Skip to content

Commit 36902ef

Browse files
fjahrb-wagn
fjahr
and
b-wagn
committed
Experimental: Add incremental half-aggregation for Schnorr signatures
Co-authored-by: Benedikt <[email protected]>
1 parent a526937 commit 36902ef

File tree

10 files changed

+723
-31
lines changed

10 files changed

+723
-31
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ env:
3333
RECOVERY: 'no'
3434
SCHNORRSIG: 'no'
3535
ELLSWIFT: 'no'
36+
SCHNORRSIG_HALFAGG: 'no'
3637
### test options
3738
SECP256K1_TEST_ITERS:
3839
BENCH: 'yes'
@@ -71,14 +72,14 @@ jobs:
7172
matrix:
7273
configuration:
7374
- env_vars: { WIDEMUL: 'int64', RECOVERY: 'yes' }
74-
- env_vars: { WIDEMUL: 'int64', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
75+
- env_vars: { WIDEMUL: 'int64', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
7576
- env_vars: { WIDEMUL: 'int128' }
7677
- env_vars: { WIDEMUL: 'int128_struct', ELLSWIFT: 'yes' }
7778
- env_vars: { WIDEMUL: 'int128', RECOVERY: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
78-
- env_vars: { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes' }
79+
- env_vars: { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
7980
- env_vars: { WIDEMUL: 'int128', ASM: 'x86_64', ELLSWIFT: 'yes' }
80-
- env_vars: { RECOVERY: 'yes', SCHNORRSIG: 'yes' }
81-
- env_vars: { CTIMETESTS: 'no', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', CPPFLAGS: '-DVERIFY' }
81+
- env_vars: { RECOVERY: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
82+
- env_vars: { CTIMETESTS: 'no', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes', CPPFLAGS: '-DVERIFY' }
8283
- env_vars: { BUILD: 'distcheck', WITH_VALGRIND: 'no', CTIMETESTS: 'no', BENCH: 'no' }
8384
- env_vars: { CPPFLAGS: '-DDETERMINISTIC' }
8485
- env_vars: { CFLAGS: '-O0', CTIMETESTS: 'no' }
@@ -140,6 +141,7 @@ jobs:
140141
ECDH: 'yes'
141142
RECOVERY: 'yes'
142143
SCHNORRSIG: 'yes'
144+
SCHNORRSIG_HALFAGG: 'yes'
143145
ELLSWIFT: 'yes'
144146
CC: ${{ matrix.cc }}
145147

@@ -184,6 +186,7 @@ jobs:
184186
ECDH: 'yes'
185187
RECOVERY: 'yes'
186188
SCHNORRSIG: 'yes'
189+
SCHNORRSIG_HALFAGG: 'yes'
187190
ELLSWIFT: 'yes'
188191
CTIMETESTS: 'no'
189192

@@ -235,6 +238,7 @@ jobs:
235238
ECDH: 'yes'
236239
RECOVERY: 'yes'
237240
SCHNORRSIG: 'yes'
241+
SCHNORRSIG_HALFAGG: 'yes'
238242
ELLSWIFT: 'yes'
239243
CTIMETESTS: 'no'
240244

@@ -280,6 +284,7 @@ jobs:
280284
ECDH: 'yes'
281285
RECOVERY: 'yes'
282286
SCHNORRSIG: 'yes'
287+
SCHNORRSIG_HALFAGG: 'yes'
283288
ELLSWIFT: 'yes'
284289
CTIMETESTS: 'no'
285290

@@ -335,6 +340,7 @@ jobs:
335340
ECDH: 'yes'
336341
RECOVERY: 'yes'
337342
SCHNORRSIG: 'yes'
343+
SCHNORRSIG_HALFAGG: 'yes'
338344
ELLSWIFT: 'yes'
339345
CTIMETESTS: 'no'
340346

@@ -387,6 +393,7 @@ jobs:
387393
ECDH: 'yes'
388394
RECOVERY: 'yes'
389395
SCHNORRSIG: 'yes'
396+
SCHNORRSIG_HALFAGG: 'yes'
390397
ELLSWIFT: 'yes'
391398
CTIMETESTS: 'no'
392399
SECP256K1_TEST_ITERS: 2
@@ -438,6 +445,7 @@ jobs:
438445
ECDH: 'yes'
439446
RECOVERY: 'yes'
440447
SCHNORRSIG: 'yes'
448+
SCHNORRSIG_HALFAGG: 'yes'
441449
ELLSWIFT: 'yes'
442450
CTIMETESTS: 'no'
443451
CFLAGS: '-fsanitize=undefined,address -g'
@@ -502,6 +510,7 @@ jobs:
502510
ECDH: 'yes'
503511
RECOVERY: 'yes'
504512
SCHNORRSIG: 'yes'
513+
SCHNORRSIG_HALFAGG: 'yes'
505514
ELLSWIFT: 'yes'
506515
CC: 'clang'
507516
SECP256K1_TEST_ITERS: 32
@@ -548,6 +557,7 @@ jobs:
548557
ECDH: 'yes'
549558
RECOVERY: 'yes'
550559
SCHNORRSIG: 'yes'
560+
SCHNORRSIG_HALFAGG: 'yes'
551561
ELLSWIFT: 'yes'
552562
CTIMETESTS: 'no'
553563

@@ -666,13 +676,13 @@ jobs:
666676
fail-fast: false
667677
matrix:
668678
env_vars:
669-
- { WIDEMUL: 'int64', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
679+
- { WIDEMUL: 'int64', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
670680
- { WIDEMUL: 'int128_struct', ECMULTGENPRECISION: 2, ECMULTWINDOW: 4 }
671-
- { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
681+
- { WIDEMUL: 'int128', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
672682
- { WIDEMUL: 'int128', RECOVERY: 'yes' }
673-
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes' }
674-
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc' }
675-
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY' }
683+
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
684+
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CC: 'gcc', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
685+
- { WIDEMUL: 'int128', RECOVERY: 'yes', ECDH: 'yes', SCHNORRSIG: 'yes', ELLSWIFT: 'yes', CPPFLAGS: '-DVERIFY', EXPERIMENTAL: 'yes', SCHNORRSIG_HALFAGG: 'yes' }
676686
- BUILD: 'distcheck'
677687

678688
steps:
@@ -779,6 +789,7 @@ jobs:
779789
ECDH: 'yes'
780790
RECOVERY: 'yes'
781791
SCHNORRSIG: 'yes'
792+
SCHNORRSIG_HALFAGG: 'yes'
782793
ELLSWIFT: 'yes'
783794

784795
steps:

‎Makefile.am‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,3 +273,7 @@ endif
273273
if ENABLE_MODULE_ELLSWIFT
274274
include src/modules/ellswift/Makefile.am.include
275275
endif
276+
277+
if ENABLE_MODULE_SCHNORRSIG_HALFAGG
278+
include src/modules/schnorrsig_halfagg/Makefile.am.include
279+
endif

‎ci/ci.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ print_environment() {
1313
# does not rely on bash.
1414
for var in WERROR_CFLAGS MAKEFLAGS BUILD \
1515
ECMULTWINDOW ECMULTGENKB ASM WIDEMUL WITH_VALGRIND EXTRAFLAGS \
16-
EXPERIMENTAL ECDH RECOVERY SCHNORRSIG ELLSWIFT \
16+
EXPERIMENTAL ECDH RECOVERY SCHNORRSIG SCHNORRSIG_HALFAGG ELLSWIFT \
1717
SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETESTS\
1818
EXAMPLES \
1919
HOST WRAPPER_CMD \
@@ -78,6 +78,7 @@ esac
7878
--enable-module-ecdh="$ECDH" --enable-module-recovery="$RECOVERY" \
7979
--enable-module-ellswift="$ELLSWIFT" \
8080
--enable-module-schnorrsig="$SCHNORRSIG" \
81+
--enable-module-schnorrsig-halfagg="$SCHNORRSIG_HALFAGG" \
8182
--enable-examples="$EXAMPLES" \
8283
--enable-ctime-tests="$CTIMETESTS" \
8384
--with-valgrind="$WITH_VALGRIND" \

‎configure.ac‎

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,10 @@ AC_ARG_ENABLE(module_schnorrsig,
184184
AS_HELP_STRING([--enable-module-schnorrsig],[enable schnorrsig module [default=yes]]), [],
185185
[SECP_SET_DEFAULT([enable_module_schnorrsig], [yes], [yes])])
186186

187+
AC_ARG_ENABLE(module_schnorrsig_halfagg,
188+
AS_HELP_STRING([--enable-module-schnorrsig-halfagg],[enable schnorrsig half-aggregation module (experimental) [default=no]]), [],
189+
[SECP_SET_DEFAULT([enable_module_schnorrsig_halfagg], [no], [yes])])
190+
187191
AC_ARG_ENABLE(module_ellswift,
188192
AS_HELP_STRING([--enable-module-ellswift],[enable ElligatorSwift module [default=yes]]), [],
189193
[SECP_SET_DEFAULT([enable_module_ellswift], [yes], [yes])])
@@ -394,6 +398,11 @@ SECP_CFLAGS="$SECP_CFLAGS $WERROR_CFLAGS"
394398

395399
# Processing must be done in a reverse topological sorting of the dependency graph
396400
# (dependent module first).
401+
if test x"$enable_module_schnorrsig_halfagg" = x"yes"; then
402+
SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_SCHNORRSIG_HALFAGG=1"
403+
enable_module_schnorrsig=yes
404+
fi
405+
397406
if test x"$enable_module_ellswift" = x"yes"; then
398407
SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ELLSWIFT=1"
399408
fi
@@ -430,6 +439,9 @@ if test x"$enable_experimental" = x"no"; then
430439
if test x"$set_asm" = x"arm32"; then
431440
AC_MSG_ERROR([ARM32 assembly is experimental. Use --enable-experimental to allow.])
432441
fi
442+
if test x"$enable_module_schnorrsig_halfagg" = x"yes"; then
443+
AC_MSG_ERROR([Schnorrsig Half-Aggregation module is experimental. Use --enable-experimental to allow.])
444+
fi
433445
fi
434446

435447
###
@@ -449,6 +461,7 @@ AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
449461
AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
450462
AM_CONDITIONAL([ENABLE_MODULE_EXTRAKEYS], [test x"$enable_module_extrakeys" = x"yes"])
451463
AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG], [test x"$enable_module_schnorrsig" = x"yes"])
464+
AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG_HALFAGG], [test x"$enable_module_schnorrsig_halfagg" = x"yes"])
452465
AM_CONDITIONAL([ENABLE_MODULE_ELLSWIFT], [test x"$enable_module_ellswift" = x"yes"])
453466
AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
454467
AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm32"])
@@ -461,32 +474,33 @@ AC_OUTPUT
461474

462475
echo
463476
echo "Build Options:"
464-
echo " with external callbacks = $enable_external_default_callbacks"
465-
echo " with benchmarks = $enable_benchmark"
466-
echo " with tests = $enable_tests"
467-
echo " with ctime tests = $enable_ctime_tests"
468-
echo " with coverage = $enable_coverage"
469-
echo " with examples = $enable_examples"
470-
echo " module ecdh = $enable_module_ecdh"
471-
echo " module recovery = $enable_module_recovery"
472-
echo " module extrakeys = $enable_module_extrakeys"
473-
echo " module schnorrsig = $enable_module_schnorrsig"
474-
echo " module ellswift = $enable_module_ellswift"
477+
echo " with external callbacks = $enable_external_default_callbacks"
478+
echo " with benchmarks = $enable_benchmark"
479+
echo " with tests = $enable_tests"
480+
echo " with ctime tests = $enable_ctime_tests"
481+
echo " with coverage = $enable_coverage"
482+
echo " with examples = $enable_examples"
483+
echo " module ecdh = $enable_module_ecdh"
484+
echo " module recovery = $enable_module_recovery"
485+
echo " module extrakeys = $enable_module_extrakeys"
486+
echo " module schnorrsig = $enable_module_schnorrsig"
487+
echo " module schnorrsig-halfagg = $enable_module_schnorrsig_halfagg"
488+
echo " module ellswift = $enable_module_ellswift"
475489
echo
476-
echo " asm = $set_asm"
477-
echo " ecmult window size = $set_ecmult_window"
478-
echo " ecmult gen table size = $set_ecmult_gen_kb KiB"
490+
echo " asm = $set_asm"
491+
echo " ecmult window size = $set_ecmult_window"
492+
echo " ecmult gen table size = $set_ecmult_gen_kb KiB"
479493
# Hide test-only options unless they're used.
480494
if test x"$set_widemul" != xauto; then
481-
echo " wide multiplication = $set_widemul"
495+
echo " wide multiplication = $set_widemul"
482496
fi
483497
echo
484-
echo " valgrind = $enable_valgrind"
485-
echo " CC = $CC"
486-
echo " CPPFLAGS = $CPPFLAGS"
487-
echo " SECP_CFLAGS = $SECP_CFLAGS"
488-
echo " CFLAGS = $CFLAGS"
489-
echo " LDFLAGS = $LDFLAGS"
498+
echo " valgrind = $enable_valgrind"
499+
echo " CC = $CC"
500+
echo " CPPFLAGS = $CPPFLAGS"
501+
echo " SECP_CFLAGS = $SECP_CFLAGS"
502+
echo " CFLAGS = $CFLAGS"
503+
echo " LDFLAGS = $LDFLAGS"
490504

491505
if test x"$print_msan_notice" = x"yes"; then
492506
echo

‎include/secp256k1_schnorrsig_halfagg.h‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#ifndef SECP256K1_SCHNORRSIG_HALFAGG_H
2+
#define SECP256K1_SCHNORRSIG_HALFAGG_H
3+
4+
#include "secp256k1.h"
5+
#include "secp256k1_extrakeys.h"
6+
7+
#ifdef __cplusplus
8+
extern "C" {
9+
#endif
10+
11+
12+
/** Incrementally (Half-)Aggregate a sequence of Schnorr
13+
* signatures to an existing half-aggregate signature.
14+
*
15+
* Returns 1 on success, 0 on failure.
16+
* Args: ctx: a secp256k1 context object.
17+
* In/Out: aggsig: pointer to the serialized aggregate signature
18+
* that is input. The first 32*(n_before+1) of this
19+
* array should hold the input aggsig. It will be
20+
* overwritten by the new serialized aggregate signature.
21+
* It should be large enough for that, see aggsig_len.
22+
* aggsig_len: size of aggsig array in bytes.
23+
* Should be large enough to hold the new
24+
* serialized aggregate signature, i.e.,
25+
* should satisfy aggsig_size >= 32*(n_before+n_new+1).
26+
* It will be overwritten to be the exact size of the
27+
* resulting aggsig.
28+
* In: all_pubkeys: Array of (n_before + n_new) many x-only public keys,
29+
* including both the ones for the already aggregated signature
30+
* and the ones for the signatures that should be added.
31+
* Can only be NULL if n_before + n_new is 0.
32+
* all_msgs32: Array of (n_before + n_new) many 32-byte messages,
33+
* including both the ones for the already aggregated signature
34+
* and the ones for the signatures that should be added.
35+
* Can only be NULL if n_before + n_new is 0.
36+
* new_sigs64: Array of n_new many 64-byte signatures, containing the new
37+
* signatures that should be added. Can only be NULL if n_new is 0.
38+
* n_before: Number of signatures that have already been aggregated
39+
* in the input aggregate signature.
40+
* n_new: Number of signatures that should now be added
41+
* to the aggregate signature.
42+
*/
43+
SECP256K1_API int secp256k1_schnorrsig_inc_aggregate(
44+
const secp256k1_context *ctx,
45+
unsigned char *aggsig,
46+
size_t *aggsig_len,
47+
const secp256k1_xonly_pubkey* all_pubkeys,
48+
const unsigned char *all_msgs32,
49+
const unsigned char *new_sigs64,
50+
size_t n_before,
51+
size_t n_new
52+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
53+
54+
/** (Half-)Aggregate a sequence of Schnorr signatures.
55+
*
56+
* Returns 1 on success, 0 on failure.
57+
* Args: ctx: a secp256k1 context object.
58+
* Out: aggsig: pointer to an array of aggsig_len many bytes to
59+
* store the serialized aggregate signature.
60+
* In/Out: aggsig_len: size of the aggsig array that is passed in bytes;
61+
* will be overwritten to be the exact size of aggsig.
62+
* In: pubkeys: Array of n many x-only public keys.
63+
* Can only be NULL if n is 0.
64+
* msgs32: Array of n many 32-byte messages.
65+
* Can only be NULL if n is 0.
66+
* sigs64: Array of n many 64-byte signatures.
67+
* Can only be NULL if n is 0.
68+
* n: number of signatures to be aggregated.
69+
*/
70+
SECP256K1_API int secp256k1_schnorrsig_aggregate(
71+
const secp256k1_context *ctx,
72+
unsigned char *aggsig,
73+
size_t *aggsig_len,
74+
const secp256k1_xonly_pubkey *pubkeys,
75+
const unsigned char *msgs32,
76+
const unsigned char *sigs64,
77+
size_t n
78+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
79+
80+
/** Verify a (Half-)aggregate Schnorr signature.
81+
*
82+
* Returns: 1: correct signature.
83+
* 0: incorrect signature.
84+
* Args: ctx: a secp256k1 context object.
85+
* In: pubkeys: Array of n many x-only public keys. Can only be NULL if n is 0.
86+
* msgs32: Array of n many 32-byte messages. Can only be NULL if n is 0.
87+
* n: number of signatures to that have been aggregated.
88+
* aggsig: Pointer to an array of aggsig_size many bytes
89+
* containing the serialized aggregate
90+
* signature to be verified.
91+
* aggsig_len: Size of the aggregate signature in bytes.
92+
* Should be aggsig_len = 32*(n+1)
93+
*/
94+
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorrsig_aggverify(
95+
const secp256k1_context *ctx,
96+
const secp256k1_xonly_pubkey *pubkeys,
97+
const unsigned char *msgs32,
98+
size_t n,
99+
const unsigned char *aggsig,
100+
size_t aggsig_len
101+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(5);
102+
103+
#ifdef __cplusplus
104+
}
105+
#endif
106+
107+
#endif /* SECP256K1_SCHNORRSIG_HALFAGG_H */

‎src/modules/schnorrsig_halfagg/Makefile.am.include‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
include_HEADERS += include/secp256k1_schnorrsig_halfagg.h
2+
noinst_HEADERS += src/modules/schnorrsig_halfagg/main_impl.h
3+
noinst_HEADERS += src/modules/schnorrsig_halfagg/tests_impl.h

0 commit comments

Comments
 (0)