|
1 | 1 | ``` |
2 | | -BIP: ? |
| 2 | +BIP: 445 |
3 | 3 | Title: FROST Signing Protocol for BIP340 Signatures |
4 | | -Author: Sivaram Dhakshinamoorthy <[email protected]> |
5 | | -Comments-URI: |
| 4 | +Authors: Sivaram Dhakshinamoorthy <[email protected]> |
6 | 5 | Status: Draft |
7 | | -Type: Standards Track |
8 | | -Assigned: ? |
| 6 | +Type: Specification |
| 7 | +Assigned: 2026-01-30 |
9 | 8 | License: CC0-1.0 |
10 | 9 | Discussion: 2024-07-31: https://groups.google.com/g/bitcoindev/c/PeMp2HQl-H4/m/AcJtK0aKAwAJ |
11 | | -Requires: 32, 340, 341 |
| 10 | +Requires: 340 |
12 | 11 | ``` |
13 | 12 |
|
14 | 13 | ## Abstract |
@@ -119,7 +118,7 @@ Every signer computes a partial signature by running *Sign* with their long-term |
119 | 118 | Then, the signers broadcast their partial signatures to the coordinator, who runs *PartialSigAgg* to produce the final signature. |
120 | 119 | If all parties behaved honestly, the result passes [BIP340][bip340] verification. |
121 | 120 |
|
122 | | - |
| 121 | + |
123 | 122 |
|
124 | 123 | A malicious coordinator can cause the signing session to fail but cannot compromise the unforgeability of the scheme. Even when colluding with up to *t-1* signers, a malicious coordinator cannot forge a signature. |
125 | 124 |
|
@@ -577,9 +576,9 @@ Algorithm *PartialSigAgg(psig<sub>1..u</sub>, id<sub>1..u</sub>, session_ctx)*: |
577 | 576 |
|
578 | 577 | ### Test Vectors & Reference Code |
579 | 578 |
|
580 | | -We provide a naive, highly inefficient, and non-constant time [pure Python 3 reference implementation of the threshold public key tweaking, nonce generation, partial signing, and partial signature verification algorithms](./bip-frost-signing/python/frost_ref/). |
| 579 | +We provide a naive, highly inefficient, and non-constant time [pure Python 3 reference implementation of the threshold public key tweaking, nonce generation, partial signing, and partial signature verification algorithms](./bip-0445/python/frost_ref/). |
581 | 580 |
|
582 | | -Standalone JSON test vectors are also available in the [same directory](./bip-frost-signing/python/vectors/), to facilitate porting the test vectors into other implementations. |
| 581 | +Standalone JSON test vectors are also available in the [same directory](./bip-0445/python/vectors/), to facilitate porting the test vectors into other implementations. |
583 | 582 |
|
584 | 583 | > [!CAUTION] |
585 | 584 | > The reference implementation is for demonstration purposes only and not to be used in production environments. |
@@ -622,7 +621,7 @@ Algorithm *DeterministicSign(secshare, my_id, aggothernonce, signers_ctx, tweak< |
622 | 621 | - The list of tweaks *tweak<sub>1..v</sub>*: *v* 32-byte arrays, each a serialized scalar |
623 | 622 | - The list of tweak methods *is_xonly_t<sub>1..v</sub>*: *v* booleans |
624 | 623 | - The message *m*: a byte array[^max-msg-len] |
625 | | - - The auxiliary randomness *rand*: a 32-byte array, serialized scalar (optional argument) |
| 624 | + - The auxiliary randomness *rand*: a 32-byte array (optional argument) |
626 | 625 | - If the optional argument *rand* is present: |
627 | 626 | - Let *secshare' = xor_bytes(secshare, hash<sub>FROST/aux</sub>(rand))* |
628 | 627 | - Else: |
@@ -786,6 +785,7 @@ This document proposes a standard for the FROST threshold signature scheme that |
786 | 785 |
|
787 | 786 | ## Changelog |
788 | 787 |
|
| 788 | +- *0.4.0* (2026-01-30): Number 445 was assigned to this BIP. |
789 | 789 | - *0.3.6* (2026-01-28): Add MIT license file for reference code and other auxiliary files. |
790 | 790 | - *0.3.5* (2026-01-25): Update secp256k1lab to latest version, remove stub file, and fix formatting in the BIP text. |
791 | 791 | - *0.3.4* (2026-01-01): Add an example file to the reference code. |
|
0 commit comments