Module schnorrkel::derive

Implementation of “hierarchical deterministic key derivation” (HDKD) for Schnorr signatures on Ristretto

Warning We warn that our VRF construction in vrf.rs supports malleable VRF outputs via the Malleable type, which becomes insecure when used in conjunction with our hierarchical key derivation methods here. Attackers could translate malleable VRF outputs from one soft subkey to another soft subkey, gaining early knowledge of the VRF output. We think most VRF applications for which HDKH sounds suitable benefit from using implicit certificates instead of HDKD anyways, which should also be secure in combination with HDKH. We always use non-malleable VRF inputs in our convenience methods. We suggest using implicit certificates instead of HDKD when using VRFs.

Structs

• ChainCode
  We cannot assume the original public key is secret and additional inputs might have low entropy, like i in BIP32. As in BIP32, chain codes fill this gap by being a high entropy secret shared between public and private key holders. These are produced by key derivations and can be incorporated into subsequence key derivations. See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#extended-keys
• ExtendedKey
  A convenience wraper that combines derivable key and a chain code.

Constants

• CHAIN_CODE_LENGTH
  Length in bytes of our chain codes.

Traits

• Derivation
  Key types that support “hierarchical deterministic” key derivation