Struct schnorrkel::context::XoFTranscript

pub struct XoFTranscript<H>(/* private fields */)
where
    H: Update + ExtendableOutput + Clone;

Very simple transcript construction from a modern hash function.

We provide this transcript type to directly use conventional hash functions with an extensible output mode, like Shake128 and Blake2x.

We recommend using merlin::Transcript instead because merlin provides the transcript abstraction natively and might function better in low memory environments. We therefore do not provide conveniences like signing_context for this.

We note that merlin already uses Keccak, upon which Shake128 is based, and that no rust implementation for Blake2x currently exists.

We caution that our transcript abstractions cannot provide the protections against hash collisions that Ed25519 provides via double hashing, but that prehashed Ed25519 variants lose. As such, any hash function used here must be collision resistant. We strongly recommend against building XOFs from weaker hash functions like SHA1 with HKDF constructions or similar.

In XoFTranscript style, we never expose the hash function H underlying this type, so that developers cannot circumvent the domain separation provided by our methods. We do this to make &mut XoFTranscript : SigningTranscript safe.

Implementations

impl<H> XoFTranscript<H>

where H: Update + ExtendableOutput + Clone,

pub fn new(h: H) -> XoFTranscript<H>

Create a XoFTranscript from a conventional hash functions with an extensible output mode.

We intentionally consume and never reexpose the hash function provided, so that our domain separation works correctly even when using &mut XoFTranscript : SigningTranscript.

Trait Implementations

impl<H> From<H> for XoFTranscript<H>

where H: Update + ExtendableOutput + Clone,

fn from(h: H) -> XoFTranscript<H>

Converts to this type from the input type.

impl<H> SigningTranscript for XoFTranscript<H>

where H: Update + ExtendableOutput + Clone,

fn commit_bytes(&mut self, label: &'static [u8], bytes: &[u8])

Extend transcript with some bytes, shadowed by merlin::Transcript.

fn challenge_bytes(&mut self, label: &'static [u8], dest: &mut [u8])

Produce some challenge bytes, shadowed by merlin::Transcript.

fn witness_bytes_rng<R>( &self, label: &'static [u8], dest: &mut [u8], nonce_seeds: &[&[u8]], rng: R, )

where R: RngCore + CryptoRng,

Produce secret witness bytes from the protocol transcript and any “nonce seeds” kept with the secret keys.

fn proto_name(&mut self, label: &'static [u8])

Extend transcript with a protocol name

fn commit_point( &mut self, label: &'static [u8], compressed: &CompressedRistretto, )

Extend the transcript with a compressed Ristretto point

fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar

Produce the public challenge scalar e.

fn witness_scalar(&self, label: &'static [u8], nonce_seeds: &[&[u8]]) -> Scalar

Produce a secret witness scalar k, aka nonce, from the protocol transcript and any “nonce seeds” kept with the secret keys.

fn witness_bytes( &self, label: &'static [u8], dest: &mut [u8], nonce_seeds: &[&[u8]], )

Produce secret witness bytes from the protocol transcript and any “nonce seeds” kept with the secret keys.