frost trusted dealer: add example file

This commit adds an example file to demonstrate how to use the module.

.gitignore

@@ -66,6 +66,7 @@ libsecp256k1.pc
 contrib/gh-pr-create.sh
 
 musig_example
+frost_example
 
 ### CMake
 /CMakeUserPresets.json

Makefile.am

@@ -195,6 +195,17 @@ musig_example_LDFLAGS += -lbcrypt
 endif
 TESTS += musig_example
 endif
+if ENABLE_MODULE_FROST
+noinst_PROGRAMS += frost_example
+frost_example_SOURCES = examples/frost.c
+frost_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
+frost_example_LDADD = libsecp256k1.la
+frost_example_LDFLAGS = -static
+if BUILD_WINDOWS
+frost_example_LDFLAGS += -lbcrypt
+endif
+TESTS += frost_example
+endif
 endif
 
 ### Precomputed tables
@@ -320,3 +331,7 @@ endif
 if ENABLE_MODULE_ECDSA_ADAPTOR
 include src/modules/ecdsa_adaptor/Makefile.am.include
 endif
+
+if ENABLE_MODULE_FROST
+include src/modules/frost/Makefile.am.include
+endif

README.md

@@ -12,6 +12,7 @@ Added features:
 * Experimental module for Confidential Assets (Pedersen commitments, range proofs, and [surjection proofs](src/modules/surjection/surjection.md)).
 * Experimental module for Bulletproofs++ range proofs.
 * Experimental module for [address whitelisting](src/modules/whitelist/whitelist.md).
+* Experimental module for [FROST](src/modules/frost/frost.md).
 
 Experimental features are made available for testing and review by the community. The APIs of these features should not be considered stable.
 

configure.ac

@@ -240,6 +240,11 @@ AC_ARG_ENABLE(external_default_callbacks,
     AS_HELP_STRING([--enable-external-default-callbacks],[enable external default callback functions [default=no]]), [],
     [SECP_SET_DEFAULT([enable_external_default_callbacks], [no], [no])])
 
+AC_ARG_ENABLE(module_frost,
+    AS_HELP_STRING([--enable-module-frost],[enable FROST module (experimental)]),
+    [],
+    [SECP_SET_DEFAULT([enable_module_frost], [no], [yes])])
+
 # Test-only override of the (autodetected by the C code) "widemul" setting.
 # Legal values are:
 #  * int64 (for [u]int64_t),
@@ -530,6 +535,14 @@ if test x"$enable_module_ecdh" = x"yes"; then
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ECDH=1"
 fi
 
+if test x"$enable_module_frost" = x"yes"; then
+  if test x"$enable_module_schnorrsig" = x"no"; then
+    AC_MSG_ERROR([Module dependency error: You have disabled the schnorrsig module explicitly, but it is required by the frost module.])
+  fi
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_FROST=1"
+  enable_module_schnorrsig=yes
+fi
+
 if test x"$enable_external_default_callbacks" = x"yes"; then
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1"
 fi
@@ -582,6 +595,9 @@ else
   if test x"$set_asm" = x"arm32"; then
     AC_MSG_ERROR([ARM32 assembly is experimental. Use --enable-experimental to allow.])
   fi
+  if test x"$enable_module_frost" = x"yes"; then
+    AC_MSG_ERROR([FROST module is experimental. Use --enable-experimental to allow.])
+  fi
 fi
 
 ###
@@ -611,6 +627,7 @@ AM_CONDITIONAL([ENABLE_MODULE_ECDSA_S2C], [test x"$enable_module_ecdsa_s2c" = x"
 AM_CONDITIONAL([ENABLE_MODULE_ECDSA_ADAPTOR], [test x"$enable_module_ecdsa_adaptor" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_BPPP], [test x"$enable_module_bppp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG_HALFAGG], [test x"$enable_module_schnorrsig_halfagg" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_FROST], [test x"$enable_module_frost" = x"yes"])
 AM_CONDITIONAL([USE_REDUCED_SURJECTION_PROOF_SIZE], [test x"$use_reduced_surjection_proof_size" = x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm32"])
@@ -651,6 +668,7 @@ echo "  module ecdsa-s2c        = $enable_module_ecdsa_s2c"
 echo "  module ecdsa-adaptor    = $enable_module_ecdsa_adaptor"
 echo "  module bppp             = $enable_module_bppp"
 echo "  module schnorrsig-halfagg = $enable_module_schnorrsig_halfagg"
+echo "  module frost            = $enable_module_frost"
 echo
 echo "  asm                       = $set_asm"
 echo "  ecmult window size        = $set_ecmult_window"

examples/frost.c

@@ -0,0 +1,294 @@
+/***********************************************************************
+ * Copyright (c) 2021-2023  Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+/**
+ * This file demonstrates how to use the FROST module to create a threshold
+ * signature. Additionally, see the documentation in include/secp256k1_frost.h.
+ */
+
+#include <stdio.h>
+#include <assert.h>
+#include <string.h>
+
+#include <secp256k1.h>
+#include <secp256k1_schnorrsig.h>
+#include <secp256k1_frost.h>
+
+#include "examples_util.h"
+/* Number of public keys involved in creating the aggregate signature */
+#define N_SIGNERS 5
+
+/* Threshold required in creating the aggregate signature */
+#define THRESHOLD 3
+
+struct signer_secrets {
+    secp256k1_keypair keypair;
+    secp256k1_frost_share agg_share;
+    secp256k1_frost_secnonce secnonce;
+    unsigned char seed[32];
+};
+
+struct signer {
+    secp256k1_pubkey pubshare;
+    secp256k1_frost_pubnonce pubnonce;
+    secp256k1_frost_session session;
+    secp256k1_frost_partial_sig partial_sig;
+    secp256k1_pubkey vss_commitment[THRESHOLD];
+    unsigned char vss_hash[32];
+    unsigned char pok[64];
+    unsigned char id[33];
+};
+
+/* Create a key pair and store it in seckey and pubkey */
+int create_keypair_and_seed(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer) {
+    unsigned char seckey[32];
+    secp256k1_pubkey pubkey_tmp;
+    size_t size = 33;
+
+    while (1) {
+        if (!fill_random(seckey, sizeof(seckey))) {
+            printf("Failed to generate randomness\n");
+            return 1;
+        }
+        if (secp256k1_keypair_create(ctx, &signer_secrets->keypair, seckey)) {
+            break;
+        }
+    }
+    if (!secp256k1_keypair_pub(ctx, &pubkey_tmp, &signer_secrets->keypair)) {
+        return 0;
+    }
+    if (!secp256k1_ec_pubkey_serialize(ctx, signer->id, &size, &pubkey_tmp, SECP256K1_EC_COMPRESSED)) {
+        return 0;
+    }
+    if (!fill_random(signer_secrets->seed, sizeof(signer_secrets->seed))) {
+        return 0;
+    }
+    return 1;
+}
+
+/* Create shares and coefficient commitments */
+int create_shares(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer, secp256k1_xonly_pubkey *agg_pk) {
+    int i, j;
+    secp256k1_frost_share shares[N_SIGNERS][N_SIGNERS];
+    const secp256k1_pubkey *vss_commitments[N_SIGNERS];
+    const unsigned char *ids[N_SIGNERS];
+
+    for (i = 0; i < N_SIGNERS; i++) {
+        vss_commitments[i] = signer[i].vss_commitment;
+        ids[i] = signer[i].id;
+    }
+
+    for (i = 0; i < N_SIGNERS; i++) {
+        /* Generate a polynomial share for the participants */
+        if (!secp256k1_frost_shares_gen(ctx, shares[i], signer[i].vss_commitment, signer[i].pok, signer_secrets[i].seed, THRESHOLD, N_SIGNERS, ids)) {
+            return 0;
+        }
+    }
+
+    /* KeyGen communication round 1: exchange shares and coefficient
+     * commitments */
+    for (i = 0; i < N_SIGNERS; i++) {
+        const secp256k1_frost_share *assigned_shares[N_SIGNERS];
+
+        /* Each participant receives a share from each participant (including
+         * themselves) corresponding to their index. */
+        for (j = 0; j < N_SIGNERS; j++) {
+            assigned_shares[j] = &shares[j][i];
+        }
+        /* Each participant aggregates the shares they received. */
+        if (!secp256k1_frost_share_agg(ctx, &signer_secrets[i].agg_share, agg_pk, assigned_shares, vss_commitments, N_SIGNERS, THRESHOLD, signer[i].id)) {
+            return 0;
+        }
+        for (j = 0; j < N_SIGNERS; j++) {
+            /* Each participant verifies their shares. share_agg calls this
+             * internally, so it is only neccessary to call this function if
+             * share_agg returns an error, to determine which participant(s)
+             * submitted faulty data. */
+            if (!secp256k1_frost_share_verify(ctx, THRESHOLD, signer[i].id, assigned_shares[j], &vss_commitments[j])) {
+                return 0;
+            }
+            /* Each participant generates public verification shares that are
+             * used for verifying partial signatures. */
+            if (!secp256k1_frost_compute_pubshare(ctx, &signer[j].pubshare, THRESHOLD, signer[j].id, vss_commitments, N_SIGNERS)) {
+                return 0;
+            }
+        }
+    }
+
+    return 1;
+}
+
+/* Tweak the pubkey corresponding to the provided tweak cache, update the cache
+ * and return the tweaked aggregate pk. */
+int tweak(const secp256k1_context* ctx, secp256k1_xonly_pubkey *agg_pk, secp256k1_frost_tweak_cache *cache) {
+    secp256k1_pubkey output_pk;
+    unsigned char ordinary_tweak[32] = "this could be a BIP32 tweak....";
+    unsigned char xonly_tweak[32] = "this could be a taproot tweak..";
+
+    if (!secp256k1_frost_pubkey_tweak(ctx, cache, agg_pk)) {
+        return 0;
+    }
+
+    /* Ordinary tweaking which, for example, allows deriving multiple child
+     * public keys from a single aggregate key using BIP32 */
+    if (!secp256k1_frost_pubkey_ec_tweak_add(ctx, NULL, cache, ordinary_tweak)) {
+        return 0;
+    }
+    /* If one is not interested in signing, the same output_pk can be obtained
+     * by calling `secp256k1_frost_pubkey_get` right after key aggregation to
+     * get the full pubkey and then call `secp256k1_ec_pubkey_tweak_add`. */
+
+    /* Xonly tweaking which, for example, allows creating taproot commitments */
+    if (!secp256k1_frost_pubkey_xonly_tweak_add(ctx, &output_pk, cache, xonly_tweak)) {
+        return 0;
+    }
+    /* Note that if we wouldn't care about signing, we can arrive at the same
+     * output_pk by providing the untweaked public key to
+     * `secp256k1_xonly_pubkey_tweak_add` (after converting it to an xonly pubkey
+     * if necessary with `secp256k1_xonly_pubkey_from_pubkey`). */
+
+    /* Now we convert the output_pk to an xonly pubkey to allow to later verify
+     * the Schnorr signature against it. For this purpose we can ignore the
+     * `pk_parity` output argument; we would need it if we would have to open
+     * the taproot commitment. */
+    if (!secp256k1_xonly_pubkey_from_pubkey(ctx, agg_pk, NULL, &output_pk)) {
+        return 0;
+    }
+    return 1;
+}
+
+/* Sign a message hash with the given threshold and aggregate shares and store
+ * the result in sig */
+int sign(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer, const unsigned char* msg32, secp256k1_xonly_pubkey *agg_pk, unsigned char *sig64, const secp256k1_frost_tweak_cache *cache) {
+    int i;
+    int signer_id = 0;
+    int signers[THRESHOLD];
+    int is_signer[N_SIGNERS];
+    const secp256k1_frost_pubnonce *pubnonces[THRESHOLD];
+    const unsigned char *ids[THRESHOLD];
+    const secp256k1_frost_partial_sig *partial_sigs[THRESHOLD];
+
+    for (i = 0; i < N_SIGNERS; i++) {
+        unsigned char session_id[32];
+        /* Create random session ID. It is absolutely necessary that the session ID
+         * is unique for every call of secp256k1_frost_nonce_gen. Otherwise
+         * it's trivial for an attacker to extract the secret key! */
+        if (!fill_random(session_id, sizeof(session_id))) {
+            return 0;
+        }
+        /* Initialize session and create secret nonce for signing and public
+         * nonce to send to the other signers. */
+        if (!secp256k1_frost_nonce_gen(ctx, &signer_secrets[i].secnonce, &signer[i].pubnonce, session_id, &signer_secrets[i].agg_share, msg32, agg_pk, NULL)) {
+            return 0;
+        }
+        is_signer[i] = 0; /* Initialize is_signer */
+    }
+    /* Select a random subset of signers */
+    for (i = 0; i < THRESHOLD; i++) {
+        unsigned int subset_seed;
+
+        while (1) {
+            if (!fill_random((unsigned char*)&subset_seed, sizeof(subset_seed))) {
+                return 0;
+            }
+            signer_id = subset_seed % N_SIGNERS;
+            /* Check if signer has already been assigned */
+            if (!is_signer[signer_id]) {
+                is_signer[signer_id] = 1;
+                signers[i] = signer_id;
+                break;
+            }
+        }
+        /* Mark signer as assigned */
+        pubnonces[i] = &signer[signer_id].pubnonce;
+        /* pubkeys[i] = &signer[signer_id].pubkey; */
+        ids[i] = signer[signer_id].id;
+    }
+    /* Signing communication round 1: Exchange nonces */
+    for (i = 0; i < THRESHOLD; i++) {
+        signer_id = signers[i];
+        if (!secp256k1_frost_nonce_process(ctx, &signer[signer_id].session, pubnonces, THRESHOLD, msg32, agg_pk, signer[signer_id].id, ids, cache, NULL)) {
+            return 0;
+        }
+        /* partial_sign will clear the secnonce by setting it to 0. That's because
+         * you must _never_ reuse the secnonce (or use the same session_id to
+         * create a secnonce). If you do, you effectively reuse the nonce and
+         * leak the secret key. */
+        if (!secp256k1_frost_partial_sign(ctx, &signer[signer_id].partial_sig, &signer_secrets[signer_id].secnonce, &signer_secrets[signer_id].agg_share, &signer[signer_id].session, cache)) {
+            return 0;
+        }
+        partial_sigs[i] = &signer[signer_id].partial_sig;
+    }
+    /* Communication round 2: A production system would exchange
+     * partial signatures here before moving on. */
+    for (i = 0; i < THRESHOLD; i++) {
+        signer_id = signers[i];
+        /* To check whether signing was successful, it suffices to either verify
+         * the aggregate signature with the aggregate public key using
+         * secp256k1_schnorrsig_verify, or verify all partial signatures of all
+         * signers individually. Verifying the aggregate signature is cheaper but
+         * verifying the individual partial signatures has the advantage that it
+         * can be used to determine which of the partial signatures are invalid
+         * (if any), i.e., which of the partial signatures cause the aggregate
+         * signature to be invalid and thus the protocol run to fail. It's also
+         * fine to first verify the aggregate sig, and only verify the individual
+         * sigs if it does not work.
+         */
+        if (!secp256k1_frost_partial_sig_verify(ctx, &signer[signer_id].partial_sig, &signer[signer_id].pubnonce, &signer[signer_id].pubshare, &signer[signer_id].session, cache)) {
+            return 0;
+        }
+    }
+    return secp256k1_frost_partial_sig_agg(ctx, sig64, &signer[signer_id].session, partial_sigs, THRESHOLD);
+}
+
+int main(void) {
+    secp256k1_context* ctx;
+    int i;
+    struct signer_secrets signer_secrets[N_SIGNERS];
+    struct signer signers[N_SIGNERS];
+    secp256k1_xonly_pubkey agg_pk;
+    secp256k1_frost_tweak_cache cache;
+    unsigned char msg[32] = "this_could_be_the_hash_of_a_msg!";
+    unsigned char sig[64];
+
+    /* Create a context for signing and verification */
+    ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
+    printf("Creating key pairs......");
+    for (i = 0; i < N_SIGNERS; i++) {
+        if (!create_keypair_and_seed(ctx, &signer_secrets[i], &signers[i])) {
+            printf("FAILED\n");
+            return 1;
+        }
+    }
+    printf("ok\n");
+    printf("Creating shares.........");
+    if (!create_shares(ctx, signer_secrets, signers, &agg_pk)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    printf("Tweaking................");
+    /* Optionally tweak the aggregate key */
+    if (!tweak(ctx, &agg_pk, &cache)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    printf("Signing message.........");
+    if (!sign(ctx, signer_secrets, signers, msg, &agg_pk, sig, &cache)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    printf("Verifying signature.....");
+    if (!secp256k1_schnorrsig_verify(ctx, sig, msg, 32, &agg_pk)) {
+        printf("FAILED\n");
+        return 1;
+    }
+    printf("ok\n");
+    secp256k1_context_destroy(ctx);
+    return 0;
+}

include/secp256k1_frost.h

@@ -0,0 +1,691 @@
+#ifndef SECP256K1_FROST_H
+#define SECP256K1_FROST_H
+
+#include "secp256k1_extrakeys.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdint.h>
+
+/** This code is currently a work in progress. It's not secure nor stable.
+ * IT IS EXTREMELY DANGEROUS AND RECKLESS TO USE THIS MODULE IN PRODUCTION!
+ *
+ * This module implements a variant of Flexible Round-Optimized Schnorr
+ * Threshold Signatures (FROST) by Chelsea Komlo and Ian Goldberg
+ * (https://crysp.uwaterloo.ca/software/frost/). Signatures are compatible with
+ * BIP-340 ("Schnorr").
+ *
+ * The module also supports BIP-341 ("Taproot") and BIP-32 ("ordinary") public
+ * key tweaking, and adaptor signatures.
+ *
+ * Following the convention used in the MuSig module, the API uses the singular
+ * term "nonce" to refer to the two "nonces" used by the FROST scheme.
+ */
+
+/** Opaque data structures
+ *
+ *  The exact representation of data inside is implementation defined and not
+ *  guaranteed to be portable between different platforms or versions. If you
+ *  need to convert to a format suitable for storage, transmission, or
+ *  comparison, use the corresponding serialization and parsing functions.
+ */
+
+/** Opaque data structure that caches information about key tweaking.
+ *
+ *  Guaranteed to be 101 bytes in size. It can be safely copied/moved. No
+ *  serialization and parsing functions.
+ */
+typedef struct {
+    unsigned char data[101];
+} secp256k1_frost_tweak_cache;
+
+/** Opaque data structure that holds a signer's _secret_ share.
+ *
+ *  Guaranteed to be 36 bytes in size. Serialized and parsed with
+ *  `frost_share_serialize` and `frost_share_parse`.
+ */
+typedef struct {
+    unsigned char data[36];
+} secp256k1_frost_share;
+
+/** Opaque data structure that holds a signer's _secret_ nonce.
+ *
+ *  Guaranteed to be 68 bytes in size.
+ *
+ *  WARNING: This structure MUST NOT be copied or read or written to directly.
+ *  A signer who is online throughout the whole process and can keep this
+ *  structure in memory can use the provided API functions for a safe standard
+ *  workflow. See
+ *  https://blockstream.com/2019/02/18/musig-a-new-multisignature-standard/ for
+ *  more details about the risks associated with serializing or deserializing
+ *  this structure.
+ *
+ *  We repeat, copying this data structure can result in nonce reuse which will
+ *  leak the secret signing key.
+ */
+typedef struct {
+    unsigned char data[68];
+} secp256k1_frost_secnonce;
+
+/** Opaque data structure that holds a signer's public nonce.
+*
+*  Guaranteed to be 132 bytes in size. It can be safely copied/moved.
+*  Serialized and parsed with `frost_pubnonce_serialize` and
+*  `frost_pubnonce_parse`.
+*/
+typedef struct {
+    unsigned char data[132];
+} secp256k1_frost_pubnonce;
+
+/** Opaque data structure that holds a FROST session.
+ *
+ *  This structure is not required to be kept secret for the signing protocol
+ *  to be secure. Guaranteed to be 133 bytes in size. It can be safely
+ *  copied/moved. No serialization and parsing functions.
+ */
+typedef struct {
+    unsigned char data[133];
+} secp256k1_frost_session;
+
+/** Opaque data structure that holds a partial FROST signature.
+ *
+ *  Guaranteed to be 36 bytes in size. Serialized and parsed with
+ *  `frost_partial_sig_serialize` and `frost_partial_sig_parse`.
+ */
+typedef struct {
+    unsigned char data[36];
+} secp256k1_frost_partial_sig;
+
+/** Parse a signer's public nonce.
+ *
+ *  Returns: 1 when the nonce could be parsed, 0 otherwise.
+ *  Args:    ctx: pointer to a context object
+ *  Out:   nonce: pointer to a nonce object
+ *  In:     in66: pointer to the 66-byte nonce to be parsed
+ */
+SECP256K1_API int secp256k1_frost_pubnonce_parse(
+    const secp256k1_context *ctx,
+    secp256k1_frost_pubnonce *nonce,
+    const unsigned char *in66
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a signer's public nonce
+ *
+ *  Returns: 1 when the nonce could be serialized, 0 otherwise
+ *  Args:    ctx: pointer to a context object
+ *  Out:   out66: pointer to a 66-byte array to store the serialized nonce
+ *  In:    nonce: pointer to the nonce
+ */
+SECP256K1_API int secp256k1_frost_pubnonce_serialize(
+    const secp256k1_context *ctx,
+    unsigned char *out66,
+    const secp256k1_frost_pubnonce *nonce
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a FROST partial signature
+ *
+ *  Returns: 1 when the signature could be serialized, 0 otherwise
+ *  Args:    ctx: pointer to a context object
+ *  Out:   out32: pointer to a 32-byte array to store the serialized signature
+ *  In:      sig: pointer to the signature
+ */
+SECP256K1_API int secp256k1_frost_partial_sig_serialize(
+    const secp256k1_context *ctx,
+    unsigned char *out32,
+    const secp256k1_frost_partial_sig *sig
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Parse a FROST partial signature.
+ *
+ *  Returns: 1 when the signature could be parsed, 0 otherwise.
+ *  Args:    ctx: pointer to a context object
+ *  Out:     sig: pointer to a signature object
+ *  In:     in32: pointer to the 32-byte signature to be parsed
+ *
+ *  After the call, sig will always be initialized. If parsing failed or the
+ *  encoded numbers are out of range, signature verification with it is
+ *  guaranteed to fail for every message and public key.
+ */
+SECP256K1_API int secp256k1_frost_partial_sig_parse(
+    const secp256k1_context *ctx,
+    secp256k1_frost_partial_sig *sig,
+    const unsigned char *in32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Serialize a FROST share
+ *
+ *  Returns: 1 when the share could be serialized, 0 otherwise
+ *  Args:    ctx: pointer to a context object
+ *  Out:   out32: pointer to a 32-byte array to store the serialized share
+ *  In:    share: pointer to the share
+ */
+SECP256K1_API int secp256k1_frost_share_serialize(
+    const secp256k1_context *ctx,
+    unsigned char *out32,
+    const secp256k1_frost_share *share
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Parse a FROST share.
+ *
+ *  Returns: 1 when the share could be parsed, 0 otherwise.
+ *  Args:    ctx: pointer to a context object
+ *  Out:   share: pointer to a share object
+ *  In:     in32: pointer to the 32-byte share to be parsed
+ */
+SECP256K1_API int secp256k1_frost_share_parse(
+    const secp256k1_context *ctx,
+    secp256k1_frost_share *share,
+    const unsigned char *in32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Creates key shares
+ *
+ *  To generate a key, each participant generates a share for each other
+ *  participant. For example, in the case of 2 particpants, Alice and Bob, they
+ *  each generate 2 shares, distribute 1 share to each other using a secure
+ *  channel, and keep 1 for themselves.
+ *
+ *  Each participant must transmit shares over secure channels to each other
+ *  participant.
+ *
+ *  Each call to this function must have a UNIQUE and uniformly RANDOM seed32
+ *  that must that must NOT BE REUSED in subsequent calls to this function and
+ *  must be KEPT SECRET (even from other participants).
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise
+ *  Args:            ctx: pointer to a context object
+ *  Out:          shares: pointer to the key shares
+ *        vss_commitment: pointer to the VSS commitment
+ *                 pok64: pointer to the proof of knowledge
+ *   In:          seed32: 32-byte random seed as explained above. Must be
+ *                        unique to this call to secp256k1_frost_shares_gen
+ *                        and must be uniformly random.
+ *             threshold: the minimum number of signers required to produce a
+ *                        signature
+ *        n_participants: the total number of participants
+ *                 ids33: array of 33-byte participant IDs
+ */
+SECP256K1_API int secp256k1_frost_shares_gen(
+    const secp256k1_context *ctx,
+    secp256k1_frost_share *shares,
+    secp256k1_pubkey *vss_commitment,
+    unsigned char *pok64,
+    const unsigned char *seed32,
+    size_t threshold,
+    size_t n_participants,
+    const unsigned char * const* ids33
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(8);
+
+/** Aggregates shares
+ *
+ *  As part of the key generation protocol, each participant receives a share
+ *  from each participant, including a share they "receive" from themselves.
+ *  This function verifies those shares against their VSS commitments,
+ *  aggregates the shares, and then aggregates the commitments to each
+ *  participant's first polynomial coefficient to derive the aggregate public
+ *  key.
+ *
+ *  If this function returns an error, `secp256k1_frost_share_verify` can be
+ *  called on each share to determine which participants submitted faulty
+ *  shares.
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise (which does NOT mean
+ *           the resulting signature verifies).
+ *  Args:         ctx: pointer to a context object
+ *  Out:    agg_share: the aggregated share
+ *             agg_pk: the aggregated x-only public key
+ *  In:        shares: all key generation shares for the partcipant's index
+ *    vss_commitments: coefficient commitments of all participants ordered by
+ *                     the x-only pubkeys of the participants
+ *           n_shares: the total number of shares
+ *          threshold: the minimum number of shares required to produce a
+ *                     signature
+ *               id33: the 33-byte ID of the participant whose shares are being
+ *                     aggregated
+ */
+SECP256K1_API int secp256k1_frost_share_agg(
+    const secp256k1_context *ctx,
+    secp256k1_frost_share *agg_share,
+    secp256k1_xonly_pubkey *agg_pk,
+    const secp256k1_frost_share * const *shares,
+    const secp256k1_pubkey * const *vss_commitments,
+    size_t n_shares,
+    size_t threshold,
+    const unsigned char *id33
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(8);
+
+/** Verifies a share received during a key generation session
+ *
+ *  The signature is verified against the VSS commitment received with the
+ *  share. This is only useful for purposes of determining which share(s) are
+ *  invalid if share_agg returns an error.
+ *
+ *  Returns: 0 if the arguments are invalid or the share does not verify, 1
+ *           otherwise
+ *  Args         ctx: pointer to a context object
+ *  In:    threshold: the minimum number of signers required to produce a
+ *                    signature
+ *              id33: the 33-byte participant ID of the share recipient
+ *             share: pointer to a key generation share
+ *    vss_commitment: the VSS commitment associated with the share
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_share_verify(
+    const secp256k1_context *ctx,
+    size_t threshold,
+    const unsigned char *id33,
+    const secp256k1_frost_share *share,
+    const secp256k1_pubkey * const *vss_commitment
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Computes a public verification share used for verifying partial signatures
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise
+ *  Args:        ctx: pointer to a context object
+ *  In:     pubshare: pointer to a struct to store the public verification
+ *                    share
+ *         threshold: the minimum number of signers required to produce a
+ *                    signature
+ *              id33: the 33-byte participant ID of the participant whose
+ *                    partial signature will be verified with the pubshare
+ *   vss_commitments: coefficient commitments of all participants
+ *    n_participants: the total number of participants
+ */
+SECP256K1_API int secp256k1_frost_compute_pubshare(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *pubshare,
+    size_t threshold,
+    const unsigned char *id33,
+    const secp256k1_pubkey * const *vss_commitments,
+    size_t n_participants
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Obtain the aggregate public key from a FROST x-only aggregate public key.
+ *
+ *  This is only useful if you need the non-xonly public key, in particular for
+ *  ordinary (non-xonly) tweaking or batch-verifying multiple key aggregations
+ *  (not implemented).
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise
+ *  Args:        ctx: pointer to a context object
+ *  Out:   ec_agg_pk: the FROST-aggregated public key.
+ *  In: xonly_agg_pk: the aggregated x-only public key that is the output of
+ *                    `secp256k1_frost_share_agg`
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_pubkey_get(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *ec_agg_pk,
+    const secp256k1_xonly_pubkey *xonly_agg_pk
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Initializes a tweak cache used for applying tweaks to a FROST key
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise
+ *  Args:        ctx: pointer to a context object
+ *  Out: tweak_cache: pointer to a frost_tweak_cache struct that is required
+ *                    for key tweaking
+ *  In:       agg_pk: the aggregated x-only public key that is the output of
+ *                    `secp256k1_frost_share_agg`
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_pubkey_tweak(
+    const secp256k1_context *ctx,
+    secp256k1_frost_tweak_cache *tweak_cache,
+    const secp256k1_xonly_pubkey *agg_pk
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Apply ordinary "EC" tweaking to a public key in a given tweak_cache by
+ *  adding the generator multiplied with `tweak32` to it. This is useful for
+ *  deriving child keys from an aggregate public key via BIP32.
+ *
+ *  The tweaking method is the same as `secp256k1_ec_pubkey_tweak_add`. So after
+ *  the following pseudocode buf and buf2 have identical contents (absent
+ *  earlier failures).
+ *
+ *  secp256k1_frost_share_agg(..., xonly_agg_pk, ...)
+ *  secp256k1_frost_pubkey_tweak(..., tweak_cache, xonly_agg_pk)
+ *  secp256k1_frost_pubkey_ec_tweak_add(..., output_pk, tweak_cache, tweak32)
+ *  secp256k1_ec_pubkey_serialize(..., buf, output_pk)
+ *  secp256k1_frost_pubkey_get(..., ec_agg_pk, xonly_agg_pk)
+ *  secp256k1_ec_pubkey_tweak_add(..., ec_agg_pk, tweak32)
+ *  secp256k1_ec_pubkey_serialize(..., buf2, ec_agg_pk)
+ *
+ *  This function is required if you want to _sign_ for a tweaked aggregate key.
+ *  On the other hand, if you are only computing a public key, but not intending
+ *  to create a signature for it, you can just use
+ *  `secp256k1_ec_pubkey_tweak_add`.
+ *
+ *  Returns: 0 if the arguments are invalid or the resulting public key would be
+ *           invalid (only when the tweak is the negation of the corresponding
+ *           secret key). 1 otherwise.
+ *  Args:            ctx: pointer to a context object
+ *  Out:   output_pubkey: pointer to a public key to store the result. Will be set
+ *                        to an invalid value if this function returns 0. If you
+ *                        do not need it, this arg can be NULL.
+ *  In/Out:  tweak_cache: pointer to a `frost_tweak_cache` struct initialized by
+ *                       `frost_pubkey_tweak`
+ *  In:          tweak32: pointer to a 32-byte tweak. If the tweak is invalid
+ *                        according to `secp256k1_ec_seckey_verify`, this function
+ *                        returns 0. For uniformly random 32-byte arrays the
+ *                        chance of being invalid is negligible (around 1 in
+ *                        2^128).
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_pubkey_ec_tweak_add(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *output_pubkey,
+    secp256k1_frost_tweak_cache *tweak_cache,
+    const unsigned char *tweak32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Apply x-only tweaking to a public key in a given tweak_cache by adding the
+ *  generator multiplied with `tweak32` to it. This is useful for creating
+ *  Taproot outputs.
+ *
+ *  The tweaking method is the same as `secp256k1_xonly_pubkey_tweak_add`. So in
+ *  the following pseudocode xonly_pubkey_tweak_add_check (absent earlier
+ *  failures) returns 1.
+ *
+ *  secp256k1_frost_share_agg(..., agg_pk, ...)
+ *  secp256k1_frost_pubkey_tweak(..., tweak_cache, agg_pk)
+ *  secp256k1_frost_pubkey_xonly_tweak_add(..., output_pk, tweak_cache, tweak32)
+ *  secp256k1_xonly_pubkey_serialize(..., buf, output_pk)
+ *  secp256k1_xonly_pubkey_tweak_add_check(..., buf, ..., agg_pk, tweak32)
+ *
+ *  This function is required if you want to _sign_ for a tweaked aggregate key.
+ *  On the other hand, if you are only computing a public key, but not intending
+ *  to create a signature for it, you can just use
+ *  `secp256k1_xonly_pubkey_tweak_add`.
+ *
+ *  Returns: 0 if the arguments are invalid or the resulting public key would be
+ *           invalid (only when the tweak is the negation of the corresponding
+ *           secret key). 1 otherwise.
+ *  Args:            ctx: pointer to a context object
+ *  Out:   output_pubkey: pointer to a public key to store the result. Will be set
+ *                        to an invalid value if this function returns 0. If you
+ *                        do not need it, this arg can be NULL.
+ *  In/Out:  tweak_cache: pointer to a `frost_tweak_cache` struct initialized by
+ *                       `frost_pubkey_tweak`
+ *  In:          tweak32: pointer to a 32-byte tweak. If the tweak is invalid
+ *                        according to secp256k1_ec_seckey_verify, this function
+ *                        returns 0. For uniformly random 32-byte arrays the
+ *                        chance of being invalid is negligible (around 1 in
+ *                        2^128).
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_pubkey_xonly_tweak_add(
+    const secp256k1_context *ctx,
+    secp256k1_pubkey *output_pubkey,
+    secp256k1_frost_tweak_cache *tweak_cache,
+    const unsigned char *tweak32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Starts a signing session by generating a nonce
+ *
+ *  This function outputs a secret nonce that will be required for signing and a
+ *  corresponding public nonce that is intended to be sent to other signers.
+ *
+ *  FROST, like MuSig, differs from regular Schnorr signing in that
+ *  implementers _must_ take special care to not reuse a nonce. This can be
+ *  ensured by following these rules:
+ *
+ *  1. Each call to this function must have a UNIQUE session_id32 that must NOT BE
+ *     REUSED in subsequent calls to this function.
+ *     If you do not provide a seckey, session_id32 _must_ be UNIFORMLY RANDOM
+ *     AND KEPT SECRET (even from other signers). If you do provide a seckey,
+ *     session_id32 can instead be a counter (that must never repeat!). However,
+ *     it is recommended to always choose session_id32 uniformly at random.
+ *  2. If you already know the seckey, message or aggregate public key, they
+ *     can be optionally provided to derive the nonce and increase
+ *     misuse-resistance. The extra_input32 argument can be used to provide
+ *     additional data that does not repeat in normal scenarios, such as the
+ *     current time.
+ *  3. Avoid copying (or serializing) the secnonce. This reduces the possibility
+ *     that it is used more than once for signing.
+ *
+ *  Remember that nonce reuse will leak the secret key!
+ *  Note that using the same agg_share for multiple FROST sessions is fine.
+ *
+ *  Returns: 0 if the arguments are invalid and 1 otherwise
+ *  Args:         ctx: pointer to a context object (not secp256k1_context_static)
+ *  Out:     secnonce: pointer to a structure to store the secret nonce
+ *           pubnonce: pointer to a structure to store the public nonce
+ *  In:  session_id32: a 32-byte session_id32 as explained above. Must be
+ *                     unique to this call to secp256k1_frost_nonce_gen and
+ *                     must be uniformly random unless you really know what you
+ *                     are doing.
+ *          agg_share: the aggregated share that will later be used for
+ *                     signing, if already known (can be NULL)
+ *              msg32: the 32-byte message that will later be signed, if
+ *                     already known (can be NULL)
+ *             agg_pk: the FROST-aggregated public key (can be NULL)
+ *      extra_input32: an optional 32-byte array that is input to the nonce
+ *                     derivation function (can be NULL)
+ */
+SECP256K1_API int secp256k1_frost_nonce_gen(
+    const secp256k1_context *ctx,
+    secp256k1_frost_secnonce *secnonce,
+    secp256k1_frost_pubnonce *pubnonce,
+    const unsigned char *session_id32,
+    const secp256k1_frost_share *agg_share,
+    const unsigned char *msg32,
+    const secp256k1_xonly_pubkey *agg_pk,
+    const unsigned char *extra_input32
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Takes the public nonces of all signers and computes a session that is
+ * required for signing and verification of partial signatures. The participant
+ * IDs can be sorted before combining, but the corresponding pubnonces must be
+ * resorted as well. All signers must use the same sorting of pubnonces,
+ * otherwise signing will fail.
+ *
+ *  Returns: 0 if the arguments are invalid or if some signer sent invalid
+ *           pubnonces, 1 otherwise
+ *  Args:          ctx: pointer to a context object
+ *  Out:       session: pointer to a struct to store the session
+ *  In:      pubnonces: array of pointers to public nonces sent by the signers
+ *         n_pubnonces: number of elements in the pubnonces array. Must be
+ *                      greater than 0.
+ *               msg32: the 32-byte message to sign
+ *              agg_pk: the FROST-aggregated public key
+ *            myd_id33: the 33-byte ID of the participant who will use the
+ *                      session for signing
+ *               ids33: array of the 33-byte participant IDs of the signers
+ *         tweak_cache: pointer to frost_tweak_cache struct (can be NULL)
+ *             adaptor: optional pointer to an adaptor point encoded as a
+ *                      public key if this signing session is part of an
+ *                      adaptor signature protocol (can be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_nonce_process(
+    const secp256k1_context *ctx,
+    secp256k1_frost_session *session,
+    const secp256k1_frost_pubnonce * const *pubnonces,
+    size_t n_pubnonces,
+    const unsigned char *msg32,
+    const secp256k1_xonly_pubkey *agg_pk,
+    const unsigned char *my_id33,
+    const unsigned char * const* ids33,
+    const secp256k1_frost_tweak_cache *tweak_cache,
+    const secp256k1_pubkey *adaptor
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(8);
+
+/** Produces a partial signature
+ *
+ *  This function overwrites the given secnonce with zeros and will abort if given a
+ *  secnonce that is all zeros. This is a best effort attempt to protect against nonce
+ *  reuse. However, this is of course easily defeated if the secnonce has been
+ *  copied (or serialized). Remember that nonce reuse will leak the secret key!
+ *
+ *  Returns: 0 if the arguments are invalid or the provided secnonce has already
+ *           been used for signing, 1 otherwise
+ *  Args:         ctx: pointer to a context object
+ *  Out:  partial_sig: pointer to struct to store the partial signature
+ *  In/Out:  secnonce: pointer to the secnonce struct created in
+ *                     frost_nonce_gen that has been never used in a
+ *                     partial_sign call before
+ *  In:     agg_share: the aggregated share
+ *            session: pointer to the session that was created with
+ *                     frost_nonce_process
+ *        tweak_cache: pointer to frost_tweak_cache struct (can be NULL)
+ */
+SECP256K1_API int secp256k1_frost_partial_sign(
+    const secp256k1_context *ctx,
+    secp256k1_frost_partial_sig *partial_sig,
+    secp256k1_frost_secnonce *secnonce,
+    const secp256k1_frost_share *agg_share,
+    const secp256k1_frost_session *session,
+    const secp256k1_frost_tweak_cache *tweak_cache
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Verifies an individual signer's partial signature
+ *
+ *  The signature is verified for a specific signing session. In order to avoid
+ *  accidentally verifying a signature from a different or non-existing signing
+ *  session, you must ensure the following:
+ *    1. The `tweak_cache` argument is identical to the one used to create the
+ *       `session` with `frost_nonce_process`.
+ *    2. The `pubshare` argument must be the output of
+ *       `secp256k1_frost_shares_trusted_gen` for the signer's 'pk'.
+ *    3. The `pubnonce` argument must be identical to the one sent by the
+ *       signer and used to create the `session` with `frost_nonce_process`.
+ *
+ *  This function can be used to assign blame for a failed signature.
+ *
+ *  Returns: 0 if the arguments are invalid or the partial signature does not
+ *           verify, 1 otherwise
+ *  Args         ctx: pointer to a context object
+ *  In:  partial_sig: pointer to partial signature to verify, sent by
+ *                    the signer associated with `pubnonce` and `pubkey`
+ *          pubnonce: public nonce of the signer in the signing session
+ *          pubshare: public verification share of the signer in the signing
+ *                    session that is the output of
+ *                    `secp256k1_frost_shares_trusted_gen`
+ *           session: pointer to the session that was created with
+ *                    `frost_nonce_process`
+ *       tweak_cache: pointer to frost_tweak_cache struct (can be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_partial_sig_verify(
+    const secp256k1_context *ctx,
+    const secp256k1_frost_partial_sig *partial_sig,
+    const secp256k1_frost_pubnonce *pubnonce,
+    const secp256k1_pubkey *pubshare,
+    const secp256k1_frost_session *session,
+    const secp256k1_frost_tweak_cache *tweak_cache
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Aggregates partial signatures
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise (which does NOT mean
+ *           the resulting signature verifies).
+ *  Args:         ctx: pointer to a context object
+ *  Out:        sig64: complete (but possibly invalid) Schnorr signature
+ *  In:       session: pointer to the session that was created with
+ *                     frost_nonce_process
+ *       partial_sigs: array of pointers to partial signatures to aggregate
+ *             n_sigs: number of elements in the partial_sigs array. Must be
+ *                     greater than 0.
+ */
+SECP256K1_API int secp256k1_frost_partial_sig_agg(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const secp256k1_frost_session *session,
+    const secp256k1_frost_partial_sig * const *partial_sigs,
+    size_t n_sigs
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Extracts the nonce_parity bit from a session
+ *
+ *  This is used for adaptor signatures.
+ *
+ *  Returns: 0 if the arguments are invalid, 1 otherwise
+ *  Args:         ctx: pointer to a context object
+ *  Out: nonce_parity: pointer to an integer that indicates the parity
+ *                     of the aggregate public nonce. Used for adaptor
+ *                     signatures.
+ *  In:       session: pointer to the session that was created with
+ *                     frost_nonce_process
+ */
+SECP256K1_API int secp256k1_frost_nonce_parity(
+    const secp256k1_context *ctx,
+    int *nonce_parity,
+    const secp256k1_frost_session *session
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
+
+/** Verifies that the adaptor can be extracted by combining the adaptor
+ *  pre-signature and the completed signature.
+ *
+ *  Returns: 0 if the arguments are invalid or the adaptor signature does not
+ *           verify, 1 otherwise
+ *  Args:         ctx: pointer to a context object
+ *  In:     pre_sig64: 64-byte pre-signature
+ *              msg32: the 32-byte message being verified
+ *             pubkey: pointer to an x-only public key to verify with
+ *            adaptor: pointer to the adaptor point being verified
+ *       nonce_parity: the output of `frost_nonce_parity` called with the
+ *                     session used for producing the pre-signature
+ */
+SECP256K1_API int secp256k1_frost_verify_adaptor(
+    const secp256k1_context *ctx,
+    const unsigned char *pre_sig64,
+    const unsigned char *msg32,
+    const secp256k1_xonly_pubkey *pubkey,
+    const secp256k1_pubkey *adaptor,
+    int nonce_parity
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+/** Creates a signature from a pre-signature and an adaptor.
+ *
+ *  If the sec_adaptor32 argument is incorrect, the output signature will be
+ *  invalid. This function does not verify the signature.
+ *
+ *  Returns: 0 if the arguments are invalid, or pre_sig64 or sec_adaptor32 contain
+ *           invalid (overflowing) values. 1 otherwise (which does NOT mean the
+ *           signature or the adaptor are valid!)
+ *  Args:         ctx: pointer to a context object
+ *  Out:        sig64: 64-byte signature. This pointer may point to the same
+ *                     memory area as `pre_sig`.
+ *  In:     pre_sig64: 64-byte pre-signature
+ *      sec_adaptor32: 32-byte secret adaptor to add to the pre-signature
+ *       nonce_parity: the output of `frost_nonce_parity` called with the
+ *                     session used for producing the pre-signature
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_adapt(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const unsigned char *pre_sig64,
+    const unsigned char *sec_adaptor32,
+    int nonce_parity
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/** Extracts a secret adaptor from a FROST pre-signature and corresponding
+ *  signature
+ *
+ *  This function will not fail unless given grossly invalid data; if it is
+ *  merely given signatures that do not verify, the returned value will be
+ *  nonsense. It is therefore important that all data be verified at earlier
+ *  steps of any protocol that uses this function. In particular, this includes
+ *  verifying all partial signatures that were aggregated into pre_sig64.
+ *
+ *  Returns: 0 if the arguments are NULL, or sig64 or pre_sig64 contain
+ *           grossly invalid (overflowing) values. 1 otherwise (which does NOT
+ *           mean the signatures or the adaptor are valid!)
+ *  Args:         ctx: pointer to a context object
+ *  Out:sec_adaptor32: 32-byte secret adaptor
+ *  In:         sig64: complete, valid 64-byte signature
+ *          pre_sig64: the pre-signature corresponding to sig64, i.e., the
+ *                     aggregate of partial signatures without the secret
+ *                     adaptor
+ *       nonce_parity: the output of `frost_nonce_parity` called with the
+ *                     session used for producing sig64
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_frost_extract_adaptor(
+    const secp256k1_context *ctx,
+    unsigned char *sec_adaptor32,
+    const unsigned char *sig64,
+    const unsigned char *pre_sig64,
+    int nonce_parity
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

src/group.h

@@ -202,6 +202,10 @@ static void secp256k1_ge_from_bytes(secp256k1_ge *r, const unsigned char *buf);
  */
 static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge);
 
+static void secp256k1_point_save_ext(unsigned char *data, secp256k1_ge *ge);
+
+static void secp256k1_point_load_ext(secp256k1_ge *ge, const unsigned char *data);
+
 /** Check invariants on an affine group element (no-op unless VERIFY is enabled). */
 static void secp256k1_ge_verify(const secp256k1_ge *a);
 #define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)

src/group_impl.h

@@ -914,6 +914,23 @@ static int secp256k1_gej_has_quad_y_var(const secp256k1_gej *a) {
     return secp256k1_fe_is_square_var(&yz);
 }
 
+static void secp256k1_point_save_ext(unsigned char *data, secp256k1_ge *ge) {
+    if (secp256k1_ge_is_infinity(ge)) {
+        memset(data, 0, 64);
+    } else {
+        secp256k1_ge_to_bytes(data, ge);
+    }
+}
+
+static void secp256k1_point_load_ext(secp256k1_ge *ge, const unsigned char *data) {
+    unsigned char zeros[64] = { 0 };
+    if (secp256k1_memcmp_var(data, zeros, sizeof(zeros)) == 0) {
+        secp256k1_ge_set_infinity(ge);
+    } else {
+        secp256k1_ge_from_bytes(ge, data);
+    }
+}
+
 static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
 #ifdef EXHAUSTIVE_TEST_ORDER
     secp256k1_gej out;

src/modules/frost/Makefile.am.include

@@ -0,0 +1,7 @@
+include_HEADERS += include/secp256k1_frost.h
+noinst_HEADERS += src/modules/frost/main_impl.h
+noinst_HEADERS += src/modules/frost/keygen.h
+noinst_HEADERS += src/modules/frost/keygen_impl.h
+noinst_HEADERS += src/modules/frost/session.h
+noinst_HEADERS += src/modules/frost/session_impl.h
+noinst_HEADERS += src/modules/frost/adaptor_impl.h

src/modules/frost/adaptor_impl.h

@@ -0,0 +1,168 @@
+/***********************************************************************
+ * Copyright (c) 2022-2024 Jesse Posner                                *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_ADAPTOR_IMPL_H
+#define SECP256K1_MODULE_FROST_ADAPTOR_IMPL_H
+
+#include <string.h>
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_frost.h"
+
+#include "session.h"
+#include "../../scalar.h"
+
+int secp256k1_frost_nonce_parity(const secp256k1_context* ctx, int *nonce_parity, const secp256k1_frost_session *session) {
+    secp256k1_frost_session_internal session_i;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(nonce_parity != NULL);
+    ARG_CHECK(session != NULL);
+
+    if (!secp256k1_frost_session_load(ctx, &session_i, session)) {
+        return 0;
+    }
+    *nonce_parity = session_i.fin_nonce_parity;
+    return 1;
+}
+
+int secp256k1_frost_verify_adaptor(const secp256k1_context* ctx, const unsigned char *pre_sig64, const unsigned char *msg32, const secp256k1_xonly_pubkey *pubkey, const secp256k1_pubkey *adaptor, int nonce_parity) {
+    secp256k1_scalar s;
+    secp256k1_scalar e;
+    secp256k1_gej rj;
+    secp256k1_ge pk;
+    secp256k1_gej pkj;
+    secp256k1_ge r;
+    unsigned char buf[32];
+    int overflow;
+    secp256k1_ge adaptorp;
+    secp256k1_xonly_pubkey noncepk;
+    secp256k1_gej fin_nonce_ptj;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pre_sig64 != NULL);
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(pubkey != NULL);
+    ARG_CHECK(adaptor != NULL);
+    ARG_CHECK(nonce_parity == 0 || nonce_parity == 1);
+
+    if (!secp256k1_xonly_pubkey_parse(ctx, &noncepk, &pre_sig64[0])) {
+        return 0;
+    }
+    if (!secp256k1_xonly_pubkey_load(ctx, &r, &noncepk)) {
+        return 0;
+    }
+    if (!secp256k1_pubkey_load(ctx, &adaptorp, adaptor)) {
+        return 0;
+    }
+    if (!nonce_parity) {
+        secp256k1_ge_neg(&adaptorp, &adaptorp);
+    }
+    secp256k1_gej_set_ge(&fin_nonce_ptj, &adaptorp);
+    secp256k1_gej_add_ge_var(&fin_nonce_ptj, &fin_nonce_ptj, &r, NULL);
+    if (secp256k1_gej_is_infinity(&fin_nonce_ptj)) {
+        /* unreachable with overwhelming probability */
+        return 0;
+    }
+
+    secp256k1_scalar_set_b32(&s, &pre_sig64[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+
+    if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
+        return 0;
+    }
+
+    /* Compute e. */
+    secp256k1_fe_get_b32(buf, &pk.x);
+    secp256k1_schnorrsig_challenge(&e, &pre_sig64[0], msg32, 32, buf);
+
+    /* Compute rj =  s*G + (-e)*pkj */
+    secp256k1_scalar_negate(&e, &e);
+    secp256k1_gej_set_ge(&pkj, &pk);
+    secp256k1_ecmult(&rj, &pkj, &e, &s);
+
+    /* secp256k1_ge_set_gej_var(&r, &rj); */
+    if (secp256k1_gej_is_infinity(&rj)) {
+        return 0;
+    }
+
+    secp256k1_gej_neg(&rj, &rj);
+    secp256k1_gej_add_var(&rj, &rj, &fin_nonce_ptj, NULL);
+    return secp256k1_gej_is_infinity(&rj);
+}
+
+int secp256k1_frost_adapt(const secp256k1_context* ctx, unsigned char *sig64, const unsigned char *pre_sig64, const unsigned char *sec_adaptor32, int nonce_parity) {
+    secp256k1_scalar s;
+    secp256k1_scalar t;
+    int overflow;
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(pre_sig64 != NULL);
+    ARG_CHECK(sec_adaptor32 != NULL);
+    ARG_CHECK(nonce_parity == 0 || nonce_parity == 1);
+
+    secp256k1_scalar_set_b32(&s, &pre_sig64[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&t, sec_adaptor32, &overflow);
+    ret &= !overflow;
+
+    /* Determine if the secret adaptor should be negated.
+     *
+     * The frost_session stores the X-coordinate and the parity of the "final nonce"
+     * (r + t)*G, where r*G is the aggregate public nonce and t is the secret adaptor.
+     *
+     * Since a BIP340 signature requires an x-only public nonce, in the case where
+     * (r + t)*G has odd Y-coordinate (i.e. nonce_parity == 1), the x-only public nonce
+     * corresponding to the signature is actually (-r - t)*G. Thus adapting a
+     * pre-signature requires negating t in this case.
+     */
+    if (nonce_parity) {
+        secp256k1_scalar_negate(&t, &t);
+    }
+
+    secp256k1_scalar_add(&s, &s, &t);
+    secp256k1_scalar_get_b32(&sig64[32], &s);
+    memmove(sig64, pre_sig64, 32);
+    secp256k1_scalar_clear(&t);
+    return ret;
+}
+
+int secp256k1_frost_extract_adaptor(const secp256k1_context* ctx, unsigned char *sec_adaptor32, const unsigned char *sig64, const unsigned char *pre_sig64, int nonce_parity) {
+    secp256k1_scalar t;
+    secp256k1_scalar s;
+    int overflow;
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sec_adaptor32 != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(pre_sig64 != NULL);
+    ARG_CHECK(nonce_parity == 0 || nonce_parity == 1);
+
+    secp256k1_scalar_set_b32(&t, &sig64[32], &overflow);
+    ret &= !overflow;
+    secp256k1_scalar_negate(&t, &t);
+
+    secp256k1_scalar_set_b32(&s, &pre_sig64[32], &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_scalar_add(&t, &t, &s);
+
+    if (!nonce_parity) {
+        secp256k1_scalar_negate(&t, &t);
+    }
+    secp256k1_scalar_get_b32(sec_adaptor32, &t);
+    secp256k1_scalar_clear(&t);
+    return ret;
+}
+
+#endif

src/modules/frost/keygen.h

@@ -0,0 +1,26 @@
+/**********************************************************************
+ * Copyright (c) 2021-2024 Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_KEYGEN_H
+#define SECP256K1_MODULE_FROST_KEYGEN_H
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_frost.h"
+
+#include "../../group.h"
+#include "../../scalar.h"
+
+typedef struct {
+    secp256k1_ge pk;
+    secp256k1_scalar tweak;
+    int parity_acc;
+} secp256k1_tweak_cache_internal;
+
+static int secp256k1_tweak_cache_load(const secp256k1_context* ctx, secp256k1_tweak_cache_internal *cache_i, const secp256k1_frost_tweak_cache *cache);
+
+static int secp256k1_frost_share_load(const secp256k1_context* ctx, secp256k1_scalar *s, const secp256k1_frost_share* share);
+
+#endif

src/modules/frost/keygen_impl.h

@@ -0,0 +1,526 @@
+/**********************************************************************
+ * Copyright (c) 2021-2024 Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_KEYGEN_IMPL_H
+#define SECP256K1_MODULE_FROST_KEYGEN_IMPL_H
+
+#include <string.h>
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_extrakeys.h"
+#include "../../../include/secp256k1_frost.h"
+
+#include "keygen.h"
+#include "../../ecmult.h"
+#include "../../field.h"
+#include "../../group.h"
+#include "../../hash.h"
+#include "../../scalar.h"
+
+static const unsigned char secp256k1_frost_tweak_cache_magic[4] = { 0x40, 0x25, 0x2e, 0x41 };
+
+/* A tweak cache consists of
+ * - 4 byte magic set during initialization to allow detecting an uninitialized
+ *   object.
+ * - 64 byte aggregate (and potentially tweaked) public key
+ * - 1 byte the parity of the internal key (if tweaked, otherwise 0)
+ * - 32 byte tweak
+ */
+/* Requires that cache_i->pk is not infinity. */
+static void secp256k1_tweak_cache_save(secp256k1_frost_tweak_cache *cache, secp256k1_tweak_cache_internal *cache_i) {
+    unsigned char *ptr = cache->data;
+    memcpy(ptr, secp256k1_frost_tweak_cache_magic, 4);
+    ptr += 4;
+    secp256k1_point_save_ext(ptr, &cache_i->pk);
+    ptr += 64;
+    *ptr = cache_i->parity_acc;
+    ptr += 1;
+    secp256k1_scalar_get_b32(ptr, &cache_i->tweak);
+}
+
+static int secp256k1_tweak_cache_load(const secp256k1_context* ctx, secp256k1_tweak_cache_internal *cache_i, const secp256k1_frost_tweak_cache *cache) {
+    const unsigned char *ptr = cache->data;
+    ARG_CHECK(secp256k1_memcmp_var(ptr, secp256k1_frost_tweak_cache_magic, 4) == 0);
+    ptr += 4;
+    secp256k1_point_load_ext(&cache_i->pk, ptr);
+    ptr += 64;
+    cache_i->parity_acc = *ptr & 1;
+    ptr += 1;
+    secp256k1_scalar_set_b32(&cache_i->tweak, ptr, NULL);
+    return 1;
+}
+
+/* Computes indexhash = tagged_hash(pk) */
+static int secp256k1_frost_compute_indexhash(secp256k1_scalar *indexhash, const unsigned char *id33) {
+    secp256k1_sha256 sha;
+    unsigned char buf[32];
+
+    secp256k1_sha256_initialize_tagged(&sha, (unsigned char*)"FROST/index", sizeof("FROST/index") - 1);
+    secp256k1_sha256_write(&sha, id33, 33);
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_scalar_set_b32(indexhash, buf, NULL);
+    /* The x-coordinate must not be zero (see
+     * draft-irtf-cfrg-frost-08#section-4.2.2) */
+    if (secp256k1_scalar_is_zero(indexhash)) {
+        return 0;
+    }
+
+    return 1;
+}
+
+static const unsigned char secp256k1_frost_share_magic[4] = { 0xa1, 0x6a, 0x42, 0x03 };
+
+static void secp256k1_frost_share_save(secp256k1_frost_share* share, secp256k1_scalar *s) {
+    memcpy(&share->data[0], secp256k1_frost_share_magic, 4);
+    secp256k1_scalar_get_b32(&share->data[4], s);
+}
+
+static int secp256k1_frost_share_load(const secp256k1_context* ctx, secp256k1_scalar *s, const secp256k1_frost_share* share) {
+    int overflow;
+
+    ARG_CHECK(secp256k1_memcmp_var(&share->data[0], secp256k1_frost_share_magic, 4) == 0);
+    secp256k1_scalar_set_b32(s, &share->data[4], &overflow);
+    /* Parsed shares cannot overflow */
+    VERIFY_CHECK(!overflow);
+    return 1;
+}
+
+int secp256k1_frost_share_serialize(const secp256k1_context* ctx, unsigned char *out32, const secp256k1_frost_share* share) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(out32 != NULL);
+    ARG_CHECK(share != NULL);
+    memcpy(out32, &share->data[4], 32);
+    return 1;
+}
+
+int secp256k1_frost_share_parse(const secp256k1_context* ctx, secp256k1_frost_share* share, const unsigned char *in32) {
+    secp256k1_scalar tmp;
+    int overflow;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(share != NULL);
+    ARG_CHECK(in32 != NULL);
+
+    secp256k1_scalar_set_b32(&tmp, in32, &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_frost_share_save(share, &tmp);
+    return 1;
+}
+
+static void secp256k1_frost_derive_coeff(secp256k1_scalar *coeff, const unsigned char *polygen32, size_t i) {
+    secp256k1_sha256 sha;
+    unsigned char buf[32];
+
+    secp256k1_sha256_initialize_tagged(&sha, (unsigned char*)"FROST/coeffgen", sizeof("FROST/coeffgen") - 1);
+    secp256k1_sha256_write(&sha, polygen32, 32);
+    secp256k1_write_be64(&buf[0], i);
+    secp256k1_sha256_write(&sha, buf, 8);
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_scalar_set_b32(coeff, buf, NULL);
+}
+
+static int secp256k1_frost_vss_gen(const secp256k1_context *ctx, secp256k1_pubkey *vss_commitment, unsigned char *pok64, const unsigned char *polygen32, size_t threshold) {
+    secp256k1_sha256 sha;
+    unsigned char buf[32];
+    secp256k1_keypair keypair;
+    secp256k1_gej rj;
+    secp256k1_ge rp;
+    size_t i;
+    int ret = 1;
+
+    for (i = 0; i < threshold; i++) {
+        secp256k1_scalar coeff_i;
+
+        secp256k1_frost_derive_coeff(&coeff_i, polygen32, i);
+        /* Compute proof-of-knowledge for constant term */
+        if (i == threshold - 1) {
+            secp256k1_scalar_get_b32(buf, &coeff_i);
+            ret &= secp256k1_keypair_create(ctx, &keypair, buf);
+
+            secp256k1_sha256_initialize_tagged(&sha, (unsigned char*)"FROST/KeygenPoK", sizeof("FROST/KeygenPoK") - 1);
+            secp256k1_sha256_finalize(&sha, buf);
+
+            ret &= secp256k1_schnorrsig_sign32(ctx, pok64, buf, &keypair, NULL);
+        }
+
+        /* Compute commitment to each coefficient */
+        secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &coeff_i);
+        secp256k1_ge_set_gej(&rp, &rj);
+        secp256k1_pubkey_save(&vss_commitment[threshold - i - 1], &rp);
+    }
+    return ret;
+}
+
+static int secp256k1_frost_share_gen(secp256k1_frost_share *share, const unsigned char *polygen32, size_t threshold, const unsigned char *id33) {
+    secp256k1_scalar idx;
+    secp256k1_scalar share_i;
+    size_t i;
+    int ret = 1;
+
+    /* Derive share */
+    /* See draft-irtf-cfrg-frost-08#appendix-C.1 */
+    secp256k1_scalar_set_int(&share_i, 0);
+    if (!secp256k1_frost_compute_indexhash(&idx, id33)) {
+        return 0;
+    }
+    for (i = 0; i < threshold; i++) {
+        secp256k1_scalar coeff_i;
+
+        secp256k1_frost_derive_coeff(&coeff_i, polygen32, i);
+        /* Horner's method to evaluate polynomial to derive shares */
+        secp256k1_scalar_add(&share_i, &share_i, &coeff_i);
+        if (i < threshold - 1) {
+            secp256k1_scalar_mul(&share_i, &share_i, &idx);
+        }
+    }
+    secp256k1_frost_share_save(share, &share_i);
+
+    return ret;
+}
+
+int secp256k1_frost_shares_gen(const secp256k1_context *ctx, secp256k1_frost_share *shares, secp256k1_pubkey *vss_commitment, unsigned char *pok64, const unsigned char *seed32, size_t threshold, size_t n_participants, const unsigned char * const* ids33) {
+    secp256k1_sha256 sha;
+    unsigned char polygen[32];
+    size_t i;
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(shares != NULL);
+    for (i = 0; i < n_participants; i++) {
+        memset(&shares[i], 0, sizeof(shares[i]));
+    }
+    ARG_CHECK(vss_commitment != NULL);
+    ARG_CHECK(pok64 != NULL);
+    ARG_CHECK(seed32 != NULL);
+    ARG_CHECK(ids33 != NULL);
+    ARG_CHECK(threshold > 1);
+    ARG_CHECK(n_participants >= threshold);
+
+    /* Commit to all inputs */
+    secp256k1_sha256_initialize(&sha);
+    secp256k1_sha256_write(&sha, seed32, 32);
+    secp256k1_write_be64(&polygen[0], threshold);
+    secp256k1_write_be64(&polygen[8], n_participants);
+    secp256k1_sha256_write(&sha, polygen, 16);
+    for (i = 0; i < n_participants; i++) {
+        secp256k1_sha256_write(&sha, ids33[i], 33);
+    }
+    secp256k1_sha256_finalize(&sha, polygen);
+
+    ret &= secp256k1_frost_vss_gen(ctx, vss_commitment, pok64, polygen, threshold);
+
+    for (i = 0; i < n_participants; i++) {
+        ret &= secp256k1_frost_share_gen(&shares[i], polygen, threshold, ids33[i]);
+    }
+
+    return ret;
+}
+
+typedef struct {
+    const secp256k1_context *ctx;
+    secp256k1_scalar idx;
+    secp256k1_scalar idxn;
+    const secp256k1_pubkey * const* vss_commitment;
+} secp256k1_frost_verify_share_ecmult_data;
+
+typedef struct {
+    const secp256k1_context *ctx;
+    secp256k1_scalar idx;
+    secp256k1_scalar idxn;
+    const secp256k1_pubkey * const* vss_commitments;
+    size_t threshold;
+} secp256k1_frost_compute_pubshare_ecmult_data;
+
+typedef struct {
+    const secp256k1_context *ctx;
+    const secp256k1_pubkey * const* pks;
+    size_t threshold;
+} secp256k1_frost_pubkey_combine_ecmult_data;
+
+static int secp256k1_frost_verify_share_ecmult_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data) {
+    secp256k1_frost_verify_share_ecmult_data *ctx = (secp256k1_frost_verify_share_ecmult_data *) data;
+    if (!secp256k1_pubkey_load(ctx->ctx, pt, *(ctx->vss_commitment)+idx)) {
+        return 0;
+    }
+    *sc = ctx->idxn;
+    secp256k1_scalar_mul(&ctx->idxn, &ctx->idxn, &ctx->idx);
+
+    return 1;
+}
+
+static int secp256k1_frost_compute_pubshare_ecmult_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data) {
+    secp256k1_frost_compute_pubshare_ecmult_data *ctx = (secp256k1_frost_compute_pubshare_ecmult_data *) data;
+
+    if (!secp256k1_pubkey_load(ctx->ctx, pt, &ctx->vss_commitments[idx/ctx->threshold][idx % ctx->threshold])) {
+        return 0;
+    }
+    if (idx != 0 && idx % ctx->threshold == 0) {
+        secp256k1_scalar_set_int(&ctx->idxn, 1);
+    }
+    *sc = ctx->idxn;
+    secp256k1_scalar_mul(&ctx->idxn, &ctx->idxn, &ctx->idx);
+
+    return 1;
+}
+
+static int secp256k1_frost_pubkey_combine_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *data) {
+    secp256k1_frost_pubkey_combine_ecmult_data *ctx = (secp256k1_frost_pubkey_combine_ecmult_data *) data;
+
+    secp256k1_scalar_set_int(sc, 1);
+    /* the public key is the first index of each set of coefficients */
+    return secp256k1_pubkey_load(ctx->ctx, pt, &ctx->pks[idx][0]);
+}
+
+/* See draft-irtf-cfrg-frost-08#appendix-C.2 */
+static int secp256k1_frost_vss_verify_internal(const secp256k1_context* ctx, size_t threshold, const unsigned char *id33, const secp256k1_scalar *share, const secp256k1_pubkey * const* vss_commitment) {
+    secp256k1_scalar share_neg;
+    secp256k1_gej tmpj, snj;
+    secp256k1_ge sng;
+    secp256k1_frost_verify_share_ecmult_data verify_share_ecmult_data;
+
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+
+    /* Use an EC multi-multiplication to verify the following equation:
+     *   0 = - share_i*G + idx^0*vss_commitment[0]
+     *                   + ...
+     *                   + idx^(threshold - 1)*vss_commitment[threshold - 1]*/
+    verify_share_ecmult_data.ctx = ctx;
+    verify_share_ecmult_data.vss_commitment = vss_commitment;
+    /* Evaluate the public polynomial at the idx */
+    if (!secp256k1_frost_compute_indexhash(&verify_share_ecmult_data.idx, id33)) {
+        return 0;
+    }
+    secp256k1_scalar_set_int(&verify_share_ecmult_data.idxn, 1);
+    /* TODO: add scratch */
+    if (!secp256k1_ecmult_multi_var(&ctx->error_callback, NULL, &tmpj, NULL, secp256k1_frost_verify_share_ecmult_callback, (void *) &verify_share_ecmult_data, threshold)) {
+        return 0;
+    }
+    secp256k1_scalar_negate(&share_neg, share);
+    secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &snj, &share_neg);
+    secp256k1_ge_set_gej(&sng, &snj);
+    secp256k1_gej_add_ge(&tmpj, &tmpj, &sng);
+    return secp256k1_gej_is_infinity(&tmpj);
+}
+
+/* See draft-irtf-cfrg-frost-08#appendix-C.2 */
+int secp256k1_frost_share_verify(const secp256k1_context* ctx, size_t threshold, const unsigned char *id33, const secp256k1_frost_share *share, const secp256k1_pubkey * const* vss_commitment) {
+    secp256k1_scalar share_i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(id33 != NULL);
+    ARG_CHECK(share != NULL);
+    ARG_CHECK(vss_commitment != NULL);
+    ARG_CHECK(threshold > 1);
+
+    if (!secp256k1_frost_share_load(ctx, &share_i, share)) {
+        return 0;
+    }
+
+    return secp256k1_frost_vss_verify_internal(ctx, threshold, id33, &share_i, vss_commitment);
+}
+
+int secp256k1_frost_compute_pubshare(const secp256k1_context* ctx, secp256k1_pubkey *pubshare, size_t threshold, const unsigned char *id33, const secp256k1_pubkey * const* vss_commitments, size_t n_participants) {
+    secp256k1_gej pkj;
+    secp256k1_ge pkp, tmp;
+    secp256k1_frost_compute_pubshare_ecmult_data compute_pubshare_ecmult_data;
+    secp256k1_frost_pubkey_combine_ecmult_data pubkey_combine_ecmult_data;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(pubshare != NULL);
+    memset(pubshare, 0, sizeof(*pubshare));
+    ARG_CHECK(id33 != NULL);
+    ARG_CHECK(vss_commitments != NULL);
+    ARG_CHECK(n_participants > 1);
+    ARG_CHECK(threshold > 1);
+
+    if (threshold > n_participants) {
+        return 0;
+    }
+
+    /* Use an EC multi-multiplication to compute the following equation:
+     *   agg_share_i*G = (
+     *      idx^0*vss_commitment[0][0] + ...
+     *                                 + idx^(t - 1)*vss_commitment[0][t - 1]
+     *   )                             + ...
+     *                                 + (
+     *      idx^0*vss_commitment[n - 1][0] + ...
+     *                                     + idx^(t - 1)*vss_commitment[n - 1][t - 1]
+     *   )*/
+    compute_pubshare_ecmult_data.ctx = ctx;
+    compute_pubshare_ecmult_data.vss_commitments = vss_commitments;
+    compute_pubshare_ecmult_data.threshold = threshold;
+    /* Evaluate the public polynomial at the idx */
+    if (!secp256k1_frost_compute_indexhash(&compute_pubshare_ecmult_data.idx, id33)) {
+        return 0;
+    }
+    secp256k1_scalar_set_int(&compute_pubshare_ecmult_data.idxn, 1);
+    /* TODO: add scratch */
+    if (!secp256k1_ecmult_multi_var(&ctx->error_callback, NULL, &pkj, NULL, secp256k1_frost_compute_pubshare_ecmult_callback, (void *) &compute_pubshare_ecmult_data, n_participants*threshold)) {
+        return 0;
+    }
+    secp256k1_ge_set_gej(&tmp, &pkj);
+
+    /* Combine pubkeys */
+    pubkey_combine_ecmult_data.ctx = ctx;
+    pubkey_combine_ecmult_data.pks = vss_commitments;
+    pubkey_combine_ecmult_data.threshold = threshold;
+
+    /* TODO: add scratch */
+    if (!secp256k1_ecmult_multi_var(&ctx->error_callback, NULL, &pkj, NULL, secp256k1_frost_pubkey_combine_callback, (void *) &pubkey_combine_ecmult_data, n_participants)) {
+        return 0;
+    }
+    secp256k1_ge_set_gej(&pkp, &pkj);
+    secp256k1_fe_normalize_var(&pkp.y);
+    if (secp256k1_fe_is_odd(&pkp.y)) {
+        secp256k1_ge_neg(&tmp, &tmp);
+    }
+
+    secp256k1_pubkey_save(pubshare, &tmp);
+
+    return 1;
+}
+
+int secp256k1_frost_share_agg(const secp256k1_context* ctx, secp256k1_frost_share *agg_share, secp256k1_xonly_pubkey *agg_pk, const secp256k1_frost_share * const* shares, const secp256k1_pubkey * const* vss_commitments, size_t n_shares, size_t threshold, const unsigned char *id33) {
+    secp256k1_frost_pubkey_combine_ecmult_data pubkey_combine_ecmult_data;
+    secp256k1_gej pkj;
+    secp256k1_ge pkp;
+    int pk_parity;
+    secp256k1_scalar acc;
+    size_t i;
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(agg_share != NULL);
+    memset(agg_share, 0, sizeof(*agg_share));
+    ARG_CHECK(agg_pk != NULL);
+    memset(agg_pk, 0, sizeof(*agg_pk));
+    ARG_CHECK(shares != NULL);
+    ARG_CHECK(vss_commitments != NULL);
+    ARG_CHECK(id33 != NULL);
+    ARG_CHECK(n_shares > 1);
+    ARG_CHECK(threshold > 1);
+
+    if (threshold > n_shares) {
+        return 0;
+    }
+
+    secp256k1_scalar_clear(&acc);
+    for (i = 0; i < n_shares; i++) {
+        secp256k1_scalar share_i;
+
+        if (!secp256k1_frost_share_load(ctx, &share_i, shares[i])) {
+            return 0;
+        }
+        /* Verify share against commitments */
+        ret &= secp256k1_frost_vss_verify_internal(ctx, threshold, id33, &share_i, &vss_commitments[i]);
+        secp256k1_scalar_add(&acc, &acc, &share_i);
+    }
+
+    /* Combine pubkeys */
+    pubkey_combine_ecmult_data.ctx = ctx;
+    pubkey_combine_ecmult_data.pks = vss_commitments;
+    pubkey_combine_ecmult_data.threshold = threshold;
+
+    /* TODO: add scratch */
+    if (!secp256k1_ecmult_multi_var(&ctx->error_callback, NULL, &pkj, NULL, secp256k1_frost_pubkey_combine_callback, (void *) &pubkey_combine_ecmult_data, n_shares)) {
+        return 0;
+    }
+
+    secp256k1_ge_set_gej(&pkp, &pkj);
+    secp256k1_fe_normalize_var(&pkp.y);
+    pk_parity = secp256k1_extrakeys_ge_even_y(&pkp);
+    secp256k1_xonly_pubkey_save(agg_pk, &pkp);
+
+    /* Invert the aggregate share if the combined pubkey has an odd Y coordinate. */
+    if (pk_parity == 1) {
+        secp256k1_scalar_negate(&acc, &acc);
+    }
+    secp256k1_frost_share_save(agg_share, &acc);
+
+    return ret;
+}
+
+int secp256k1_frost_pubkey_get(const secp256k1_context* ctx, secp256k1_pubkey *ec_pk, const secp256k1_xonly_pubkey *xonly_pk) {
+    secp256k1_ge pk;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(ec_pk != NULL);
+    memset(ec_pk, 0, sizeof(*ec_pk));
+    ARG_CHECK(xonly_pk != NULL);
+
+    /* The output of keygen is an aggregated public key that *always* has an
+     * even Y coordinate. */
+    if (!secp256k1_xonly_pubkey_load(ctx, &pk, xonly_pk)) {
+        return 0;
+    }
+    secp256k1_pubkey_save(ec_pk, &pk);
+    return 1;
+}
+
+int secp256k1_frost_pubkey_tweak(const secp256k1_context* ctx, secp256k1_frost_tweak_cache *tweak_cache, const secp256k1_xonly_pubkey *pk) {
+    secp256k1_tweak_cache_internal cache_i = { 0 };
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(tweak_cache != NULL);
+    ARG_CHECK(pk != NULL);
+
+    /* The output of keygen is an aggregated public key that *always* has an
+     * even Y coordinate. */
+    if (!secp256k1_xonly_pubkey_load(ctx, &cache_i.pk, pk)) {
+        return 0;
+    }
+    secp256k1_tweak_cache_save(tweak_cache, &cache_i);
+
+    return 1;
+}
+
+static int secp256k1_frost_pubkey_tweak_add_internal(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, secp256k1_frost_tweak_cache *tweak_cache, const unsigned char *tweak32, int xonly) {
+    secp256k1_tweak_cache_internal cache_i;
+    int overflow = 0;
+    secp256k1_scalar tweak;
+
+    VERIFY_CHECK(ctx != NULL);
+    if (output_pubkey != NULL) {
+        memset(output_pubkey, 0, sizeof(*output_pubkey));
+    }
+    ARG_CHECK(tweak_cache != NULL);
+    ARG_CHECK(tweak32 != NULL);
+
+    if (!secp256k1_tweak_cache_load(ctx, &cache_i, tweak_cache)) {
+        return 0;
+    }
+    secp256k1_scalar_set_b32(&tweak, tweak32, &overflow);
+    if (overflow) {
+        return 0;
+    }
+    if (xonly && secp256k1_extrakeys_ge_even_y(&cache_i.pk)) {
+        cache_i.parity_acc ^= 1;
+        secp256k1_scalar_negate(&cache_i.tweak, &cache_i.tweak);
+    }
+    secp256k1_scalar_add(&cache_i.tweak, &cache_i.tweak, &tweak);
+    if (!secp256k1_eckey_pubkey_tweak_add(&cache_i.pk, &tweak)) {
+        return 0;
+    }
+    /* eckey_pubkey_tweak_add fails if cache_i.pk is infinity */
+    VERIFY_CHECK(!secp256k1_ge_is_infinity(&cache_i.pk));
+    secp256k1_tweak_cache_save(tweak_cache, &cache_i);
+    if (output_pubkey != NULL) {
+        secp256k1_pubkey_save(output_pubkey, &cache_i.pk);
+    }
+    return 1;
+}
+
+int secp256k1_frost_pubkey_ec_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, secp256k1_frost_tweak_cache *tweak_cache, const unsigned char *tweak32) {
+    return secp256k1_frost_pubkey_tweak_add_internal(ctx, output_pubkey, tweak_cache, tweak32, 0);
+}
+
+int secp256k1_frost_pubkey_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, secp256k1_frost_tweak_cache *tweak_cache, const unsigned char *tweak32) {
+    return secp256k1_frost_pubkey_tweak_add_internal(ctx, output_pubkey, tweak_cache, tweak32, 1);
+}
+
+#endif

src/modules/frost/main_impl.h

@@ -0,0 +1,14 @@
+/**********************************************************************
+ * Copyright (c) 2021-2024 Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_MAIN
+#define SECP256K1_MODULE_FROST_MAIN
+
+#include "keygen_impl.h"
+#include "session_impl.h"
+#include "adaptor_impl.h"
+
+#endif

src/modules/frost/session.h

@@ -0,0 +1,25 @@
+/**********************************************************************
+ * Copyright (c) 2021-2024 Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_SESSION_H
+#define SECP256K1_MODULE_FROST_SESSION_H
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_frost.h"
+
+#include "../../scalar.h"
+
+typedef struct {
+    int fin_nonce_parity;
+    unsigned char fin_nonce[32];
+    secp256k1_scalar noncecoef;
+    secp256k1_scalar challenge;
+    secp256k1_scalar s_part;
+} secp256k1_frost_session_internal;
+
+static int secp256k1_frost_session_load(const secp256k1_context* ctx, secp256k1_frost_session_internal *session_i, const secp256k1_frost_session *session);
+
+#endif

src/modules/frost/session_impl.h

@@ -0,0 +1,662 @@
+/**********************************************************************
+ * Copyright (c) 2021-2024 Jesse Posner                               *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_FROST_SESSION_IMPL_H
+#define SECP256K1_MODULE_FROST_SESSION_IMPL_H
+
+#include <string.h>
+
+#include "../../../include/secp256k1.h"
+#include "../../../include/secp256k1_extrakeys.h"
+#include "../../../include/secp256k1_frost.h"
+
+#include "keygen.h"
+#include "session.h"
+#include "../../eckey.h"
+#include "../../hash.h"
+#include "../../scalar.h"
+#include "../../util.h"
+
+static const unsigned char secp256k1_frost_secnonce_magic[4] = { 0x84, 0x7d, 0x46, 0x25 };
+
+static void secp256k1_frost_secnonce_save(secp256k1_frost_secnonce *secnonce, secp256k1_scalar *k) {
+    memcpy(&secnonce->data[0], secp256k1_frost_secnonce_magic, 4);
+    secp256k1_scalar_get_b32(&secnonce->data[4], &k[0]);
+    secp256k1_scalar_get_b32(&secnonce->data[36], &k[1]);
+}
+
+static int secp256k1_frost_secnonce_load(const secp256k1_context* ctx, secp256k1_scalar *k, secp256k1_frost_secnonce *secnonce) {
+    int is_zero;
+    ARG_CHECK(secp256k1_memcmp_var(&secnonce->data[0], secp256k1_frost_secnonce_magic, 4) == 0);
+    secp256k1_scalar_set_b32(&k[0], &secnonce->data[4], NULL);
+    secp256k1_scalar_set_b32(&k[1], &secnonce->data[36], NULL);
+    /* We make very sure that the nonce isn't invalidated by checking the values
+     * in addition to the magic. */
+    is_zero = secp256k1_scalar_is_zero(&k[0]) & secp256k1_scalar_is_zero(&k[1]);
+    secp256k1_declassify(ctx, &is_zero, sizeof(is_zero));
+    ARG_CHECK(!is_zero);
+    return 1;
+}
+
+/* If flag is true, invalidate the secnonce; otherwise leave it. Constant-time. */
+static void secp256k1_frost_secnonce_invalidate(const secp256k1_context* ctx, secp256k1_frost_secnonce *secnonce, int flag) {
+    secp256k1_memczero(secnonce->data, sizeof(secnonce->data), flag);
+    /* The flag argument is usually classified. So, above code makes the magic
+     * classified. However, we need the magic to be declassified to be able to
+     * compare it during secnonce_load. */
+    secp256k1_declassify(ctx, secnonce->data, sizeof(secp256k1_frost_secnonce_magic));
+}
+
+static const unsigned char secp256k1_frost_pubnonce_magic[4] = { 0x8b, 0xcf, 0xe2, 0xc2 };
+
+/* Requires that none of the provided group elements is infinity. Works for both
+ * frost_pubnonce and frost_aggnonce. */
+static void secp256k1_frost_pubnonce_save(secp256k1_frost_pubnonce* nonce, secp256k1_ge* ge) {
+    int i;
+    memcpy(&nonce->data[0], secp256k1_frost_pubnonce_magic, 4);
+    for (i = 0; i < 2; i++) {
+        secp256k1_point_save_ext(nonce->data + 4+64*i, &ge[i]);
+    }
+}
+
+/* Works for both frost_pubnonce and frost_aggnonce. Returns 1 unless the nonce
+ * wasn't properly initialized */
+static int secp256k1_frost_pubnonce_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_frost_pubnonce* nonce) {
+    int i;
+
+    ARG_CHECK(secp256k1_memcmp_var(&nonce->data[0], secp256k1_frost_pubnonce_magic, 4) == 0);
+    for (i = 0; i < 2; i++) {
+        secp256k1_point_load_ext(&ge[i], nonce->data + 4+64*i);
+    }
+    return 1;
+}
+
+static const unsigned char secp256k1_frost_session_cache_magic[4] = { 0x5c, 0x11, 0xa8, 0x3 };
+
+/* A session consists of
+ * - 4 byte session cache magic
+ * - 1 byte the parity of the final nonce
+ * - 32 byte serialized x-only final nonce
+ * - 32 byte nonce coefficient b
+ * - 32 byte signature challenge hash e
+ * - 32 byte scalar s that is added to the partial signatures of the signers
+ */
+static void secp256k1_frost_session_save(secp256k1_frost_session *session, const secp256k1_frost_session_internal *session_i) {
+    unsigned char *ptr = session->data;
+
+    memcpy(ptr, secp256k1_frost_session_cache_magic, 4);
+    ptr += 4;
+    *ptr = session_i->fin_nonce_parity;
+    ptr += 1;
+    memcpy(ptr, session_i->fin_nonce, 32);
+    ptr += 32;
+    secp256k1_scalar_get_b32(ptr, &session_i->noncecoef);
+    ptr += 32;
+    secp256k1_scalar_get_b32(ptr, &session_i->challenge);
+    ptr += 32;
+    secp256k1_scalar_get_b32(ptr, &session_i->s_part);
+}
+
+static int secp256k1_frost_session_load(const secp256k1_context* ctx, secp256k1_frost_session_internal *session_i, const secp256k1_frost_session *session) {
+    const unsigned char *ptr = session->data;
+
+    ARG_CHECK(secp256k1_memcmp_var(ptr, secp256k1_frost_session_cache_magic, 4) == 0);
+    ptr += 4;
+    session_i->fin_nonce_parity = *ptr;
+    ptr += 1;
+    memcpy(session_i->fin_nonce, ptr, 32);
+    ptr += 32;
+    secp256k1_scalar_set_b32(&session_i->noncecoef, ptr, NULL);
+    ptr += 32;
+    secp256k1_scalar_set_b32(&session_i->challenge, ptr, NULL);
+    ptr += 32;
+    secp256k1_scalar_set_b32(&session_i->s_part, ptr, NULL);
+    return 1;
+}
+
+static const unsigned char secp256k1_frost_partial_sig_magic[4] = { 0x8d, 0xd8, 0x31, 0x6e };
+
+static void secp256k1_frost_partial_sig_save(secp256k1_frost_partial_sig* sig, secp256k1_scalar *s) {
+    memcpy(&sig->data[0], secp256k1_frost_partial_sig_magic, 4);
+    secp256k1_scalar_get_b32(&sig->data[4], s);
+}
+
+static int secp256k1_frost_partial_sig_load(const secp256k1_context* ctx, secp256k1_scalar *s, const secp256k1_frost_partial_sig* sig) {
+    int overflow;
+
+    ARG_CHECK(secp256k1_memcmp_var(&sig->data[0], secp256k1_frost_partial_sig_magic, 4) == 0);
+    secp256k1_scalar_set_b32(s, &sig->data[4], &overflow);
+    /* Parsed signatures can not overflow */
+    VERIFY_CHECK(!overflow);
+    return 1;
+}
+
+int secp256k1_frost_pubnonce_serialize(const secp256k1_context* ctx, unsigned char *out66, const secp256k1_frost_pubnonce* nonce) {
+    secp256k1_ge ge[2];
+    int i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(out66 != NULL);
+    memset(out66, 0, 66);
+    ARG_CHECK(nonce != NULL);
+
+    if (!secp256k1_frost_pubnonce_load(ctx, ge, nonce)) {
+        return 0;
+    }
+    for (i = 0; i < 2; i++) {
+        int ret;
+        size_t size = 33;
+        ret = secp256k1_eckey_pubkey_serialize(&ge[i], &out66[33*i], &size, 1);
+#ifdef VERIFY
+         /* serialize must succeed because the point was just loaded */
+         VERIFY_CHECK(ret && size == 33);
+#else
+        (void) ret;
+#endif
+    }
+    return 1;
+}
+
+int secp256k1_frost_pubnonce_parse(const secp256k1_context* ctx, secp256k1_frost_pubnonce* nonce, const unsigned char *in66) {
+    secp256k1_ge ge[2];
+    int i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(nonce != NULL);
+    ARG_CHECK(in66 != NULL);
+    for (i = 0; i < 2; i++) {
+        if (!secp256k1_eckey_pubkey_parse(&ge[i], &in66[33*i], 33)) {
+            return 0;
+        }
+        if (!secp256k1_ge_is_in_correct_subgroup(&ge[i])) {
+            return 0;
+        }
+    }
+    /* The group elements can not be infinity because they were just parsed */
+    secp256k1_frost_pubnonce_save(nonce, ge);
+    return 1;
+}
+
+int secp256k1_frost_partial_sig_serialize(const secp256k1_context* ctx, unsigned char *out32, const secp256k1_frost_partial_sig* sig) {
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(out32 != NULL);
+    ARG_CHECK(sig != NULL);
+    memcpy(out32, &sig->data[4], 32);
+    return 1;
+}
+
+int secp256k1_frost_partial_sig_parse(const secp256k1_context* ctx, secp256k1_frost_partial_sig* sig, const unsigned char *in32) {
+    secp256k1_scalar tmp;
+    int overflow;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig != NULL);
+    ARG_CHECK(in32 != NULL);
+
+    secp256k1_scalar_set_b32(&tmp, in32, &overflow);
+    if (overflow) {
+        return 0;
+    }
+    secp256k1_frost_partial_sig_save(sig, &tmp);
+    return 1;
+}
+
+static void secp256k1_nonce_function_frost(secp256k1_scalar *k, const unsigned char *session_id, const unsigned char *msg32, const unsigned char *key32, const unsigned char *pk32, const unsigned char *extra_input32) {
+    secp256k1_sha256 sha;
+    unsigned char seed[32];
+    unsigned char i;
+    enum { n_extra_in = 4 };
+    const unsigned char *extra_in[n_extra_in];
+
+    /* TODO: this doesn't have the same sidechannel resistance as the BIP340
+     * nonce function because the seckey feeds directly into SHA. */
+
+    /* Subtract one from `sizeof` to avoid hashing the implicit null byte */
+    secp256k1_sha256_initialize_tagged(&sha, (unsigned char*)"FROST/nonce", sizeof("FROST/nonce") - 1);
+    secp256k1_sha256_write(&sha, session_id, 32);
+    extra_in[0] = msg32;
+    extra_in[1] = key32;
+    extra_in[2] = pk32;
+    extra_in[3] = extra_input32;
+    for (i = 0; i < n_extra_in; i++) {
+        unsigned char len;
+        if (extra_in[i] != NULL) {
+            len = 32;
+            secp256k1_sha256_write(&sha, &len, 1);
+            secp256k1_sha256_write(&sha, extra_in[i], 32);
+        } else {
+            len = 0;
+            secp256k1_sha256_write(&sha, &len, 1);
+        }
+    }
+    secp256k1_sha256_finalize(&sha, seed);
+
+    for (i = 0; i < 2; i++) {
+        unsigned char buf[32];
+        secp256k1_sha256_initialize(&sha);
+        secp256k1_sha256_write(&sha, seed, 32);
+        secp256k1_sha256_write(&sha, &i, sizeof(i));
+        secp256k1_sha256_finalize(&sha, buf);
+        secp256k1_scalar_set_b32(&k[i], buf, NULL);
+    }
+}
+
+int secp256k1_frost_nonce_gen(const secp256k1_context* ctx, secp256k1_frost_secnonce *secnonce, secp256k1_frost_pubnonce *pubnonce, const unsigned char *session_id32, const secp256k1_frost_share *share, const unsigned char *msg32, const secp256k1_xonly_pubkey *pk, const unsigned char *extra_input32) {
+    secp256k1_scalar k[2];
+    secp256k1_ge nonce_pt[2];
+    int i;
+    unsigned char pk_ser[32];
+    unsigned char *pk_ser_ptr = NULL;
+    unsigned char sk_ser[32];
+    unsigned char *sk_ser_ptr = NULL;
+    int sk_serialize_success;
+    int ret = 1;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secnonce != NULL);
+    memset(secnonce, 0, sizeof(*secnonce));
+    ARG_CHECK(pubnonce != NULL);
+    memset(pubnonce, 0, sizeof(*pubnonce));
+    ARG_CHECK(session_id32 != NULL);
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    if (share == NULL) {
+        /* Check in constant time that the session_id is not 0 as a
+         * defense-in-depth measure that may protect against a faulty RNG. */
+        unsigned char acc = 0;
+        for (i = 0; i < 32; i++) {
+            acc |= session_id32[i];
+        }
+        ret &= !!acc;
+        memset(&acc, 0, sizeof(acc));
+    }
+
+    if (share != NULL) {
+        /* Check that the share is valid to be able to sign for it later. */
+        secp256k1_scalar sk;
+
+        ret &= secp256k1_frost_share_load(ctx, &sk, share);
+        secp256k1_scalar_clear(&sk);
+
+        sk_serialize_success = secp256k1_frost_share_serialize(ctx, sk_ser, share);
+        sk_ser_ptr = sk_ser;
+#ifdef VERIFY
+    VERIFY_CHECK(sk_serialize_success);
+#else
+    (void) sk_serialize_success;
+#endif
+    }
+
+    if (pk != NULL) {
+        if (!secp256k1_xonly_pubkey_serialize(ctx, pk_ser, pk)) {
+            return 0;
+        }
+        pk_ser_ptr = pk_ser;
+    }
+    secp256k1_nonce_function_frost(k, session_id32, msg32, sk_ser_ptr, pk_ser_ptr, extra_input32);
+    VERIFY_CHECK(!secp256k1_scalar_is_zero(&k[0]));
+    VERIFY_CHECK(!secp256k1_scalar_is_zero(&k[1]));
+    VERIFY_CHECK(!secp256k1_scalar_eq(&k[0], &k[1]));
+    secp256k1_frost_secnonce_save(secnonce, k);
+    secp256k1_frost_secnonce_invalidate(ctx, secnonce, !ret);
+
+    for (i = 0; i < 2; i++) {
+        secp256k1_gej nonce_ptj;
+        secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &nonce_ptj, &k[i]);
+        secp256k1_ge_set_gej(&nonce_pt[i], &nonce_ptj);
+        secp256k1_declassify(ctx, &nonce_pt[i], sizeof(nonce_pt));
+        secp256k1_scalar_clear(&k[i]);
+    }
+    /* nonce_pt won't be infinity because k != 0 with overwhelming probability */
+    secp256k1_frost_pubnonce_save(pubnonce, nonce_pt);
+    return ret;
+}
+
+static int secp256k1_frost_sum_nonces(const secp256k1_context* ctx, secp256k1_gej *summed_nonces, const secp256k1_frost_pubnonce * const *pubnonces, size_t n_pubnonces) {
+    size_t i;
+    int j;
+
+    secp256k1_gej_set_infinity(&summed_nonces[0]);
+    secp256k1_gej_set_infinity(&summed_nonces[1]);
+
+    for (i = 0; i < n_pubnonces; i++) {
+        secp256k1_ge nonce_pt[2];
+        if (!secp256k1_frost_pubnonce_load(ctx, nonce_pt, pubnonces[i])) {
+            return 0;
+        }
+        for (j = 0; j < 2; j++) {
+            secp256k1_gej_add_ge_var(&summed_nonces[j], &summed_nonces[j], &nonce_pt[j], NULL);
+        }
+    }
+    return 1;
+}
+
+/* TODO: consider updating to frost-08 to address maleability at the cost of performance */
+/* See https://github.com/cfrg/draft-irtf-cfrg-frost/pull/217 */
+static int secp256k1_frost_compute_noncehash(const secp256k1_context* ctx, unsigned char *noncehash, const unsigned char *msg, const secp256k1_frost_pubnonce * const *pubnonces, size_t n_pubnonces, const unsigned char *pk32, const unsigned char * const *ids33) {
+    unsigned char buf[66];
+    secp256k1_sha256 sha;
+    size_t i;
+
+    secp256k1_sha256_initialize_tagged(&sha, (unsigned char*)"FROST/noncecoef", sizeof("FROST/noncecoef") - 1);
+    /* TODO: sort by index */
+    for (i = 0; i < n_pubnonces; i++) {
+        secp256k1_scalar idx;
+
+        if (!secp256k1_frost_compute_indexhash(&idx, ids33[i])) {
+            return 0;
+        }
+        secp256k1_scalar_get_b32(buf, &idx);
+        secp256k1_sha256_write(&sha, buf, 32);
+        if (!secp256k1_frost_pubnonce_serialize(ctx, buf, pubnonces[i])) {
+            return 0;
+        }
+        secp256k1_sha256_write(&sha, buf, sizeof(buf));
+    }
+    secp256k1_sha256_write(&sha, pk32, 32);
+    secp256k1_sha256_write(&sha, msg, 32);
+    secp256k1_sha256_finalize(&sha, noncehash);
+    return 1;
+}
+
+static int secp256k1_frost_nonce_process_internal(const secp256k1_context* ctx, int *fin_nonce_parity, unsigned char *fin_nonce, secp256k1_scalar *b, secp256k1_gej *aggnoncej, const unsigned char *msg, const secp256k1_frost_pubnonce * const *pubnonces, size_t n_pubnonces, const unsigned char *pk32, const unsigned char * const *ids33) {
+    unsigned char noncehash[32];
+    secp256k1_ge fin_nonce_pt;
+    secp256k1_gej fin_nonce_ptj;
+    secp256k1_ge aggnonce[2];
+
+    secp256k1_ge_set_gej(&aggnonce[0], &aggnoncej[0]);
+    secp256k1_ge_set_gej(&aggnonce[1], &aggnoncej[1]);
+    if (!secp256k1_frost_compute_noncehash(ctx, noncehash, msg, pubnonces, n_pubnonces, pk32, ids33)) {
+        return 0;
+    }
+    /* fin_nonce = aggnonce[0] + b*aggnonce[1] */
+    secp256k1_scalar_set_b32(b, noncehash, NULL);
+    secp256k1_ecmult(&fin_nonce_ptj, &aggnoncej[1], b, NULL);
+    secp256k1_gej_add_ge_var(&fin_nonce_ptj, &fin_nonce_ptj, &aggnonce[0], NULL);
+    secp256k1_ge_set_gej(&fin_nonce_pt, &fin_nonce_ptj);
+
+    if (secp256k1_ge_is_infinity(&fin_nonce_pt)) {
+        /* unreachable with overwhelming probability */
+        return 0;
+    }
+    secp256k1_fe_normalize_var(&fin_nonce_pt.x);
+    secp256k1_fe_get_b32(fin_nonce, &fin_nonce_pt.x);
+
+    secp256k1_fe_normalize_var(&fin_nonce_pt.y);
+    *fin_nonce_parity = secp256k1_fe_is_odd(&fin_nonce_pt.y);
+    return 1;
+}
+
+static int secp256k1_frost_lagrange_coefficient(secp256k1_scalar *r, const unsigned char * const *ids33, size_t n_participants, const unsigned char *my_id33) {
+    size_t i;
+    secp256k1_scalar num;
+    secp256k1_scalar den;
+    secp256k1_scalar party_idx;
+
+    secp256k1_scalar_set_int(&num, 1);
+    secp256k1_scalar_set_int(&den, 1);
+    if (!secp256k1_frost_compute_indexhash(&party_idx, my_id33)) {
+        return 0;
+    }
+    for (i = 0; i < n_participants; i++) {
+        secp256k1_scalar mul;
+
+        if (!secp256k1_frost_compute_indexhash(&mul, ids33[i])) {
+            return 0;
+        }
+        if (secp256k1_scalar_eq(&mul, &party_idx)) {
+            continue;
+        }
+
+        secp256k1_scalar_negate(&mul, &mul);
+        secp256k1_scalar_mul(&num, &num, &mul);
+        secp256k1_scalar_add(&mul, &mul, &party_idx);
+        secp256k1_scalar_mul(&den, &den, &mul);
+    }
+
+    secp256k1_scalar_inverse_var(&den, &den);
+    secp256k1_scalar_mul(r, &num, &den);
+
+    return 1;
+}
+
+int secp256k1_frost_nonce_process(const secp256k1_context* ctx, secp256k1_frost_session *session, const secp256k1_frost_pubnonce * const* pubnonces, size_t n_pubnonces, const unsigned char *msg32, const secp256k1_xonly_pubkey *pk, const unsigned char *my_id33, const unsigned char * const *ids33, const secp256k1_frost_tweak_cache *tweak_cache, const secp256k1_pubkey *adaptor) {
+    secp256k1_ge aggnonce_pt[2];
+    secp256k1_gej aggnonce_ptj[2];
+    unsigned char fin_nonce[32];
+    secp256k1_frost_session_internal session_i = { 0 };
+    unsigned char pk32[32];
+    size_t i;
+    secp256k1_scalar l;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(pubnonces != NULL);
+    ARG_CHECK(ids33 != NULL);
+    ARG_CHECK(my_id33 != NULL);
+    ARG_CHECK(pk != NULL);
+    ARG_CHECK(n_pubnonces > 1);
+
+    if (!secp256k1_xonly_pubkey_serialize(ctx, pk32, pk)) {
+        return 0;
+    }
+
+    if (!secp256k1_frost_sum_nonces(ctx, aggnonce_ptj, pubnonces, n_pubnonces)) {
+        return 0;
+    }
+    for (i = 0; i < 2; i++) {
+        if (secp256k1_gej_is_infinity(&aggnonce_ptj[i])) {
+            /* There must be at least one dishonest signer. If we would return 0
+               here, we will never be able to determine who it is. Therefore, we
+               should continue such that the culprit is revealed when collecting
+               and verifying partial signatures.
+               However, dealing with the point at infinity (loading,
+               de-/serializing) would require a lot of extra code complexity.
+               Instead, we set the aggregate nonce to some arbitrary point (the
+               generator). This is secure, because it only restricts the
+               abilities of the attacker: an attacker that forces the sum of
+               nonces to be infinity by sending some maliciously generated nonce
+               pairs can be turned into an attacker that forces the sum to be
+               the generator (by simply adding the generator to one of the
+               malicious nonces), and this does not change the winning condition
+               of the EUF-CMA game. */
+            aggnonce_pt[i] = secp256k1_ge_const_g;
+        } else {
+            secp256k1_ge_set_gej(&aggnonce_pt[i], &aggnonce_ptj[i]);
+        }
+    }
+    /* Add public adaptor to nonce */
+    if (adaptor != NULL) {
+        secp256k1_ge adaptorp;
+        if (!secp256k1_pubkey_load(ctx, &adaptorp, adaptor)) {
+            return 0;
+        }
+        secp256k1_gej_add_ge_var(&aggnonce_ptj[0], &aggnonce_ptj[0], &adaptorp, NULL);
+    }
+    if (!secp256k1_frost_nonce_process_internal(ctx, &session_i.fin_nonce_parity, fin_nonce, &session_i.noncecoef, aggnonce_ptj, msg32, pubnonces, n_pubnonces, pk32, ids33)) {
+        return 0;
+    }
+
+    secp256k1_schnorrsig_challenge(&session_i.challenge, fin_nonce, msg32, 32, pk32);
+
+    /* If there is a tweak then set `challenge` times `tweak` to the `s`-part.*/
+    secp256k1_scalar_set_int(&session_i.s_part, 0);
+    if (tweak_cache != NULL) {
+        secp256k1_tweak_cache_internal cache_i;
+        if (!secp256k1_tweak_cache_load(ctx, &cache_i, tweak_cache)) {
+            return 0;
+        }
+        if (!secp256k1_scalar_is_zero(&cache_i.tweak)) {
+            secp256k1_scalar e_tmp;
+            secp256k1_scalar_mul(&e_tmp, &session_i.challenge, &cache_i.tweak);
+            if (secp256k1_fe_is_odd(&cache_i.pk.y)) {
+                secp256k1_scalar_negate(&e_tmp, &e_tmp);
+            }
+            secp256k1_scalar_add(&session_i.s_part, &session_i.s_part, &e_tmp);
+        }
+    }
+    /* Update the challenge by multiplying the Lagrange coefficient to prepare
+     * for signing. */
+    if (!secp256k1_frost_lagrange_coefficient(&l, ids33, n_pubnonces, my_id33)) {
+        return 0;
+    }
+    secp256k1_scalar_mul(&session_i.challenge, &session_i.challenge, &l);
+    memcpy(session_i.fin_nonce, fin_nonce, sizeof(session_i.fin_nonce));
+    secp256k1_frost_session_save(session, &session_i);
+    return 1;
+}
+
+void secp256k1_frost_partial_sign_clear(secp256k1_scalar *sk, secp256k1_scalar *k) {
+    secp256k1_scalar_clear(sk);
+    secp256k1_scalar_clear(&k[0]);
+    secp256k1_scalar_clear(&k[1]);
+}
+
+int secp256k1_frost_partial_sign(const secp256k1_context* ctx, secp256k1_frost_partial_sig *partial_sig, secp256k1_frost_secnonce *secnonce, const secp256k1_frost_share *share, const secp256k1_frost_session *session, const secp256k1_frost_tweak_cache *tweak_cache) {
+    secp256k1_scalar sk;
+    secp256k1_scalar k[2];
+    secp256k1_scalar s;
+    secp256k1_frost_session_internal session_i;
+    int ret;
+
+    VERIFY_CHECK(ctx != NULL);
+
+    ARG_CHECK(secnonce != NULL);
+    /* Fails if the magic doesn't match */
+    ret = secp256k1_frost_secnonce_load(ctx, k, secnonce);
+    /* Set nonce to zero to avoid nonce reuse. This will cause subsequent calls
+     * of this function to fail */
+    memset(secnonce, 0, sizeof(*secnonce));
+    if (!ret) {
+        secp256k1_frost_partial_sign_clear(&sk, k);
+        return 0;
+    }
+
+    ARG_CHECK(partial_sig != NULL);
+    ARG_CHECK(share != NULL);
+    ARG_CHECK(session != NULL);
+
+    if (!secp256k1_frost_share_load(ctx, &sk, share)) {
+        secp256k1_frost_partial_sign_clear(&sk, k);
+        return 0;
+    }
+    if (!secp256k1_frost_session_load(ctx, &session_i, session)) {
+        secp256k1_frost_partial_sign_clear(&sk, k);
+        return 0;
+    }
+
+    if (tweak_cache != NULL) {
+        secp256k1_tweak_cache_internal cache_i;
+        if (!secp256k1_tweak_cache_load(ctx, &cache_i, tweak_cache)) {
+            secp256k1_frost_partial_sign_clear(&sk, k);
+            return 0;
+        }
+        if (secp256k1_fe_is_odd(&cache_i.pk.y) != cache_i.parity_acc) {
+            secp256k1_scalar_negate(&sk, &sk);
+        }
+    }
+
+    if (session_i.fin_nonce_parity) {
+        secp256k1_scalar_negate(&k[0], &k[0]);
+        secp256k1_scalar_negate(&k[1], &k[1]);
+    }
+
+    /* Sign */
+    secp256k1_scalar_mul(&s, &session_i.challenge, &sk);
+    secp256k1_scalar_mul(&k[1], &session_i.noncecoef, &k[1]);
+    secp256k1_scalar_add(&k[0], &k[0], &k[1]);
+    secp256k1_scalar_add(&s, &s, &k[0]);
+    secp256k1_frost_partial_sig_save(partial_sig, &s);
+    secp256k1_frost_partial_sign_clear(&sk, k);
+    return 1;
+}
+
+int secp256k1_frost_partial_sig_verify(const secp256k1_context* ctx, const secp256k1_frost_partial_sig *partial_sig, const secp256k1_frost_pubnonce *pubnonce, const secp256k1_pubkey *pubshare, const secp256k1_frost_session *session, const secp256k1_frost_tweak_cache *tweak_cache) {
+    secp256k1_frost_session_internal session_i;
+    secp256k1_scalar e, s;
+    secp256k1_gej pkj;
+    secp256k1_ge nonce_pt[2];
+    secp256k1_gej rj;
+    secp256k1_gej tmp;
+    secp256k1_ge pkp;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(partial_sig != NULL);
+    ARG_CHECK(pubnonce != NULL);
+    ARG_CHECK(pubshare != NULL);
+    ARG_CHECK(session != NULL);
+
+    if (!secp256k1_frost_session_load(ctx, &session_i, session)) {
+        return 0;
+    }
+
+    /* Compute "effective" nonce rj = aggnonce[0] + b*aggnonce[1] */
+    /* TODO: use multiexp to compute -s*G + e*pubshare + aggnonce[0] + b*aggnonce[1] */
+    if (!secp256k1_frost_pubnonce_load(ctx, nonce_pt, pubnonce)) {
+        return 0;
+    }
+    secp256k1_gej_set_ge(&rj, &nonce_pt[1]);
+    secp256k1_ecmult(&rj, &rj, &session_i.noncecoef, NULL);
+    secp256k1_gej_add_ge_var(&rj, &rj, &nonce_pt[0], NULL);
+
+    if (!secp256k1_pubkey_load(ctx, &pkp, pubshare)) {
+        return 0;
+    }
+
+    secp256k1_scalar_set_int(&e, 1);
+    if (tweak_cache != NULL) {
+        secp256k1_tweak_cache_internal cache_i;
+        if (!secp256k1_tweak_cache_load(ctx, &cache_i, tweak_cache)) {
+            return 0;
+        }
+        if (secp256k1_fe_is_odd(&cache_i.pk.y)
+                != cache_i.parity_acc) {
+            secp256k1_scalar_negate(&e, &e);
+        }
+    }
+    secp256k1_scalar_mul(&e, &e, &session_i.challenge);
+
+    if (!secp256k1_frost_partial_sig_load(ctx, &s, partial_sig)) {
+        return 0;
+    }
+    /* Compute -s*G + e*pkj + rj (e already includes the lagrange coefficient l) */
+    secp256k1_scalar_negate(&s, &s);
+    secp256k1_gej_set_ge(&pkj, &pkp);
+    secp256k1_ecmult(&tmp, &pkj, &e, &s);
+    if (session_i.fin_nonce_parity) {
+        secp256k1_gej_neg(&rj, &rj);
+    }
+    secp256k1_gej_add_var(&tmp, &tmp, &rj, NULL);
+
+    return secp256k1_gej_is_infinity(&tmp);
+}
+
+int secp256k1_frost_partial_sig_agg(const secp256k1_context* ctx, unsigned char *sig64, const secp256k1_frost_session *session, const secp256k1_frost_partial_sig * const* partial_sigs, size_t n_sigs) {
+    size_t i;
+    secp256k1_frost_session_internal session_i;
+
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(session != NULL);
+    ARG_CHECK(partial_sigs != NULL);
+    ARG_CHECK(n_sigs > 0);
+
+    if (!secp256k1_frost_session_load(ctx, &session_i, session)) {
+        return 0;
+    }
+    for (i = 0; i < n_sigs; i++) {
+        secp256k1_scalar term;
+        if (!secp256k1_frost_partial_sig_load(ctx, &term, partial_sigs[i])) {
+            return 0;
+        }
+        secp256k1_scalar_add(&session_i.s_part, &session_i.s_part, &term);
+    }
+    secp256k1_scalar_get_b32(&sig64[32], &session_i.s_part);
+    memcpy(&sig64[0], session_i.fin_nonce, 32);
+    return 1;
+}
+
+#endif

src/modules/musig/keyagg.h

@@ -27,12 +27,6 @@ typedef struct {
     int parity_acc;
 } secp256k1_keyagg_cache_internal;
 
-/* point_save_ext and point_load_ext are identical to point_save and point_load
- * except that they allow saving and loading the point at infinity */
-static void secp256k1_point_save_ext(unsigned char *data, secp256k1_ge *ge);
-
-static void secp256k1_point_load_ext(secp256k1_ge *ge, const unsigned char *data);
-
 static int secp256k1_keyagg_cache_load(const secp256k1_context* ctx, secp256k1_keyagg_cache_internal *cache_i, const secp256k1_musig_keyagg_cache *cache);
 
 static void secp256k1_musig_keyaggcoef(secp256k1_scalar *r, const secp256k1_keyagg_cache_internal *cache_i, secp256k1_ge *pk);

src/modules/musig/keyagg_impl.h

@@ -17,23 +17,6 @@
 #include "../../hash.h"
 #include "../../util.h"
 
-static void secp256k1_point_save_ext(unsigned char *data, secp256k1_ge *ge) {
-    if (secp256k1_ge_is_infinity(ge)) {
-        memset(data, 0, 64);
-    } else {
-        secp256k1_ge_to_bytes(data, ge);
-    }
-}
-
-static void secp256k1_point_load_ext(secp256k1_ge *ge, const unsigned char *data) {
-    unsigned char zeros[64] = { 0 };
-    if (secp256k1_memcmp_var(data, zeros, sizeof(zeros)) == 0) {
-        secp256k1_ge_set_infinity(ge);
-    } else {
-        secp256k1_ge_from_bytes(ge, data);
-    }
-}
-
 static const unsigned char secp256k1_musig_keyagg_cache_magic[4] = { 0xf4, 0xad, 0xbb, 0xdf };
 
 /* A keyagg cache consists of

src/secp256k1.c

@@ -908,3 +908,7 @@ static int secp256k1_ge_parse_ext(secp256k1_ge* ge, const unsigned char *in33) {
 #ifdef ENABLE_MODULE_SURJECTIONPROOF
 # include "modules/surjection/main_impl.h"
 #endif
+
+#ifdef ENABLE_MODULE_FROST
+# include "modules/frost/main_impl.h"
+#endif