Randomizer Generation

A new helper function is defined, which generates a randomizer. The encode_signing_package is defined as the byte serialization of the msg, commitment_list values as described in 11. Implementations MAY choose another encoding as long as all values (the message, and the identifier, binding nonce and hiding nonce for each participant) are unambiguously encoded.

The function random_bytes(n) is defined in 3 and it returns a buffer with n bytes sampled uniformly at random. The constant Ns is also specified in 3 and is the size of a serialized scalar.

randomizer_generate():

Inputs:
- msg, the message being signed in the current FROST signing run
- commitment_list = [(i, hiding_nonce_commitment_i,
  binding_nonce_commitment_i), ...], a list of commitments issued by
  each participant, where each element in the list indicates a
  NonZeroScalar identifier i and two commitment Element values
  (hiding_nonce_commitment_i, binding_nonce_commitment_i). This list
  MUST be sorted in ascending order by identifier.

Outputs: randomizer, a Scalar

def randomizer_generate(msg, commitment_list):
  # Generate a random byte buffer with the size of a serialized scalar
  rng_randomizer = random_bytes(Ns)
  signing_package_enc = encode_signing_package(commitment_list, msg)
  randomizer_input = rng_randomizer || signing_package_enc
  return HR(randomizer_input)

Round One - Commitment

Roune One is exactly the same as specified 3. But for context, it involves these steps:

• Each signer generates nonces and their corresponding public commitments. A nonce is a pair of Scalar values, and a commitment is a pair of Element values.
• The nonces are stored locally by the signer and kept private for use in the second round.
• The commitments are sent to the Coordinator.

Round Two - Signature Share Generation

In Round Two, the Coordinator generates a random scalar randomizer by calling randomizer_generate and sends it to each signer, over a confidential and authenticated channel, along with the message and the set of signing commitments. (Note that this differs from regular FROST which just requires an authenticated channel.)

In Zcash, the message that needs to be signed is actually the SIGHASH transaction hash, which does not convey enough information for the signers to decide if they want to authorize the transaction or not. Therefore, in practice, more data is needed to be sent (over the same encrypted, authenticated channel) from the Coordinator to the signers, possibly the transaction itself, openings of value commitments, decryption of note ciphertexts, etc.; and the signers MUST check that the given SIGHASH matches the data sent from the Coordinator, or compute the SIGHASH themselves from that data. However, the specific mechanism for that process is outside the scope of this ZIP.

The randomized sign function is defined as the regular FROST sign function, but with its inputs modified relative to the randomizer as following:

• sk_i = sk_i + randomizer
• group_public_key = group_public_key + G.ScalarBaseMult(randomizer)

Signature Share Verification and Aggregation

The randomized aggregate function is defined as the regular FROST aggregate function, but with its inputs modified relative to the randomizer as following:

• group_public_key = group_public_key + G.ScalarBaseMult(randomizer)

The randomized verify_signature_share function is defined as the regular FROST verify_signature_share function, but with its inputs modified relative to the randomizer as following:

• PK_i = PK_i + G.ScalarBaseMult(randomizer)
• group_public_key = group_public_key + G.ScalarBaseMult(randomizer)

FROST(Jubjub, BLAKE2b-512)

This ciphersuite uses Jubjub for the Group and BLAKE2b-512 for the Hash function H meant to produce signatures indistinguishable from RedJubjub Sapling Spend Authorization Signatures as specified in 13.

• Group: Jubjub 15 with base point \(\mathcal{G}^{\mathsf{Sapling}}\) as defined in 13.
  • Order: \(r_\mathbb{J}\) as defined in 15.
  • Identity: as defined in 15.
  • RandomScalar(): Implemented by returning a uniformly random Scalar in the range [0, G.Order() - 1]. Refer to {{frost-randomscalar}} for implementation guidance.
  • SerializeElement(P): Implemented as \(\mathsf{repr}_\mathbb{J}(P)\) as defined in 15
  • DeserializeElement(P): Implemented as \(\mathsf{abst}_\mathbb{J}(P)\) as defined in 15, returning an error if \(\bot\) is returned. Additionally, this function validates that the resulting element is not the group identity element, returning an error if the check fails.
  • SerializeScalar: Implemented by outputting the little-endian 32-byte encoding of the Scalar value.
  • DeserializeScalar: Implemented by attempting to deserialize a Scalar from a little-endian 32-byte string. This function can fail if the input does not represent a Scalar in the range [0, G.Order() - 1].
• Hash (H): BLAKE2b-512 1 (BLAKE2b with 512-bit output and 16-byte personalization string), and Nh = 64.
  • H1(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubR", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().
  • H2(m): Implemented by computing BLAKE2b-512("Zcash_RedJubjubH", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order(). (This is equivalent to \(\mathsf{H}^\circledast(m)\!\) , as defined by the \(\mathsf{RedJubjub}\) scheme instantiated in 12.)
  • H3(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubN", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().
  • H4(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubM", m).
  • H5(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubC", m).
  • HR(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubA", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().

Signature verification is as specified in 13 for RedJubjub.

FROST(Pallas, BLAKE2b-512)

This ciphersuite uses Pallas for the Group and BLAKE2b-512 for the Hash function H meant to produce signatures indistinguishable from RedPallas Orchard Spend Authorization Signatures as specified in 13.

• Group: Pallas 16 with base point \(\mathcal{G}^{\mathsf{Orchard}}\) as defined in 13.
  • Order: \(r_\mathbb{P}\) as defined in 16.
  • Identity: as defined in 16.
  • RandomScalar(): Implemented by returning a uniformly random Scalar in the range [0, G.Order() - 1]. Refer to {{frost-randomscalar}} for implementation guidance.
  • SerializeElement(P): Implemented as \(\mathsf{repr}_\mathbb{P}(P)\) as defined in 16.
  • DeserializeElement(P): Implemented as \(\mathsf{abst}_\mathbb{P}(P)\) as defined in 16, failing if \(\bot\) is returned. Additionally, this function validates that the resulting element is not the group identity element, returning an error if the check fails.
  • SerializeScalar: Implemented by outputting the little-endian 32-byte encoding of the Scalar value.
  • DeserializeScalar: Implemented by attempting to deserialize a Scalar from a little-endian 32-byte string. This function can fail if the input does not represent a Scalar in the range [0, G.Order() - 1].
• Hash (H): BLAKE2b-512 1 (BLAKE2b with 512-bit output and 16-byte personalization string), and Nh = 64.
  • H1(m): Implemented by computing BLAKE2b-512("FROST_RedPallasR", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().
  • H2(m): Implemented by computing BLAKE2b-512("Zcash_RedPallasH", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order(). (This is equivalent to \(\mathsf{H}^\circledast(m)\!\) , as defined by the \(\mathsf{RedPallas}\) scheme instantiated in 12.)
  • H3(m): Implemented by computing BLAKE2b-512("FROST_RedPallasN", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().
  • H4(m): Implemented by computing BLAKE2b-512("FROST_RedPallasM", m).
  • H5(m): Implemented by computing BLAKE2b-512("FROST_RedPallasC", m).
  • HR(m): Implemented by computing BLAKE2b-512("FROST_RedPallasA", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer modulo G.Order().

Signature verification is as specified in 13 for RedPallas.