e462f7c1ac
Add the byte-exact internal primitives for the ChillDKG module,
mirroring the Python reference implementation of the bip-frost-dkg
draft (v0.3.0-dev), pinned to upstream commit
a91896883f85b159415ecf298d5e844879af112d.
util.h / util_impl.h (mirrors chilldkg_ref/util.py):
- Point (de)serialization with explicit point-at-infinity support:
33 zero bytes <-> infinity, otherwise SEC compressed. Checked parse
rejects invalid encodings and out-of-range x coordinates
(point_save/point_load, xonly_save/xonly_load).
- Internal parameterized-tag BIP-340 Schnorr sign/verify
(chilldkg_schnorrsig_sign/_verify): tag prefix selects the
<prefix>/aux, /nonce, /challenge subtags ("BIP DKG/pop message" for
proofs of possession, "BIP0340" for CertEq signatures and recovery
acks), arbitrary-length messages, pad33 zero-padding helper. The
public schnorrsig API hardcodes BIP0340/32-byte messages, so the
algorithm is replicated from secp256k1_schnorrsig_sign_internal with
a custom tag; cross-checked against secp256k1_schnorrsig_sign32.
- Tagged hashes via secp256k1_sha256_initialize_tagged:
"BIP DKG/params_hash", "BIP DKG/encpedpop seed",
"BIP DKG/simplpedpop aux", "BIP DKG/encpedpop secnonce",
"BIP DKG/encpedpop ecdh", "BIP DKG/encaps_multi self_pad",
"BIP DKG/vss coeffs", and BIP-341 "TapTweak" (32-byte x-only input).
- params_hash = TH("BIP DKG/params_hash", u32be(t) || hostpubkeys)
(note: plan had the operand order reversed; the reference hashes t
first).
- ECDH pads: reuses the ecdh module's SHA256-of-compressed-shared-
point hash, then TH("BIP DKG/encpedpop ecdh", ecdh ||
sender_pubnonce || receiver_hostpubkey || context) with a sending
flag fixing the sender|receiver order; self_pad for the own index.
Pads are parsed wrapping (mod-n reduction); wire scalars, VSS
coefficients and the TapTweak are parsed checked.
vss.h / vss_impl.h (mirrors chilldkg_ref/vss.py):
- vss_gen_coeffs: per-coefficient TH("BIP DKG/vss coeffs", seed ||
u32be(j)), checked parse with bitwise error accumulation.
- vss_poly_eval (Horner) and vss_secshare_for with the x = id+1
convention (safe at UINT32_MAX).
- vss_commit (constant-time ecmult_gen, zero coefficient -> infinity),
vss_pubshare (powers-of-x over commitments, skips infinity),
vss_commitment_add, vss_verify_secshare.
- vss_invalid_taproot_commit: TapTweak applied to the x-only constant
term so the Taproot script path is unspendable; returns tweak and
pubtweak.
tests_impl.h: 7 vector tests (tagged hashes, params_hash, point
serialization incl. infinity roundtrip and parity prefixes, checked
vs wrapping scalar parse at the group order boundary, custom-tag
schnorrsig incl. wrong-tag/key/msg rejection, ECDH pad sender/receiver
symmetry, VSS coeff derivation/Horner/commitment/pubshare/tweak) with
expected values generated once from the Python reference
(committed into the test file, reference commit recorded).
Verified: make check 3/3 suites pass; CMake ctest all pass;
./tests --target=chilldkg runs all 7 new tests green in both verify
and noverify builds.
8 lines
343 B
Makefile
8 lines
343 B
Makefile
include_HEADERS += include/secp256k1_chilldkg.h
|
|
noinst_HEADERS += src/modules/chilldkg/main_impl.h
|
|
noinst_HEADERS += src/modules/chilldkg/util.h
|
|
noinst_HEADERS += src/modules/chilldkg/util_impl.h
|
|
noinst_HEADERS += src/modules/chilldkg/vss.h
|
|
noinst_HEADERS += src/modules/chilldkg/vss_impl.h
|
|
noinst_HEADERS += src/modules/chilldkg/tests_impl.h
|