Olaoluwa Osuntokun
08187eb786
btcec/schnorr/musig2: add support for tweaked aggregated keys
...
In this commit, we add support for signing with tweaked aggregated keys.
Such signing is required when signing for a taproot output key that
actually commits to a script tree root, or was generated using BIP 86.
A series of new functional arguments (that can likely be de-dup'd using
Go's new type params), have been added to allow callers to optionally
flip on this new behavior.
2022-04-28 16:19:55 -07:00
Olaoluwa Osuntokun
743cbc8403
btcec/schnorr/musig2: add safer signing API with Session+Context
...
In this commit, we introduce an easier to use API for musig2 signing in
the Session and Context structs.
The Context struct represents a particular musig2 signing context which
is defined by the set of signers. The struct can be serialized to disk
as it contains no volatile information. A given context can be kept for
each signer in the final set.
The Session struct represents an ephemeral musig2 signing session. It
handles nonce generation, key aggregation, nonce combination, signature
combination, and final sig verification all in one API. The API also
protects against nonce generation by not exposing nonces to the end user
and also attempting to catch nonce re-use (assuming no process forking)
across sessions.
2022-04-28 16:19:53 -07:00
Olaoluwa Osuntokun
e85e7c3ac7
btcec/schnorr/musig2: optimize signing+verification
...
In this commit, we optimize signing+verification mainly by only
computing values once, and reducing allocations when possible.
The following optimizations have been implemented:
* Use a single buffer allocation in keyHashFingerprint to avoid
dynamic buffer growth+re-sizing
* Remove the isSecondKey computation and replace that with a single
routine that computes the index of the second unique key.
* Optimize keyHashFingerprint usage by only computing it once during
signing +verification.
A further optimization is possible: use the x coordinate of a key for
comparisons instead of computing the full sexualision. We need to do
the latter atm, as the X() method of the public key struct will allocate
more memory as it allocate and sets the buffer in place.
The final benchmarks of before and after this commit:
benchmark old ns/op new ns/op delta
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=true-8 1227374 1194047 -2.72%
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=false-8 1217743 1191468 -2.16%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=true-8 2755544 2698827 -2.06%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=false-8 2754749 2694547 -2.19%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=true-8 12382654 10561204 -14.71%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=false-8 12260134 10315376 -15.86%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=true-8 24832061 22009935 -11.36%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=false-8 24650086 21022833 -14.71%
BenchmarkPartialVerify/sort_keys=true/num_signers=10-8 1485787 1473377 -0.84%
BenchmarkPartialVerify/sort_keys=false/num_signers=10-8 1447275 1465139 +1.23%
BenchmarkPartialVerify/sort_keys=true/num_signers=100-8 12503482 10672618 -14.64%
BenchmarkPartialVerify/sort_keys=false/num_signers=100-8 12388289 10581398 -14.59%
BenchmarkCombineSigs/num_signers=10-8 0.00 0.00 +0.00%
BenchmarkCombineSigs/num_signers=100-8 0.00 0.00 -1.95%
BenchmarkAggregateNonces/num_signers=10-8 0.00 0.00 -0.76%
BenchmarkAggregateNonces/num_signers=100-8 0.00 0.00 +1.13%
BenchmarkAggregateKeys/num_signers=10/sort_keys=true-8 0.00 0.00 -0.09%
BenchmarkAggregateKeys/num_signers=10/sort_keys=false-8 0.00 0.01 +559.94%
BenchmarkAggregateKeys/num_signers=100/sort_keys=true-8 0.01 0.01 -11.30%
BenchmarkAggregateKeys/num_signers=100/sort_keys=false-8 0.01 0.01 -11.66%
benchmark old allocs new allocs delta
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=true-8 458 269 -41.27%
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=false-8 409 222 -45.72%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=true-8 892 524 -41.26%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=false-8 841 467 -44.47%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=true-8 14366 3089 -78.50%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=false-8 13143 1842 -85.98%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=true-8 27596 4964 -82.01%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=false-8 26309 3707 -85.91%
BenchmarkPartialVerify/sort_keys=true/num_signers=10-8 430 243 -43.49%
BenchmarkPartialVerify/sort_keys=false/num_signers=10-8 430 243 -43.49%
BenchmarkPartialVerify/sort_keys=true/num_signers=100-8 13164 1863 -85.85%
BenchmarkPartialVerify/sort_keys=false/num_signers=100-8 13164 1863 -85.85%
BenchmarkCombineSigs/num_signers=10-8 0 0 +0.00%
BenchmarkCombineSigs/num_signers=100-8 0 0 +0.00%
BenchmarkAggregateNonces/num_signers=10-8 0 0 +0.00%
BenchmarkAggregateNonces/num_signers=100-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=10/sort_keys=true-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=10/sort_keys=false-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=100/sort_keys=true-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=100/sort_keys=false-8 0 0 +0.00%
benchmark old bytes new bytes delta
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=true-8 27854 14878 -46.59%
BenchmarkPartialSign/num_signers=10/fast_sign=true/sort=false-8 25508 12605 -50.58%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=true-8 54982 29476 -46.39%
BenchmarkPartialSign/num_signers=10/fast_sign=false/sort=false-8 52581 26805 -49.02%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=true-8 1880138 166996 -91.12%
BenchmarkPartialSign/num_signers=100/fast_sign=true/sort=false-8 1820561 106295 -94.16%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=true-8 3706291 275344 -92.57%
BenchmarkPartialSign/num_signers=100/fast_sign=false/sort=false-8 3642725 214122 -94.12%
BenchmarkPartialVerify/sort_keys=true/num_signers=10-8 26995 14078 -47.85%
BenchmarkPartialVerify/sort_keys=false/num_signers=10-8 26980 14078 -47.82%
BenchmarkPartialVerify/sort_keys=true/num_signers=100-8 1822043 107767 -94.09%
BenchmarkPartialVerify/sort_keys=false/num_signers=100-8 1822046 107752 -94.09%
BenchmarkCombineSigs/num_signers=10-8 0 0 +0.00%
BenchmarkCombineSigs/num_signers=100-8 0 0 +0.00%
BenchmarkAggregateNonces/num_signers=10-8 0 0 +0.00%
BenchmarkAggregateNonces/num_signers=100-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=10/sort_keys=true-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=10/sort_keys=false-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=100/sort_keys=true-8 0 0 +0.00%
BenchmarkAggregateKeys/num_signers=100/sort_keys=false-8 0 0 +0.00%
2022-04-28 16:19:51 -07:00
Olaoluwa Osuntokun
bb7ba7b1fc
btcec/schnorr/musig2: add partial sig generation, validation, and combination
...
In this commit, we build on the prior two commits by adding the ability
to generate partial musig2 signatures, validate them individually, and
finally combine them into a single signature.
Much of the logic here is unoptimized, and will be optimized in a later
commit. In addition, we also want to eventually have a nicer API to
support the book keeping necessary during multi signing.
2022-04-28 16:19:42 -07:00
