mirror of
https://github.com/bitcoin/bitcoin.git
synced 2026-02-06 05:31:23 +00:00
48aa0e98d0
ac599c4a9cb3b2d424932d3fd91f9eed17426827 test: Test MuSig2 in the wallet (Ava Chow)
68ef954c4c59802a6810a462eaa8dd61728ba820 wallet: Keep secnonces in DescriptorScriptPubKeyMan (Ava Chow)
4a273edda0ec10f0c5ae5d94b9925fa334d1c6e6 sign: Create MuSig2 signatures for known MuSig2 aggregate keys (Ava Chow)
258db938899409c8ee1cef04e16ba1795ea0038d sign: Add CreateMuSig2AggregateSig (Ava Chow)
bf69442b3f5004dc3df5a1b1d752114ba68fa5f4 sign: Add CreateMuSig2PartialSig (Ava Chow)
512b17fc56eac3a2e2b9ba489b5423d098cce0db sign: Add CreateMuSig2Nonce (Ava Chow)
82ea67c607cde6187d7082429d27b927dc21c0c6 musig: Add MuSig2AggregatePubkeys variant that validates the aggregate (Ava Chow)
d99a081679e16668458512aba2fd13a3e1bdb09f psbt: MuSig2 data in Fill/FromSignatureData (Ava Chow)
4d8b4f53363f013ed3972997f0b05b9c19e9db9d signingprovider: Add musig2 secnonces (Ava Chow)
c06a1dc86ff2347538e95041ab7b97af25342958 Add MuSig2SecNonce class for secure allocation of musig nonces (Ava Chow)
9baff05e494443cd82708490f384aa3034ad43bd sign: Include taproot output key's KeyOriginInfo in sigdata (Ava Chow)
4b24bfeab9d6732aae3e69efd33105792ef1198f pubkey: Return tweaks from BIP32 derivation (Ava Chow)
f14876213aad0e67088b75cae24323db9f2576d8 musig: Move synthetic xpub construction to its own function (Ava Chow)
fb8720f1e09f4e41802f07be53fb220d6f6c127f sign: Refactor Schnorr sighash computation out of CreateSchnorrSig (Ava Chow)
a4cfddda644f1fc9a815b2d16c997716cd63554a tests: Clarify why musig derivation adds a pubkey and xpub (Ava Chow)
39a63bf2e7e38dd3f30b5d1a8f6b2fff0e380d12 descriptors: Add a doxygen comment for has_hardened output_parameter (Ava Chow)
2320184d0ea87279558a8e6cbb3bccf5ba1bb781 descriptors: Fix meaning of any_key_parsed (Ava Chow)
Pull request description:
This PR implements MuSig2 signing so that the wallet can receive and spend from imported `musig(0` descriptors.
The libsecp musig module is enabled so that it can be used for all of the MuSig2 cryptography.
Secnonces are handled in a separate class which holds the libsecp secnonce object in a `secure_unique_ptr`. Since secnonces must not be used, this class has no serialization and will only live in memory. A restart of the software will require a restart of the MuSig2 signing process.
ACKs for top commit:
fjahr:
tACK ac599c4a9cb3b2d424932d3fd91f9eed17426827
rkrux:
lgtm tACK ac599c4a9cb3b2d424932d3fd91f9eed17426827
theStack:
Code-review ACK ac599c4a9cb3b2d424932d3fd91f9eed17426827 🗝️
Tree-SHA512: 626b9adc42ed2403e2f4405321eb9ce009a829c07d968e95ab288fe4940b195b0af35ca279a4a7fa51af76e55382bad6f63a23bca14a84140559b3c667e7041e
73 lines
3.0 KiB
C++
73 lines
3.0 KiB
C++
// Copyright (c) 2024-present The Bitcoin Core developers
|
|
// Distributed under the MIT software license, see the accompanying
|
|
// file COPYING or https://www.opensource.org/licenses/mit-license.php.
|
|
|
|
#ifndef BITCOIN_MUSIG_H
|
|
#define BITCOIN_MUSIG_H
|
|
|
|
#include <pubkey.h>
|
|
|
|
#include <optional>
|
|
#include <vector>
|
|
|
|
struct secp256k1_musig_keyagg_cache;
|
|
class MuSig2SecNonceImpl;
|
|
struct secp256k1_musig_secnonce;
|
|
|
|
//! MuSig2 chaincode as defined by BIP 328
|
|
using namespace util::hex_literals;
|
|
constexpr uint256 MUSIG_CHAINCODE{
|
|
// Use immediate lambda to work around GCC-14 bug https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117966
|
|
[]() consteval { return uint256{"868087ca02a6f974c4598924c36b57762d32cb45717167e300622c7167e38965"_hex_u8}; }(),
|
|
};
|
|
|
|
|
|
|
|
constexpr size_t MUSIG2_PUBNONCE_SIZE{66};
|
|
|
|
//! Compute the full aggregate pubkey from the given participant pubkeys in their current order.
|
|
//! Outputs the secp256k1_musig_keyagg_cache and validates that the computed aggregate pubkey matches an expected aggregate pubkey.
|
|
//! This is necessary for most MuSig2 operations.
|
|
std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys, secp256k1_musig_keyagg_cache& keyagg_cache, const std::optional<CPubKey>& expected_aggregate);
|
|
std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys);
|
|
|
|
//! Construct the BIP 328 synthetic xpub for a pubkey
|
|
CExtPubKey CreateMuSig2SyntheticXpub(const CPubKey& pubkey);
|
|
|
|
/**
|
|
* MuSig2SecNonce encapsulates a secret nonce in use in a MuSig2 signing session.
|
|
* Since this nonce persists outside of libsecp256k1 signing code, we must handle
|
|
* its construction and destruction ourselves.
|
|
* The secret nonce must be kept a secret, otherwise the private key may be leaked.
|
|
* As such, it needs to be treated in the same way that CKeys are treated.
|
|
* So this class handles the secure allocation of the secp256k1_musig_secnonce object
|
|
* that libsecp256k1 uses, and only gives out references to this object to avoid
|
|
* any possibility of copies being made. Furthermore, objects of this class are not
|
|
* copyable to avoid nonce reuse.
|
|
*/
|
|
class MuSig2SecNonce
|
|
{
|
|
private:
|
|
std::unique_ptr<MuSig2SecNonceImpl> m_impl;
|
|
|
|
public:
|
|
MuSig2SecNonce();
|
|
MuSig2SecNonce(MuSig2SecNonce&&) noexcept;
|
|
MuSig2SecNonce& operator=(MuSig2SecNonce&&) noexcept;
|
|
~MuSig2SecNonce();
|
|
|
|
// Delete copy constructors
|
|
MuSig2SecNonce(const MuSig2SecNonce&) = delete;
|
|
MuSig2SecNonce& operator=(const MuSig2SecNonce&) = delete;
|
|
|
|
secp256k1_musig_secnonce* Get() const;
|
|
void Invalidate();
|
|
bool IsValid();
|
|
};
|
|
|
|
uint256 MuSig2SessionID(const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256& sighash);
|
|
|
|
std::optional<std::vector<uint8_t>> CreateMuSig2AggregateSig(const std::vector<CPubKey>& participants, const CPubKey& aggregate_pubkey, const std::vector<std::pair<uint256, bool>>& tweaks, const uint256& sighash, const std::map<CPubKey, std::vector<uint8_t>>& pubnonces, const std::map<CPubKey, uint256>& partial_sigs);
|
|
|
|
#endif // BITCOIN_MUSIG_H
|