-
Notifications
You must be signed in to change notification settings - Fork 1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ecdsa sign-to-contract module, with anti nonce covert chan util functions #637
Closed
+1,127
−23
Closed
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
0929853
Add ec_commitments which are essentially the pay-to-contract-style tw…
jonasnick bfbf416
Add and expose sign-to-contract opening with parse and serialize func…
jonasnick 962ce23
modules: add ecdsa_sign_to_contract
benma 18cb435
ecdsa_sign_to_contract: add Anti Nonce Covert Channel util functions
benma File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| #ifndef SECP256K1_ECDSA_SIGN_TO_CONTRACT_H | ||
| #define SECP256K1_ECDSA_SIGN_TO_CONTRACT_H | ||
|
|
||
| #include "secp256k1.h" | ||
|
|
||
| #ifdef __cplusplus | ||
| extern "C" { | ||
| #endif | ||
|
|
||
| /** Same as secp256k1_ecdsa_sign, but s2c_data32 is committed to by adding `hash(R1, s2c_data32)` to | ||
| * the nonce generated by noncefp, with `ndata=hash(s2c_data32, ndata)`. | ||
| * Returns: 1: signature created | ||
| * 0: the nonce generation function failed, or the private key was invalid. | ||
| * Args: ctx: pointer to a context object, initialized for signing (cannot be NULL) | ||
| * Out: sig: pointer to an array where the signature will be placed (cannot be NULL) | ||
| * s2c_opening: pointer to an secp256k1_s2c_opening structure which can be | ||
| * NULL but is required to be not NULL if this signature creates | ||
| * a sign-to-contract commitment (i.e. the `s2c_data` argument | ||
| * is not NULL). | ||
| * In: | ||
| * msg32: the 32-byte message hash being signed (cannot be NULL) | ||
| * seckey: pointer to a 32-byte secret key (cannot be NULL) | ||
| * s2c_data32: pointer to a 32-byte data to create an optional | ||
| * sign-to-contract commitment to if not NULL (can be NULL). | ||
| * noncefp: pointer to a nonce generation function. | ||
| * If NULL, secp256k1_nonce_function_default is used. | ||
| * Must be the default if s2c_data32 is not NULL. | ||
| * ndata: pointer to arbitrary data used by the nonce generation function (can be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_sign( | ||
| const secp256k1_context* ctx, | ||
| secp256k1_ecdsa_signature *sig, | ||
| secp256k1_s2c_opening *s2c_opening, | ||
| const unsigned char *msg32, | ||
| const unsigned char *seckey, | ||
| const unsigned char* s2c_data32, | ||
| secp256k1_nonce_function noncefp, | ||
| const void *ndata | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| /** Verify a sign-to-contract commitment. | ||
| * | ||
| * Returns: 1: the signature contains a commitment to data32 | ||
| * 0: incorrect opening | ||
| * Args: ctx: a secp256k1 context object, initialized for verification. | ||
| * In: sig: the signature containing the sign-to-contract commitment (cannot be NULL) | ||
| * data32: the 32-byte data that was committed to (cannot be NULL) | ||
| * opening: pointer to the opening created during signing (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_verify_commit( | ||
| const secp256k1_context* ctx, | ||
| const secp256k1_ecdsa_signature *sig, | ||
| const unsigned char *data32, | ||
| const secp256k1_s2c_opening *opening | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4); | ||
|
|
||
| /** Compute commitment on the client as part of the ECDSA Anti Nonce Covert Channel Protocol. | ||
| * | ||
| * ECDSA Anti Nonce Covert Channel Protocol: | ||
| * 1. The host draws randomness `k2`, commits to it with sha256 and sends the commitment to the client. | ||
| * 2. The client commits to its original nonce `k1` using the host commitment by calling | ||
| * `secp256k1_ecdsa_anti_covert_channel_client_commit`. The client sends the resulting commitment | ||
| * `R1` to the host. | ||
| * 3. The host replies with `k2` generated in step 1. | ||
| * 4. The client signs with `secp256k1_ecdsa_s2c_sign`, using the `k2` as `s2c_data` and | ||
| * sends the signature and opening to the host. | ||
| * 5. The host verifies that `R_x = (R1 + H(R1, k2)*G)_x`, where R_x is the `r` part of the signature by using | ||
| * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify` with the client's | ||
| * commitment from step 2 and the signature and opening received in step 4. If verification does | ||
| * not succeed, the protocol failed and can be restarted. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * Out: client_commit: pointer to a pubkey where the clients public nonce will be | ||
| * placed. (cannot be NULL) | ||
| * In: msg32: the 32-byte message hash to be signed (cannot be NULL) | ||
| * seckey32: the 32-byte secret key used for signing (cannot be NULL) | ||
| * noncefp: pointer to a nonce generation function. If NULL, secp256k1_nonce_function_default is used | ||
| * rand_commitment32: the 32-byte randomness commitment from the host (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit( | ||
| const secp256k1_context* ctx, | ||
| secp256k1_pubkey *client_commit, | ||
| const unsigned char *msg32, | ||
| const unsigned char *seckey32, | ||
| unsigned char *rand_commitment32 | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| /** Create a randomness commitment on the host as part of the ECDSA Anti Nonce Covert Channel Protocol. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * Out: rand_commitment32: pointer to 32-byte array to store the returned commitment (cannot be NULL) | ||
| * In: rand32: the 32-byte randomness to commit to (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_commit( | ||
| secp256k1_context *ctx, | ||
| unsigned char *rand_commitment32, | ||
| const unsigned char *rand32 | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3); | ||
|
|
||
| /** Verify that a clients signature contains the hosts randomness as part of the Anti | ||
| * Nonce Covert Channel Protocol. Does not verify the signature itself. | ||
| * | ||
| * Returns 1 on success, 0 on failure. | ||
| * Args: ctx: pointer to a context object (cannot be NULL) | ||
| * In: sig: pointer to the signature whose randomness should be verified | ||
| * (cannot be NULL) | ||
| * rand32: pointer to the 32-byte randomness from the host which should | ||
| * be included by the signature (cannot be NULL) | ||
| * opening: pointer to the opening produced by the client when signing | ||
| * with `rand32` as `s2c_data` (cannot be NULL) | ||
| * client_commit: pointer to the client's commitment created in | ||
| * `secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit` | ||
| * (cannot be NULL) | ||
| */ | ||
| SECP256K1_API int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify( | ||
| secp256k1_context *ctx, | ||
| const secp256k1_ecdsa_signature *sig, | ||
| const unsigned char *rand32, | ||
| const secp256k1_s2c_opening *opening, | ||
| const secp256k1_pubkey *client_commit | ||
| ) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5); | ||
|
|
||
| #ifdef __cplusplus | ||
| } | ||
| #endif | ||
|
|
||
| #endif /* SECP256K1_ECDSA_SIGN_TO_CONTRACT_H */ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| include_HEADERS += include/secp256k1_ecdsa_sign_to_contract.h | ||
| noinst_HEADERS += src/modules/ecdsa_sign_to_contract/main_impl.h | ||
| noinst_HEADERS += src/modules/ecdsa_sign_to_contract/tests_impl.h |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,218 @@ | ||
| /********************************************************************** | ||
| * Copyright (c) 2019 Marko Bencun, Jonas Nick * | ||
| * Distributed under the MIT software license, see the accompanying * | ||
| * file COPYING or http://www.opensource.org/licenses/mit-license.php.* | ||
| **********************************************************************/ | ||
|
|
||
| #ifndef SECP256K1_MODULE_ECDSA_SIGN_TO_CONTRACT_MAIN_H | ||
| #define SECP256K1_MODULE_ECDSA_SIGN_TO_CONTRACT_MAIN_H | ||
|
|
||
| #include "include/secp256k1_ecdsa_sign_to_contract.h" | ||
|
|
||
| int secp256k1_ecdsa_s2c_sign(const secp256k1_context *ctx, secp256k1_ecdsa_signature *signature, secp256k1_s2c_opening *s2c_opening, const unsigned char *msg32, const unsigned char *seckey, const unsigned char* s2c_data32, secp256k1_nonce_function noncefp, const void* noncedata) { | ||
| secp256k1_scalar r, s; | ||
| secp256k1_scalar sec, non, msg; | ||
| secp256k1_sha256 sha; | ||
| int ret = 0; | ||
| int overflow = 0; | ||
| int is_zero = 0; | ||
| unsigned char ndata[32]; | ||
| VERIFY_CHECK(ctx != NULL); | ||
| ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); | ||
| ARG_CHECK(msg32 != NULL); | ||
| ARG_CHECK(signature != NULL); | ||
| ARG_CHECK(seckey != NULL); | ||
| if (noncefp == NULL) { | ||
| noncefp = secp256k1_nonce_function_default; | ||
| } | ||
| /* sign-to-contract commitments only work with the default nonce function, | ||
| * because we need to ensure that s2c_data is actually hashed into the nonce and | ||
| * not just ignored. */ | ||
| ARG_CHECK(s2c_data32 == NULL || noncefp == secp256k1_nonce_function_default); | ||
| /* s2c_opening and s2c_data32 should be either both non-NULL or both NULL. */ | ||
| ARG_CHECK((s2c_opening != NULL) == (s2c_data32 != NULL)); | ||
|
|
||
| if (s2c_opening != NULL) { | ||
| secp256k1_s2c_opening_init(s2c_opening); | ||
| } | ||
|
|
||
| if(s2c_data32 != NULL) { | ||
| /* Provide s2c_data32 and ndata (if not NULL) to the the nonce function | ||
| * as additional data to derive the nonce from. If both pointers are | ||
| * not NULL, they need to be hashed to get the nonce data 32 bytes. | ||
| * Even if only s2c_data32 is not NULL, it's hashed because it should | ||
| * be possible to derive nonces even if only a SHA256 commitment to the | ||
| * data is known. This is for example important in the | ||
| * anti-nonce-sidechannel protocol. | ||
| */ | ||
| secp256k1_sha256_initialize(&sha); | ||
| secp256k1_sha256_write(&sha, s2c_data32, 32); | ||
| if (noncedata != NULL) { | ||
| secp256k1_sha256_write(&sha, noncedata, 32); | ||
| } | ||
| secp256k1_sha256_finalize(&sha, ndata); | ||
| noncedata = &ndata; | ||
| } | ||
|
|
||
| secp256k1_scalar_set_b32(&sec, seckey, &overflow); | ||
| /* Fail if the secret key is invalid. */ | ||
| if (!overflow && !secp256k1_scalar_is_zero(&sec)) { | ||
| unsigned char nonce32[32]; | ||
| unsigned int count = 0; | ||
| secp256k1_scalar_set_b32(&msg, msg32, NULL); | ||
| while (1) { | ||
| ret = noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count); | ||
| if (!ret) { | ||
| break; | ||
| } | ||
| secp256k1_scalar_set_b32(&non, nonce32, &overflow); | ||
| is_zero = secp256k1_scalar_is_zero(&non); | ||
| if (!overflow && !is_zero) { | ||
| if (s2c_data32 != NULL) { | ||
| secp256k1_gej nonce_pj; | ||
| secp256k1_ge nonce_p; | ||
|
|
||
| /* Compute original nonce commitment/pubkey */ | ||
| secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &nonce_pj, &non); | ||
| secp256k1_ge_set_gej(&nonce_p, &nonce_pj); | ||
| secp256k1_pubkey_save(&s2c_opening->original_pubnonce, &nonce_p); | ||
|
|
||
| /* Tweak nonce with s2c commitment. */ | ||
| if (!secp256k1_ec_commit_seckey(ctx, nonce32, &s2c_opening->original_pubnonce, s2c_data32, 32)) { | ||
| return 0; | ||
| } | ||
| secp256k1_scalar_set_b32(&non, nonce32, &overflow); | ||
| is_zero = secp256k1_scalar_is_zero(&non); | ||
| } | ||
|
|
||
| if (!overflow && !is_zero) { | ||
| if (secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, &r, &s, &sec, &msg, &non, NULL)) { | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| count++; | ||
| } | ||
| memset(nonce32, 0, 32); | ||
| secp256k1_scalar_clear(&msg); | ||
| secp256k1_scalar_clear(&non); | ||
| secp256k1_scalar_clear(&sec); | ||
| } | ||
| if (ret) { | ||
| secp256k1_ecdsa_signature_save(signature, &r, &s); | ||
| } else { | ||
| memset(signature, 0, sizeof(*signature)); | ||
| } | ||
| return ret; | ||
| } | ||
|
|
||
| int secp256k1_ecdsa_s2c_verify_commit(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *data32, const secp256k1_s2c_opening *opening) { | ||
| secp256k1_pubkey commitment; | ||
| secp256k1_ge commitment_ge; | ||
| unsigned char x_bytes1[32]; | ||
| unsigned char x_bytes2[32]; | ||
| secp256k1_scalar sigr, sigs; | ||
|
|
||
| VERIFY_CHECK(ctx != NULL); | ||
| ARG_CHECK(sig != NULL); | ||
| ARG_CHECK(data32 != NULL); | ||
| ARG_CHECK(opening != NULL); | ||
| ARG_CHECK(secp256k1_s2c_commit_is_init(opening)); | ||
|
|
||
| if (!secp256k1_ec_commit(ctx, &commitment, &opening->original_pubnonce, data32, 32)) { | ||
| return 0; | ||
| } | ||
|
|
||
| /* Check that sigr (x coordinate of R) matches the x coordinate of the commitment. */ | ||
| secp256k1_ecdsa_signature_load(ctx, &sigr, &sigs, sig); | ||
|
|
||
| if (!secp256k1_pubkey_load(ctx, &commitment_ge, &commitment)) { | ||
| return 0; | ||
| } | ||
| secp256k1_fe_normalize(&commitment_ge.x); | ||
| secp256k1_fe_get_b32(x_bytes1, &commitment_ge.x); | ||
| secp256k1_scalar_get_b32(x_bytes2, &sigr); | ||
| return memcmp(x_bytes1, x_bytes2, 32) == 0; | ||
|
|
||
| } | ||
|
|
||
| int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_client_commit(const secp256k1_context* ctx, secp256k1_pubkey *client_commit, const unsigned char *msg32, const unsigned char *seckey32, unsigned char *rand_commitment32) { | ||
| unsigned char nonce32[32]; | ||
| secp256k1_scalar k; | ||
| secp256k1_gej rj; | ||
| secp256k1_ge r; | ||
| unsigned int count = 0; | ||
| VERIFY_CHECK(ctx != NULL); | ||
| ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx)); | ||
| ARG_CHECK(client_commit != NULL); | ||
| ARG_CHECK(msg32 != NULL); | ||
| ARG_CHECK(seckey32 != NULL); | ||
| ARG_CHECK(rand_commitment32 != NULL); | ||
|
|
||
| while (1) { | ||
| int overflow = 0; | ||
| if (!secp256k1_nonce_function_default(nonce32, msg32, seckey32, NULL, rand_commitment32, count)) { | ||
| /* cannot happen with secp256k1_nonce_function_default */ | ||
| return 0; | ||
| } | ||
|
|
||
| secp256k1_scalar_set_b32(&k, nonce32, &overflow); | ||
| if (!overflow && !secp256k1_scalar_is_zero(&k)) { | ||
| break; | ||
| } | ||
| count++; | ||
| } | ||
|
|
||
| secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &rj, &k); | ||
| secp256k1_ge_set_gej(&r, &rj); | ||
| secp256k1_pubkey_save(client_commit, &r); | ||
| return 1; | ||
| } | ||
|
|
||
| int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_verify(secp256k1_context *ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *rand32, const secp256k1_s2c_opening *opening, const secp256k1_pubkey *client_commit) { | ||
|
|
||
| secp256k1_ge gcommit; | ||
| secp256k1_ge gopening; | ||
| secp256k1_gej pj; | ||
|
|
||
| VERIFY_CHECK(ctx != NULL); | ||
| ARG_CHECK(sig != NULL); | ||
| ARG_CHECK(rand32 != NULL); | ||
| ARG_CHECK(opening != NULL); | ||
| ARG_CHECK(secp256k1_s2c_commit_is_init(opening)); | ||
| ARG_CHECK(client_commit != NULL); | ||
|
|
||
| /* Check that client_commit == opening->original_pubnonce */ | ||
| secp256k1_gej_set_infinity(&pj); | ||
| if (!secp256k1_pubkey_load(ctx, &gcommit, client_commit)) { | ||
| return 0; | ||
| } | ||
| secp256k1_ge_neg(&gcommit, &gcommit); | ||
| secp256k1_gej_add_ge(&pj, &pj, &gcommit); | ||
| if (!secp256k1_pubkey_load(ctx, &gopening, &opening->original_pubnonce)) { | ||
| return 0; | ||
| } | ||
| secp256k1_gej_add_ge(&pj, &pj, &gopening); | ||
| if (!secp256k1_gej_is_infinity(&pj)) { | ||
| return 0; | ||
| } | ||
| if (!secp256k1_ecdsa_s2c_verify_commit(ctx, sig, rand32, opening)) { | ||
| return 0; | ||
| } | ||
| return 1; | ||
| } | ||
|
|
||
| int secp256k1_ecdsa_s2c_anti_nonce_covert_channel_host_commit(secp256k1_context *ctx, unsigned char *rand_commitment32, const unsigned char *rand32) { | ||
| secp256k1_sha256 sha; | ||
|
|
||
| VERIFY_CHECK(ctx != NULL); | ||
| ARG_CHECK(rand_commitment32 != NULL); | ||
| ARG_CHECK(rand32 != NULL); | ||
|
|
||
| secp256k1_sha256_initialize(&sha); | ||
| secp256k1_sha256_write(&sha, rand32, 32); | ||
| secp256k1_sha256_finalize(&sha, rand_commitment32); | ||
| return 1; | ||
| } | ||
|
|
||
| #endif /* SECP256K1_ECDSA_SIGN_TO_CONTRACT_MAIN_H */ |
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: The
with [...]part is a bit difficult to understand. Also noncefp is alwayssecp256k1_nonce_function_default. Perhaps for this function we can remove thenoncefpandndataargument because they don't have a purpose anyway.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are we sure that there is no use case for
ndatawhen you could also provides2c_data? I am not familiar with uses ofndatain general, but ifs2c_dataalone is enough for all cases, thenndatacould also be removed fromsecp256k1_schnorrsig_sign?I can remove
noncefp, but we could also keep it so other functions could be allowed in the future without breaking API compatibility.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ndatais for giving additional information to the nonce function. Since it is hashed withs2c_dataI don't see how you'd transmit usable information to the nonce function in that way.ndatashouldn't be removed fromschnorrsig_signbecauseschnorrsig_signcan be used with other nonce functions than just the default. Imo, simpler is better than optimizing for some unknown future usecase.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Dropped the
noncefpandndataparams from the function in the alternative here. Can also do it for this version if we choose this alternative over the other.