLE_MODULE_ECDSA_ADAPTOR], [test x"$enable_module_ecdsa_adapt
 AM_CONDITIONAL([ENABLE_MODULE_BPPP], [test x"$enable_module_bppp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG_HALFAGG], [test x"$enable_module_schnorrsig_halfagg" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_FROST], [test x"$enable_module_frost" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_CHILLDKG], [test x"$enable_module_chilldkg" = x"yes"])
 AM_CONDITIONAL([USE_REDUCED_SURJECTION_PROOF_SIZE], [test x"$use_reduced_surjection_proof_size" = x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm32"])
@@ -678,6 +699,7 @@ echo "  module ecdsa-adaptor    = $enable_module_ecdsa_adaptor"
 echo "  module bppp             = $enable_module_bppp"
 echo "  module schnorrsig-halfagg = $enable_module_schnorrsig_halfagg"
 echo "  module frost            = $enable_module_frost"
+echo "  module chilldkg         = $enable_module_chilldkg"
 echo
 echo "  asm                     = $set_asm"
 echo "  ecmult window size      = $set_ecmult_window"

include/secp256k1_chilldkg.h

@@ -0,0 +1,38 @@
+#ifndef SECP256K1_CHILLDKG_H
+#define SECP256K1_CHILLDKG_H
+
+#include "secp256k1.h"
+#include "secp256k1_extrakeys.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+/** This module implements ChillDKG, a distributed key generation (DKG)
+ *  protocol for FROST, as specified by the bip-frost-dkg BIP draft
+ *  (https://github.com/BlockstreamResearch/bip-frost-dkg, version 0.3.0-dev).
+ *
+ *  This code is currently a work in progress. It's not secure nor stable.
+ *  IT IS EXTREMELY DANGEROUS AND RECKLESS TO USE THIS MODULE IN PRODUCTION!
+ *
+ *  Moreover, the bip-frost-dkg BIP is still a draft: tagged hashes, wire
+ *  formats, and protocol details may change in future BIP versions. There is
+ *  no guarantee that this implementation will remain compatible with the
+ *  final specification.
+ *
+ *  The output of a ChillDKG session (a secret share, the threshold public
+ *  key, and the public shares of all participants) is designed to be used
+ *  directly with the FROST signing module (see include/secp256k1_frost.h).
+ *
+ *  It is recommended to read the documentation in this include file carefully.
+ *  Further notes on API usage can be found in src/modules/chilldkg/chilldkg.md.
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/CMakeLists.txt

@@ -91,6 +91,19 @@ if(SECP256K1_ENABLE_MODULE_FROST)
   set_property(TARGET secp256k1 APPEND PROPERTY PUBLIC_HEADER ${PROJECT_SOURCE_DIR}/include/secp256k1_frost.h)
 endif()
 
+if(SECP256K1_ENABLE_MODULE_CHILLDKG)
+  if(DEFINED SECP256K1_ENABLE_MODULE_SCHNORRSIG AND NOT SECP256K1_ENABLE_MODULE_SCHNORRSIG)
+    message(FATAL_ERROR "Module dependency error: You have disabled the schnorrsig module explicitly, but it is required by the chilldkg module.")
+  endif()
+  if(DEFINED SECP256K1_ENABLE_MODULE_ECDH AND NOT SECP256K1_ENABLE_MODULE_ECDH)
+    message(FATAL_ERROR "Module dependency error: You have disabled the ecdh module explicitly, but it is required by the chilldkg module.")
+  endif()
+  set(SECP256K1_ENABLE_MODULE_SCHNORRSIG ON)
+  set(SECP256K1_ENABLE_MODULE_ECDH ON)
+  add_compile_definitions(ENABLE_MODULE_CHILLDKG=1)
+  set_property(TARGET secp256k1 APPEND PROPERTY PUBLIC_HEADER ${PROJECT_SOURCE_DIR}/include/secp256k1_chilldkg.h)
+endif()
+
 if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
   if(DEFINED SECP256K1_ENABLE_MODULE_EXTRAKEYS AND NOT SECP256K1_ENABLE_MODULE_EXTRAKEYS)
     message(FATAL_ERROR "Module dependency error: You have disabled the extrakeys module explicitly, but it is required by the schnorrsig module.")

src/modules/chilldkg/Makefile.am.include

@@ -0,0 +1,3 @@
+include_HEADERS += include/secp256k1_chilldkg.h
+noinst_HEADERS += src/modules/chilldkg/main_impl.h
+noinst_HEADERS += src/modules/chilldkg/tests_impl.h

src/modules/chilldkg/chilldkg.md

@@ -0,0 +1,24 @@
+Notes on the chilldkg module API
+================================
+
+This module implements ChillDKG, a distributed key generation (DKG) protocol
+for FROST, as specified by the bip-frost-dkg BIP draft
+(https://github.com/BlockstreamResearch/bip-frost-dkg, version 0.3.0-dev). In
+a ChillDKG session, n participants jointly generate a threshold key with the
+help of an untrusted coordinator, such that no party (including the
+coordinator) learns more than its own secret share, and every participant
+obtains the threshold public key and the public shares of all participants.
+The output is designed to feed directly into the frost module
+(`include/secp256k1_frost.h`), which implements FROST signing (BIP 445) and
+explicitly leaves DKG out of scope.
+
+**This module is experimental.** Do not use it in production. The API should
+not be considered stable. The underlying BIP is still a draft (v0.3.0-dev):
+tagged hashes, wire formats, and protocol details may change in future BIP
+versions.
+
+The module depends on the schnorrsig module (for the CertEq certificate and
+proofs of possession) and the ecdh module (for encrypted share distribution).
+
+The API is under construction; see the implementation plan in
+`.idea/docs/chilldkg-implementation-plan.md` for the phased roadmap.

src/modules/chilldkg/main_impl.h

@@ -0,0 +1,11 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_CHILLDKG_MAIN_H
+#define SECP256K1_MODULE_CHILLDKG_MAIN_H
+
+#include "../../../include/secp256k1_chilldkg.h"
+
+#endif

src/modules/chilldkg/tests_impl.h

@@ -0,0 +1,21 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_CHILLDKG_TESTS_IMPL_H
+#define SECP256K1_MODULE_CHILLDKG_TESTS_IMPL_H
+
+#include "../../../include/secp256k1_chilldkg.h"
+
+/* Placeholder test for the chilldkg module scaffolding. Real tests are added
+ * in later implementation phases. */
+static void chilldkg_scaffolding_test(void) {
+    CHECK(1);
+}
+
+static const struct tf_test_entry tests_chilldkg[] = {
+    CASE1(chilldkg_scaffolding_test),
+};
+
+#endif

src/secp256k1.c

@@ -956,3 +956,7 @@ static int secp256k1_ge_parse_ext(secp256k1_ge* ge, const unsigned char *in33) {
 #ifdef ENABLE_MODULE_FROST
 # include "modules/frost/main_impl.h"
 #endif
+
+#ifdef ENABLE_MODULE_CHILLDKG
+# include "modules/chilldkg/main_impl.h"
+#endif

src/tests.c

@@ -7924,6 +7924,10 @@ static void run_ecdsa_wycheproof(void) {
 # include "modules/frost/tests_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_CHILLDKG
+# include "modules/chilldkg/tests_impl.h"
+#endif
+
 static void run_secp256k1_memczero_test(void) {
     unsigned char buf1[6] = {1, 2, 3, 4, 5, 6};
     unsigned char buf2[sizeof(buf1)];
@@ -8294,6 +8298,9 @@ static const struct tf_test_module registry_modules[] = {
 #endif
 #ifdef ENABLE_MODULE_FROST
     MAKE_TEST_MODULE(frost),
+#endif
+#ifdef ENABLE_MODULE_CHILLDKG
+    MAKE_TEST_MODULE(chilldkg),
 #endif
     MAKE_TEST_MODULE(utils),
 };