Struct schnorrkel::musig::MuSig

source ·

pub struct MuSig<T: SigningTranscript + Clone, S> { /* private fields */ }

👎Deprecated since 0.11.0: This module will be replaced in the future

Expand description

Schnorr multi-signature (MuSig) container generic over its session types

Implementations§

source §

impl<T: SigningTranscript + Clone, S> MuSig<T, S>

source

pub fn public_keys( &self, require_reveal: bool, ) -> impl Iterator<Item = &PublicKey>

👎Deprecated since 0.11.0: This module will be replaced in the future

Iterates over public keys.

If require_reveal=true then we count only public key that revealed their R values.

source

pub fn public_key(&self) -> PublicKey

👎Deprecated since 0.11.0: This module will be replaced in the future

Aggregate public key given currently revealed R values

source

pub fn expected_public_key(&self) -> PublicKey

👎Deprecated since 0.11.0: This module will be replaced in the future

Aggregate public key expected if all currently committed nodes fully participate

source §

impl<T, S> MuSig<T, S>
where T: SigningTranscript + Clone, S: TranscriptStages,

source

pub fn transcript(&mut self) -> &mut T

👎Deprecated since 0.11.0: This module will be replaced in the future

We permit extending the transcript whenever you like, so that say the message may be agreed upon in parallel to the commitments. We advise against doing so however, as this requires absolute faith in your random number generator, usually rand::thread_rng().

source §

impl<K, T> MuSig<T, CommitStage<K>>
where K: Borrow<Keypair>, T: SigningTranscript + Clone,

source

pub fn new(keypair: K, t: T) -> MuSig<T, CommitStage<K>>

👎Deprecated since 0.11.0: This module will be replaced in the future

Initialize a multi-signature aka cosignature protocol run.

We encourage borrowing the Keypair to minimize copies of the private key, so we provide the Keypair::musig method for the K = &'k Keypair case. You could use Rc or Arc with this MuSig::new method, or even pass in an owned copy.

source

pub fn our_commitment(&self) -> Commitment

👎Deprecated since 0.11.0: This module will be replaced in the future

Our commitment to our R to send to all other cosigners

source

pub fn add_their_commitment( &mut self, them: PublicKey, theirs: Commitment, ) -> SignatureResult<()>

👎Deprecated since 0.11.0: This module will be replaced in the future

Add a new cosigner’s public key and associated R bypassing our commitment phase.

source

pub fn reveal_stage(self) -> MuSig<T, RevealStage<K>>

👎Deprecated since 0.11.0: This module will be replaced in the future

Commit to reveal phase transition.

source §

impl<K, T> MuSig<T, RevealStage<K>>
where K: Borrow<Keypair>, T: SigningTranscript + Clone,

source

pub fn our_reveal(&self) -> &Reveal

👎Deprecated since 0.11.0: This module will be replaced in the future

Reveal our R contribution to send to all other cosigners

source

pub fn add_their_reveal( &mut self, them: PublicKey, theirs: Reveal, ) -> SignatureResult<()>

👎Deprecated since 0.11.0: This module will be replaced in the future

Include a revealed R value from a previously committed cosigner

source

pub fn add_trusted( &mut self, them: PublicKey, theirs: Reveal, ) -> SignatureResult<()>

👎Deprecated since 0.11.0: This module will be replaced in the future

Add a new cosigner’s public key and associated R bypassing our commitment phase.

We implemented defenses that reduce the risks posed by this method, but anyone who wishes provable security should heed the advice below:

Avoid using this due to the attack described in “On the Provable Security of Two-Round Multi-Signatures” by Manu Drijvers, Kasra Edalatnejad, Bryan Ford, and Gregory Neven https://eprint.iacr.org/2018/417 Avoid using this for public keys held by networked devices in particular.

There are however limited scenarios in which using this appears secure, primarily if the trusted device is (a) air gapped, (b) stateful, and (c) infrequently used, via some constrained channel like manually scanning QR code. Almost all hardware wallets designs fail (b), but non-hardware wallets fail (a), with the middle ground being only something like Parity Signer. Also, any public keys controlled by an organization likely fail (c) too, making this only useful for individuals.

source