frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

musig: rename Musig coefficient to KeyAgg coefficient

Browse Source 
This is done to be consistent with the MuSig2 paper
This commit is contained in:
Jonas Nick 2021-07-08 17:06:24 +00:00
parent 4bc46d836e
commit 4a9b059b16
2 changed files with 37 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/modules/musig/main_impl.h
View File

@ -30,25 +30,25 @@ static int secp256k1_musig_compute_ell(const secp256k1_context *ctx, unsigned ch
} }
/* Initializes SHA256 with fixed midstate. This midstate was computed by applying /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
* SHA256 to SHA256("MuSig coefficient")||SHA256("MuSig coefficient"). */ * SHA256 to SHA256("KeyAgg coefficient")||SHA256("KeyAgg coefficient"). */
static void secp256k1_musig_sha256_init_tagged(secp256k1_sha256 *sha) { static void secp256k1_musig_sha256_init_tagged(secp256k1_sha256 *sha) {
secp256k1_sha256_initialize(sha); secp256k1_sha256_initialize(sha);
sha->s[0] = 0x0fd0690cul; sha->s[0] = 0x6ef02c5aul;
sha->s[1] = 0xfefeae97ul; sha->s[1] = 0x06a480deul;
sha->s[2] = 0x996eac7ful; sha->s[2] = 0x1f298665ul;
sha->s[3] = 0x5c30d864ul; sha->s[3] = 0x1d1134f2ul;
sha->s[4] = 0x8c4a0573ul; sha->s[4] = 0x56a0b063ul;
sha->s[5] = 0xaca1a22ful; sha->s[5] = 0x52da4147ul;
sha->s[6] = 0x6f43b801ul; sha->s[6] = 0xf280d9d4ul;
sha->s[7] = 0x85ce27cdul; sha->s[7] = 0x4484be15ul;
sha->bytes = 64; sha->bytes = 64;
} }
/* Compute MuSig coefficient which is constant 1 for the second pubkey and /* Compute KeyAgg coefficient which is constant 1 for the second pubkey and
* SHA256(ell, x) otherwise. second_pk_x can be NULL in case there is no * SHA256(ell, x) otherwise. second_pk_x can be NULL in case there is no
* second_pk. Assumes both field elements x and second_pk_x are normalized. */ * second_pk. Assumes both field elements x and second_pk_x are normalized. */
static void secp256k1_musig_coefficient_internal(secp256k1_scalar *r, const unsigned char *ell, secp256k1_fe *x, const secp256k1_fe *second_pk_x) { static void secp256k1_musig_keyaggcoef_internal(secp256k1_scalar *r, const unsigned char *ell, secp256k1_fe *x, const secp256k1_fe *second_pk_x) {
secp256k1_sha256 sha; secp256k1_sha256 sha;
unsigned char buf[32]; unsigned char buf[32];
@ -65,10 +65,10 @@ static void secp256k1_musig_coefficient_internal(secp256k1_scalar *r, const unsi
} }
/* Assumes both field elements x and second_pk_x are normalized. */ /* Assumes both field elements x and second_pk_x are normalized. */
static void secp256k1_musig_coefficient(secp256k1_scalar *r, const secp256k1_musig_pre_session *pre_session, secp256k1_fe *x) { static void secp256k1_musig_keyaggcoef(secp256k1_scalar *r, const secp256k1_musig_pre_session *pre_session, secp256k1_fe *x) {
secp256k1_fe second_pk_x; secp256k1_fe second_pk_x;
secp256k1_fe_set_b32(&second_pk_x, pre_session->second_pk); secp256k1_fe_set_b32(&second_pk_x, pre_session->second_pk);
secp256k1_musig_coefficient_internal(r, pre_session->pk_hash, x, &second_pk_x); secp256k1_musig_keyaggcoef_internal(r, pre_session->pk_hash, x, &second_pk_x);
} }
typedef struct { typedef struct {
@ -84,7 +84,7 @@ static int secp256k1_musig_pubkey_combine_callback(secp256k1_scalar *sc, secp256
if (!secp256k1_xonly_pubkey_load(ctx->ctx, pt, &ctx->pks[idx])) { if (!secp256k1_xonly_pubkey_load(ctx->ctx, pt, &ctx->pks[idx])) {
return 0; return 0;
} }
secp256k1_musig_coefficient_internal(sc, ctx->ell, &pt->x, &ctx->second_pk_x); secp256k1_musig_keyaggcoef_internal(sc, ctx->ell, &pt->x, &ctx->second_pk_x);
return 1; return 1;
} }
@ -224,7 +224,7 @@ int secp256k1_musig_session_init(const secp256k1_context* ctx, secp256k1_musig_s
secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pj, &secret); secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pj, &secret);
secp256k1_ge_set_gej(&p, &pj); secp256k1_ge_set_gej(&p, &pj);
secp256k1_fe_normalize_var(&p.x); secp256k1_fe_normalize_var(&p.x);
secp256k1_musig_coefficient(&mu, &session->pre_session, &p.x); secp256k1_musig_keyaggcoef(&mu, &session->pre_session, &p.x);
/* Compute the signer's public key point and determine if the secret is /* Compute the signer's public key point and determine if the secret is
* negated before signing. That happens if if the signer's pubkey has an odd * negated before signing. That happens if if the signer's pubkey has an odd
* Y coordinate XOR the MuSig-combined pubkey has an odd Y coordinate XOR * Y coordinate XOR the MuSig-combined pubkey has an odd Y coordinate XOR
@ -233,7 +233,7 @@ int secp256k1_musig_session_init(const secp256k1_context* ctx, secp256k1_musig_s
* This can be seen by looking at the secret key belonging to `combined_pk`. * This can be seen by looking at the secret key belonging to `combined_pk`.
* Let's define * Let's define
* P' := mu_0*|P_0| + ... + mu_n*|P_n| where P_i is the i-th public key * P' := mu_0*|P_0| + ... + mu_n*|P_n| where P_i is the i-th public key
* point x_i*G, mu_i is the i-th musig coefficient and |.| is a function * point x_i*G, mu_i is the i-th KeyAgg coefficient and |.| is a function
* that normalizes a point to an even Y by negating if necessary similar to * that normalizes a point to an even Y by negating if necessary similar to
* secp256k1_extrakeys_ge_even_y. Then we have * secp256k1_extrakeys_ge_even_y. Then we have
* P := |P'| + t*G where t is the tweak. * P := |P'| + t*G where t is the tweak.
@ -615,10 +615,10 @@ int secp256k1_musig_partial_sig_verify(const secp256k1_context* ctx, const secp2
if (!secp256k1_xonly_pubkey_load(ctx, &pkp, pubkey)) { if (!secp256k1_xonly_pubkey_load(ctx, &pkp, pubkey)) {
return 0; return 0;
} }
/* Multiplying the messagehash by the musig coefficient is equivalent /* Multiplying the messagehash by the KeyAgg coefficient is equivalent
* to multiplying the signer's public key by the coefficient, except * to multiplying the signer's public key by the coefficient, except
* much easier to do. */ * much easier to do. */
secp256k1_musig_coefficient(&mu, &session->pre_session, &pkp.x); secp256k1_musig_keyaggcoef(&mu, &session->pre_session, &pkp.x);
secp256k1_scalar_mul(&e, &e, &mu); secp256k1_scalar_mul(&e, &e, &mu);
if (!secp256k1_xonly_pubkey_load(ctx, &rp, &signer->nonce)) { if (!secp256k1_xonly_pubkey_load(ctx, &rp, &signer->nonce)) {

38
src/modules/musig/tests_impl.h
View File

@ -829,7 +829,7 @@ void scriptless_atomic_swap(secp256k1_scratch_space *scratch) {
/* Checks that hash initialized by secp256k1_musig_sha256_init_tagged has the /* Checks that hash initialized by secp256k1_musig_sha256_init_tagged has the
* expected state. */ * expected state. */
void sha256_tag_test(void) { void sha256_tag_test(void) {
char tag[17] = "MuSig coefficient"; char tag[18] = "KeyAgg coefficient";
secp256k1_sha256 sha; secp256k1_sha256 sha;
secp256k1_sha256 sha_tagged; secp256k1_sha256 sha_tagged;
unsigned char buf[32]; unsigned char buf[32];
@ -837,9 +837,9 @@ void sha256_tag_test(void) {
size_t i; size_t i;
secp256k1_sha256_initialize(&sha); secp256k1_sha256_initialize(&sha);
secp256k1_sha256_write(&sha, (unsigned char *) tag, 17); secp256k1_sha256_write(&sha, (unsigned char *) tag, sizeof(tag));
secp256k1_sha256_finalize(&sha, buf); secp256k1_sha256_finalize(&sha, buf);
/* buf = SHA256("MuSig coefficient") */ /* buf = SHA256("KeyAgg coefficient") */
secp256k1_sha256_initialize(&sha); secp256k1_sha256_initialize(&sha);
secp256k1_sha256_write(&sha, buf, 32); secp256k1_sha256_write(&sha, buf, 32);
@ -1012,28 +1012,28 @@ void musig_test_vectors(void) {
}; };
const unsigned char combined_pk_expected[4][32] = { const unsigned char combined_pk_expected[4][32] = {
{ /* 0 */ { /* 0 */
0xF1, 0x94, 0x7D, 0x65, 0x53, 0x3A, 0x1D, 0x9E, 0xEA, 0x06, 0x7B, 0x01, 0x67, 0x24, 0x5A, 0x6F,
0x46, 0xDD, 0x16, 0x60, 0x3C, 0x95, 0x04, 0x66, 0xED, 0xB1, 0xB1, 0x22, 0xBB, 0x03, 0xAB, 0x7E,
0x34, 0x31, 0xDC, 0x7E, 0xF8, 0x3B, 0x64, 0xC9, 0x5D, 0x48, 0x6C, 0x81, 0x83, 0x42, 0xE0, 0xE9,
0xD5, 0x1C, 0xE6, 0x71, 0x8E, 0x6E, 0x57, 0x1C, 0xB6, 0x41, 0x79, 0xAD, 0x32, 0x8D, 0x9D, 0x19,
}, },
{ /* 1 */ { /* 1 */
0xA5, 0x1C, 0x71, 0x3F, 0xD4, 0xC3, 0x29, 0xCD, 0x14, 0xE1, 0xF8, 0x3E, 0x9E, 0x25, 0x60, 0xFB,
0x6D, 0x35, 0x69, 0xBC, 0x36, 0x67, 0xE4, 0x9A, 0x2A, 0x6C, 0x04, 0x24, 0x55, 0x6C, 0x86, 0x8D,
0xC6, 0xD4, 0x75, 0x4E, 0xC2, 0x66, 0x25, 0xED, 0x9F, 0xB4, 0x63, 0x35, 0xD4, 0xF7, 0x8D, 0x22,
0x12, 0x2B, 0x24, 0x28, 0x40, 0x57, 0xC9, 0xD4, 0x7D, 0x5D, 0x1D, 0x3C, 0x89, 0x90, 0x6F, 0x1E,
}, },
{ /* 2 */ { /* 2 */
0xA0, 0xFD, 0x5D, 0x2F, 0xCC, 0x4F, 0x90, 0xDF, 0x70, 0x28, 0x8D, 0xF2, 0xB7, 0x60, 0x3D, 0xBE,
0x42, 0xD4, 0x26, 0x38, 0x31, 0x73, 0x0B, 0x21, 0xA0, 0xC7, 0xB7, 0x41, 0xDD, 0xAA, 0xB9, 0x46,
0xC4, 0xAB, 0x0E, 0xFA, 0xD2, 0x09, 0x10, 0xD0, 0x81, 0x14, 0x4E, 0x0B, 0x19, 0x08, 0x6C, 0x69,
0x07, 0xED, 0xCB, 0x69, 0x1D, 0xD5, 0xD1, 0x82, 0xB2, 0x34, 0x89, 0xE4, 0xF5, 0xB7, 0x01, 0x9A,
}, },
{ /* 3 */ { /* 3 */
0x2E, 0x58, 0x3B, 0x3C, 0x30, 0x8B, 0x14, 0x28, 0x93, 0xEE, 0xD8, 0x24, 0xF2, 0x3C, 0x5A, 0xE1,
0x81, 0x36, 0x57, 0x9B, 0x3A, 0x63, 0xDB, 0x71, 0xC1, 0x05, 0xE7, 0x31, 0x09, 0x97, 0x3F, 0xCD,
0x82, 0xB0, 0xFB, 0xE6, 0xE4, 0x25, 0xE7, 0xD0, 0x4A, 0xE3, 0x3A, 0x9F, 0xA0, 0x2F, 0x0A, 0xC8,
0x30, 0x68, 0xC5, 0x9C, 0xFC, 0xAD, 0x12, 0xF3, 0x5A, 0x3E, 0x55, 0x89, 0x07, 0x53, 0xB0, 0x67,
}, },
}; };