Added Jupyter Chapter 1.2 (Musig Introduction) #10
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,261 @@ | ||
| { | ||
| "cells": [ | ||
| { | ||
| "cell_type": "code", | ||
| "execution_count": null, | ||
| "metadata": {}, | ||
| "outputs": [], | ||
| "source": [ | ||
| "import hashlib\n", | ||
| "import util\n", | ||
| "from test_framework.key import generate_schnorr_nonce, ECKey, ECPubKey\n", | ||
| "from test_framework.musig import aggregate_musig_signatures, aggregate_schnorr_nonces, generate_musig_key, sign_musig" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "# 1.2 Introduction to n-of-n MuSig\n", | ||
| "\n", | ||
| "* Part 1: Public Key Generation.\n", | ||
| "* Part 2: Signing.\n", | ||
| " * Nonce Aggregation.\n", | ||
| " * Signature Aggregation.\n", | ||
| "\n", | ||
| "In this chapter, we introduce the interactive [MuSig protocol](https://eprint.iacr.org/2018/068.pdf) which allows n-of-n participants to jointly create and spend taproot or tapscript outputs using aggregated schnorr signatures. \n", | ||
| "\n", | ||
| "Using a signature aggregation scheme like MuSig has two significant advantages over using Script's `OP_CHECKMULTISIG` and tapscript's `OP_CHECKSIGADD` opcodes:\n", | ||
| "\n", | ||
| "* **Transaction Size/Fees**: an aggregate MuSig pubkey and signature is indistinguishable from a single-key pubkey and signature, meaning that the transaction size (and required fee) for a multi-key output are the same as for a single-key output.\n", | ||
| "* **Privacy and Fungibility**: an aggregate MuSig pubkey and signature is indistinguishable from a single-key pubkey and signature, making it impossible for anyone to use the public block chain data to identify where a multi-key scheme has been used.\n", | ||
| "\n", | ||
| "The MuSig protocol covers both the initial setup (generating an aggregate pubkey for all participants), and the signing protocol (creating a valid signature for the aggregate pubkey). The signing requires multiple rounds of communication between the individual signers.\n", | ||
| "\n", | ||
| "Bip-schnorr is linear in the nonce points and public keys, which means that public keys, nonces and signatures can be aggregated. A very naive multiparty signature scheme could be achieved by simply summing the individual pubkeys to generate an aggregate pubkey, each participant signing with a shared nonce, and then summing the signatures. Such a scheme would be vulnerable to both the [key cancellation attack](https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#key-cancellation-attack) and private key extraction by exploiting weak or known nonces. Countering these attacks is what adds some complexity to the MuSig protocol." | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "## Part 1: Public Key Generation\n", | ||
| "\n", | ||
| "To counter the key cancellation attack, each participant's pubkey is _tweaked_ by a _challenge factor,_ which is generated by hashing all the participants' pubkeys together. Doing this ensures that no individual participant (or group of participants) is able to create a pubkey that cancels out other participants' pubkeys.\n", | ||
| "\n", | ||
| "The challenge factor is unique for each participant, but all challenge factors are based on a hash of all participants' pubkeys.\n", | ||
| "\n", | ||
| "No interactive round-trips are required in this step. All participants can provide their pubkey to a central co-ordinator, which can generate the challenge factors and aggregate pubkey." | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "" | ||
|
Contributor
There was a problem hiding this comment. Can you use subscript for all of the indices? In this image you use |
||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "#### 1.2.1 _Programming Exercise:_ Compute 3-of-3 MuSig public key\n", | ||
| "\n", | ||
| "In this exercise, we'll use the `generate_musig_key()` function to generate challenge factors for each participant and an aggregate MuSig pubkey.\n", | ||
| "\n", | ||
| "`generate_musig_key()` takes a list of the participants' keys `generate_musig_key([ECPubKey0, ECPubKey1, ...])` and returns a challenge map and the aggregate pubkey:\n", | ||
| "* the challenge map contains `ECPubKey_i, challenge_data_i` key - value pairs.\n", | ||
| "* The aggregate pubkey is an `ECPubKey` object" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "code", | ||
| "execution_count": null, | ||
| "metadata": { | ||
| "scrolled": true | ||
| }, | ||
| "outputs": [], | ||
| "source": [ | ||
| "# Compute key pairs\n", | ||
| "privkey0 = ECKey()\n", | ||
| "privkey1 = ECKey()\n", | ||
| "privkey2 = ECKey()\n", | ||
| "privkey0.generate()\n", | ||
| "privkey1.generate()\n", | ||
| "privkey2.generate()\n", | ||
| "pk0 = privkey0.get_pubkey()\n", | ||
| "pk1 = privkey1.get_pubkey()\n", | ||
| "pk2 = privkey2.get_pubkey()\n", | ||
| "pk_v = [pk0, pk1, pk2]\n", | ||
| "\n", | ||
| "# Compute Key Challenges\n", | ||
| "\n", | ||
| "\n", | ||
| "# Multiply key pairs by challenge factor\n", | ||
| "privkey0_c = # TODO: implement\n", | ||
| "privkey1_c = # TODO: implement\n", | ||
| "privkey2_c = # TODO: implement\n", | ||
| "pk0_c = # TODO: implement\n", | ||
| "pk1_c = # TODO: implement\n", | ||
| "pk2_c = # TODO: implement\n", | ||
| "\n", | ||
| "\n", | ||
| "print(\"Tweaked privkey0 is {}\".format(privkey0_c.secret))\n", | ||
| "print(\"Tweaked privkey1 is {}\".format(privkey1_c.secret))\n", | ||
| "print(\"Tweaked privkey2 is {}\".format(privkey2_c.secret))" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "## Part 2: Signing \n", | ||
| "\n", | ||
| "### 2a - Nonce Generation\n", | ||
| "\n", | ||
| "The first step of creating a MuSig signature requires each signer to generate their own nonce and nonce point. The participants then exchange those nonces points and an aggregate nonce point is derived by summing all the nonce points.\n", | ||
| "\n", | ||
| "The security proof for MuSig requires that nonces are randomly generated and are independent of each other. To ensure that no individual participant (or group of participants) can create their nonce as a function of the other nonces or individually control what the aggregate nonce point will be, there is an initial round of exchanging hash commitments to the individual nonce points.\n", | ||
| "\n", | ||
| "Individual participants should only exchange their nonce point when they have received all commitments, and only proceed with signing if all nonce points match their commitments.\n", | ||
| "\n", | ||
| "Finally, if the aggregate nonce is not a quadratic residue, then it is negated and all individual nonce points are also negated." | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "#### 1.2.2 _Programming Exercise:_ Compute 3-of-3 MuSig nonce\n", | ||
| "\n", | ||
| "In this exercise, we'll generate nonces for individual participants, calculate the nonce point commitments, and then generate an aggregate nonce point.\n", | ||
| "\n", | ||
| "* Use `generate_schnorr_nonce()` to generate a random nonce. The function returns an `ECkey` object which is a valid schnorr nonce (quadratic residue y-value).\n", | ||
| "* Use `aggregate_schnorr_nonces()` to aggregate those individual nonces. The function takes a list of `ECKey` nonces and returns a the aggregate nonce and a negation flag:\n", | ||
| " * the aggregate nonce is an `ECPubKey` object\n", | ||
| " * the negation flag is a boolean and indicates that the individual nonces should be negated" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "code", | ||
| "execution_count": null, | ||
| "metadata": {}, | ||
| "outputs": [], | ||
| "source": [ | ||
| "# Generate nonces.\n", | ||
| "k0 = # TODO: implement\n", | ||
| "k1 = # TODO: implement\n", | ||
| "k2 = # TODO: implement\n", | ||
| "\n", | ||
| "# Nonce point commitment round.\n", | ||
| "R0_digest = hashlib.sha256(R0.get_bytes()).digest()\n", | ||
| "R1_digest = hashlib.sha256(R1.get_bytes()).digest()\n", | ||
| "R2_digest = hashlib.sha256(R2.get_bytes()).digest()\n", | ||
| "\n", | ||
| "# Aggregate nonces.\n", | ||
| "R_agg = # TODO: implement\n", | ||
| "\n", | ||
| "print(\"Individual nonces are {}, {}, {}.\".format(k0.secret, k1.secret, k2.secret))\n", | ||
| "print(\"Aggregate nonce point is {}\".format(R_agg.get_bytes().hex()))" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "### 2b - Signature Aggregation\n", | ||
| "\n", | ||
| "Once all participants have their individual nonces and the aggregate nonce point, then can all sign individually. \n", | ||
| "\n", | ||
| "The individual `s` values are then exchanged and summed together. The aggregate `s` value and aggregate nonce point `R` form a valid bip-schnorr signature for the aggregate pubkey.\n", | ||
| "\n", | ||
| "Notice that the hash expressions are identical in all signatures, which makes aggregation possible." | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "" | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "markdown", | ||
| "metadata": {}, | ||
| "source": [ | ||
| "#### 1.2.3 _Programming exercise:_ Compute aggregated MuSig signature\n", | ||
| "\n", | ||
| "In this exercise, we'll create individual signatures and then aggregate them to create a valid signature.\n", | ||
| "\n", | ||
| "Use the `sign_musig()` function to create individual signatures. `sign_musig()` takes:\n", | ||
| " - the individual participant's private key (an `ECKey` object)\n", | ||
| " - the invididual participant's nonce (an `ECKey` object)\n", | ||
| " - the aggregate nonce point (an `ECPubKey` object)\n", | ||
| " - the aggregate pubkey (an `ECPubKey` object)\n", | ||
| " - the message (a 32 byte `bytes` object)\n", | ||
| "\n", | ||
| "and returns an individual signature (a 64 byte `bytes` object containing `R(x)` and `s`).\n", | ||
| "\n", | ||
| "Use `aggregate_musig_signatures()` to aggregate the individual signatures. `aggregate_musig_signatures()` takes a list of signatures and returns the aggregated signature.\n", | ||
| "\n", | ||
| "Use `ECPubKey.verify(sig, msg)` to verify that the signature is valid." | ||
| ] | ||
| }, | ||
| { | ||
| "cell_type": "code", | ||
| "execution_count": null, | ||
| "metadata": {}, | ||
| "outputs": [], | ||
| "source": [ | ||
| "msg = hashlib.sha256(b'transaction').digest()\n", | ||
| "\n", | ||
| "# Generate individual signatures\n", | ||
| "sig0 = # TODO: implement\n", | ||
| "sig1 = # TODO: implement\n", | ||
| "sig2 = # TODO: implement\n", | ||
| "\n", | ||
| "# Aggregate signatures\n", | ||
| "sig_agg = # TODO: implement\n", | ||
| "\n", | ||
| "# Verify signature\n", | ||
| "assert pk_musig.verify_schnorr(sig_agg, msg)\n", | ||
| "print(\"Success!\")" | ||
| ] | ||
| } | ||
| ], | ||
| "metadata": { | ||
| "kernelspec": { | ||
| "display_name": "Python 3", | ||
| "language": "python", | ||
| "name": "python3" | ||
| }, | ||
| "language_info": { | ||
| "codemirror_mode": { | ||
| "name": "ipython", | ||
| "version": 3 | ||
| }, | ||
| "file_extension": ".py", | ||
| "mimetype": "text/x-python", | ||
| "name": "python", | ||
| "nbconvert_exporter": "python", | ||
| "pygments_lexer": "ipython3", | ||
| "version": "3.6.5" | ||
| } | ||
| }, | ||
| "nbformat": 4, | ||
| "nbformat_minor": 2 | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| #### 1.2.1 Compute 3-of-3 MuSig public key | ||
|
|
||
| ``` | ||
| # Compute key pairs | ||
| privkey0 = ECKey() | ||
| privkey1 = ECKey() | ||
| privkey2 = ECKey() | ||
| privkey0.generate() | ||
| privkey1.generate() | ||
| privkey2.generate() | ||
| pk0 = privkey0.get_pubkey() | ||
| pk1 = privkey1.get_pubkey() | ||
| pk2 = privkey2.get_pubkey() | ||
| pk_v = [pk0, pk1, pk2] | ||
|
|
||
| # Compute Key Challenges | ||
| c_map, pk_musig = generate_musig_key(pk_v) | ||
| print("Aggregated Public Key is {}\n".format(pk_musig.get_bytes().hex())) | ||
|
|
||
| # Multiply key pairs by challenge factor | ||
| privkey0_c = privkey0.mul(c_map[pk0]) | ||
| privkey1_c = privkey1.mul(c_map[pk1]) | ||
| privkey2_c = privkey2.mul(c_map[pk2]) | ||
| pk0_c = pk0.mul(c_map[pk0]) | ||
| pk1_c = pk1.mul(c_map[pk1]) | ||
| pk2_c = pk2.mul(c_map[pk2]) | ||
|
|
||
| print("Tweaked privkey0 is {}".format(privkey0_c.secret)) | ||
| print("Tweaked privkey1 is {}".format(privkey1_c.secret)) | ||
| print("Tweaked privkey2 is {}".format(privkey2_c.secret)) | ||
| ``` | ||
|
|
||
| #### 1.2.2 Compute 3-of-3 MuSig nonce | ||
|
|
||
| ``` | ||
| # Generate nonces. | ||
| k0 = generate_schnorr_nonce() | ||
| k1 = generate_schnorr_nonce() | ||
| k2 = generate_schnorr_nonce() | ||
| R0 = k0.get_pubkey() | ||
| R1 = k1.get_pubkey() | ||
| R2 = k2.get_pubkey() | ||
|
|
||
| # Nonce point commitment round. | ||
| R0_digest = hashlib.sha256(R0.get_bytes()).digest() | ||
| R1_digest = hashlib.sha256(R1.get_bytes()).digest() | ||
| R2_digest = hashlib.sha256(R2.get_bytes()).digest() | ||
|
|
||
| # Aggregate nonces. | ||
| R_agg, negated = aggregate_schnorr_nonces([R0, R1, R2]) | ||
| if negated: | ||
| k0.negate() | ||
| k1.negate() | ||
| k2.negate() | ||
|
|
||
| print("Individual nonces are {}, {}, {}.".format(k0.secret, k1.secret, k2.secret)) | ||
| print("Aggregate nonce point is {}".format(R_agg.get_bytes().hex())) | ||
| print("R_agg was negated:", negated) | ||
| ``` | ||
|
|
||
| #### 1.2.3 Compute aggregated MuSig signature | ||
|
|
||
| ``` | ||
| msg = hashlib.sha256(b'transaction').digest() | ||
|
|
||
| # Generate individual signatures. | ||
| sig0 = sign_musig(privkey0_c, k0, R_agg, pk_musig, msg) | ||
| sig1 = sign_musig(privkey1_c, k1, R_agg, pk_musig, msg) | ||
| sig2 = sign_musig(privkey2_c, k2, R_agg, pk_musig, msg) | ||
|
|
||
| # Aggregate signatures. | ||
| sig_agg = aggregate_musig_signatures([sig0, sig1, sig2]) | ||
| print("Signature verifies against MuSig pubkey:", pk_musig.verify_schnorr(sig_agg, msg)) | ||
| ``` |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ifor both the index and for the total number of keys. You should change to something likec_all = H(P_0, P_1, P_2, ..., P_n)(same for finalP_aggequation)