Skip to content

Commit 2fc700a

Browse files
jonasnickjonasnick
committed
Add 3-of-3 MuSig example
1 parent 77d5b4a commit 2fc700a

File tree

3 files changed

+181
-1
lines changed

3 files changed

+181
-1
lines changed

‎include/secp256k1_musig.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
#include <stdint.h>
55

66
/** This module implements a Schnorr-based multi-signature scheme called MuSig
7-
* (https://eprint.iacr.org/2018/068.pdf).
7+
* (https://eprint.iacr.org/2018/068.pdf). There's an example C source file in the
8+
* module's directory (src/modules/musig/example.c) that demonstrates how it can be
9+
* used.
810
*/
911

1012
/** Data structure containing data related to a signing session resulting in a single

‎src/modules/musig/Makefile.am.include

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
11
include_HEADERS += include/secp256k1_musig.h
22
noinst_HEADERS += src/modules/musig/main_impl.h
33
noinst_HEADERS += src/modules/musig/tests_impl.h
4+
5+
noinst_PROGRAMS += example_musig
6+
example_musig_SOURCES = src/modules/musig/example.c
7+
example_musig_CPPFLAGS = -DSECP256K1_BUILD -I$(top_srcdir)/include $(SECP_INCLUDES)
8+
if !ENABLE_COVERAGE
9+
example_musig_CPPFLAGS += -DVERIFY
10+
endif
11+
example_musig_LDADD = libsecp256k1.la $(SECP_LIBS)
12+
example_musig_LDFLAGS = -static
13+
14+
if USE_TESTS
15+
TESTS += example_musig
16+
endif

‎src/modules/musig/example.c

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
/**********************************************************************
2+
* Copyright (c) 2018 Jonas Nick *
3+
* Distributed under the MIT software license, see the accompanying *
4+
* file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5+
**********************************************************************/
6+
7+
/**
8+
* This file demonstrates how to use the MuSig module to create a multisignature.
9+
* Additionally, see the documentation in include/secp256k1_musig.h.
10+
*/
11+
12+
#include <stdio.h>
13+
#include <assert.h>
14+
#include <secp256k1.h>
15+
#include <secp256k1_schnorrsig.h>
16+
#include <secp256k1_musig.h>
17+
18+
/* Number of public keys involved in creating the aggregate signature */
19+
#define N_SIGNERS 3
20+
/* Create a key pair and store it in seckey and pubkey */
21+
int create_key(const secp256k1_context* ctx, unsigned char* seckey, secp256k1_pubkey* pubkey) {
22+
int ret;
23+
FILE *frand = fopen("/dev/urandom", "r");
24+
if (frand == NULL) {
25+
return 0;
26+
}
27+
do {
28+
if(!fread(seckey, 32, 1, frand)) {
29+
fclose(frand);
30+
return 0;
31+
}
32+
/* The probability that this not a valid secret key is approximately 2^-128 */
33+
} while (!secp256k1_ec_seckey_verify(ctx, seckey));
34+
fclose(frand);
35+
ret = secp256k1_ec_pubkey_create(ctx, pubkey, seckey);
36+
return ret;
37+
}
38+
39+
/* Sign a message hash with the given key pairs and store the result in sig */
40+
int sign(const secp256k1_context* ctx, unsigned char seckeys[][32], const secp256k1_pubkey* pubkeys, const unsigned char* msg32, secp256k1_schnorrsig *sig) {
41+
secp256k1_musig_session musig_session[N_SIGNERS];
42+
unsigned char nonce_commitment[N_SIGNERS][32];
43+
const unsigned char *nonce_commitment_ptr[N_SIGNERS];
44+
secp256k1_musig_session_signer_data signer_data[N_SIGNERS][N_SIGNERS];
45+
secp256k1_pubkey nonce[N_SIGNERS];
46+
int i, j;
47+
secp256k1_musig_partial_signature partial_sig[N_SIGNERS];
48+
49+
for (i = 0; i < N_SIGNERS; i++) {
50+
FILE *frand;
51+
unsigned char session_id32[32];
52+
unsigned char pk_hash[32];
53+
secp256k1_pubkey combined_pk;
54+
55+
/* Create combined pubkey and initialize signer data */
56+
if (!secp256k1_musig_pubkey_combine(ctx, NULL, &combined_pk, pk_hash, pubkeys, N_SIGNERS)) {
57+
return 0;
58+
}
59+
/* Create random session ID. It is absolutely necessary that the session ID
60+
* is unique for every call of secp256k1_musig_session_initialize. Otherwise
61+
* it's trivial for an attacker to extract the secret key! */
62+
frand = fopen("/dev/urandom", "r");
63+
if(frand == NULL) {
64+
return 0;
65+
}
66+
if (!fread(session_id32, 32, 1, frand)) {
67+
fclose(frand);
68+
return 0;
69+
}
70+
fclose(frand);
71+
/* Initialize session */
72+
if (!secp256k1_musig_session_initialize(ctx, &musig_session[i], signer_data[i], nonce_commitment[i], session_id32, msg32, &combined_pk, pk_hash, N_SIGNERS, i, seckeys[i])) {
73+
return 0;
74+
}
75+
nonce_commitment_ptr[i] = &nonce_commitment[i][0];
76+
}
77+
/* Communication round 1: Exchange nonce commitments */
78+
for (i = 0; i < N_SIGNERS; i++) {
79+
/* Set nonce commitments in the signer data and get the own public nonce */
80+
if (!secp256k1_musig_session_get_public_nonce(ctx, &musig_session[i], signer_data[i], &nonce[i], nonce_commitment_ptr, N_SIGNERS)) {
81+
return 0;
82+
}
83+
}
84+
/* Communication round 2: Exchange nonces */
85+
for (i = 0; i < N_SIGNERS; i++) {
86+
for (j = 0; j < N_SIGNERS; j++) {
87+
if (!secp256k1_musig_set_nonce(ctx, &signer_data[i][j], &nonce[j])) {
88+
/* Signer j's nonce does not match the nonce commitment. In this case
89+
* abort the protocol. If you make another attempt at finishing the
90+
* protocol, create a new session (with a fresh session ID!). */
91+
return 0;
92+
}
93+
}
94+
if (!secp256k1_musig_session_combine_nonces(ctx, &musig_session[i], signer_data[i], N_SIGNERS, NULL, NULL)) {
95+
return 0;
96+
}
97+
}
98+
for (i = 0; i < N_SIGNERS; i++) {
99+
if (!secp256k1_musig_partial_sign(ctx, &musig_session[i], &partial_sig[i])) {
100+
return 0;
101+
}
102+
}
103+
/* Communication round 3: Exchange partial signatures */
104+
for (i = 0; i < N_SIGNERS; i++) {
105+
for (j = 0; j < N_SIGNERS; j++) {
106+
/* To check whether signing was successful, it suffices to either verify
107+
* the the combined signature with the combined public key using
108+
* secp256k1_schnorrsig_verify, or verify all partial signatures of all
109+
* signers individually. Verifying the combined signature is cheaper but
110+
* verifying the individual partial signatures has the advantage that it
111+
* can be used to determine which of the partial signatures are invalid
112+
* (if any), i.e., which of the partial signatures cause the combined
113+
* signature to be invalid and thus the protocol run to fail. It's also
114+
* fine to first verify the combined sig, and only verify the individual
115+
* sigs if it does not work.
116+
*/
117+
if (!secp256k1_musig_partial_sig_verify(ctx, &musig_session[i], &signer_data[i][j], &partial_sig[j], &pubkeys[j])) {
118+
return 0;
119+
}
120+
}
121+
}
122+
return secp256k1_musig_partial_sig_combine(ctx, &musig_session[0], sig, partial_sig, N_SIGNERS);
123+
}
124+
125+
int main(void) {
126+
secp256k1_context* ctx;
127+
int i;
128+
unsigned char seckeys[N_SIGNERS][32];
129+
secp256k1_pubkey pubkeys[N_SIGNERS];
130+
secp256k1_pubkey combined_pk;
131+
unsigned char msg[32] = "this_could_be_the_hash_of_a_msg!";
132+
secp256k1_schnorrsig sig;
133+
134+
/* Create a context for signing and verification */
135+
ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
136+
printf("Creating key pairs......");
137+
for (i = 0; i < N_SIGNERS; i++) {
138+
if (!create_key(ctx, seckeys[i], &pubkeys[i])) {
139+
printf("FAILED\n");
140+
return 1;
141+
}
142+
}
143+
printf("ok\n");
144+
printf("Combining public keys...");
145+
if (!secp256k1_musig_pubkey_combine(ctx, NULL, &combined_pk, NULL, pubkeys, N_SIGNERS)) {
146+
printf("FAILED\n");
147+
return 1;
148+
}
149+
printf("ok\n");
150+
printf("Signing message.........");
151+
if (!sign(ctx, seckeys, pubkeys, msg, &sig)) {
152+
printf("FAILED\n");
153+
return 1;
154+
}
155+
printf("ok\n");
156+
printf("Verifying signature.....");
157+
if (!secp256k1_schnorrsig_verify(ctx, &sig, msg, &combined_pk)) {
158+
printf("FAILED\n");
159+
return 1;
160+
}
161+
printf("ok\n");
162+
secp256k1_context_destroy(ctx);
163+
return 0;
164+
}
165+

0 commit comments

Comments
 (0)