1 #ifndef SECP256K1_MUSIG_H
2 #define SECP256K1_MUSIG_H
3 4 #include "secp256k1_extrakeys.h"
5 6 #ifdef __cplusplus
7 extern "C" {
8 #endif
9 10 #include <stddef.h>
11 #include <stdint.h>
12 13 /** This module implements BIP 327 "MuSig2 for BIP340-compatible
14 * Multi-Signatures"
15 * (https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki)
16 * v1.0.0. You can find an example demonstrating the musig module in
17 * examples/musig.c.
18 *
19 * The module also supports BIP 341 ("Taproot") public key tweaking.
20 *
21 * It is recommended to read the documentation in this include file carefully.
22 * Further notes on API usage can be found in doc/musig.md
23 *
24 * Since the first version of MuSig is essentially replaced by MuSig2, we use
25 * MuSig, musig and MuSig2 synonymously unless noted otherwise.
26 */
27 28 /** Opaque data structures
29 *
30 * The exact representation of data inside the opaque data structures is
31 * implementation defined and not guaranteed to be portable between different
32 * platforms or versions. With the exception of `secp256k1_musig_secnonce`, the
33 * data structures can be safely copied/moved. If you need to convert to a
34 * format suitable for storage, transmission, or comparison, use the
35 * corresponding serialization and parsing functions.
36 */
37 38 /** Opaque data structure that caches information about public key aggregation.
39 *
40 * Guaranteed to be 197 bytes in size. No serialization and parsing functions
41 * (yet).
42 */
43 typedef struct secp256k1_musig_keyagg_cache {
44 unsigned char data[197];
45 } secp256k1_musig_keyagg_cache;
46 47 /** Opaque data structure that holds a signer's _secret_ nonce.
48 *
49 * Guaranteed to be 132 bytes in size.
50 *
51 * WARNING: This structure MUST NOT be copied or read or written to directly. A
52 * signer who is online throughout the whole process and can keep this
53 * structure in memory can use the provided API functions for a safe standard
54 * workflow.
55 *
56 * Copying this data structure can result in nonce reuse which will leak the
57 * secret signing key.
58 */
59 typedef struct secp256k1_musig_secnonce {
60 unsigned char data[132];
61 } secp256k1_musig_secnonce;
62 63 /** Opaque data structure that holds a signer's public nonce.
64 *
65 * Guaranteed to be 132 bytes in size. Serialized and parsed with
66 * `musig_pubnonce_serialize` and `musig_pubnonce_parse`.
67 */
68 typedef struct secp256k1_musig_pubnonce {
69 unsigned char data[132];
70 } secp256k1_musig_pubnonce;
71 72 /** Opaque data structure that holds an aggregate public nonce.
73 *
74 * Guaranteed to be 132 bytes in size. Serialized and parsed with
75 * `musig_aggnonce_serialize` and `musig_aggnonce_parse`.
76 */
77 typedef struct secp256k1_musig_aggnonce {
78 unsigned char data[132];
79 } secp256k1_musig_aggnonce;
80 81 /** Opaque data structure that holds a MuSig session.
82 *
83 * This structure is not required to be kept secret for the signing protocol to
84 * be secure. Guaranteed to be 133 bytes in size. No serialization and parsing
85 * functions (yet).
86 */
87 typedef struct secp256k1_musig_session {
88 unsigned char data[133];
89 } secp256k1_musig_session;
90 91 /** Opaque data structure that holds a partial MuSig signature.
92 *
93 * Guaranteed to be 36 bytes in size. Serialized and parsed with
94 * `musig_partial_sig_serialize` and `musig_partial_sig_parse`.
95 */
96 typedef struct secp256k1_musig_partial_sig {
97 unsigned char data[36];
98 } secp256k1_musig_partial_sig;
99 100 /** Parse a signer's public nonce.
101 *
102 * Returns: 1 when the nonce could be parsed, 0 otherwise.
103 * Args: ctx: pointer to a context object
104 * Out: nonce: pointer to a nonce object
105 * In: in66: pointer to the 66-byte nonce to be parsed
106 */
107 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubnonce_parse(
108 const secp256k1_context *ctx,
109 secp256k1_musig_pubnonce *nonce,
110 const unsigned char *in66
111 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
112 113 /** Serialize a signer's public nonce
114 *
115 * Returns: 1 always
116 * Args: ctx: pointer to a context object
117 * Out: out66: pointer to a 66-byte array to store the serialized nonce
118 * In: nonce: pointer to the nonce
119 */
120 SECP256K1_API int secp256k1_musig_pubnonce_serialize(
121 const secp256k1_context *ctx,
122 unsigned char *out66,
123 const secp256k1_musig_pubnonce *nonce
124 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
125 126 /** Parse an aggregate public nonce.
127 *
128 * Returns: 1 when the nonce could be parsed, 0 otherwise.
129 * Args: ctx: pointer to a context object
130 * Out: nonce: pointer to a nonce object
131 * In: in66: pointer to the 66-byte nonce to be parsed
132 */
133 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_aggnonce_parse(
134 const secp256k1_context *ctx,
135 secp256k1_musig_aggnonce *nonce,
136 const unsigned char *in66
137 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
138 139 /** Serialize an aggregate public nonce
140 *
141 * Returns: 1 always
142 * Args: ctx: pointer to a context object
143 * Out: out66: pointer to a 66-byte array to store the serialized nonce
144 * In: nonce: pointer to the nonce
145 */
146 SECP256K1_API int secp256k1_musig_aggnonce_serialize(
147 const secp256k1_context *ctx,
148 unsigned char *out66,
149 const secp256k1_musig_aggnonce *nonce
150 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
151 152 /** Parse a MuSig partial signature.
153 *
154 * Returns: 1 when the signature could be parsed, 0 otherwise.
155 * Args: ctx: pointer to a context object
156 * Out: sig: pointer to a signature object
157 * In: in32: pointer to the 32-byte signature to be parsed
158 */
159 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_partial_sig_parse(
160 const secp256k1_context *ctx,
161 secp256k1_musig_partial_sig *sig,
162 const unsigned char *in32
163 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
164 165 /** Serialize a MuSig partial signature
166 *
167 * Returns: 1 always
168 * Args: ctx: pointer to a context object
169 * Out: out32: pointer to a 32-byte array to store the serialized signature
170 * In: sig: pointer to the signature
171 */
172 SECP256K1_API int secp256k1_musig_partial_sig_serialize(
173 const secp256k1_context *ctx,
174 unsigned char *out32,
175 const secp256k1_musig_partial_sig *sig
176 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
177 178 /** Computes an aggregate public key and uses it to initialize a keyagg_cache
179 *
180 * Different orders of `pubkeys` result in different `agg_pk`s.
181 *
182 * Before aggregating, the pubkeys can be sorted with `secp256k1_ec_pubkey_sort`
183 * which ensures the same `agg_pk` result for the same multiset of pubkeys.
184 * This is useful to do before `pubkey_agg`, such that the order of pubkeys
185 * does not affect the aggregate public key.
186 *
187 * Returns: 0 if the arguments are invalid, 1 otherwise
188 * Args: ctx: pointer to a context object
189 * Out: agg_pk: the MuSig-aggregated x-only public key. If you do not need it,
190 * this arg can be NULL.
191 * keyagg_cache: if non-NULL, pointer to a musig_keyagg_cache struct that
192 * is required for signing (or observing the signing session
193 * and verifying partial signatures).
194 * In: pubkeys: input array of pointers to public keys to aggregate. The order
195 * is important; a different order will result in a different
196 * aggregate public key.
197 * n_pubkeys: length of pubkeys array. Must be greater than 0.
198 */
199 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_agg(
200 const secp256k1_context *ctx,
201 secp256k1_xonly_pubkey *agg_pk,
202 secp256k1_musig_keyagg_cache *keyagg_cache,
203 const secp256k1_pubkey * const *pubkeys,
204 size_t n_pubkeys
205 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(4);
206 207 /** Obtain the aggregate public key from a keyagg_cache.
208 *
209 * This is only useful if you need the non-xonly public key, in particular for
210 * plain (non-xonly) tweaking or batch-verifying multiple key aggregations
211 * (not implemented).
212 *
213 * Returns: 0 if the arguments are invalid, 1 otherwise
214 * Args: ctx: pointer to a context object
215 * Out: agg_pk: the MuSig-aggregated public key.
216 * In: keyagg_cache: pointer to a `musig_keyagg_cache` struct initialized by
217 * `musig_pubkey_agg`
218 */
219 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_get(
220 const secp256k1_context *ctx,
221 secp256k1_pubkey *agg_pk,
222 const secp256k1_musig_keyagg_cache *keyagg_cache
223 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
224 225 /** Apply plain "EC" tweaking to a public key in a given keyagg_cache by adding
226 * the generator multiplied with `tweak32` to it. This is useful for deriving
227 * child keys from an aggregate public key via BIP 32 where `tweak32` is set to
228 * a hash as defined in BIP 32.
229 *
230 * Callers are responsible for deriving `tweak32` in a way that does not reduce
231 * the security of MuSig (for example, by following BIP 32).
232 *
233 * The tweaking method is the same as `secp256k1_ec_pubkey_tweak_add`. So after
234 * the following pseudocode buf and buf2 have identical contents (absent
235 * earlier failures).
236 *
237 * secp256k1_musig_pubkey_agg(..., keyagg_cache, pubkeys, ...)
238 * secp256k1_musig_pubkey_get(..., agg_pk, keyagg_cache)
239 * secp256k1_musig_pubkey_ec_tweak_add(..., output_pk, tweak32, keyagg_cache)
240 * secp256k1_ec_pubkey_serialize(..., buf, ..., output_pk, ...)
241 * secp256k1_ec_pubkey_tweak_add(..., agg_pk, tweak32)
242 * secp256k1_ec_pubkey_serialize(..., buf2, ..., agg_pk, ...)
243 *
244 * This function is required if you want to _sign_ for a tweaked aggregate key.
245 * If you are only computing a public key but not intending to create a
246 * signature for it, use `secp256k1_ec_pubkey_tweak_add` instead.
247 *
248 * Returns: 0 if the arguments are invalid, 1 otherwise
249 * Args: ctx: pointer to a context object
250 * Out: output_pubkey: pointer to a public key to store the result. Will be set
251 * to an invalid value if this function returns 0. If you
252 * do not need it, this arg can be NULL.
253 * In/Out: keyagg_cache: pointer to a `musig_keyagg_cache` struct initialized by
254 * `musig_pubkey_agg`
255 * In: tweak32: pointer to a 32-byte tweak. The tweak is valid if it passes
256 * `secp256k1_ec_seckey_verify` and is not equal to the
257 * secret key corresponding to the public key represented
258 * by keyagg_cache or its negation. For uniformly random
259 * 32-byte arrays the chance of being invalid is
260 * negligible (around 1 in 2^128).
261 */
262 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_ec_tweak_add(
263 const secp256k1_context *ctx,
264 secp256k1_pubkey *output_pubkey,
265 secp256k1_musig_keyagg_cache *keyagg_cache,
266 const unsigned char *tweak32
267 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
268 269 /** Apply x-only tweaking to a public key in a given keyagg_cache by adding the
270 * generator multiplied with `tweak32` to it. This is useful for creating
271 * Taproot outputs where `tweak32` is set to a TapTweak hash as defined in BIP
272 * 341.
273 *
274 * Callers are responsible for deriving `tweak32` in a way that does not reduce
275 * the security of MuSig (for example, by following Taproot BIP 341).
276 *
277 * The tweaking method is the same as `secp256k1_xonly_pubkey_tweak_add`. So in
278 * the following pseudocode xonly_pubkey_tweak_add_check (absent earlier
279 * failures) returns 1.
280 *
281 * secp256k1_musig_pubkey_agg(..., agg_pk, keyagg_cache, pubkeys, ...)
282 * secp256k1_musig_pubkey_xonly_tweak_add(..., output_pk, keyagg_cache, tweak32)
283 * secp256k1_xonly_pubkey_serialize(..., buf, output_pk)
284 * secp256k1_xonly_pubkey_tweak_add_check(..., buf, ..., agg_pk, tweak32)
285 *
286 * This function is required if you want to _sign_ for a tweaked aggregate key.
287 * If you are only computing a public key but not intending to create a
288 * signature for it, use `secp256k1_xonly_pubkey_tweak_add` instead.
289 *
290 * Returns: 0 if the arguments are invalid, 1 otherwise
291 * Args: ctx: pointer to a context object
292 * Out: output_pubkey: pointer to a public key to store the result. Will be set
293 * to an invalid value if this function returns 0. If you
294 * do not need it, this arg can be NULL.
295 * In/Out: keyagg_cache: pointer to a `musig_keyagg_cache` struct initialized by
296 * `musig_pubkey_agg`
297 * In: tweak32: pointer to a 32-byte tweak. The tweak is valid if it passes
298 * `secp256k1_ec_seckey_verify` and is not equal to the
299 * secret key corresponding to the public key represented
300 * by keyagg_cache or its negation. For uniformly random
301 * 32-byte arrays the chance of being invalid is
302 * negligible (around 1 in 2^128).
303 */
304 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_xonly_tweak_add(
305 const secp256k1_context *ctx,
306 secp256k1_pubkey *output_pubkey,
307 secp256k1_musig_keyagg_cache *keyagg_cache,
308 const unsigned char *tweak32
309 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
310 311 /** Starts a signing session by generating a nonce
312 *
313 * This function outputs a secret nonce that will be required for signing and a
314 * corresponding public nonce that is intended to be sent to other signers.
315 *
316 * MuSig differs from regular Schnorr signing in that implementers _must_ take
317 * special care to not reuse a nonce. This can be ensured by following these rules:
318 *
319 * 1. Each call to this function must have a UNIQUE session_secrand32 that must
320 * NOT BE REUSED in subsequent calls to this function and must be KEPT
321 * SECRET (even from other signers).
322 * 2. If you already know the seckey, message or aggregate public key
323 * cache, they can be optionally provided to derive the nonce and increase
324 * misuse-resistance. The extra_input32 argument can be used to provide
325 * additional data that does not repeat in normal scenarios, such as the
326 * current time.
327 * 3. Avoid copying (or serializing) the secnonce. This reduces the possibility
328 * that it is used more than once for signing.
329 *
330 * If you don't have access to good randomness for session_secrand32, but you
331 * have access to a non-repeating counter, then see
332 * secp256k1_musig_nonce_gen_counter.
333 *
334 * Remember that nonce reuse will leak the secret key!
335 * Note that using the same seckey for multiple MuSig sessions is fine.
336 *
337 * Returns: 0 if the arguments are invalid and 1 otherwise
338 * Args: ctx: pointer to a context object (not secp256k1_context_static)
339 * Out: secnonce: pointer to a structure to store the secret nonce
340 * pubnonce: pointer to a structure to store the public nonce
341 * In/Out:
342 * session_secrand32: a 32-byte session_secrand32 as explained above. Must be unique to this
343 * call to secp256k1_musig_nonce_gen and must be uniformly
344 * random. If the function call is successful, the
345 * session_secrand32 buffer is invalidated to prevent reuse.
346 * In:
347 * seckey: the 32-byte secret key that will later be used for signing, if
348 * already known (can be NULL)
349 * pubkey: public key of the signer creating the nonce. The secnonce
350 * output of this function cannot be used to sign for any
351 * other public key. While the public key should correspond
352 * to the provided seckey, a mismatch will not cause the
353 * function to return 0.
354 * msg32: the 32-byte message that will later be signed, if already known
355 * (can be NULL)
356 * keyagg_cache: pointer to the keyagg_cache that was used to create the aggregate
357 * (and potentially tweaked) public key if already known
358 * (can be NULL)
359 * extra_input32: an optional 32-byte array that is input to the nonce
360 * derivation function (can be NULL)
361 */
362 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_nonce_gen(
363 const secp256k1_context *ctx,
364 secp256k1_musig_secnonce *secnonce,
365 secp256k1_musig_pubnonce *pubnonce,
366 unsigned char *session_secrand32,
367 const unsigned char *seckey,
368 const secp256k1_pubkey *pubkey,
369 const unsigned char *msg32,
370 const secp256k1_musig_keyagg_cache *keyagg_cache,
371 const unsigned char *extra_input32
372 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(6);
373 374 375 /** Alternative way to generate a nonce and start a signing session
376 *
377 * This function outputs a secret nonce that will be required for signing and a
378 * corresponding public nonce that is intended to be sent to other signers.
379 *
380 * This function differs from `secp256k1_musig_nonce_gen` by accepting a
381 * non-repeating counter value instead of a secret random value. This requires
382 * that a secret key is provided to `secp256k1_musig_nonce_gen_counter`
383 * (through the keypair argument), as opposed to `secp256k1_musig_nonce_gen`
384 * where the seckey argument is optional.
385 *
386 * MuSig differs from regular Schnorr signing in that implementers _must_ take
387 * special care to not reuse a nonce. This can be ensured by following these rules:
388 *
389 * 1. The nonrepeating_cnt argument must be a counter value that never repeats,
390 * i.e., you must never call `secp256k1_musig_nonce_gen_counter` twice with
391 * the same keypair and nonrepeating_cnt value. For example, this implies
392 * that if the same keypair is used with `secp256k1_musig_nonce_gen_counter`
393 * on multiple devices, none of the devices should have the same counter
394 * value as any other device.
395 * 2. If the seckey, message or aggregate public key cache is already available
396 * at this stage, any of these can be optionally provided, in which case
397 * they will be used in the derivation of the nonce and increase
398 * misuse-resistance. The extra_input32 argument can be used to provide
399 * additional data that does not repeat in normal scenarios, such as the
400 * current time.
401 * 3. Avoid copying (or serializing) the secnonce. This reduces the possibility
402 * that it is used more than once for signing.
403 *
404 * Remember that nonce reuse will leak the secret key!
405 * Note that using the same keypair for multiple MuSig sessions is fine.
406 *
407 * Returns: 0 if the arguments are invalid and 1 otherwise
408 * Args: ctx: pointer to a context object (not secp256k1_context_static)
409 * Out: secnonce: pointer to a structure to store the secret nonce
410 * pubnonce: pointer to a structure to store the public nonce
411 * In:
412 * nonrepeating_cnt: the value of a counter as explained above. Must be
413 * unique to this call to secp256k1_musig_nonce_gen.
414 * keypair: keypair of the signer creating the nonce. The secnonce
415 * output of this function cannot be used to sign for any
416 * other keypair.
417 * msg32: the 32-byte message that will later be signed, if already known
418 * (can be NULL)
419 * keyagg_cache: pointer to the keyagg_cache that was used to create the aggregate
420 * (and potentially tweaked) public key if already known
421 * (can be NULL)
422 * extra_input32: an optional 32-byte array that is input to the nonce
423 * derivation function (can be NULL)
424 */
425 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_nonce_gen_counter(
426 const secp256k1_context *ctx,
427 secp256k1_musig_secnonce *secnonce,
428 secp256k1_musig_pubnonce *pubnonce,
429 uint64_t nonrepeating_cnt,
430 const secp256k1_keypair *keypair,
431 const unsigned char *msg32,
432 const secp256k1_musig_keyagg_cache *keyagg_cache,
433 const unsigned char *extra_input32
434 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5);
435 436 /** Aggregates the nonces of all signers into a single nonce
437 *
438 * This can be done by an untrusted party to reduce the communication
439 * between signers. Instead of everyone sending nonces to everyone else, there
440 * can be one party receiving all nonces, aggregating the nonces with this
441 * function and then sending only the aggregate nonce back to the signers.
442 *
443 * If the aggregator does not compute the aggregate nonce correctly, the final
444 * signature will be invalid.
445 *
446 * Returns: 0 if the arguments are invalid, 1 otherwise
447 * Args: ctx: pointer to a context object
448 * Out: aggnonce: pointer to an aggregate public nonce object for
449 * musig_nonce_process
450 * In: pubnonces: array of pointers to public nonces sent by the
451 * signers
452 * n_pubnonces: number of elements in the pubnonces array. Must be
453 * greater than 0.
454 */
455 SECP256K1_API int secp256k1_musig_nonce_agg(
456 const secp256k1_context *ctx,
457 secp256k1_musig_aggnonce *aggnonce,
458 const secp256k1_musig_pubnonce * const *pubnonces,
459 size_t n_pubnonces
460 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
461 462 /** Takes the aggregate nonce and creates a session that is required for signing
463 * and verification of partial signatures.
464 *
465 * Returns: 0 if the arguments are invalid, 1 otherwise
466 * Args: ctx: pointer to a context object
467 * Out: session: pointer to a struct to store the session
468 * In: aggnonce: pointer to an aggregate public nonce object that is the
469 * output of musig_nonce_agg
470 * msg32: the 32-byte message to sign
471 * keyagg_cache: pointer to the keyagg_cache that was used to create the
472 * aggregate (and potentially tweaked) pubkey
473 */
474 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_nonce_process(
475 const secp256k1_context *ctx,
476 secp256k1_musig_session *session,
477 const secp256k1_musig_aggnonce *aggnonce,
478 const unsigned char *msg32,
479 const secp256k1_musig_keyagg_cache *keyagg_cache
480 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
481 482 /** Produces a partial signature
483 *
484 * This function overwrites the given secnonce with zeros and will abort if given a
485 * secnonce that is all zeros. This is a best effort attempt to protect against nonce
486 * reuse. However, this is of course easily defeated if the secnonce has been
487 * copied (or serialized). Remember that nonce reuse will leak the secret key!
488 *
489 * For signing to succeed, the secnonce provided to this function must have
490 * been generated for the provided keypair. This means that when signing for a
491 * keypair consisting of a seckey and pubkey, the secnonce must have been
492 * created by calling musig_nonce_gen with that pubkey. Otherwise, the
493 * illegal_callback is called.
494 *
495 * This function does not verify the output partial signature, deviating from
496 * the BIP 327 specification. It is recommended to verify the output partial
497 * signature with `secp256k1_musig_partial_sig_verify` to prevent random or
498 * adversarially provoked computation errors.
499 *
500 * Returns: 0 if the arguments are invalid or the provided secnonce has already
501 * been used for signing, 1 otherwise
502 * Args: ctx: pointer to a context object
503 * Out: partial_sig: pointer to struct to store the partial signature
504 * In/Out: secnonce: pointer to the secnonce struct created in
505 * musig_nonce_gen that has been never used in a
506 * partial_sign call before and has been created for the
507 * keypair
508 * In: keypair: pointer to keypair to sign the message with
509 * keyagg_cache: pointer to the keyagg_cache that was output when the
510 * aggregate public key for this session
511 * session: pointer to the session that was created with
512 * musig_nonce_process
513 */
514 SECP256K1_API int secp256k1_musig_partial_sign(
515 const secp256k1_context *ctx,
516 secp256k1_musig_partial_sig *partial_sig,
517 secp256k1_musig_secnonce *secnonce,
518 const secp256k1_keypair *keypair,
519 const secp256k1_musig_keyagg_cache *keyagg_cache,
520 const secp256k1_musig_session *session
521 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);
522 523 /** Verifies an individual signer's partial signature
524 *
525 * The signature is verified for a specific signing session. In order to avoid
526 * accidentally verifying a signature from a different or non-existing signing
527 * session, you must ensure the following:
528 * 1. The `keyagg_cache` argument is identical to the one used to create the
529 * `session` with `musig_nonce_process`.
530 * 2. The `pubkey` argument must be identical to the one sent by the signer
531 * before aggregating it with `musig_pubkey_agg` to create the
532 * `keyagg_cache`.
533 * 3. The `pubnonce` argument must be identical to the one sent by the signer
534 * before aggregating it with `musig_nonce_agg` and using the result to
535 * create the `session` with `musig_nonce_process`.
536 *
537 * It is not required to call this function in regular MuSig sessions, because
538 * if any partial signature does not verify, the final signature will not
539 * verify either, so the problem will be caught. However, this function
540 * provides the ability to identify which specific partial signature fails
541 * verification.
542 *
543 * Returns: 0 if the arguments are invalid or the partial signature does not
544 * verify, 1 otherwise
545 * Args ctx: pointer to a context object
546 * In: partial_sig: pointer to partial signature to verify, sent by
547 * the signer associated with `pubnonce` and `pubkey`
548 * pubnonce: public nonce of the signer in the signing session
549 * pubkey: public key of the signer in the signing session
550 * keyagg_cache: pointer to the keyagg_cache that was output when the
551 * aggregate public key for this signing session
552 * session: pointer to the session that was created with
553 * `musig_nonce_process`
554 */
555 SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_partial_sig_verify(
556 const secp256k1_context *ctx,
557 const secp256k1_musig_partial_sig *partial_sig,
558 const secp256k1_musig_pubnonce *pubnonce,
559 const secp256k1_pubkey *pubkey,
560 const secp256k1_musig_keyagg_cache *keyagg_cache,
561 const secp256k1_musig_session *session
562 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);
563 564 /** Aggregates partial signatures
565 *
566 * Returns: 0 if the arguments are invalid, 1 otherwise (which does NOT mean
567 * the resulting signature verifies).
568 * Args: ctx: pointer to a context object
569 * Out: sig64: complete (but possibly invalid) Schnorr signature
570 * In: session: pointer to the session that was created with
571 * musig_nonce_process
572 * partial_sigs: array of pointers to partial signatures to aggregate
573 * n_sigs: number of elements in the partial_sigs array. Must be
574 * greater than 0.
575 */
576 SECP256K1_API int secp256k1_musig_partial_sig_agg(
577 const secp256k1_context *ctx,
578 unsigned char *sig64,
579 const secp256k1_musig_session *session,
580 const secp256k1_musig_partial_sig * const *partial_sigs,
581 size_t n_sigs
582 ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
583 584 #ifdef __cplusplus
585 }
586 #endif
587 588 #endif
589