frost/secp256k1-zkp
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'review-fixes'

Browse Source
This commit is contained in:
Kgothatso Ngako
2026-09-04 02:56:23 +02:00
parent 46a59c2ad5 42f827a7d9
commit 0bbf50187a
11 changed files with 406 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
doc/iceberg.md
View File

@@ -5,15 +5,15 @@ The following sections contain additional notes on the API of the iceberg
module (`include/secp256k1_iceberg.h`). A usage example can be found in
`examples/iceberg.c`, which runs the whole flow and narrates it.
**This module is experimental.** It builds by default here, which is a
development convenience rather than a statement that it is ready. Iceberg has a
security proof, by reduction to NestedMuSig2's unforgeability, but it is in an
anonymous conference submission that is still a working draft, and at the two
nonces BIP-327 fixes that reduction holds in the algebraic group model rather
than the plain random oracle model. The proof also assumes a property no library
can provide (that a session label is used once, group-wide) and the known
ways to lose a key all live in exactly that assumption. Do not put money behind
this module.
**This module is experimental.** It is off by default and on in dev mode, and
both build systems refuse it outright without `--enable-experimental` or
`-DSECP256K1_EXPERIMENTAL=ON`. Iceberg has a security proof, by reduction to
NestedMuSig2's unforgeability, but it is in an anonymous conference submission
that is still a working draft, and at the two nonces BIP-327 fixes that
reduction holds in the algebraic group model rather than the plain random
oracle model. The proof also assumes a property no library can provide (that a
session label is used once, group-wide) and the known ways to lose a key all
live in exactly that assumption. Do not put money behind this module.
Iceberg lets a *t*-of-*n* group act as a single MuSig2 participant. From outside,
the result is an ordinary BIP-340 signature: nothing in it records that a group