pub struct MuSig<T: SigningTranscript + Clone, S> { /* private fields */ }
Expand description

Schnorr multi-signature (MuSig) container generic over its session types

Implementations

Iterates over public keys.

If require_reveal=true then we count only public key that revealed their R values.

Aggregate public key given currently revealed R values

Aggregate public key expected if all currently committed nodes fully participate

We permit extending the transcript whenever you like, so that say the message may be agreed upon in parallel to the commitments. We advise against doing so however, as this requires absolute faith in your random number generator, usually rand::thread_rng().

Initialize a multi-signature aka cosignature protocol run.

We encurage borrowing the Keypair to minimize copies of the private key, so we provide the Keypair::musig method for the K = &'k Keypair case. You could use Rc or Arc with this MuSig::new method, or even pass in an owned copy.

Our commitment to our R to send to all other cosigners

Add a new cosigner’s public key and associated R bypassing our commitmewnt phase.

Commit to reveal phase transition.

Reveal our R contribution to send to all other cosigners

Include a revealed R value from a previously committed cosigner

Add a new cosigner’s public key and associated R bypassing our commitmewnt phase.

We implemented defenses that reduce the risks posed by this method, but anyone who wishes provable security should heed the advice below:

Avoid using this due to the attack described in “On the Provable Security of Two-Round Multi-Signatures” by Manu Drijvers, Kasra Edalatnejad, Bryan Ford, and Gregory Neven https://eprint.iacr.org/2018/417 Avoid using this for public keys held by networked devices in particular.

There are however limited scenarios in which using this appears secure, primarily if the trusted device is (a) air gapped, (b) stateful, and (c) infrequently used, via some constrained channel like manually scanning QR code. Almost all hardware wallets designs fail (b), but non-hardware wallets fail (a), with the middle ground being only something like Pairty Signer. Also, any public keys controlled by an organization likely fail (c) too, making this only useful for individuals.

Reveal to cosign phase transition.

Reveals our signature contribution

Include a cosignature from another cosigner

Interate over the cosigners who successfully revaled and later cosigned.

Interate over the possible cosigners who successfully committed and revaled, but actually cosigned.

Actually computes the cosignature

Adds revealed R and cosignature into a cosignature collector

Actually computes the collected cosignature.

Auto Trait Implementations

Blanket Implementations

Gets the TypeId of self. Read more

Immutably borrows from an owned value. Read more

Mutably borrows from an owned value. Read more

Returns the argument unchanged.

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Should always be Self

The type returned in the event of a conversion error.

Performs the conversion.

The type returned in the event of a conversion error.

Performs the conversion.