Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add description of MuSig signing to musig-spec.md #157

Merged

Conversation

jonasnick
Copy link
Contributor

@jonasnick jonasnick commented Jan 1, 2022

Will wait before adding tweaking until #151 is merged.

@jonasnick jonasnick changed the title Add description of Add description of MuSig signing to musig-spec.md Jan 1, 2022
Copy link
Contributor

@robot-dreams robot-dreams left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking great so far! Aside from inline comments:

  • For each of the various functions that take a list of input public keys, is there a precondition on the input public keys being already sorted, or is the function expected to sort the keys itself, or neither?

  • There are a few places where you're using lift_x(int(...)) where the input is a 33-byte compressed representation, rather than a 32-byte x-only representation. Is it necessary to define a new helper to handle this case?

doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
Therefore, we should continue such that the culprit is revealed when collecting and verifying partial signatures.
However, dealing with the point at infinity requires defining a serialization and may require extra code complexity in implementations.
Instead, we set the aggregate nonce to some arbitrary point, the generator.
This is secure, because it only restricts the abilities of the attacker: an attacker that forces the sum of nonces to be infinity by sending some maliciously generated nonce pairs can be turned into an attacker that forces the sum to be the generator (by simply adding the generator to one of the malicious nonces), and this does not change the winning condition of the signature security game (EUF-CMA).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think your argument makes sense, but is it also worth adding something like "the attacker's nonce pairs aren't used anywhere else, except to generate the final nonce"?

For example, you could imagine that if H_sig depended not just on the final nonce, but also on the attacker's choice of pre-nonces, then the modified scheme would be broken, because you could get two partial signatures with the same final nonce R but two different values of c.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand. You're saying that the attacker can send R_neg = - R_others and R_neg + G and both will result in the same final nonce R. If you get two partial sigs with the same R but two different values of c, then the secnonce has been reused. The attacker can also get same R different c by choosing a different message if the secnonce is reused.

Copy link
Contributor

@robot-dreams robot-dreams Jan 3, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, what I said before was nonsense. I forgot that the adversary also needs the private pre-nonces, haha.

Is it correct if an adversary A can win the EUF-CMA game against the modified scheme (call it MuSig2'), then A can be used directly to also win the EUF-CMA game against MuSig2*?

I'm thinking every query that A makes against a MuSig2' challenger (H_agg, H_non, H_sig, Sign, Sign') is also a valid query against a MuSig2* challenger (I assume this is what you meant by "only restricts the abilities of the attacker"), and a valid forgery (L, m, (R, s)) against MuSig2' is also a valid forgery against MuSig2*; thus the "reduction" is completely trivial.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I had to think about this quite a bit again which is an indication that we should expand on this argument a bit. Well, now we have the space for it.

then A can be used directly to also win the EUF-CMA game against MuSig2*?

I don't think so. If A sends a Sign' query with aggnonce[0] = infinity, it expects a partial signature using aggnonce[0] = G. Therefore, a reduction would need to add G to A's query if it is infinity.

a valid forgery (L, m, (R, s)) against MuSig2' is also a valid forgery against MuSig2*

What confused me a bit is that R = infinity is allowed in principle in MuSig2*. The scheme we're comparing this to is where R = infinity in a forgery is disallowed already (which is what BIP340 also implements).

Copy link
Contributor

@robot-dreams robot-dreams Jan 3, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I think I see what you're saying.

I was previously consideringNonceAgg as being done by the adversary, including the part where it possibly replaces infinity with the generator (because NonceAgg only depends on public data). By the way, in this case, I think if Sign' for MuSig2' receives infinity as one of the aggnonces, the Sign' query should just fail.

But if replacing infinity with the generator is done inside Sign', by the MuSig2' challenger, then I agree with you that the reduction needs to replace infinity with the generator before passing the query onto the MuSig2* challenger.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's a suggestion for an alternate way to argue about the security of the modification. I'm not 100% confident in it but if this general idea works I think it might be easier to understand:

Note that NonceAgg (both the original and modified version) only depends on publicly available data (the set of public pre-nonces from every signer). Thus in the context of the signature security game (EUF-CMA), we can consider NonceAgg to be performed by the adversary (rather than the challenger) without loss of generality.

This modification changes neither the behavior of the EUF-CMA challenger nor the condition required to win the security game (the adversary still has to output a valid forgery according to the unmodified MuSig2* scheme). Since we've already proved that MuSig2* is secure against an arbitrary adversary, we can conclude that the modified scheme is still secure.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if replacing infinity with the generator is done inside Sign', by the MuSig2' challenger, then I agree with you

You're right, what I said is nonsense. Aggregation happens outside of Sign' exactly because we don't want to trust aggregation.

The sentence "it only restricts the abilities of the attacker" is wrong, because the abilities of the attacker are exactly the same (arbitrary NonceAgg). I pushed your suggestion (after minor modifications).

CC @real-or-random

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was also confused first but I think now the argument makes sense. Wording can still be improved. Right now it sounds like we're coming up with this argument here in the spec but the EUF-CMA game in the paper already lets the adversary perform NonceAgg (=SignAgg in the paper).

So I believe a formal argument is as simple as this.

Let MuSig2* be the scheme from the paper, let MuSig2† be MuSig2* with the modification that the scheme simply aborts if one of the aggregate nonces is infinity, and let MuSig2†† be the scheme in the spec. (Note that MuSig2†† also aborts if the one of the aggregate nonces is infinity because then parsing fails.)

MuSig2* is EUF-CMA by the theorem in the paper. Since Sign† only adds aborts to Sign*, and the adversary can simulate internally whether Sign† will hit those aborts (by checking whether one of the aggregate nonces is infinity), MuSig2† is EUF-CMA. Since MuSig2† and MuSig2†† differ only in NonceAgg, the EUF-CMA games of MuSig2† and MuSig2†† are identical. Thus MuSig2†† is EUF-CMA.

(This could also be written nicely in game hopping style.)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, I think I'm following—my problem with my informal argument above is that it doesn't account for the extra "abort" possibility (it used without proof the fact that MuSig2† is secure). Here's my understanding of your formal argument, is this correct?

  • Suppose we have adversary A†† that wins MuSig2†† game[1]; here's how we build A†:

    • Use A†† directly, since MuSig2† and MuSig2†† are the same game
  • Suppose we have adversary A† that wins MuSig2† game; here's how we build A*:

    • Start with transparent wrapper around A†
    • Whenever A† makes call to Sign†, first check public nonces
      • If either of them is infinity, return "abort" to A†
      • Otherwise, forward call to Sign* and return result to A†
    • Wrapper simulates Sign† perfectly to A†, and everything else is unchanged
    • The forgery that A† outputs wins MuSig2† (of course) but it also wins MuSig2*

Thus if we have adversary A†† that wins MuSig2†† game, then we could build A* that wins MuSig2* game. From the paper, we can't have adversary A* that wins MuSig2* game. So taking the contrapositive, we can't have adversary A†† that wins MuSig2†† game. So the scheme in the spec is secure.

[1] I mean "wins ... game with non-negligible probability" everywhere, but I'll leave that out to keep it shorter.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, exactly correct! So your wrapper around A† is the formal implementation of my sentence "the adversary can simulate internally whether Sign† will hit those aborts (by checking whether one of the aggregate nonces is infinity)".

I think the "abort" thing is a very minor detail here -- but I believe it's necessary in a fully rigorous proof: by observing aborts, the adversary could learn new information (say Sign† aborts iff the last bit of the secret key is 1).

But since the aborts in fact depend only on publicly available information, this is not the case here. And your reduction formalizes this intuition: whatever can be learned from a Sign† oracle (which can abort) can also be learned from a Sign* oracle (which does not abort), simply by determining locally whether Sign† would abort.

This also means that the current text is slightly wrong, when it says "This modification changes neither the behavior of the EUF-CMA challenger". The modification does change the behavior of the EUF-CMA challenger, namely by introducing aborts -- but it does so only in a way that anyhow can be simulated by the adversary.

doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
@jonasnick
Copy link
Contributor Author

@robot-dreams

For each of the various functions that take a list of input public keys, is there a precondition on the input public keys being already sorted, or is the function expected to sort the keys itself, or neither?

Neither. Added a note that the output of KeyAgg is dependent on the order of the inputs. So either implementors of the spec make sure that that all signers get the same order of pubkeys or they sort them according to the spec (see discussion here #120).

Is it necessary to define a new helper to handle this case?

Oops, added point and pointc function.

Copy link

@brandonblack brandonblack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great to see this in detail and with clear definitions for inputs!

doc/musig-spec.mediawiki Show resolved Hide resolved
doc/musig-spec.mediawiki Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved

The algorithm ''IsSecond(pk<sub>1..u</sub>, pk')'' is defined as:
* For ''j = 1 .. u'':
** If ''pk<sub>j</sub> &ne; pk<sub>1</sub>'':

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
** If ''pk<sub>j</sub> &ne; pk<sub>1</sub>'':
** If ''pk<sub>j</sub> &eq; pk<sub>2</sub>'':

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not equivalent if pk1 = pk2. We really want the "second pubkey" in the sense that it's unequal from the first.

Copy link
Contributor

@robot-dreams robot-dreams left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did a second review pass by just trying to implement the spec directly and seeing if any issues came up.

Aside from the inline comments below, the spec was enough to produce the expected test vectors for KeyAgg and Sign :)

doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
* Let ''mu = KeyAggCoeff(pk<sub>1..u</sub>, bytes(P))''
* Let ''s = (k<sub>1</sub> + b⋅k<sub>2</sub> + e⋅mu⋅d) mod n''
* Let ''psig = bytes(s)''
* If ''PartialSigVerify(psig, pk<sub>1..u</sub>, pubnonce<sub>1..u</sub>, m, bytes(P))'' (see below) returns failure, abort<ref>Verifying the signature before leaving the signer prevents random or attacker provoked computation errors. This prevents publishing invalid signatures which may leak information about the secret key. It is recommended, but can be omitted if the computation cost is prohibitive.</ref>.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does pubnonce<sub>1..u</sub> come from, since this isn't an input to Sign?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a PartialSigVerifyInternal function that takes the aggregate nonce.
I didn't want to replace the pubnonces argument of PartialSigVerify with aggnonce because that would wrongly indicate that verifying makes sense with untrusted nonce aggregation

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, sounds good for now, but I do want to think about this more if you add adaptors to the spec (since the implementation has comments that it's much more important to call PartialSigVerify in that case)

doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
* The aggregate public nonce ''aggnonce'': a 66-byte array
* The number ''u'' of public keys with ''0 < u < 2^32''
* The public keys ''pk<sub>1..u</sub>'': ''u'' 32-byte arrays
* The message ''m'': a 32-byte array
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be used with taproot, signing also needs a tweak parameter. I don't know if this needs to be passed into the nonce stuff.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, see the PR description:

Will wait before adding tweaking until #151 is merged.

The implementation already has x-only tweaking and #151 adds "ordinary" tweaking.

@jonasnick
Copy link
Contributor Author

@robot-dreams

Aside from the inline comments below, the spec was enough to produce the expected test vectors for KeyAgg and Sign :)

Excellent, that's great to hear. Thank you for the review!

doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
doc/musig-spec.mediawiki Outdated Show resolved Hide resolved
@jonasnick
Copy link
Contributor Author

Rebased

@robot-dreams
Copy link
Contributor

ACK 623f3cb 🚀

@jonasnick
Copy link
Contributor Author

Squashed fixups

* Let ''mu = KeyAggCoeff(pk<sub>1..u</sub>, bytes(P))''
* Let ''s = (k<sub>1</sub> + b⋅k<sub>2</sub> + e⋅mu⋅d) mod n''
* Let ''psig = bytes(s)''
* Let ''pubnonce = cbytes(k'<sub>1</sub>⋅G) || cbytes(k'<sub>2</sub>⋅G)''
Copy link
Contributor Author

@jonasnick jonasnick Jan 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm tending towards changing the serialization of the nonce pair from compressed(R1) || compressed(R2) (66 bytes) to parity(R1) | parity(R2) << 1 || xonly(R1) || xonly(R2) (65 bytes).

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

parity(R1) | parity(R2) << 1? (| instead of &)

Although I'm having a hard time thinking of a case where this 1 byte matters, given that the partial nonces never appear in the blockchain.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eh sure, edited. OTOH there's no reason to add a useless byte.

@jonasnick
Copy link
Contributor Author

Squashed fixup & rebased

@robot-dreams
Copy link
Contributor

ACK 69b392f based on:

Copy link
Collaborator

@real-or-random real-or-random left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK 69b392f I haven't looked at every detail but it's certainly ready to be merged as draft spec

I think we should move this to a separate repo (fork of bips repo) soon.

gwillen added a commit to gwillen/elements that referenced this pull request May 25, 2022
7a30cb0c9d Merge BlockstreamResearch/secp256k1-zkp#187: musig-spec: remove it from this repo
cc07b8f7a9 musig-spec: remove it
c1640b7049 Merge BlockstreamResearch/secp256k1-zkp#166: musig-spec: Add naive Python reference implementation
c235e5055f musig-spec: Add naive Python reference implementation
d45fbdcfad Merge BlockstreamResearch/secp256k1-zkp#180: musig: add test vectors for applying multiple tweaks
9a814bea32 Merge BlockstreamResearch/secp256k1-zkp#186: musig-spec: Minor cleanup
67247e53af musig-spec: More minor cleanup
9a1645f0ef Merge BlockstreamResearch/secp256k1-zkp#184: musig-spec: minor fixups
bf615193ce musig-spec: minor fixups
ebd10f210b Merge BlockstreamResearch/secp256k1-zkp#185: musig-spec: Clarify negation for signing and verification
0940575215 musig-spec: Clarify negation for signing and verification
18a35ec1af Merge BlockstreamResearch/secp256k1-zkp#183: Improve writing in Signing flow
1b292cdb52 Improve writing in Signing flow
a86bfa991a Merge BlockstreamResearch/secp256k1-zkp#181: musig-spec: clarify hashing in noncegen by converting ints to bytes
4469cad42f Merge BlockstreamResearch/secp256k1-zkp#182: musig-spec: address robot-dreams' comments
b7f8ea2f2a musig-spec: address robot-dreams' comments
376733b58b musig-spec: clarify hashing in noncegen by converting ints to bytes
510b61a803 musig: add test vectors for applying multiple tweaks
ac477d5148 Merge BlockstreamResearch/secp256k1-zkp#179: musig-spec: Improve writing in Motivation, Design
d903c09fd2 musig-spec: Improve writing in Motivation, Design
1d0d60d9eb Merge BlockstreamResearch/secp256k1-zkp#178: musig-spec: expand on signing flow
fd51a6281e musig-spec: add authors
f56e223a7a musig-spec: explain NonceGen and tweaking in signing flow context
e463ea42bb musig-spec: mention stateless signing in signing flow
a29b961eb7 musig-spec: add acknowledgements and improve abstract
1a086ba9c9 musig-spec: add optional arguments to strengthen nonce function
8d04ac318f musig-spec: remove unnecessary and inconsistent input paragraph
6c0aecf72b Merge BlockstreamResearch/secp256k1-zkp#174: Upstream PRs 1064, 1049, 899, 1068, 1072, 1069, 1074, 1026, 1033, 748, 1079, 1088, 1090, 731, 1089, 995, 1094, 1093
eafcd04216 Merge BlockstreamResearch/secp256k1-zkp#176: musig-spec: expand on signing flow
c715407b4f musig-spec: fix partial sig verification note in intro
11fb8a664b musig-spec: expand on signing flow
43c853fa28 Merge BlockstreamResearch/secp256k1-zkp#173: musig-spec: Add motivation and design sections
3deaa006a0 Merge BlockstreamResearch/secp256k1-zkp#175: configure: Check compile+link when checking existence of functions
79472c7ee5 configure: Check compile+link when checking existence of functions
645d9c53c4 examples: let musig use random.h instead of /dev/urandom
eccba5b4e5 examples: relicense musig example to CC0 public domain
802b7daf23 musig-spec: add motivation and design sections
7c5af740fa ci: fix missing EXPERIMENTAL flags
03bea1e173 configure: add -zkp modules to dev-mode and remove redundant code
2adb741c45 examples: rename example_musig to musig_example for consistency
8298c0c79b Merge commits 'c8aa516b 0a40a486 d8a24632 85b00a1c 59547943 5dcc6f8d 07752831 3ef94aa5 1253a277 64b34979 ac83be33 0e5cbd01 e0508ee9 587239db 1ac7e31c d0ad5814 912b7ccc 8746600e ' into temp-merge-1093
8746600eec Merge bitcoin-core/secp256k1#1093: hash: Make code agnostic of endianness
686d96222d musig-spec: various cleanups
ef537b2065 musig-spec: fix unnecessary O(n^2) KeyAgg runtime
37d36927df tests: Add tests for _read_be32 and _write_be32
912b7ccc44 Merge bitcoin-core/secp256k1#1094: doc: Clarify configure flags for optional modules
55512d30b7 doc: clean up module help text in configure.ac
d9d94a9969 doc: mention optional modules in README
616b43dd3b util: Remove endianness detection
8d89b9e6e5 hash: Make code agnostic of endianness
d0ad5814a5 Merge bitcoin-core/secp256k1#995: build: stop treating schnorrsig, extrakeys modules as experimental
1ac7e31c5b Merge bitcoin-core/secp256k1#1089: Schnorrsig API improvements
587239dbe3 Merge bitcoin-core/secp256k1#731: Change SHA256 byte counter from size_t to uint64_t
f8d9174357 Add SHA256 bit counter tests
d13429e28c Merge BlockstreamResearch/secp256k1-zkp#167: Add ordinary and x-only tweaking to spec and simplify implementation
eac0df1379 musig: mention how keyagg_cache tweak and parity relate to spec
57eb6b4167 musig-spec: move description of secret key negation to spec
633d01add0 musig-spec: add x-only and ordinary tweaking to musig
aee0747e38 musig-spec: add general description of tweaking
fb060a0c4e musig-spec: add Session Context to simplify sign/verify/sigagg
3aec4332b5 musig-spec: move remarks on spec below specification section
628d52c718 musig-spec: fix title/abstract and make algo names bold
5b760cc172 musig-spec: consistently call partial sigs psig
7f09d0f311 README: mention that ARM assembly is experimental
b8f8b99f0f docs: Fix return value for functions that don't have invalid inputs
f813bb0df3 schnorrsig: Adapt example to new API
99e6568fc6 schnorrsig: Rename schnorrsig_sign to schnorsig_sign32 and deprecate
fc94a2da44 Use SECP256K1_DEPRECATED for existing deprecated API functions
3db0560606 Add SECP256K1_DEPRECATED attribute for marking API parts as deprecated
80cf4eea5f build: stop treating schnorrsig, extrakeys modules as experimental
e0508ee9db Merge bitcoin-core/secp256k1#1090: configure: Remove redundant pkg-config code
21b2ebaf74 configure: Remove redundant pkg-config code
0e5cbd01b3 Merge bitcoin-core/secp256k1#1088: configure: Use modern way to set AR
0d253d52e8 configure: Use modern way to set AR
9b514ce1d2 Add test vector for very long SHA256 messages
8e3dde1137 Simplify struct initializer for SHA256 padding
eb28464a8b Change SHA256 byte counter from size_t to uint64_t
ac83be33d0 Merge bitcoin-core/secp256k1#1079: configure: Add hidden --enable-dev-mode to enable all the stuff
e0838d663d configure: Add hidden --enable-dev-mode to enable all the stuff
fabd579dfa configure: Remove redundant code that sets _enable variables
0d4226c051 configure: Use canonical variable prefix _enable consistently
64b34979ed Merge bitcoin-core/secp256k1#748: Add usage examples
7c9502cece Add a copy of the CC0 license to the examples
42e03432e6 Add usage examples to the readme
517644eab1 Optionally compile the examples in autotools, compile+run in travis
422a7cc86a Add a ecdh shared secret example
b0cfbcc143 Add a Schnorr signing and verifying example
fee7d4bf9e Add an ECDSA signing and verifying example
1253a27756 Merge bitcoin-core/secp256k1#1033: Add _fe_half and use in _gej_add_ge and _gej_double
3ef94aa5ba Merge bitcoin-core/secp256k1#1026: ecdh: Add test computing shared_secret=basepoint with random inputs
3531a43b5b ecdh: Make generator_basepoint test depend on global iteration count
c881dd49bd ecdh: Add test computing shared_secret=basepoint with random inputs
077528317d Merge bitcoin-core/secp256k1#1074: ci: Retry brew update a few times to avoid random failures
e51ad3b737 ci: Retry `brew update` a few times to avoid random failures
b1cb969e8a ci: Revert "Attempt to make macOS builds more reliable"
f0edc90755 musig: fix number of tweaks in tweak_test
5dcc6f8dbd Merge bitcoin-core/secp256k1#1069: build: Replace use of deprecated autoconf macro AC_PROG_CC_C89
59547943d6 Merge bitcoin-core/secp256k1#1072: ci: Attempt to make macOS builds more reliable
85b00a1c65 Merge bitcoin-core/secp256k1#1068: sage: Fix incompatibility with sage 9.4
ebb1beea78 sage: Ensure that constraints are always fastfracs
d8d54859ed ci: Run sage prover on CI
77cfa98dbc sage: Normalize sign of polynomial factors in prover
eae75869cf sage: Exit with non-zero status in case of failures
d9396a56da ci: Attempt to make macOS builds more reliable
e0db3f8a25 build: Replace use of deprecated autoconf macro AC_PROG_CC_C89
e848c3799c Update sage files for new formulae
d64bb5d4f3 Add fe_half tests for worst-case inputs
b54d843eac sage: Fix printing of errors
725d895fc5 Merge BlockstreamResearch/secp256k1-zkp#165: musig-spec: improve security argument for handling infinity
4eb8b932ff Further improve doubling formula using fe_half
557b31fac3 Doubling formula using fe_half
2cbb4b1a42 Run more iterations of run_field_misc
9cc5c257ed Add test for secp256k1_fe_half
925f78d55e Add _fe_half and use in _gej_add_ge
e108d0039c sage: Fix incompatibility with sage 9.4
aa1acb4bd1 musig-spec: improve security argument for handling infinity
d8a2463246 Merge bitcoin-core/secp256k1#899: Reduce stratch space needed by ecmult_strauss_wnaf.
73f0cbd3cc Merge BlockstreamResearch/secp256k1-zkp#157: Add description of MuSig signing to musig-spec.md
8fd97d8116 Merge BlockstreamResearch/secp256k1-zkp#158: Small musig improvements
772df3694e Merge BlockstreamResearch/secp256k1-zkp#151: MuSig: Add Minimal Compatibility with BIP32 Tweaking
0a40a4861a Merge bitcoin-core/secp256k1#1049: Faster fixed-input ecmult tests
69b392f3cb musig: move explanation for aggnonce=inf to spec
4824220bb7 musig-spec: describe NonceGen, NonceAgg, Sign,PartialSig{Verify,Agg}
3c122d0780 musig-spec: improve definition of lift_x
e0bb2d7009 musig-spec: improve KeyAgg description
b8f4e75d89 musig-spec: move to doc directory
070e772211 Faster fixed-input ecmult tests
c8aa516b57 Merge bitcoin-core/secp256k1#1064: Modulo-reduce msg32 inside RFC6979 nonce fn to match spec. Fixes ElementsProject#1063
8088eddc53 musig: add test vector for ordinary (non xonly) tweaking
57a17929fc musig: add ordinary and xonly tweaking to the example
37107361a0 musig: allow ordinary, non-xonly tweaking
c519b46879 musig: add pubkey_get to obtain a full pubkey from a keyagg_cache
b797a500ec Create a SECP256K1_ECMULT_TABLE_VERIFY macro.
a731200cc3 Replace ECMULT_TABLE_GET_GE_STORAGE macro with a function.
fe34d9f341 Eliminate input_pos state field from ecmult_strauss_wnaf.
0397d00ba0 Eliminate na_1 and na_lam state fields from ecmult_strauss_wnaf.
7ba3ffcca0 Remove the unused pre_a_lam allocations.
b3b57ad6ee Eliminate the pre_a_lam array from ecmult_strauss_wnaf.
ae7ba0f922 Remove the unused prej allocations.
e5c18892db Eliminate the prej array from ecmult_strauss_wnaf.
c9da1baad1 Move secp256k1_fe_one to field.h
45f37b6506 Modulo-reduce msg32 inside RFC6979 nonce fn to match spec. Fixes ElementsProject#1063.
a5b5909e8d Merge BlockstreamResearch/secp256k1-zkp#163: Typo, add subscript i
44001ad716 Typo fix, add subscript i
eb5e71b5dc Merge BlockstreamResearch/secp256k1-zkp#162: whitelist: remove ability to specific nonce function
11d675dce8 whitelist: remove ability to specific nonce function
21e2d65b79 Merge BlockstreamResearch/secp256k1-zkp#159: Sync Upstream
b7ebe6436c Test APIs of funcs that need an ecmult_gen ctx with static ctx
d895b10c18 musig: mention musig.md in example
588009d26f musig: improve doc of partial_sig_verify regarding signing sessions
72c8deac03 Merge commits with sync-upstream.sh
a1102b1219 Merge bitcoin-core/secp256k1#1029: Simpler and faster ecdh skew fixup
b1094953c4 musig: remove superfluous comment
e82144edfb Fixup skew before global Z fixup
40b624c90b Add tests for _gej_cmov
8c13a9bfe1 ECDH skews by 0 or 1
1515099433 Simpler and faster ecdh skew fixup
39a36db94a Merge bitcoin-core/secp256k1#1054: tests: Fix test whose result is implementation-defined
a310e79ee5 Merge bitcoin-core/secp256k1#1052: Use xoshiro256++ instead of RFC6979 for tests
423b6d19d3 Merge bitcoin-core/secp256k1#964: Add release-process.md
9281c9f4e1 Merge bitcoin-core/secp256k1#1053: ecmult: move `_ecmult_odd_multiples_table_globalz_windowa`
77a19750b4 Use xoshiro256++ PRNG instead of RFC6979 in tests
5f2efe684e secp256k1_testrand_int(2**N) -> secp256k1_testrand_bits(N)
05e049b73c ecmult: move `_ecmult_odd_multiples_table_globalz_windowa`
3d7cbafb5f tests: Fix test whose result is implementation-defined
3ed0d02bf7 doc: add CHANGELOG template
6f42dc16c8 doc: add release_process.md
0bd3e4243c build: set library version to 0.0.0 explicitly
b4b02fd8c4 build: change libsecp version from 0.1 to 0.1.0-pre
09971a3ffd Merge bitcoin-core/secp256k1#1047: ci: Various improvements
0b83b203e1 Merge bitcoin-core/secp256k1#1030: doc: Fix upper bounds + cleanup in field_5x52_impl.h comment
1287786c7a doc: Add comment to top of field_10x26_impl.h
58da5bd589 doc: Fix upper bounds + cleanup in field_5x52_impl.h comment
b39d431aed Merge bitcoin-core/secp256k1#1044: Add another ecmult_multi test
b4ac1a1d5f ci: Run valgrind/memcheck tasks with 2 CPUs
e70acab601 ci: Use Cirrus "greedy" flag to use idle CPU time when available
d07e30176e ci: Update brew on macOS
22382f0ea0 ci: Test different ecmult window sizes
a69df3ad24 Merge bitcoin-core/secp256k1#816: Improve checks at top of _fe_negate methods
22d25c8e0a Add another ecmult_multi test
515e7953ca Improve checks at top of _fe_negate methods
b2206619e6 Merge BlockstreamResearch/secp256k1-zkp#131: Replace MuSig(1) module with MuSig2
26a022a3a0 ci: Remove STATICPRECOMPUTATION
10461d8bd3 precompute_ecmult: Always compute all tables up to default WINDOW_G
be6944ade9 Merge bitcoin-core/secp256k1#1042: Follow-ups to making all tables fully static
e05da9e480 Fix c++ build
c45386d994 Cleanup preprocessor indentation in precompute{,d}_ecmult{,_gen}
19d96e15f9 Split off .c file from precomputed_ecmult.h
1a6691adae Split off .c file from precomputed_ecmult_gen.h
bb36331412 Simplify precompute_ecmult_print_*
38cd84a0cb Compute ecmult tables at runtime for tests_exhaustive
e458ec26d6 Move ecmult table computation code to separate file
fc1bf9f15f Split ecmult table computation and printing
31feab053b Rename function secp256k1_ecmult_gen_{create_prec -> compute}_table
725370c3f2 Rename ecmult_gen_prec -> ecmult_gen_compute_table
075252c1b7 Rename ecmult_static_pre_g -> precomputed_ecmult
7cf47f72bc Rename ecmult_gen_static_prec_table -> precomputed_ecmult_gen
f95b8106d0 Rename gen_ecmult_static_pre_g -> precompute_ecmult
bae77685eb Rename gen_ecmult_gen_static_prec_table -> precompute_ecmult_gen
ac1e36769d musig: turn off multiexponentiation for now
3c79d97bd9 ci: increase timeout for macOS tasks
22c88815c7 musig: replace MuSig(1) with MuSig2
0559fc6e41 Merge bitcoin-core/secp256k1#988: Make signing table fully static
7dfceceea6 build: Remove #undef hack for ASM in the precomputation programs
bb36fe9be0 ci: Test `make precomp`
d94a37a20c build: Remove CC_FOR_BUILD stuff
ad63bb4c29 build: Prebuild and distribute ecmult_gen table
ac49361ed0 prealloc: Get rid of manual memory management for prealloc contexts
6573c08f65 ecmult_gen: Tidy precomputed file and save space
5eba83f17c ecmult_gen: Precompute tables for all values of ECMULT_GEN_PREC_BITS
5d0dbef018 Merge bitcoin-core/secp256k1#942: Verify that secp256k1_ge_set_gej_zinv does not operate on infinity.
486205aa68 Merge bitcoin-core/secp256k1#920: Test all ecmult functions with many j*2^i combinations
fdb33dd122 refactor: Make PREC_BITS a parameter of ecmult_gen_build_prec_table
5eb519e1f6 ci: reduce TEST_ITERS in memcheck run
e2cf77328a Test ecmult functions for all i*2^j for j=0..255 and odd i=1..255.
61ae37c612 Merge bitcoin-core/secp256k1#1022: build: Windows DLL additions
4f01840b82 Merge bitcoin-core/secp256k1#1027: build: Add a check that Valgrind actually supports a host platform
6ad908aa00 Merge bitcoin-core/secp256k1#1008: bench.c: add `--help` option and ci: move env variables
592661c22f ci: move test environment variable declaration to .cirrus.yml
dcbe84b841 bench: add --help option to bench.
099bad945e Comment and check a parameter for inf in secp256k1_ecmult_const.
6c0be857f8 Verify that secp256k1_ge_set_gej_zinv does not operate on infinity. a->x and a->y should not be used if the infinity flag is set.
4900227451 Merge bitcoin-core/secp256k1#1025: build: replace backtick command substitution with $()
7c7ce872a5 build: Add a check that Valgrind actually supports a host platform
a4875e30a6 refactor: Move default callbacks to util.h
4c94c55bce doc: Remove obsolete hint for valgrind stack size
5106226991 exhaustive_tests: Fix with ecmult_gen table with custom generator
e1a76530db refactor: Make generator a parameter of ecmult_gen_create_prec_table
9ad09f6911 refactor: Rename program that generates static ecmult_gen table
8ae18f1ab3 refactor: Rename file that contains static ecmult_gen table
00d2fa116e ecmult_gen: Make code consistent with comment
3b0c2185ea ecmult_gen: Simplify ecmult_gen context after making table static
2b7c7497ef build: replace backtick command substitution with $()
49f608de47 Merge bitcoin-core/secp256k1#1004: ecmult: fix definition of STRAUSS_SCRATCH_OBJECTS
c0cd7de6d4 build: add -no-undefined to libtool LDFLAGS
fe32a79d35 build: pass win32-dll to LT_INIT
60bf8890df ecmult: fix definition of STRAUSS_SCRATCH_OBJECTS
fecf436d53 Merge bitcoin-core/secp256k1#1019: build: don't append valgrind CPPFLAGS if not installed (macOS)
2e5e4b67df Merge bitcoin-core/secp256k1#1020: doc: remove use of <0xa0> "no break space"
812ff5c747 doc: remove use of 0xa0 "no break space"
214042a170 build: don't append valgrind CPPFLAGS if not installed
e43ba02cfc refactor: Decouple table generation and ecmult_gen context
22dc2c0a0d ecmult_gen: Move table creation to new file and force static prec
793ad9016a Merge bitcoin-core/secp256k1#1010: doc: Minor fixes in safegcd_implementation.md
dc9b6853b7 doc: Minor fixes in safegcd_implementation.md
ea5e8a9c47 Merge bitcoin-core/secp256k1#1012: Fix typos
233297579d Fix typos
7006f1b97f Merge bitcoin-core/secp256k1#1011: ci: Enable -g if we set CFLAGS manually
72de1359e9 ci: Enable -g if we set CFLAGS manually
74c34e727b Merge bitcoin-core/secp256k1#1009: refactor: Use (int)&(int) in boolean context to avoid compiler warning
16d132215c refactor: Use (int)&(int) in boolean context to avoid compiler warning
c74a7b7e51 Merge bitcoin-core/secp256k1#1007: doc: Replace apoelstra's GPG key by jonasnick's GPG key
3b157c48ed doc: Suggest keys.openpgp.org as keyserver in SECURITY.md
73a7472cd0 doc: Replace apoelstra's GPG key by jonasnick's GPG key
515a5dbd02 Merge bitcoin-core/secp256k1#991: Merge all "external" benchmarks into a single bench binary
af6abcb3d0 Make bench support selecting which benchmarks to run
9f56bdf5b9 Merge bench_schnorrsig into bench
3208557ae1 Merge bench_recover into bench
855e18d8a8 Merge bench_ecdh into bench
2a7be678a6 Combine bench_sign and bench_verify into single bench
8fa41201bd Merge bitcoin-core/secp256k1#1002: Make aux_rnd32==NULL behave identical to 0x0000..00.
5324f8942d Make aux_rnd32==NULL behave identical to 0x0000..00.
21c188b3c5 Merge bitcoin-core/secp256k1#943: VERIFY_CHECK precondition for secp256k1_fe_set_int.
3e7b2ea194 Merge bitcoin-core/secp256k1#999: bench_ecmult: improve clarity of output
23e2f66726 bench: don't return 1 in have_flag() if argc = 1
96b1ad2ea9 bench_ecmult: improve clarity of output
20d791edfb Merge bitcoin-core/secp256k1#989: Shared benchmark format for command line and CSV outputs
aa1b889b61 Merge bitcoin-core/secp256k1#996: Fix G.y parity in sage code
044d956305 Fix G.y parity in sage code
b4b130678d create csv file from the benchmark output
26a255beb6 Shared benchmark format for command line and CSV outputs
9526874d14 Merge bitcoin-core/secp256k1#810: Avoid overly-wide multiplications in 5x52 field mul/sqr
6b8733577e Merge BlockstreamResearch/secp256k1-zkp#147: whitelist: fix SECP256K1_WHITELIST_MAX_N_KEYS constant
920a0e5fa6 Merge bitcoin-core/secp256k1#952: Avoid computing out-of-bounds pointer.
f34b5cae03 Merge bitcoin-core/secp256k1#983: [RFC] Remove OpenSSL testing support
27d1c3b6a1 whitelist: add test for MAX_N_KEYS
c8ac14d9dc whitelist: fix SECP256K1_WHITELIST_MAX_N_KEYS constant
297ce82091 Merge bitcoin-core/secp256k1#966: Make aux_rand32 arg to secp256k1_schnorrsig_sign const
2888640132 VERIFY_CHECK precondition for secp256k1_fe_set_int.
d49011f54c Make _set_fe_int( . , 0 ) set magnitude to 0
e290c0f835 Merge BlockstreamResearch/secp256k1-zkp#148: fix a couple things to make Elements 22's linter happy
7812feb896 Merge BlockstreamResearch/secp256k1-zkp#144: Upstream PRs 969, 956, 783, 976
b9ebee1490 fix a couple things to make Elements 22's linter happy
bc08599e77 Remove OpenSSL testing support
10f9bd84f4 Merge bitcoin-core/secp256k1#987: Fix unused parameter warnings when building without VERIFY
189f6bcfef Fix unused parameter warnings when building without VERIFY
da0092bccc Merge bitcoin-core/secp256k1#986: tests: remove `secp256k1_fe_verify` from tests.c and modify `_fe_from_storage` to call `_fe_verify`
d43993724d tests: remove `secp256k1_fe_verify` from tests.c and modify `secp256k1_fe_from_storage` to call `secp256k1_fe_verify`
7fec4e7acc Merge BlockstreamResearch/secp256k1-zkp#145: sync-upstream: fix quoting
938725c1c9 Merge commits 'd7ec49a6 9a5a87e0 aa5d34a8 2a3a97c6 ' into temp-merge-976
95ee1fa030 sync-upstream: fix quoting
2a3a97c665 Merge bitcoin-core/secp256k1#976: `secp256k1_schnorrsig_sign_internal` should be static
aa5d34a8fe Merge bitcoin-core/secp256k1#783: Make the public API docs more consistent and explicit
72713872a8 Add missing static to secp256k1_schnorrsig_sign_internal
db4667d5e0 Make aux_rand32 arg to secp256k1_schnorrsig_sign const
9a5a87e0f1 Merge bitcoin-core/secp256k1#956: Replace ecmult_context with a generated static array.
20abd52c2e Add tests for pre_g tables.
6815761cf5 Remove ecmult_context.
f20dcbbad1 Correct typo.
16a3cc07e8 Generate ecmult_static_pre_g.h
8de2d86a06 Bump memory limits in advance of making the ecmult context static.
d7ec49a689 Merge bitcoin-core/secp256k1#969: ci: Fixes after Debian release
5d5c74a057 tests: Rewrite code to circument potential bug in clang
3d2f492ceb ci: Install libasan6 (instead of 5) after Debian upgrade
9447642140 Merge BlockstreamResearch/secp256k1-zkp#142: musig: fix session_init argument NULL check
9124ce0d9c musig: fix session_init argument NULL check
881b15cb43 Merge BlockstreamResearch/secp256k1-zkp#139: musig: use tagged hash for the list of pubkeys to aggregate
8f093be374 musig: use tagged hash for the list of pubkeys to aggregate
a6a768a4bf musig: make key agg test vector more precise
adec5a1638 Add missing null check for ctx and input keys in the public API
f4edfc7581 Improve consistency for NULL arguments in the public interface
9be7b0f083 Avoid computing out-of-bounds pointer.
b53e0cd61f Avoid overly-wide multiplications

git-subtree-dir: src/secp256k1
git-subtree-split: 7a30cb0c9d99ab195c461a6fb4e654cd4ef19a8d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants