musig2: Add adaptor signature support to MuSig2 protocol

btcec/schnorr/musig2/context.go

@@ -3,6 +3,7 @@
 package musig2
 
 import (
+	"crypto/rand"
 	"fmt"
 
 	"github.com/btcsuite/btcd/btcec/v2"
@@ -52,6 +53,27 @@ var (
 	// required combined nonces.
 	ErrCombinedNonceUnavailable = fmt.Errorf("missing combined nonce")
 
+	// ErrFinalSigUnavailable is returned when a caller attempts to adapt a
+	// final signature, but the final signature is not available.
+	ErrFinalSigUnavailable = fmt.Errorf("final signature unavailable")
+
+	// ErrAdaptorSecretUnavailable is returned when a caller attempts to adapt
+	// a final signature, but the adaptor secret key is not available.
+	ErrAdaptorSecretUnavailable = fmt.Errorf("adaptor secret key unavailable")
+
+	// ErrAdaptorPointUnavailable is returned when a caller attempts to recover
+	// the adaptor signature from a valid signature, but the adaptor point
+	// is not available.
+	ErrAdaptorPointUnavailable = fmt.Errorf("adaptor point unavailable")
+
+	// ErrInvalidAdaptorPoint is returned when a caller attempts to provide
+	// an adaptor point that is incompatible with the combined nonce.
+	ErrInvalidAdaptorPoint = fmt.Errorf("invalid adaptor point")
+
+	// ErrAlreadySigned is returned when a caller attempts to provide an
+	// adaptor point, but a signature was already signed.
+	ErrAlreadySigned = fmt.Errorf("already signed")
+
 	// ErrTaprootInternalKeyUnavailable is returned when a user attempts to
 	// obtain the
 	ErrTaprootInternalKeyUnavailable = fmt.Errorf("taproot tweak not used")
@@ -99,7 +121,7 @@ type ContextOption func(*contextOptions)
 // contextOptions houses the set of functional options that can be used to
 // musig2 signing protocol.
 type contextOptions struct {
-	// tweaks is the set of optinoal tweaks to apply to the combined public
+	// tweaks is the set of optional tweaks to apply to the combined public
 	// key.
 	tweaks []KeyTweakDesc
 
@@ -439,6 +461,9 @@ type Session struct {
 
 	msg [32]byte
 
+	adaptorSecret *btcec.ModNScalar
+	adaptorPoint  *btcec.JacobianPoint
+
 	ourSig *PartialSignature
 	sigs   []*PartialSignature
 
@@ -548,6 +573,115 @@ func (s *Session) RegisterPubNonce(nonce [PubNonceSize]byte) (bool, error) {
 	return haveAllNonces, nil
 }
 
+// GenerateAdaptor generates an adaptor secret key and point. This must be
+// called after the public nonces have been registered for all signers, because
+// the validity of the adaptor secret key depends on the combined nonce. It
+// must also be called before any partial signatures are generated or provided,
+// because the validation of the signatures depends on the adaptor point.
+func (s *Session) GenerateAdaptor(msg [32]byte) (*btcec.ModNScalar,
+	*btcec.JacobianPoint, error) {
+
+	// The adaptor point added to the combined nonce must be even.
+	// We keep generating random secrets until we find one that works.
+	for {
+		var secretB [32]byte
+		_, err := rand.Read(secretB[:])
+		if err != nil {
+			return nil, nil, err
+		}
+
+		var secret btcec.ModNScalar
+		secret.SetBytes(&secretB)
+
+		err = s.SetAdaptorSecret(msg, &secret)
+		if err == ErrInvalidAdaptorPoint {
+			continue
+		} else if err != nil {
+			return nil, nil, err
+		}
+
+		return &secret, s.adaptorPoint, nil
+	}
+}
+
+// SetAdaptorSecret sets the adaptor secret key for the session. This must be
+// called after the public nonces have been registered for all signers, because
+// the validity of the adaptor secret key depends on the combined nonce. It
+// must also be called before any partial signatures are generated or provided,
+// because the validation of the signatures depends on the adaptor point.
+func (s *Session) SetAdaptorSecret(msg [32]byte,
+	adaptorSecret *btcec.ModNScalar) error {
+
+	if s.combinedNonce == nil {
+		return ErrCombinedNonceUnavailable
+	}
+
+	if len(s.sigs) != 0 {
+		return ErrAlreadySigned
+	}
+
+	nonce, _, err := ComputeSigningNonce(
+		*s.combinedNonce, s.ctx.combinedKey.FinalKey, msg,
+	)
+	if err != nil {
+		return err
+	}
+
+	var adaptorPoint btcec.JacobianPoint
+	btcec.ScalarBaseMultNonConst(adaptorSecret, &adaptorPoint)
+	adaptorPoint.ToAffine()
+
+	var adaptedNonce btcec.JacobianPoint
+	btcec.AddNonConst(&adaptorPoint, nonce, &adaptedNonce)
+	adaptedNonce.ToAffine()
+
+	if adaptedNonce.Y.IsOdd() {
+		return ErrInvalidAdaptorPoint
+	}
+
+	s.adaptorSecret = adaptorSecret
+	s.adaptorPoint = &adaptorPoint
+
+	return nil
+}
+
+// SetAdaptorPoint sets the adaptor point for the session. This is called by
+// other signers after the adaptor point has been generated by the signer that
+// knows the adaptor secret key. It must be called after all the public nonces
+// have been registered, and before any partial signatures are generated or
+// provided.
+func (s *Session) SetAdaptorPoint(msg [32]byte,
+	adaptorPoint *btcec.JacobianPoint) error {
+
+	if s.combinedNonce == nil {
+		return ErrCombinedNonceUnavailable
+	}
+
+	if len(s.sigs) != 0 {
+		return ErrAlreadySigned
+	}
+
+	// Verify that the adaptor point added to the combined nonce will result in
+	// a point with even y-coordinate.
+	nonce, _, err := ComputeSigningNonce(
+		*s.combinedNonce, s.ctx.combinedKey.FinalKey, msg,
+	)
+	if err != nil {
+		return err
+	}
+
+	var adaptedNonce btcec.JacobianPoint
+	btcec.AddNonConst(adaptorPoint, nonce, &adaptedNonce)
+	adaptedNonce.ToAffine()
+	if adaptedNonce.Y.IsOdd() {
+		return ErrInvalidAdaptorPoint
+	}
+
+	s.adaptorPoint = adaptorPoint
+
+	return nil
+}
+
 // Sign generates a partial signature for the target message, using the target
 // context. If this method is called more than once per context, then an error
 // is returned, as that means a nonce was re-used.
@@ -579,6 +713,10 @@ func (s *Session) Sign(msg [32]byte,
 		signOpts = append(signOpts, WithTweaks(s.ctx.opts.tweaks...))
 	}
 
+	if s.adaptorPoint != nil {
+		signOpts = append(signOpts, WithAdaptorSign(s.adaptorPoint))
+	}
+
 	partialSig, err := Sign(
 		s.localNonces.SecNonce, s.ctx.signingKey, *s.combinedNonce,
 		s.ctx.opts.keySet, msg, signOpts...,
@@ -650,11 +788,14 @@ func (s *Session) CombineSig(sig *PartialSignature) (bool, error) {
 		finalSig := CombineSigs(s.ourSig.R, s.sigs, combineOpts...)
 
 		// We'll also verify the signature at this point to ensure it's
-		// valid.
+		// valid. For adaptor signatures, verification is done when the
+		// signature is adapted using the secret key.
 		//
 		// TODO(roasbef): allow skipping?
-		if !finalSig.Verify(s.msg[:], s.ctx.combinedKey.FinalKey) {
-			return false, ErrFinalSigInvalid
+		if s.adaptorPoint == nil {
+			if !finalSig.Verify(s.msg[:], s.ctx.combinedKey.FinalKey) {
+				return false, ErrFinalSigInvalid
+			}
 		}
 
 		s.finalSig = finalSig
@@ -667,3 +808,55 @@ func (s *Session) CombineSig(sig *PartialSignature) (bool, error) {
 func (s *Session) FinalSig() *schnorr.Signature {
 	return s.finalSig
 }
+
+// AdaptFinalSig adapts the final signature with the provided adaptor secret
+// key, and returns a valid signature.
+func (s *Session) AdaptFinalSig() (
+	*schnorr.Signature, error) {
+
+	if s.finalSig == nil {
+		return nil, ErrFinalSigUnavailable
+	}
+	if s.adaptorSecret == nil {
+		return nil, ErrAdaptorSecretUnavailable
+	}
+
+	sigB := s.finalSig.Serialize()
+	r := new(btcec.FieldVal)
+	r.SetByteSlice(sigB[0:32])
+	sigS := new(btcec.ModNScalar)
+	sigS.SetByteSlice(sigB[32:64])
+
+	sigS.Add(s.adaptorSecret)
+	adaptedSig := schnorr.NewSignature(r, sigS)
+
+	if !adaptedSig.Verify(s.msg[:], s.ctx.combinedKey.FinalKey) {
+		return nil, ErrFinalSigInvalid
+	}
+
+	return adaptedSig, nil
+}
+
+// RecoverAdaptorSecret recovers the adaptor secret key from a valid signature
+// created by the signer that knows the adaptor secret key.
+func (s *Session) RecoverAdaptorSecret(sig *schnorr.Signature) (
+	*btcec.ModNScalar, error) {
+
+	if s.finalSig == nil {
+		return nil, ErrFinalSigUnavailable
+	}
+	if s.adaptorPoint == nil {
+		return nil, ErrAdaptorPointUnavailable
+	}
+
+	finalSigB := s.finalSig.Serialize()
+	finalSigS := new(btcec.ModNScalar)
+	finalSigS.SetByteSlice(finalSigB[32:64])
+
+	sigSB := sig.Serialize()
+	sigS := new(btcec.ModNScalar)
+	sigS.SetByteSlice(sigSB[32:64])
+	sigS.Add(finalSigS.Negate())
+
+	return sigS, nil
+}