Commit graph

57 commits

Author SHA1 Message Date
Olaoluwa Osuntokun
d25f072e71
btcec/schnorr/musig2: add test vectors from secp256k1-zkp
In this commit, we add test vectors which are extracted from the
secp256k1-zkp/ codebase and match up with the current draft
specification.
2022-04-28 16:19:44 -07:00
Olaoluwa Osuntokun
bb7ba7b1fc
btcec/schnorr/musig2: add partial sig generation, validation, and combination
In this commit, we build on the prior two commits by adding the ability
to generate partial musig2 signatures, validate them individually, and
finally combine them into a single signature.

Much of the logic here is unoptimized, and will be optimized in a later
commit. In addition, we also want to eventually have a nicer API to
support the book keeping necessary during multi signing.
2022-04-28 16:19:42 -07:00
Olaoluwa Osuntokun
8343e462a6
btcec/schnorr/musig2: add nonce generation & aggregation funcs
In this commit, we add the ability to generate the secret+public nonces,
as well as combine a series of nonces into a single combined nonce
(which is used when doing multi signing).
2022-04-28 16:19:40 -07:00
Olaoluwa Osuntokun
1a65f1ccf0
btcec/schnorr/musig2: add key musig2 key aggregation routines
In this commit, we add the set of key aggregation routines for musig2.
This includes the main public key aggregation method, as well as the
aggregation coefficient which is used to compute "mu" when signing.

The logic in this implementation is based on the musig2 paper, as well
as this spec:
https://github.com/ElementsProject/secp256k1-zkp/blob/master/doc/musig-spec.mediawiki.
2022-04-28 16:19:38 -07:00
Olaoluwa Osuntokun
b7a4622a6b
btcec+chaincfg: use pre-computed tag hash values
In this commit, we optimize our signature implementation slightly, by
defining pre-computed sha256(tag) variables for the commonly used
values.  If a tag matches this, then we'll use that hash value to avoid
an extra round of hashing.
2022-01-31 14:55:08 -08:00
Olaoluwa Osuntokun
973fb37600
btcec/schnorr: add benchmarks for sign/verify
Benchmarks run w/o fast sign (always verify after you generate a sig):
```
goos: darwin
goarch: amd64
pkg: github.com/btcsuite/btcd/btcec/v2/schnorr
cpu: VirtualApple @ 2.50GHz
BenchmarkSigVerify-8     	    8000	    152468 ns/op	     960 B/op	      16 allocs/op
BenchmarkSign-8          	    4939	    215489 ns/op	    1408 B/op	      27 allocs/op
BenchmarkSignRfc6979-8   	    5106	    217416 ns/op	    2129 B/op	      37 allocs/op
PASS
ok  	github.com/btcsuite/btcd/btcec/v2/schnorr	4.629s
```

Benchmarks w/ fast sign:
```
goos: darwin
goarch: amd64
pkg: github.com/btcsuite/btcd/btcec/v2/schnorr
cpu: VirtualApple @ 2.50GHz
BenchmarkSigVerify-8     	    7982	    142826 ns/op	     960 B/op	      16 allocs/op
BenchmarkSign-8          	   18210	     65908 ns/op	     496 B/op	      12 allocs/op
BenchmarkSignRfc6979-8   	   16537	     78161 ns/op	    1216 B/op	      22 allocs/op
PASS
ok  	github.com/btcsuite/btcd/btcec/v2/schnorr	5.418s
```
2022-01-31 14:40:35 -08:00
Olaoluwa Osuntokun
d6d38ad4ae
btcec/v2/schnorr: add initial BIP-340 schnorr sig implementation
In this commit, we add an initial implementation of BIP-340. Mirroring
the recently added `ecsda` package, we create a new `schnorr` package
with a unique `Signature` type and `ParsePubkey` function. The new
`Signature` type implements the fixed-sized 64-byte signatures, and the
`ParsePubkey` method only accepts pubkeys that are 32-bytes in length,
with an implicit sign byte.

The signing implementation by default, deviates from BIP-340 as it opts
to use rfc6979 deterministic signatures by default, which means callers
don't need to always pass in their own `auxNonce` randomness. A set of
functional arguments allows callers to pass in their own value, which is
the way all the included test vectors function.

The other optional functional argument added is the `FastSign` option
that allows callers to skip the final step of verifying each signature
they generate.
2022-01-31 14:25:47 -08:00