Skip to content

Commit bef6f7c

Browse files
jesseposnerjesseposner
committed
frost trusted dealer: add example file
This commit adds an example file to demonstrate how to use the module.
1 parent ab1bb83 commit bef6f7c

File tree

4 files changed

+293
-1
lines changed

4 files changed

+293
-1
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ libsecp256k1.pc
6666
contrib/gh-pr-create.sh
6767

6868
musig_example
69+
frost_example
6970

7071
### CMake
7172
/CMakeUserPresets.json

‎Makefile.am

+11
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,17 @@ musig_example_LDFLAGS += -lbcrypt
195195
endif
196196
TESTS += musig_example
197197
endif
198+
if ENABLE_MODULE_FROST
199+
noinst_PROGRAMS += frost_example
200+
frost_example_SOURCES = examples/frost.c
201+
frost_example_CPPFLAGS = -I$(top_srcdir)/include -DSECP256K1_STATIC
202+
frost_example_LDADD = libsecp256k1.la
203+
frost_example_LDFLAGS = -static
204+
if BUILD_WINDOWS
205+
frost_example_LDFLAGS += -lbcrypt
206+
endif
207+
TESTS += frost_example
208+
endif
198209
endif
199210

200211
### Precomputed tables

‎examples/frost.c

+279
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
/***********************************************************************
2+
* Copyright (c) 2021-2024 Jesse Posner *
3+
* Distributed under the MIT software license, see the accompanying *
4+
* file COPYING or https://www.opensource.org/licenses/mit-license.php.*
5+
***********************************************************************/
6+
7+
/**
8+
* This file demonstrates how to use the FROST module to create a threshold
9+
* signature. Additionally, see the documentation in include/secp256k1_frost.h.
10+
*/
11+
12+
#include <stdio.h>
13+
#include <assert.h>
14+
#include <string.h>
15+
16+
#include <secp256k1.h>
17+
#include <secp256k1_schnorrsig.h>
18+
#include <secp256k1_frost.h>
19+
20+
#include "examples_util.h"
21+
22+
struct signer_secrets {
23+
secp256k1_keypair keypair;
24+
secp256k1_frost_share share;
25+
secp256k1_frost_secnonce secnonce;
26+
};
27+
28+
struct signer {
29+
secp256k1_pubkey pubshare;
30+
secp256k1_frost_pubnonce pubnonce;
31+
secp256k1_frost_session session;
32+
secp256k1_frost_partial_sig partial_sig;
33+
unsigned char id[33];
34+
};
35+
36+
/* Threshold required in creating the aggregate signature */
37+
#define THRESHOLD 3
38+
39+
40+
/* Number of public keys involved in creating the aggregate signature */
41+
#define N_SIGNERS 5
42+
/* Create a key pair, store it in signer_secrets->keypair and signer->pubkey */
43+
static int create_keypair(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer) {
44+
secp256k1_pubkey pubkey_tmp;
45+
unsigned char seckey[32];
46+
size_t size = 33;
47+
while (1) {
48+
if (!fill_random(seckey, sizeof(seckey))) {
49+
printf("Failed to generate randomness\n");
50+
return 1;
51+
}
52+
if (secp256k1_keypair_create(ctx, &signer_secrets->keypair, seckey)) {
53+
break;
54+
}
55+
}
56+
if (!secp256k1_keypair_pub(ctx, &pubkey_tmp, &signer_secrets->keypair)) {
57+
return 0;
58+
}
59+
if (!secp256k1_ec_pubkey_serialize(ctx, signer->id, &size, &pubkey_tmp, SECP256K1_EC_COMPRESSED)) {
60+
return 0;
61+
}
62+
return 1;
63+
}
64+
65+
/* Create shares and coefficient commitments */
66+
static int create_shares(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer) {
67+
int i;
68+
secp256k1_frost_share shares[N_SIGNERS];
69+
secp256k1_pubkey vss_commitment[THRESHOLD];
70+
const unsigned char *ids[N_SIGNERS];
71+
unsigned char seed[32];
72+
73+
if (!fill_random(seed, sizeof(seed))) {
74+
return 0;
75+
}
76+
77+
for (i = 0; i < N_SIGNERS; i++) {
78+
ids[i] = signer[i].id;
79+
}
80+
81+
/* Generate a polynomial share for the participants */
82+
if (!secp256k1_frost_shares_gen(ctx, shares, vss_commitment, seed, THRESHOLD, N_SIGNERS, ids)) {
83+
return 0;
84+
}
85+
86+
/* Distribute shares and VSS commitment */
87+
for (i = 0; i < N_SIGNERS; i++) {
88+
signer_secrets[i].share = shares[i];
89+
/* Each participant verifies their share. */
90+
if (!secp256k1_frost_share_verify(ctx, THRESHOLD, signer[i].id, &shares[i], vss_commitment)) {
91+
return 0;
92+
}
93+
/* Each participant generates public verification shares that are
94+
* used for verifying partial signatures. */
95+
if (!secp256k1_frost_compute_pubshare(ctx, &signer[i].pubshare, THRESHOLD, signer[i].id, vss_commitment)) {
96+
return 0;
97+
}
98+
}
99+
100+
return 1;
101+
}
102+
103+
/* Tweak the pubkey corresponding to the provided tweak cache, update the cache
104+
* and return the tweaked aggregate pk. */
105+
static int tweak(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pk, secp256k1_frost_keygen_cache *cache) {
106+
secp256k1_pubkey output_pk;
107+
unsigned char ordinary_tweak[32] = "this could be a BIP32 tweak....";
108+
unsigned char xonly_tweak[32] = "this could be a taproot tweak..";
109+
110+
/* Ordinary tweaking which, for example, allows deriving multiple child
111+
* public keys from a single aggregate key using BIP32 */
112+
if (!secp256k1_frost_pubkey_ec_tweak_add(ctx, NULL, cache, ordinary_tweak)) {
113+
return 0;
114+
}
115+
/* If one is not interested in signing, the same output_pk can be obtained
116+
* by calling `secp256k1_frost_pubkey_get` right after key aggregation to
117+
* get the full pubkey and then call `secp256k1_ec_pubkey_tweak_add`. */
118+
119+
/* Xonly tweaking which, for example, allows creating taproot commitments */
120+
if (!secp256k1_frost_pubkey_xonly_tweak_add(ctx, &output_pk, cache, xonly_tweak)) {
121+
return 0;
122+
}
123+
/* Note that if we wouldn't care about signing, we can arrive at the same
124+
* output_pk by providing the untweaked public key to
125+
* `secp256k1_xonly_pubkey_tweak_add` (after converting it to an xonly pubkey
126+
* if necessary with `secp256k1_xonly_pubkey_from_pubkey`). */
127+
128+
/* Now we convert the output_pk to an xonly pubkey to allow to later verify
129+
* the Schnorr signature against it. For this purpose we can ignore the
130+
* `pk_parity` output argument; we would need it if we would have to open
131+
* the taproot commitment. */
132+
if (!secp256k1_xonly_pubkey_from_pubkey(ctx, pk, NULL, &output_pk)) {
133+
return 0;
134+
}
135+
return 1;
136+
}
137+
138+
/* Sign a message hash with the given threshold and aggregate shares and store
139+
* the result in sig */
140+
static int sign(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer, const unsigned char *msg32, unsigned char *sig64, const secp256k1_frost_keygen_cache *cache) {
141+
int i;
142+
int signer_id = 0;
143+
int signers[THRESHOLD];
144+
int is_signer[N_SIGNERS];
145+
const secp256k1_frost_pubnonce *pubnonces[THRESHOLD];
146+
const unsigned char *ids[THRESHOLD];
147+
const secp256k1_frost_partial_sig *partial_sigs[THRESHOLD];
148+
149+
for (i = 0; i < N_SIGNERS; i++) {
150+
unsigned char session_id[32];
151+
/* Create random session ID. It is absolutely necessary that the session ID
152+
* is unique for every call of secp256k1_frost_nonce_gen. Otherwise
153+
* it's trivial for an attacker to extract the secret key! */
154+
if (!fill_random(session_id, sizeof(session_id))) {
155+
return 0;
156+
}
157+
/* Initialize session and create secret nonce for signing and public
158+
* nonce to send to the other signers. */
159+
if (!secp256k1_frost_nonce_gen(ctx, &signer_secrets[i].secnonce, &signer[i].pubnonce, session_id, &signer_secrets[i].share, msg32, cache, NULL)) {
160+
return 0;
161+
}
162+
is_signer[i] = 0; /* Initialize is_signer */
163+
}
164+
/* Select a random subset of signers */
165+
for (i = 0; i < THRESHOLD; i++) {
166+
unsigned int subset_seed;
167+
168+
while (1) {
169+
if (!fill_random((unsigned char*)&subset_seed, sizeof(subset_seed))) {
170+
return 0;
171+
}
172+
signer_id = subset_seed % N_SIGNERS;
173+
/* Check if signer has already been assigned */
174+
if (!is_signer[signer_id]) {
175+
is_signer[signer_id] = 1;
176+
signers[i] = signer_id;
177+
break;
178+
}
179+
}
180+
/* Mark signer as assigned */
181+
pubnonces[i] = &signer[signer_id].pubnonce;
182+
/* pubkeys[i] = &signer[signer_id].pubkey; */
183+
ids[i] = signer[signer_id].id;
184+
}
185+
/* Signing communication round 1: Exchange nonces */
186+
for (i = 0; i < THRESHOLD; i++) {
187+
signer_id = signers[i];
188+
if (!secp256k1_frost_nonce_process(ctx, &signer[signer_id].session, pubnonces, THRESHOLD, msg32, signer[signer_id].id, ids, cache, NULL)) {
189+
return 0;
190+
}
191+
/* partial_sign will clear the secnonce by setting it to 0. That's because
192+
* you must _never_ reuse the secnonce (or use the same session_id to
193+
* create a secnonce). If you do, you effectively reuse the nonce and
194+
* leak the secret key. */
195+
if (!secp256k1_frost_partial_sign(ctx, &signer[signer_id].partial_sig, &signer_secrets[signer_id].secnonce, &signer_secrets[signer_id].share, &signer[signer_id].session, cache)) {
196+
return 0;
197+
}
198+
partial_sigs[i] = &signer[signer_id].partial_sig;
199+
}
200+
/* Communication round 2: A production system would exchange
201+
* partial signatures here before moving on. */
202+
for (i = 0; i < THRESHOLD; i++) {
203+
signer_id = signers[i];
204+
/* To check whether signing was successful, it suffices to either verify
205+
* the aggregate signature with the aggregate public key using
206+
* secp256k1_schnorrsig_verify, or verify all partial signatures of all
207+
* signers individually. Verifying the aggregate signature is cheaper but
208+
* verifying the individual partial signatures has the advantage that it
209+
* can be used to determine which of the partial signatures are invalid
210+
* (if any), i.e., which of the partial signatures cause the aggregate
211+
* signature to be invalid and thus the protocol run to fail. It's also
212+
* fine to first verify the aggregate sig, and only verify the individual
213+
* sigs if it does not work.
214+
*/
215+
if (!secp256k1_frost_partial_sig_verify(ctx, &signer[signer_id].partial_sig, &signer[signer_id].pubnonce, &signer[signer_id].pubshare, &signer[signer_id].session, cache)) {
216+
return 0;
217+
}
218+
}
219+
return secp256k1_frost_partial_sig_agg(ctx, sig64, &signer[signer_id].session, partial_sigs, THRESHOLD);
220+
}
221+
222+
int main(void) {
223+
secp256k1_context* ctx;
224+
int i;
225+
struct signer_secrets signer_secrets[N_SIGNERS];
226+
struct signer signers[N_SIGNERS];
227+
const secp256k1_pubkey *pubshares_ptr[N_SIGNERS];
228+
secp256k1_xonly_pubkey pk;
229+
secp256k1_frost_keygen_cache keygen_cache;
230+
const unsigned char msg[32] = "this_could_be_the_hash_of_a_msg!";
231+
unsigned char sig[64];
232+
const unsigned char *id_ptr[5];
233+
234+
/* Create a context for signing and verification */
235+
ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
236+
printf("Creating key pairs......");
237+
for (i = 0; i < N_SIGNERS; i++) {
238+
if (!create_keypair(ctx, &signer_secrets[i], &signers[i])) {
239+
printf("FAILED\n");
240+
return 1;
241+
}
242+
pubshares_ptr[i] = &signers[i].pubshare;
243+
id_ptr[i] = signers[i].id;
244+
}
245+
printf("ok\n");
246+
printf("Creating shares.........");
247+
if (!create_shares(ctx, signer_secrets, signers)) {
248+
printf("FAILED\n");
249+
return 1;
250+
}
251+
printf("ok\n");
252+
printf("Generating public key...");
253+
if (!secp256k1_frost_pubkey_gen(ctx, &keygen_cache, pubshares_ptr, N_SIGNERS, id_ptr)) {
254+
printf("FAILED\n");
255+
return 1;
256+
}
257+
printf("ok\n");
258+
printf("Tweaking................");
259+
/* Optionally tweak the aggregate key */
260+
if (!tweak(ctx, &pk, &keygen_cache)) {
261+
printf("FAILED\n");
262+
return 1;
263+
}
264+
printf("ok\n");
265+
printf("Signing message.........");
266+
if (!sign(ctx, signer_secrets, signers, msg, sig, &keygen_cache)) {
267+
printf("FAILED\n");
268+
return 1;
269+
}
270+
printf("ok\n");
271+
printf("Verifying signature.....");
272+
if (!secp256k1_schnorrsig_verify(ctx, sig, msg, 32, &pk)) {
273+
printf("FAILED\n");
274+
return 1;
275+
}
276+
printf("ok\n");
277+
secp256k1_context_destroy(ctx);
278+
return 0;
279+
}

‎include/secp256k1_frost.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ extern "C" {
1515
* This module implements a variant of Flexible Round-Optimized Schnorr
1616
* Threshold Signatures (FROST) by Chelsea Komlo and Ian Goldberg
1717
* (https://crysp.uwaterloo.ca/software/frost/). Signatures are compatible with
18-
* BIP-340 ("Schnorr").
18+
* BIP-340 ("Schnorr"). There's an example C source file in the module's
19+
* directory (examples/frost.c) that demonstrates how it can be used.
1920
*
2021
* The module also supports BIP-341 ("Taproot") and BIP-32 ("ordinary") public
2122
* key tweaking, and adaptor signatures.

0 commit comments

Comments
 (0)