PR #895proposed changes toZIP 0·ZIP 312

[ZIP 312] Specify key generation, change randomizer handling

Activeby conradoplg · updated 2026-11-04zips/zip-0000.rst @ be04583c30 · upstream 4699a8d518view on GitHub ↗

Unofficial preview — the proposed text below is rendered from the pull request head and is not part of the canonical ZIP set.

Contents

Terminology

The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", "MAY", "RECOMMENDED", "OPTIONAL", and "REQUIRED" in this document are to be interpreted as described in BCP 14 [1] when, and only when, they appear in all capitals.

The term "network upgrade" in this document is to be interpreted as described in ZIP 200. [2]

Abstract

A Zcash Improvement Proposal (ZIP) is a design document providing information to the Zcash community, or describing a new feature for Zcash or its processes or environment. The ZIP should provide a concise technical specification of the feature and a rationale for the feature.

We intend ZIPs to be the primary mechanism for proposing new features, for collecting community input on an issue, and for documenting the design decisions that have gone into Zcash. The Owner(s) of the ZIP (usually the authors(s)) are responsible for building consensus within the community and documenting dissenting opinions.

Because the ZIPs are maintained as text files in a versioned repository, their revision history is the historical record of the feature proposal.

This document is based partly on the work done by Luke Dashjr with BIP 2.

Specification

ZIP Workflow

The ZIP process begins with a new idea for Zcash. Each potential ZIP MUST have Owners — one or more people who write the ZIP using the style and format described below, shepherd the discussions in the appropriate forums, and attempt to build community consensus around the idea. The ZIP Owners should first attempt to ascertain whether the idea is ZIP-able. Small enhancements or patches to a particular piece of software often don't require standardisation between multiple projects; these don't need a ZIP and should be injected into the relevant project-specific development workflow with a patch submission to the applicable issue tracker. Additionally, many ideas have been brought forward for changing Zcash that have been rejected for various reasons. The first step should be to search past discussions to see if an idea has been considered before, and if so, what issues arose in its progression. After investigating past work, the best way to proceed is usually by posting about the new idea to the Zcash Community Forum.

Vetting an idea publicly before going as far as writing a ZIP is meant to save both the potential Owners and the wider community time. Asking the Zcash community first if an idea is original helps prevent too much time being spent on something that is guaranteed to be rejected based on prior discussions (searching the internet does not always do the trick). It also helps to make sure the idea is applicable to the entire community and not just the Owners. Just because an idea sounds good to the Owners does not mean it will work for most people in most areas where Zcash is used. On the other hand, some Owners may already have the experience and knowledge of the history of Zcash development needed to determine whether the idea is applicable without this vetting step.

Once the Owners are convinced that an idea has some chance of acceptance, a ZIP draft should be presented to the Zcash Community Forum. Particularly in the case of first-time submitters, this gives the Owners a chance to flesh out the ZIP draft to make it properly formatted and of high quality. It can also allow concerns about the proposal to be addressed at an early stage, potentially reducing the amount of re-work required; however, addressing concerns at this stage is not a requirement in order for a ZIP draft to be merged.

Following a discussion, the proposal should be submitted to the ZIPs git repository [7] as a pull request. This draft MUST be written in ZIP style as described below, and named with an alias such as draft-zatoshizakamoto-42millionzec until the ZIP Editors have assigned it a ZIP number (Owners MUST NOT self-assign ZIP numbers).

ZIP Owners are responsible for collecting community feedback on both the initial idea and the ZIP draft before submitting it for review. However, wherever possible, long open-ended discussions on forums should be avoided. In some cases the need for a ZIP arises for technical or process reasons that are not in doubt, in which case a forum discussion might not be necessary.

It is highly recommended that a single ZIP contain a single key proposal or new idea. The more focused the ZIP, the more successful it tends to be. If in doubt, split your ZIP draft into several well-focused ones.

When the ZIP draft is complete, the ZIP Editors will assign the ZIP a number (if that has not already been done) and one or more Categories, and merge the pull request to the ZIPs git repository. The ZIP Editors will not unreasonably reject a ZIP. Reasons for rejecting ZIPs include duplication of effort, disregard for formatting rules, being too unfocused or too broad, being technically unsound, not providing proper motivation or not in keeping with the Zcash philosophy. For a ZIP to be accepted it must meet certain minimum criteria. It must be a clear and complete description of the proposed enhancement. The enhancement must represent a net improvement. The proposed implementation, if applicable, must be solid and must not complicate the protocol unduly.

The ZIP Owners may update the draft as necessary in the git repository. Updates to drafts should also be submitted by the Owners as pull requests.

ZIP Numbering Conventions

The ZIP Editors currently use the following conventions when numbering ZIPs:

  • if a ZIP directly corresponds to a BIP (Bitcoin Improvement Proposal), and the number doesn't clash, assign the same number;

  • if it affects the consensus layer or the core protocol, assign a number in the range 200..299;

  • if it affects only higher layers but is needed for interoperability between node implementations or other parts of the ecosystem, assign a number in the range 300..399;

  • if it is specific to an implementation (e.g. zebra or zcashd), assign a number in the range 400..499;

  • if it concerns Consensus Process, assign a number in the range 0..9 or 1000..1199;

  • if it only describes updates to existing ZIPs and/or the Zcash Protocol Specification (that will be a complete specification in themselves after deployment), assign a number in the range 2000..2999.

  • try to number ZIPs that should or will be deployed together consecutively (subject to the above conventions), and in a coherent reading order.

These conventions are subject to change by consensus of the ZIP Editors.

Transferring ZIP Ownership

It occasionally becomes necessary to transfer ownership of ZIPs to a new Owner. In general, we'd like to retain the original Owner as a co-Owner of the transferred ZIP, but that's really up to the original Owner. A good reason to transfer ownership is because the original Owner no longer has the time or interest in updating it or following through with the ZIP process, or has fallen off the face of the 'net (i.e. is unreachable or not responding to email). A bad reason to transfer ownership is because you don't agree with the direction of the ZIP. We try to build consensus around a ZIP, but if that's not possible, you can always submit a competing ZIP.

If you are interested in assuming ownership of a ZIP, send a message asking to take over, addressed to all of the current Owner(s) and the ZIP Editors. If the Owner(s) who are proposed to be removed don't respond in a timely manner, the ZIP Editors and any remaining current Owners will make a decision (such decisions may be reversed).

If an author of a ZIP is no longer an Owner, an Original-Authors: field SHOULD be added to the ZIP metadata indicating the original authorship (without email addresses), unless the original author(s) request otherwise.

ZIP Editors

The current ZIP Editors are:

  • Jack Grigg, Daira-Emma Hopwood, and Kris Nuttycombe in their individual capacities.

  • Arya, associated with the Zcash Foundation.

  • Mark Henderson and Sam H. Smith, associated with Shielded Labs.

All can be reached at zips@z.cash. The current design of the ZIP Process dictates that there are always at least two ZIP Editors, including at least one from the Zcash Foundation.

ZIP Editors MUST declare any potential or perceived conflict of interest they have relating to their responsibilities as ZIP Editors.

Daira-Emma Hopwood declares a conflict of interest in acting as a ZIP Editor and as Head of Research and Assurance at Znewco, Inc., and will endeavour to minimize the downsides of that confluence of roles as far as possible. In particular, ze commits to stepping down from the ZIP Editor role after the deployment of Zcash Shielded Assets, assuming ze is still in a management role at a company primarily involved with the development of Zcash at that point.

ZIP Editors MUST be publicly transparent about any external influence or constraints that have been placed or attempted to be placed on their actions as ZIP Editors (including from Zcash Foundation, Shielded Labs, or other organizations with which the Editors are associated), whether or not it affects those actions. This should not be interpreted as requiring ZIP Editors to reveal knowledge of undisclosed security vulnerabilities or mitigations.

Additional Editors may be selected, with their consent, by consensus among the current Editors.

An Editor may be removed or replaced by consensus among the current Editors. However, if the other ZIP Editors have consensus, an Editor can not prevent their own removal.

Any Editor can resign by informing the other Editors in writing.

Whenever the ZIP Editors change, the new ZIP Editors SHOULD:

  • review this ZIP to make sure it reflects current practice,

  • update the Owners of this ZIP,

  • review access to the ZIPs repository,

  • update the <zips@z.cash> email alias, and

  • invite new Editors to the Zcash Community Forum, and the #zips channel on Discord.

Whenever it has been at least 12 months since this ZIP was last reviewed (whether or not that was a review in response to a ZIP Editor change), the ZIP Editors SHOULD review this ZIP again to make sure that it reflects current practice.

ZIP Editor Responsibilities

The ZIP Editors subscribe to the Zcash Community Forum.

Each new ZIP draft SHOULD be submitted as a "pull request" to the ZIPs git repository [7]. It SHOULD NOT contain a ZIP number unless one had already been assigned by the ZIP Editors. The ZIP content SHOULD be submitted in reStructuredText [4] or Markdown [5] format, and the Status field MUST initially be set to Draft. Generated HTML MUST NOT be included in the pull request.

For each new ZIP draft that is received, the ZIP Editors SHOULD:

  • Read the ZIP draft to check if it is ready: sound and complete. The ideas must make technical sense, even if they don't seem likely to be accepted. See Reviewing a ZIP below for further detail.

  • Check that the Title, Category, and other metadata fields accurately describe the content.

  • Ensure that a PR has been created for the ZIP draft in the ZIPs git repository [7].

  • Ensure that the existence of the draft has been announced on the Zcash Community Forum and the #zips channel of the Zcash R&D Discord.

  • Check that the licensing terms are acceptable for ZIPs.

For proposals to revise an existing ZIP, the ZIP Editors SHOULD:

  • Read the proposed modification to check if it is ready: sound, complete, and non-disruptive to the ZIP's existing deployments if any. See Reviewing a ZIP below for further detail.

  • If the proposed changes primarily affect already-deployed aspects of the Zcash consensus protocol, they SHOULD be specified in an "Update ZIP" describing the changes to be made, rather than directly as a pull request modifying the existing ZIP(s) or the Zcash Protocol Specification. At the discretion of the ZIP Editors, this might not be needed for compatible changes or clarifications.

  • If a change is to be made to an existing ZIP, check that the Title, Category, and other metadata fields still accurately describe the modified content.

  • If the ZIP has a Change History section, check that it is accurately updated. If it does not, consider whether the ZIP is a "living ZIP", and whether a Change History section would be beneficial.

  • Ensure that the update has been submitted as a PR to the ZIPs git repository [7].

  • If the proposed update is substantive and not merely editorial, ensure that it has been announced on the Zcash Community Forum and the #zips channel of the Zcash R&D Discord.

  • Check that the licensing terms are still acceptable for ZIPs.

Announcing new ZIP drafts and updated ZIPs helps ensure transparency and encourages timely community engagement and feedback. Such announcements SHOULD clearly state the ZIP number, title, and a brief summary.

If an Update ZIP is accepted, it is the responsibility of the ZIP Editors to apply the changes it describes to any existing specifications, but this MUST only be done once the Status of the Update ZIP has reached at least Proposed.

If a new Revision is added to a ZIP, then its original deployment is called Revision 0. In some cases the revisions of a ZIP may have differing deployment Status, which is expressed in the Status field as described in ZIP Status Field below.

The ZIP Editors are also generally responsible for adminstration and access control of the ZIPs repository [7].

Reviewing a ZIP

Any ZIP Editor can suggest changes to a ZIP. These suggestions are the opinion of the individual ZIP Editor. Any technical or process review that ZIP Editors perform is expected to be independent of their contractual or other relationships.

ZIP Owners are free to clarify, modify, or decline suggestions from ZIP Editors. If the ZIP Editors make a change to a ZIP that the Owners object to, then the Editors MUST either revert the change or provide a public rationale for overriding the objection. Examples of reasons to override an objection could be that the change is necessary in order to accurately document the ZIP's deployment status, to call attention to a security or privacy issue or significant community opposition, or to enforce a process requirement of this or another ZIP.

If a previous publication or update is found after-the-fact to have been made in a way that violated a process requirement, the ZIP Editors MAY revert it.

Any changes to a ZIP by the ZIP Editors SHOULD be communicated to the ZIP Owners.

Typically, the ZIP Editors suggest changes in two phases:

  • content review: multiple ZIP Editors discuss the ZIP draft or update, and suggest changes to the overall content. This is a "big picture" review.

  • format review: two ZIP Editors do a detailed review of the structure and format of the ZIP draft. This ensures the ZIP draft is consistent with other Zcash specifications.

The content review is where general weaknesses in the ZIP draft should be identified, which might include:

  • Insufficient or unclear motivation.

  • Unclear, under-documented, or missing privacy implications.

  • Significant objectives of the ZIP draft that are not clearly documented in the Requirements section.

  • Missing trust assumptions.

  • Security risks that are insufficiently addressed.

  • Unaddressed backward compatibility issues.

In addition, ZIP Editors may request input from community security or privacy experts for proposals with significant implications.

Note that it is not the primary responsibility of the ZIP Editors to review proposals for security, correctness, or implementability.

If the ZIP draft isn't ready, the Editors SHOULD make suggestions to the Owners for the ZIP draft to be revised.

If a pull request exclusively updates ZIP drafts owned by the PR creator (and is free from spam, abusive or malicious content, etc.), then the ZIP Editors SHOULD approve it without any need for substantive editorial review, so that the Owners are able to merge their changes into the main branch essentially at will.

If changes to a ZIP draft are merged into main, an issue tracking the ZIP draft MUST be opened if one is not open already. In this situation, any outstanding suggestions or comments that need to be addressed before the ZIP draft can be converted to a numbered ZIP SHOULD be moved to this issue.

If the ZIP draft isn't ready, the Editors will send it back to the Owners for revision, with specific instructions. This decision is made by consensus among the current Editors.

Format review should generally occur after content review feedback has been addressed, to avoid unnecessary document churn or merge conflicts.

When a ZIP draft is ready, the ZIP Editors will:

  • Ensure that a unique ZIP number has been assigned in the pull request.

  • Regenerate the corresponding HTML documents, if required.

  • Remove Draft status and merge the pull request.

The ZIP editors monitor ZIP changes and update ZIP headers as appropriate.

Rejecting a ZIP or update

The ZIP Editors MAY reject a new ZIP draft or an update to an existing ZIP, by consensus among the current Editors. Rejections can be based on any of the following reasons:

  • it violates the Zcash Code of Conduct [3] ;

  • it appears too unfocused or broad;

  • it duplicates effort in other ZIPs without sufficient technical justification (however, alternative proposals to address similar or overlapping problems are not excluded for this reason);

  • it has manifest security flaws (including being unrealistically dependent on user vigilance to avoid security weaknesses);

  • it fails to adequately consider privacy implications;

  • it disregards compatibility with the existing Zcash blockchain or ecosystem;

  • it is manifestly unimplementable;

  • it includes buggy code, pseudocode, or algorithms;

  • it manifestly violates common expectations of a significant portion of the Zcash community;

  • it updates a ZIP's status, or fails to make a needed status update, in a way inconsistent with the requirements in Specification of Status Workflow;

  • in the case of a Proposed, Active, Implemented, or Final ZIP, the update makes a substantive change to which there is significant community opposition;

  • it is dependent on a patent that could potentially be an obstacle to adoption of the ZIP;

  • it includes commercial advertising or spam;

  • it disregards formatting rules;

  • it makes non-editorial edits to previous entries in a ZIP's Change History, if there is one;

  • an update to an existing ZIP extends or changes its scope to an extent that would be better handled as a separate ZIP;

  • a new ZIP draft has a category that does not reflect its content, or an update would change a ZIP to an inappropriate category;

  • it violates any specific "MUST" or "MUST NOT" rule in this document;

  • the expressed political views of a Owner of the document are inimical to the Zcash Code of Conduct [3] (except in the case of an update removing that Owner);

  • it is not authorized by the stated ZIP Owners;

  • it removes an Owner without their consent (unless the reason for removal is directly related to a breach of the Code of Conduct by that Owner);

  • it violates a conformance requirement of any Active Process ZIP (including this ZIP).

The ZIP Editors MUST NOT unreasonably deny publication of a ZIP draft or update that does not violate any of these criteria. If they refuse a proposal or update, they MUST give an explanation of which of the criteria were violated, with the exception that spam may be deleted without an explanation.

Communicating with the ZIP Editors

Please send all ZIP-related communications either:

All communications should abide by the Zcash Code of Conduct [3].

ZIP Editor Meeting Practices

The ZIP Editors SHOULD meet on a regular basis to review draft changes to ZIPs. Meeting times are agreed by consensus among the current ZIP Editors. A ZIP Editor meeting can be held even if some ZIP Editors are not available, but all Editors SHOULD be informed of significant decisions that are likely to be made at upcoming meetings.

The ZIP Editors will appoint a ZIP Secretary, which can be a shared or rotating role. The ZIP Secretary will:

  • share a draft agenda with the ZIP Editors at least 24 hours before each ZIP Editors' meeting;

  • share draft minutes of significant decisions with the ZIP Editors in the week after the ZIP Editors' meeting; and

  • share significant ZIP changes, including significant changes of status (in particular, progression of a ZIP to Proposed status), on the Zcash Community Forum.

If the draft agenda is empty, any ZIP Editor MAY submit agenda items, or suggest that the meeting is cancelled.

ZIP format and structure

ZIPs SHOULD be written in reStructuredText [4], Markdown [5], or LaTeX [6]. For ZIPs written in LaTeX, a Makefile MUST be provided to build (at least) a PDF version of the document.

Each ZIP SHOULD have the following parts:

  • Preamble — Headers containing metadata about the ZIP (see below). The License field of the preamble indicates the licensing terms, which MUST be acceptable according to the ZIP licensing requirements.

  • Terminology — Definitions of technical or non-obvious terms used in the document.

  • Abstract — The abstract SHOULD be a concise summary (approximately 200 words) that clearly describes the issue the ZIP addresses, the proposed solution, and the intended outcome. The ZIP MUST remain complete without the abstract.

    The abstract SHOULD, as far as practical, provide enough context for readers to quickly understand what the ZIP is about, why it matters, and how it fits into the broader Zcash ecosystem. In addition to summarizing the technical content, the abstract SHOULD briefly mention any significant privacy implications. The abstract should not be vague or overly generic, but should serve as a faithful, high-level summary of the proposal that enables reviewers to understand the key ideas and potential implications without reading the entire document.

  • Motivation — The motivation is critical for ZIPs that want to change the Zcash protocol. It should clearly explain why the existing protocol is inadequate to address the problem that the ZIP solves.

  • Privacy Implications — This section SHOULD be present if the ZIP makes trade-offs or assumptions that could impact the privacy of Zcash users or protocol participants. Since this section is not part of the Specification, it MUST NOT directly include or duplicate conformance requirements on implementations or processes. Instead it contains a high-level overview of the privacy implications that may need to be considered for deployment of the ZIP.

    The contents of this section could include, for example, trust assumptions affecting privacy that are introduced or modified by the proposal; privacy trade-offs or changes to anonymity guarantees; potential data leakage (e.g., from metadata, timing, or usage patterns); and exposure to known or novel privacy attack vectors. Proposals SHOULD consider any relevant threat model(s), and SHOULD propose updates to those threat models if the ZIP introduces new privacy-relevant assumptions or risks not currently addressed.

    If a change affects how wallets construct, interpret, or expose transaction data, or modifies user-facing protocol behavior, the ZIP SHOULD assess the implications for user privacy in that context.

  • Requirements — This section describes high-level goals that the Specification MUST ensure. It MUST NOT itself include conformance requirements, so that it is possible to perform a consistency check that what is specified meets the Requirements.

  • Specification — The technical specification should describe the interface and semantics of any new feature. The specification should be detailed enough to allow competing, interoperable implementations for any of the current Zcash platforms.

  • Rationale — The rationale fleshes out the specification by describing what motivated the design and why particular design decisions were made. It should describe alternate designs that were considered and related work. The rationale should provide evidence of consensus within the community and discuss important objections or concerns raised during discussion.

    For longer ZIPs it can potentially be easier to have inline Rationale subsections interspersed throughout the Specification part. When taking this approach, the content of these subsections should be annotated with HTML tags to make it collapsible (so the rationale is available for review but doesn't get in the way of reading the specification). ZIPs written in Markdown can use the following syntax (note the newline after the <summary> tag):

    # Specification

## Foobar

Important details.

<details>
<summary>

### Rationale for foobar
</summary>

Important but hidden rationale!
</details>

    ZIPs written in reStructuredText can use the following syntax:

    Specification
=============

Foobar
------

Important details.

Rationale for foobar
''''''''''''''''''''

.. raw:: html

   <details>
   <summary>Click to show/hide</summary>

Important but hidden rationale!

.. raw:: html

   </details>

  • Reference implementation — Literal code implementing the ZIP's specification, and/or a link to the reference implementation of the ZIP's specification. The reference implementation MUST be completed before any ZIP is given status “Implemented” or “Final”, but it generally need not be completed before the ZIP is accepted into “Proposed”.

  • Change History — A list of dates, each with details of any semantic changes made to the ZIP (not editorial changes). This section is OPTIONAL; if present, the Preamble MUST include a Last-Updated field. It is RECOMMENDED to include this section in "living ZIPs" (Released ZIPs to which semantic changes are made after their initial transition out of Draft). If a ZIP that already contains a Change History section is modified with semantic changes, the Change History section and Last-Updated field MUST also be updated.

ZIP stubs

A ZIP stub records that the ZIP Editors have reserved a number for a ZIP that is under development. It is not a ZIP, but exists in the ZIPs git repository [7] at the same path that will be used for the corresponding ZIP if and when it is published. It consists only of a preamble, which MUST use Reserved as the value of the Status field.

ZIP stubs can be added and removed, or replaced by the corresponding ZIP, at the discretion of the ZIP Editors. If a ZIP stub is removed then its number MAY be reused, possibly for an entirely different ZIP.

ZIP header preamble

Each ZIP or ZIP stub MUST begin with a RFC 822-style header preamble. For ZIPs and ZIP stubs written in reStructuredText, this is represented as :: on the first line, followed by a blank line, then the preamble indented by 2 spaces.

The following header fields are REQUIRED for ZIPs:

ZIP:
Title:
Owners:
Status:
Category:
Created:
License:

The following additional header fields are OPTIONAL for ZIPs:

Credits:
Original-Authors:
Discussions-To:
Pull-Request:
Last-Updated:
Obsoleted-By:
Updated-By:
Obsoletes:
Updates:

For ZIP stubs, only the ZIP:, Title:, Status:, and Category: fields are REQUIRED. Typically the other fields applicable to ZIP stubs are Credits:, Discussions-To: and Pull-Request:, which are OPTIONAL.

The Owners header lists the names and email addresses of all the Owners of the ZIP. The format of the Owners header value SHOULD be:

Random J. User <address@dom.ain>

If there are multiple Owners, each should be on a separate line.

Credits: and Original-Authors: fields SHOULD NOT include email addresses.

While a ZIP is in public discussions (usually during the initial Draft phase), a Discussions-To header will indicate the URL where the ZIP is being discussed. No Discussions-To header is necessary if the ZIP is being discussed privately with the Owner.

The Pull-Request header, if present, gives one or more URLs to Pull Requests for the ZIP.

The Category header specifies the type of ZIP, as described in ZIP categories. Multiple categories MAY be specified, separated by " / ".

The Created header records the date that the ZIP was submitted. Dates should be in yyyy-mm-dd format, e.g. 2001-08-14.

For ZIPs written in reStructuredText, URLs in header fields SHOULD be surrounded by < >; this ensures that the link is rendered correctly.

The "Owners", "Credits", and "Original-Authors" headers always use these plural spellings even if there is only one Owner, one person to be credited, or one original author. The "Pull-Request" header always uses this singular spelling even there are multiple Pull Requests.

Auxiliary Files

ZIPs may include auxiliary files such as diagrams. Auxiliary files should be included in a subdirectory for that ZIP; that is, for any ZIP that requires more than one file, all of the files SHOULD be in a subdirectory named zip-XXXX.

ZIP categories

Each ZIP is in one or more of the following categories, as specified in the Category header:

Consensus

Rules that affect the consensus protocol followed by all Zcash implementations.

Standards

Non-consensus changes affecting most or all Zcash implementations, or the interoperability of applications using Zcash.

Process

A Process ZIP describes a process surrounding Zcash, or proposes a change to (or an event in) a process. They may propose an implementation, but not to Zcash's codebase; they often require community consensus; unlike Informational ZIPs, they are more than recommendations, and users are typically not free to ignore them. Examples include procedures, guidelines, changes to the decision-making process, and changes to the tools or environment used in Zcash development.

Consensus Process

A subcategory of Process ZIP that specifies requirements and processes that are to be realized by one or more Consensus ZIPs, and/or by social consensus of the Zcash community.

Informational

An Informational ZIP describes non-consensus Zcash design issues, or general guidelines or information for the Zcash community. These ZIPs do not necessarily represent a Zcash community consensus or recommendation, so users and implementors are free to ignore Informational ZIPs or follow their advice.

Network

Specifications of peer-to-peer networking behaviour.

RPC

Specifications of the RPC interface provided by zebra or zcashd nodes.

Wallet

Specifications affecting wallets (e.g. non-consensus changes to how transactions, addresses, etc. are constructed or interpreted).

Ecosystem

Specifications otherwise useful to the Zcash ecosystem.

New categories may be added by consensus among the ZIP Editors.

Consensus and Standards ZIPs SHOULD have a Reference Implementation section, which includes or (more often) links to an implementation.

Consensus ZIPs SHOULD have a Deployment section, describing how and when the consensus change is planned to be deployed (for example, in a particular network upgrade).

ZIP Status Field

  • Reserved: The ZIP Editors have reserved this ZIP number, and there MAY be a Pull Request for it, but no ZIP has been published. The ZIP Editors SHOULD publish a stub header so that the reservation appears in the ZIP index. This status MUST only be used for ZIP stubs.

  • Draft: All initial ZIP submissions have this status.

  • Withdrawn: The Owners of a ZIP MAY remove it from consideration by the community, by changing its status to Withdrawn (in a PR or by request to the ZIP Editors).

  • Active: Typically only used for Process or Informational ZIPs, achieved once rough consensus on a Proposed ZIP is reached in PR/forum posts.

  • Proposed: Typically the stage after Draft, added to a ZIP after consideration, feedback, and rough consensus from the community.

  • Rejected: If no progress on a Draft or Proposed ZIP has been made for one year, the ZIP Editors SHOULD move it to Rejected status. It can revert back to Draft or Proposed if the Owners resume work or resolve issues preventing consensus.

  • Implemented: When a Consensus or Standards ZIP has a working reference implementation but before activation on the Zcash network. The status MAY indicate which node implementation has implemented the ZIP, e.g. "Implemented (zebra)" or "Implemented (zcashd)".

  • Final: When a Consensus or Standards ZIP is both implemented and activated on the Zcash network.

  • Obsolete: The status when a ZIP is no longer relevant (typically when superseded by another ZIP).

If a ZIP has multiple Revisions, they may have differing deployment status. In that case the status of every Revision SHOULD be specified, using the format "[Revision 0] <Status-0>, [Revision 1] <Status-1>, ..." where "<Status-n>" is one of the alternatives above.

Once any Revision has been Released (as defined in the next section), all subsequent Revisions MUST also be at least Proposed (that is, they MUST NOT be Reserved or Draft). For example, a status such as:

[Revision 0] Final, [Revision 1] Draft

is not valid, because changes that are in Draft should not have been applied yet.

Specification of Status Workflow

Owners of a ZIP MAY decide on their own to change the status between Draft or Withdrawn. All other changes in status MUST be approved by consensus among the current ZIP Editors.

A ZIP SHOULD only change status from Draft (or Rejected) to Proposed, when the Owner deems it is complete and there is rough consensus on the forums, validated by consensus among the current ZIP Editors. If it's a Consensus ZIP, a Deployment section MUST be present in order for the ZIP to change status to Proposed. Typically, although not necessarily, this will specify a network upgrade in which the consensus change is to activate.

A ZIP's status is Released if it is Proposed, Active, Implemented, or Final (i.e. not Draft, Rejected, Obsolete, or Withdrawn).

A ZIP that has significant security or privacy implications MUST NOT be changed from a non-Released status to a Released status without the design having undergone independent security review from qualified security or privacy experts. Similarly, changes to a Released ZIP that might invalidate the conclusions of previous security or privacy review, or leave significant security or privacy implications unaddressed, MUST undergo further independent review.

A ZIP SHOULD NOT be changed from a non-Released status to a Released status if there is significant community opposition to its content. (However, Draft ZIPs explicitly MAY describe proposals to which there is, or could be expected, significant community opposition.)

A Released ZIP MUST NOT be changed to a non-Released status if the specification is already implemented and is in common use, or where a Process ZIP still reflects a consensus of the community.

A Standards ZIP SHOULD only change status from Proposed to Implemented once the Owners provide an associated reference implementation. For Consensus ZIPs, an implementation MUST have been merged into at least one consensus node codebase (currently zebra and/or zcashd), typically in the period after the network upgrade's specification freeze but before the implementation audit. If the Owners miss this deadline, the Editors or Owners MAY choose to update the Deployment section of the ZIP to target another upgrade, at their discretion.

A Process or Informational ZIP SHOULD change status from Proposed to Active when it achieves rough consensus on the forum or PR. Such a proposal is said to have rough consensus if it has been substantially complete and open to discussion on the forum or GitHub PR for at least one month, has been in Proposed status for at least one week, and no person maintains any unaddressed substantiated objections to it. Addressed or obstructive objections can be ignored/overruled by general agreement that they have been sufficiently addressed, but clear reasoning MUST be given in such circumstances.

When an Active, Implemented, or Final ZIP is no longer relevant –for example because its implementation has fallen out of use or its process is no longer followed– its status SHOULD be changed to Obsolete. This change MUST also be objectively verifiable and/or discussed. Final ZIPs MAY be updated; the specification is still in force but modified by another specified ZIP or ZIPs (check the optional Updated-By header).

If a non-editorial update is made to an Obsolete, Withdrawn, or Rejected ZIP, its status MUST be changed appropriately.

The above process also applies to any subsequent Revisions of a ZIP.

ZIP Comments

Comments from the community on the ZIP should occur on the Zcash Community Forum and the comment fields of the pull requests in any open ZIPs. Editors will use these sources to judge rough consensus.

ZIP Licensing

New ZIPs may be accepted with the following licenses. Each new ZIP MUST identify at least one acceptable license in its preamble. Each license MUST be referenced by their respective abbreviation given below.

For example, a preamble might include the following License header:

License: BSD-2-Clause
         GNU-All-Permissive

In this case, the ZIP text is fully licensed under both the OSI-approved BSD 2-clause license as well as the GNU All-Permissive License, and anyone may modify and redistribute the text provided they comply with the terms of either license. In other words, the license list is an "OR choice", not an "AND also" requirement.

It is also possible to license source code differently from the ZIP text. This case SHOULD be indicated in the Reference Implementation section of the ZIP. Again, each license MUST be referenced by its respective abbreviation given below.

Statements of code licenses in ZIPs are only advisory; anyone intending to use the code should look for license statements in the code itself.

ZIPs are not required to be exclusively licensed under approved terms, and MAY also be licensed under unacceptable licenses in addition to at least one acceptable license. In this case, only the acceptable license(s) should be listed in the License header.

In addition, it is RECOMMENDED that literal code included in the ZIP, or written for and linked by the ZIP, be multi-licensed under the union of the license(s) of the project(s) it is intended to be used by. In particular, code intended for zebra, zcashd, Zallet, Zaino, or their dependencies SHOULD be multi-licensed under at least the MIT and Apache-2.0 license terms.

If a ZIP links to a reference implementation that does not follow the above recommendation, its license terms MUST be documented in the ZIP.

Not acceptable licenses

All licenses not explicitly included in the above lists are not acceptable terms and MUST NOT be used for a Zcash Improvement Proposal.

Rationale

Bitcoin's BIP 1 allowed the Open Publication License or releasing into the public domain; was this insufficient?

  • The OPL is generally regarded as obsolete, and not a license suitable for new publications.

  • The OPL license terms allowed for the author to prevent publication and derived works, which was widely considered inappropriate.

  • In some jurisdictions, releasing a work to the public domain is not recognised as a legitimate legal action, leaving the ZIP simply copyrighted with no redistribution or modification allowed at all.

Why are there software licenses included?

  • Some ZIPs, especially in the Consensus category, may include literal code in the ZIP itself which may not be available under the exact license terms of the ZIP.

  • Despite this, not all software licenses would be acceptable for content included in ZIPs.

Why are GPL/AGPL/LGPL-style licenses not included?

  • No existing ZIP had used these licenses.

  • There is no reason to use such licenses for documentation, and including literal code under these licenses in a ZIP could undesirably affect the distribution terms of the ZIP as a whole.

  • If necessary, code under such licenses can be linked for informational purposes, or as long as its incompatibility with the zebra, zcashd, Zallet, and/or Zaino licenses is noted.

See Also

Acknowledgements

We thank George Tankersley, Deirdre Connolly, Teor, Aditya Bharadwaj, and Conrado Gouvêa for their past contributions as ZIP Editors.

References

Changes

static/css/style.css +1 −1
@@ -204,7 +204,7 @@ pre:has(.mermaid) { aside { display: flex; flex-direction: column; - gap: 1em; + gap: 0; padding-top: 0.15rem; padding-left: 0.15rem; padding-right: 0.15rem;
zips/zip-0000.rst +7 −6
@@ -653,17 +653,13 @@ If there are multiple Owners, each should be on a separate line. Credits: and Original-Authors: fields SHOULD NOT include email addresses. -The "Owners", "Credits", and "Original-Authors" headers always use -these plural spellings even there is only one Owner, one person to be -credited, or one original author. - While a ZIP is in public discussions (usually during the initial Draft phase), a Discussions-To header will indicate the URL where the ZIP is being discussed. No Discussions-To header is necessary if the ZIP is being discussed privately with the Owner. -The Pull-Request header, if present, gives an URL to a Pull Request for -the ZIP. +The Pull-Request header, if present, gives one or more URLs to +Pull Requests for the ZIP. The Category header specifies the type of ZIP, as described in `ZIP categories`_. Multiple categories MAY be specified, separated by @@ -675,6 +671,11 @@ Dates should be in yyyy-mm-dd format, e.g. 2001-08-14. For ZIPs written in reStructuredText, URLs in header fields SHOULD be surrounded by ``<`` ``>``; this ensures that the link is rendered correctly. +The "Owners", "Credits", and "Original-Authors" headers always use +these plural spellings even if there is only one Owner, one person to +be credited, or one original author. The "Pull-Request" header always +uses this singular spelling even there are multiple Pull Requests. + Auxiliary Files ^^^^^^^^^^^^^^^
zips/zip-0312.rst +398 −196
@@ -3,24 +3,29 @@ ZIP: 312 Title: FROST for Spend Authorization Multisignatures Owners: Conrado Gouvea <conrado@zfnd.org> - Chelsea Komlo <ckomlo@uwaterloo.ca> - Deirdre Connolly <deirdre@zfnd.org> + Daira-Emma Hopwood <daira-emma@electriccoin.co> + Original-Authors: Chelsea Komlo + Deirdre Connolly Status: Draft Category: Wallet - Created: 2022-08-dd + Created: 2022-08-01 License: MIT Discussions-To: <https://github.com/zcash/zips/issues/382> Pull-Request: <https://github.com/zcash/zips/pull/662> + <https://github.com/zcash/zips/pull/895> Terminology =========== -{Edit this to reflect the key words that are actually used.} -The key words "MUST", "MUST NOT", "SHOULD", and "MAY" in this document are to -be interpreted as described in RFC 2119. [#RFC2119]_ +The key words "MUST", "SHOULD", "RECOMMENDED", "NOT RECOMMENDED", and "MAY" in +this document are to be interpreted as described in BCP 14 [#BCP14]_ when, and +only when, they appear in all capitals. -The terms below are to be interpreted as follows: +The term "Recovery Protocol" in this document is to be interpreted as described +in [#zip-2005]_. + +The term below is to be interpreted as follows: Unlinkability The property of statistical independence of signatures from the @@ -33,28 +38,29 @@ Unlinkability Abstract ======== -This proposal adapts FROST [#FROST]_, a threshold signature scheme, -to make it unlinkable, which is a requirement for its use in the Zcash protocol. -The adapted scheme generates signatures compatible with spend authorization -signatures in the Sapling and Orchard shielded protocols as deployed in Zcash. +This proposal adapts FROST [#FROST]_, a threshold signature scheme, to make it +support key re-randomization as described in [#protocol-abstractsigrerand]_. +This is a requirement in order for it to be used to implement unlinkable spend +authorization signatures in the Orchard and Sapling shielded protocols, as +deployed in Zcash. Motivation ========== In the Zcash protocol, Spend Authorization Signatures are employed to authorize -a transaction. The ability to generate these signatures with the user's -private key is what effectively allows the user to spend funds. +a transaction. The ability to generate these signatures with the user's private +key is what effectively allows the user to spend funds. This is a security-critical step, since anyone who obtains access to the private key will be able to spend the user's funds. For this reason, one interesting -possibility is to require multiple parties to allow the transaction to go -through. This can be accomplished with threshold signatures, where the private -key is split between parties (or generated already split using a distributed -protocol) in a way that a threshold (e.g. 2 out of 3) of them must sign the -transaction in order to create the final signature. This enables scenarios such -as users and third-party services sharing custody of a wallet, or a group of -people managing shared funds, for example. +possibility is to ensure that authorization from multiple parties is needed in +order for the transaction to go through. This can be accomplished with threshold +signatures, where the private key is split between parties (or generated already +split using a distributed protocol) in such a way that a threshold (e.g. 2 out +of 3) of them must sign the transaction in order to create the final signature. +This enables scenarios such as users and third-party services sharing custody of +a wallet, or a group of people managing shared funds, for example. FROST is one of such threshold signature protocols. However, it can't be used as-is since the Zcash protocol also requires re-randomizing public and private @@ -73,6 +79,8 @@ Requirements criteria for Signature with Re-Randomizable Keys as specified in the Zcash protocol [#protocol-concretereddsa]_. - The threat model described below must be taken into account. +- The key generation must be compatible with Quantum Recoverability + [#zip-2005]_. Threat Model ------------ @@ -87,9 +95,9 @@ shielded transaction: as an auxiliary (secret) input, among others. When employing re-randomizable FROST as specified in this ZIP, the goal is to -split the spend authorization private key $\mathsf{ask}$ among multiple -possible signers. This means that the proof generation will still be performed -by a single participant, likely the one that created the transaction in the first +split the spend authorization private key $\mathsf{ask}$ among multiple possible +signers. This means that the proof generation will still be performed by a +single participant, likely the one that created the transaction in the first place. Note that this user already controls the privacy of the transaction since they are responsible for creating the proof. @@ -101,21 +109,26 @@ With those considerations in mind, the threat model considered in this ZIP is: - The Coordinator is trusted with the privacy of the transaction (which includes the unlinkability property). A rogue Coordinator will be able to break - unlinkability and privacy, but should not be able to create signed transactions - without the approval of ``MIN_PARTICIPANTS`` participants, as specified in FROST. + unlinkability and privacy, but should not be able to create signed + transactions without the approval of ``MIN_PARTICIPANTS`` participants, as + specified in FROST. - All key share holders are also trusted with the privacy of the transaction, - thus a rogue key share holder will be able to break its privacy and unlinkability. + thus a rogue key share holder will be able to break its privacy and + unlinkability. + +Caveats concerning the security model for use of FROST keys in a Quantum +Recovery protocol are covered in [#zip-2005-usage-with-frost]_. Non-requirements ================ - This ZIP does not support removing the Coordinator role, as described in [#frost-removingcoordinator]_. -- This ZIP does not prevent key share holders from linking the signing operation to a - transaction in the blockchain. -- Like the FROST specification [#FROST]_, this ZIP does not specify a key generation - procedure; but refer to that specification for guidelines. +- This ZIP does not prevent key share holders from linking the signing operation + to a transaction in the blockchain. +- Like the FROST specification [#FROST]_, this ZIP does not require a particular + key generation procedure, although it does suggest one. - Network privacy is not in scope for this ZIP, and must be obtained with other tools if desired. @@ -126,60 +139,161 @@ Specification Algorithms in this section are specified using Python pseudo-code, in the same fashion as the FROST specification [#FROST]_. -The types Scalar, Element, and G are defined in [#frost-primeordergroup]_, as -well as the notation for elliptic-curve arithmetic, which uses the additive -notation. Note that this notation differs from that used in the Zcash Protocol -Specification. For example, ``G.ScalarMult(P, k)`` is used for scalar -multiplication, where the protocol spec would use $[k] P$ with the group -implied by $P$. - -An additional per-ciphersuite hash function is used, denote ``HR(m)``, which -receives an arbitrary-sized byte string and returns a Scalar. It is defined -concretely in the Ciphersuites section. +We define the following as in [#FROST]_ for a specific FROST ciphersuite: + +* Let $G$ be a group of prime order $p$ as described in [#frost-primeordergroup]_, + with element type $\mathtt{Element}$, identity $I \;{\small ⦂}\; \mathtt{Element}$, + base element $B \;{\small ⦂}\; \mathtt{Element}$ where $B \neq I$, and scalar type + $\mathtt{Scalar} = \mathbb{F}_p$. +* Let $\mathtt{Ne}$ and $\mathtt{Ns}$ be the sizes in bytes of a serialized Element + representation and Scalar representation, respectively. +* Let functions $\mathsf{Scalar} \;{\small ⦂}\; \{ 0 .. p-1 \} \rightarrow \mathtt{Scalar}$, + $\mathsf{RandomScalar} \;{\small ⦂}\; () \stackrel{\tiny\mathrm{R}}{\rightarrow} \mathtt{Scalar}$, + $\mathsf{ScalarMult} \;{\small ⦂}\; \mathtt{Element} \times \mathtt{Scalar} \rightarrow \mathtt{Element}$, + $\mathsf{ScalarBaseMult} \;{\small ⦂}\; \mathtt{Scalar} \rightarrow \mathtt{Element}$, + $\mathsf{SerializeElement} \;{\small ⦂}\; \mathtt{Element} \rightarrow \mathbb{B}^{{\kern-0.05em\tiny\mathbb{Y}}[\mathtt{Ne}]}$, + $\mathsf{DeserializeElement} \;{\small ⦂}\; \mathbb{B}^{{\kern-0.05em\tiny\mathbb{Y}}[\mathtt{Ne}]} \rightarrow \mathtt{Element} \cup \{ \bot \}$, + $\mathsf{SerializeScalar} \;{\small ⦂}\; \mathtt{Scalar} \rightarrow \mathbb{B}^{{\kern-0.05em\tiny\mathbb{Y}}[\mathtt{Ns}]}$, + $\mathsf{DeserializeScalar} \;{\small ⦂}\; \mathbb{B}^{{\kern-0.05em\tiny\mathbb{Y}}[\mathtt{Ns}]} \rightarrow \mathtt{Scalar} \cup \{ \bot \}$ + also be as described in [#frost-primeordergroup]_ (where "raising an error" + corresponds to returning $\bot$). + +Note that the notation for elliptic-curve scalar multiplication, +$\mathsf{G.ScalarMult}(P, k)$, differs from that used in the Zcash Protocol +Specification, which would use $[k]\, P$ with the group implied by $P$ +[#protocol-abstractgroup]_. Key Generation -------------- -While key generation is out of scope for this ZIP and the FROST spec [#FROST]_, -it needs to be consistent with FROST, see [#frost-tdkg]_ for guidance. The spend -authorization private key $\mathsf{ask}$ [#protocol-spendauthsig]_ is the -particular key that must be used in the context of this ZIP. Note that the -$\mathsf{ask}$ is usually derived from the spending key -$\mathsf{sk}$, though that is not required. Not doing so allows using -distributed key generation, since the key it generates is unpredictable. Note -however that not deriving $\mathsf{ask}$ from $\mathsf{sk}$ prevents -using seed phrases to recover the original secret (which may be something -desirable in the context of FROST). +FROST key generation with a trusted dealer is described in [#frost-tdkg]_. That +description does not support key re-randomization but can be adapted to do so, +as described in section 5 of [#frost-rerandomized]_. + +.. warning:: + Trusted dealer key generation has the severe disadvantage that it requires + absolutely trustworthy hardware and software to be used by the dealer in + order to reliably avoid exposing the private key material. That is, it is + not sufficient simply to have an individual or organization that is trusted + by all participants; their entire hardware and software stack also needs to + be trusted by all participants. + + Since this will often be an unrealistic assumption that partly defeats the + point of using a threshold signature scheme, trusted dealer key generation + SHOULD NOT be used. + +Instead, it is RECOMMENDED to instead use Distributed Key Generation. + +A suitable DKG protocol is COCKTAIL-DKG [#cocktail-dkg]_. +COCKTAIL-DKG assumes that each participant has a static public key known to all +other participants. + +Other Distributed Key Generation protocols MAY be used. + +To define a spending or viewing key that uses FROST, the Orchard and Sapling key +trees [#protocol-orchardkeycomponents]_ [#protocol-saplingkeycomponents]_ are +adjusted as follows: + +- The Spend validating key $\mathsf{ak}$ is replaced by the FROST group + public key `PK` [#frost-protocol]_ when deriving other key components. +- The Spend authorizing key $\mathsf{ask}$ [#protocol-spendauthsig]_ is + replaced by the logical signing key that corresponds to the group public key + `PK`. By design, this key is never explicitly constructed (unless trusted + dealer key generation was used), and instead is represented by any sufficient + subset of the participant FROST signing key shares `sk_i`. + +For both Orchard and Sapling, use of Distributed Key Generation precludes +generating $\mathsf{ask}$ from a spending key $\mathsf{sk}$. Instead the +Distributed Key Generation protocol will output the FROST group public key `PK` +(equivalent to $\mathsf{ak}$). + +When generating FROST key components for the Orchard shielded protocol, the +remaining parts of the Orchard key tree apart from $\mathsf{ask}$ and +$\mathsf{ak}$ SHOULD be generated as described in [#zip-2005-usage-with-frost]_. +The specification there is normative, and is only summarized here. It requires +the participants to privately agree on a value $\mathsf{sk}$ (which is no longer +sufficient by itself for spend authorization), and then use it to obtain the +nullifier deriving key $\mathsf{nk}$, the quantum spending key $\mathsf{qsk}$, +the quantum intermediate key $\mathsf{qk}$, and (using the FROST group public +key in place of $\mathsf{ak}$) $\mathsf{rivk\_ext}$. This process is specified +in § 4.2.3 ‘Orchard Key Components’ [#protocol-orchardkeycomponents]_ as +modified by [#zip-2005-usage-with-frost]_. + +Similarly, when generating a FROST key for the Sapling shielded protocol, the +remaining parts of the Sapling key tree apart from $\mathsf{ask}$ and +$\mathsf{ak}$ (that is, $\mathsf{nk}$, $\mathsf{rivk\_ext}$, and further values +derived from them and $\mathsf{ak}$) SHOULD be generated from a common value +$\mathsf{sk}$ (again, not sufficient by itself for spend authorization) as +described in [#protocol-saplingkeycomponents]_. + +Regardless of how the Orchard or Sapling key components are generated, the +participants MUST ensure that they have obtained the same values for +$\mathsf{ak}$, $\mathsf{nk}$, and $\mathsf{rivk\_ext}$. + +Since Sapling will not be modified to support Quantum Recoverability +[#zip-2005]_, Orchard is RECOMMENDED for new FROST keys. + +In order for all participants to agree on the value of $\mathsf{sk}$, one +of the following options SHOULD be used: + +- Participants generate a $\mathsf{sk}$ in a contributory manner, for example + using the method defined in `Contributory Generation of sk`_. This approach + SHOULD be used to generate $\mathsf{sk}$ if Distributed Key Generation was + employed. +- One participant generates a random $\mathsf{sk}$ and sends it to the + others via an encrypted and authenticated channel. This option SHOULD be used + if trusted dealer key generation was used, and the $\mathsf{sk}$ value + can be sent along with the FROST shares during key generation. This option is + NOT RECOMMENDED if Distributed Key Generation was employed. -Re-randomizable FROST +Randomizer Generation --------------------- -To add re-randomization to FROST, follow the specification [#FROST]_ with the -following modifications. +Re-Randomized FROST uses randomizers. This section specifies how they are +generated; this will be required for the Signature Share Generation +specification below. +Two functions are provided to generate randomizers: `randomizer_generate()` and +`randomizer_regenerate()`. Both use helper functions and a constant which are +defined as follows: -Randomizer Generation -''''''''''''''''''''' +- The `encode_group_commitment_list()` function is defined in + [#frost-listoperations]_. It returns a byte serialization of a + `commitment_list` value. +- The `random_bytes(n)` function is defined in [#frost-conventions]_ and it + returns a sequence of `n` bytes sampled uniformly at random. +- The `HR(m)` function is a ciphersuite-generic function that maps an arbitrary + byte string to a scalar and is instantiated in the `Ciphersuites`_ section. + +:: + + randomizer_generate(): -A new helper function is defined, which generates a randomizer. The -`encode_signing_package` is defined as the byte serialization of the `msg`, -`commitment_list` values as described in [#frost-serialization]_. -Implementations MAY choose another encoding as long as all values (the message, -and the identifier, binding nonce and hiding nonce for each participant) are -unambiguously encoded. + Inputs: + - commitment_list = [(i, hiding_nonce_commitment_i, + binding_nonce_commitment_i), ...], a list of commitments issued by + each participant, where each element in the list indicates a + NonZeroScalar identifier i and two commitment Element values + (hiding_nonce_commitment_i, binding_nonce_commitment_i). This list + MUST be sorted in ascending order by identifier. -The function `random_bytes(n)` is defined in [#FROST]_ and it returns a buffer -with `n` bytes sampled uniformly at random. The constant `Ns` is also specified -in [#FROST]_ and is the size of a serialized scalar. + Outputs: (randomizer_seed, randomizer), a byte sequence and a Scalar + + def randomizer_generate(commitment_list): + # Generate a random byte sequence with the size of a serialized scalar. + randomizer_seed = random_bytes(Ns) + signing_commitments_enc = encode_group_commitment_list(commitment_list) + randomizer_input = randomizer_seed || signing_commitments_enc + return (randomizer_seed, HR(randomizer_input)) :: - randomizer_generate(): + randomizer_regenerate(): Inputs: - - msg, the message being signed in the current FROST signing run + - randomizer_seed = a sequence of Ns bytes - commitment_list = [(i, hiding_nonce_commitment_i, binding_nonce_commitment_i), ...], a list of commitments issued by each participant, where each element in the list indicates a @@ -189,68 +303,127 @@ in [#FROST]_ and is the size of a serialized scalar. Outputs: randomizer, a Scalar - def randomizer_generate(msg, commitment_list): - # Generate a random byte buffer with the size of a serialized scalar - rng_randomizer = random_bytes(Ns) - signing_package_enc = encode_signing_package(commitment_list, msg) - randomizer_input = rng_randomizer || signing_package_enc - return HR(randomizer_input) + def randomizer_regenerate(randomizer_seed, commitment_list): + signing_commitments_enc = encode_group_commitment_list(commitment_list) + randomizer_input = randomizer_seed || signing_commitments_enc + return H2(randomizer_input) + + +Re-Randomized FROST +------------------- + +To add re-randomization to FROST, the signers MUST follow the specification +[#FROST]_ with the following modifications. Round One - Commitment '''''''''''''''''''''' -Roune One is exactly the same as specified [#FROST]_. But for context, it +Round One is exactly the same as specified [#FROST]_. But for context, it involves these steps: -- Each signer generates nonces and their corresponding public commitments. - A nonce is a pair of Scalar values, and a commitment is a pair of Element values. -- The nonces are stored locally by the signer and kept private for use in the second round. +- Each signer generates nonces and their corresponding public commitments. A + nonce is a pair of $\mathtt{Scalar}$ values, and a commitment is a pair of + $\mathtt{Element}$ values. +- The nonces are stored locally by the signer and kept private for use in the + second round. - The commitments are sent to the Coordinator. Round Two - Signature Share Generation '''''''''''''''''''''''''''''''''''''' -In Round Two, the Coordinator generates a random scalar ``randomizer`` by calling -``randomizer_generate`` and sends it to each signer, over a confidential and -authenticated channel, along with the message and the set of signing -commitments. (Note that this differs from regular FROST which just requires an -authenticated channel.) +In Round Two of regular FROST, the Coordinator picks a message and sends it to +each signer along with the commitments received in Round One. In Re-Randomized +FROST, the Coordinator MUST additionally call $\mathtt{randomizer\_generate}()$ +and send the $\mathtt{randomizer\_seed}$ along with the message and the +commitments. Each participant, upon receiving those values, MUST compute +$\mathtt{randomizer}$ by calling $\mathtt{randomizer\_regenerate}()$ with the +received $\mathtt{randomizer\_seed}$ and commitments. + +In Zcash, the message that needs to be signed is the SIGHASH transaction hash. +This by itself does not convey enough information for the signers to decide +whether they want to authorize the transaction or not. Therefore, in addition +to the serialized transaction, more data (such as openings of value commitments, +decryption of note ciphertexts, etc.) needs to be sent from the Coordinator to +the signers. This SHOULD be done by sending a Partially Constructed Zcash Transaction +[#draft-zip-0374]_ over the same encrypted, authenticated channel. In order to sign, +each signer MUST be satisfied that the transaction should be authorized, using +the additional information provided in the PCZT where necessary. That information +MUST be checked for consistency with the transaction and not trusted simply +because the Coordinator is providing it. + +The details of this checking, and of what needs to be included in the PCZT in +order for the signers to be satisfied that the transaction should be authorized, +are to be specified in [#draft-zip-0374]_. + +Let $\textsf{FROST.sign}$ be the regular FROST signing function with arguments +``(identifier, sk_i, group_public_key, nonce_i, msg, commitment_list)``, +as defined in [#frost-sign]_. + +The $\textsf{Rerandomized-FROST.sign}$ function takes an additional input +$\mathtt{randomizer\_seed}$, and adjusts the inputs relative to the +$\mathtt{randomizer}$ computed by $\mathtt{randomizer\_regenerate}()$:: + + def Rerandomized-FROST.sign(identifier, sk_i, group_public_key, nonce_i, msg, + commitment_list, randomizer_seed): + randomizer = randomizer_regenerate(randomizer_seed, commitment_list) + randomized_sk_i = sk_i + randomizer + randomized_group_public_key = group_public_key + G.ScalarBaseMult(randomizer) + return FROST.sign(identifier, randomized_sk_i, randomized_group_public_key, + nonce_i, msg, commitment_list) + +The signer MAY cache $\mathtt{randomizer}$ and +$\mathsf{G.ScalarBaseMult}(\mathtt{randomizer})$ for use in the +$\textsf{Rerandomized-FROST.}$ {aggregate, verify_signature_share} +functions defined below. -In Zcash, the message that needs to be signed is actually the SIGHASH -transaction hash, which does not convey enough information for the signers to -decide if they want to authorize the transaction or not. Therefore, in practice, -more data is needed to be sent (over the same encrypted, authenticated channel) -from the Coordinator to the signers, possibly the transaction itself, openings of -value commitments, decryption of note ciphertexts, etc.; and the signers MUST check -that the given SIGHASH matches the data sent from the Coordinator, or compute the -SIGHASH themselves from that data. However, the specific mechanism for that process -is outside the scope of this ZIP. -The randomized ``sign`` function is defined as the regular FROST ``sign`` -function, but with its inputs modified relative to the ``randomizer`` as -following: +Signature Share Verification and Aggregation +'''''''''''''''''''''''''''''''''''''''''''' -- ``sk_i = sk_i + randomizer`` -- ``group_public_key = group_public_key + G.ScalarBaseMult(randomizer)`` +Let $\textsf{FROST.aggregate}$ be the regular FROST aggregation function with +arguments ``(commitment_list, msg, group_public_key, sig_shares)``, as defined +in [#frost-aggregate]_. +The $\textsf{Rerandomized-FROST.aggregate}$ function takes an additional input +$\mathtt{randomizer}$ computed as above, and adjusts the inputs relative to this +randomizer:: -Signature Share Verification and Aggregation -'''''''''''''''''''''''''''''''''''''''''''' + def Rerandomized-FROST.aggregate(commitment_list, msg, group_public_key, sig_shares, + randomizer): + randomized_group_public_key = group_public_key + G.ScalarBaseMult(randomizer) + return FROST.aggregate(commitment_list, msg, randomized_group_public_key, sig_shares) + +Similarly, let $\textsf{FROST.verify\_signature\_share}$ be the regular FROST signature +share verification function with arguments +``(identifier, PK_i, comm_i, sig_share_i, commitment_list, group_public_key, msg)``, +as defined also in [#frost-aggregate]_. + +The $\textsf{Rerandomized-FROST.verify\_signature\_share}$ function takes an +additional input $\mathtt{randomizer}$ computed as above, and adjusts the inputs +relative to this randomizer:: -The randomized ``aggregate`` function is defined as the regular FROST -``aggregate`` function, but with its inputs modified relative to the -``randomizer`` as following: + def Rerandomized-FROST.verify_signature_share(identifier, PK_i, comm_i, sig_share_i, + commitment_list, group_public_key, msg): + group_offset = G.ScalarBaseMult(randomizer) + randomized_PK_i = PK_i + group_offset + randomized_group_public_key = group_public_key + group_offset + return FROST.verify_signature_share(identifier, randomized_PK_i, comm_i, sig_share_i, + commitment_list, randomized_group_public_key, msg) -- ``group_public_key = group_public_key + G.ScalarBaseMult(randomizer)`` -The randomized ``verify_signature_share`` function is defined as the regular -FROST ``verify_signature_share`` function, but with its inputs modified relative -to the ``randomizer`` as following: +Contributory Generation of sk +----------------------------- -- ``PK_i = PK_i + G.ScalarBaseMult(randomizer)`` -- ``group_public_key = group_public_key + G.ScalarBaseMult(randomizer)`` +The contributory generation of $\mathsf{sk}$ uses the application-defined +payloads feature of the COCKTAIL-DKG protocol [#cocktail-dkg]_, as follows: + +- In Round 1, generate ``sk_i = random_bytes(32)`` +- Also in Round 1, set $\mathsf{payload}_{i,j} = \mathtt{sk\_i}$ for all `j` +- When running Round 3, use the following as the ``extension`` argument: + $ext = H(n \parallel len(payload_1) \parallel payload_1 \parallel \cdots \parallel len(payload_n) \parallel payload_n)$ +- After Round 3 is finished, set $\mathsf{sk} = ext$. Ciphersuites @@ -259,47 +432,51 @@ Ciphersuites FROST(Jubjub, BLAKE2b-512) '''''''''''''''''''''''''' -This ciphersuite uses Jubjub for the Group and BLAKE2b-512 for the Hash function ``H`` -meant to produce signatures indistinguishable from RedJubjub Sapling Spend -Authorization Signatures as specified in [#protocol-concretespendauthsig]_. +This ciphersuite uses Jubjub for the Group and BLAKE2b-512 for the Hash function +$\mathtt{H}$ meant to produce signatures indistinguishable from RedJubjub +Sapling Spend Authorization Signatures as specified in [#protocol-concretespendauthsig]_. - Group: Jubjub [#protocol-jubjub]_ with base point $\mathcal{G}^{\mathsf{Sapling}}$ as defined in [#protocol-concretespendauthsig]_. - - Order: $r_\mathbb{J}$ as defined in [#protocol-jubjub]_. + - Order: $r_{\mathbb{J}}$ as defined in [#protocol-jubjub]_. - Identity: as defined in [#protocol-jubjub]_. - - RandomScalar(): Implemented by returning a uniformly random Scalar in the range - \[0, ``G.Order()`` - 1\]. Refer to {{frost-randomscalar}} for implementation guidance. - - SerializeElement(P): Implemented as $\mathsf{repr}_\mathbb{J}(P)$ as defined in [#protocol-jubjub]_ - - DeserializeElement(P): Implemented as $\mathsf{abst}_\mathbb{J}(P)$ as defined in [#protocol-jubjub]_, - returning an error if $\bot$ is returned. Additionally, this function - validates that the resulting element is not the group identity element, - returning an error if the check fails. - - SerializeScalar: Implemented by outputting the little-endian 32-byte encoding - of the Scalar value. - - DeserializeScalar: Implemented by attempting to deserialize a Scalar from a - little-endian 32-byte string. This function can fail if the input does not - represent a Scalar in the range \[0, ``G.Order()`` - 1\]. - -- Hash (``H``): BLAKE2b-512 [#BLAKE]_ (BLAKE2b with 512-bit output and 16-byte personalization string), - and Nh = 64. + - $\mathsf{RandomScalar}()$: Implemented by returning a uniformly random + $\mathtt{Scalar}$ in the range $[0, \mathsf{G.Order}() - 1]$. Refer to + [#frost-randomscalar]_ for implementation guidance. + - $\mathsf{SerializeElement}(P)$: Implemented as + $\mathsf{repr}_{\mathbb{J}}(P)$ as defined in [#protocol-jubjub]_. + - $\mathsf{DeserializeElement}(P)$: Implemented as + $\mathsf{abst}_{\mathbb{J}}(P)$ as defined in [#protocol-jubjub]_, returning + an error if $\bot$ is returned. Additionally, this function validates that + the resulting element is not the group identity element, returning an error + if the check fails. + - $\mathsf{SerializeScalar}$: Implemented by outputting the little-endian + 32-byte encoding of the $\mathtt{Scalar}$ value. + - $\mathsf{DeserializeScalar}$: Implemented by attempting to deserialize a + $\mathtt{Scalar}$ from a little-endian 32-byte string. This function can + fail if the input does not represent a $\mathtt{Scalar}$ in the range + $[0, \mathsf{G.Order}() - 1]$. + +- Hash ($\mathtt{H}$): BLAKE2b-512 [#BLAKE]_ (BLAKE2b with 512-bit output and + 16-byte personalization string), and $\mathtt{Nh} = 64$. - H1(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubR", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. - H2(m): Implemented by computing BLAKE2b-512("Zcash_RedJubjubH", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. (This is equivalent to $\mathsf{H}^\circledast(m)$, as defined by the $\mathsf{RedJubjub}$ scheme instantiated in [#protocol-concretereddsa]_.) - H3(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubN", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. - H4(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubM", m). - H5(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubC", m). - HR(m): Implemented by computing BLAKE2b-512("FROST_RedJubjubA", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. Signature verification is as specified in [#protocol-concretespendauthsig]_ for RedJubjub. @@ -317,37 +494,41 @@ Authorization Signatures as specified in [#protocol-concretespendauthsig]_. - Order: $r_\mathbb{P}$ as defined in [#protocol-pallasandvesta]_. - Identity: as defined in [#protocol-pallasandvesta]_. - - RandomScalar(): Implemented by returning a uniformly random Scalar in the range - \[0, ``G.Order()`` - 1\]. Refer to {{frost-randomscalar}} for implementation guidance. - - SerializeElement(P): Implemented as $\mathsf{repr}_\mathbb{P}(P)$ as defined in [#protocol-pallasandvesta]_. - - DeserializeElement(P): Implemented as $\mathsf{abst}_\mathbb{P}(P)$ as defined in [#protocol-pallasandvesta]_, - failing if $\bot$ is returned. Additionally, this function validates that the resulting - element is not the group identity element, returning an error if the check fails. - - SerializeScalar: Implemented by outputting the little-endian 32-byte encoding - of the Scalar value. - - DeserializeScalar: Implemented by attempting to deserialize a Scalar from a - little-endian 32-byte string. This function can fail if the input does not - represent a Scalar in the range \[0, ``G.Order()`` - 1\]. - -- Hash (``H``): BLAKE2b-512 [#BLAKE]_ (BLAKE2b with 512-bit output and 16-byte personalization string), - and Nh = 64. + - $\mathsf{RandomScalar}()$: Implemented by returning a uniformly random + $\mathtt{Scalar}$ in the range $[0, \mathsf{G.Order}() - 1]$. Refer to + [#frost-randomscalar]_ for implementation guidance. + - $\mathsf{SerializeElement}(P)$: Implemented as $\mathsf{repr}_\mathbb{P}(P)$ + as defined in [#protocol-pallasandvesta]_. + - $\mathsf{DeserializeElement}(P)$: Implemented as $\mathsf{abst}_\mathbb{P}(P)$ + as defined in [#protocol-pallasandvesta]_, failing if $\bot$ is returned. + Additionally, this function validates that the resulting element is not the + group identity element, returning an error if the check fails. + - $\mathsf{SerializeScalar}$: Implemented by outputting the little-endian + 32-byte encoding of the $\mathtt{Scalar}$ value. + - $\mathsf{DeserializeScalar}$: Implemented by attempting to deserialize a + $\mathtt{Scalar}$ from a little-endian 32-byte string. This function can + fail if the input does not represent a $\mathtt{Scalar}$ in the range + $[0, \mathsf{G.Order}() - 1]$. + +- Hash ($\mathtt{H}$): BLAKE2b-512 [#BLAKE]_ (BLAKE2b with 512-bit output and + 16-byte personalization string), and $\mathtt{Nh} = 64$. - H1(m): Implemented by computing BLAKE2b-512("FROST_RedPallasR", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. - H2(m): Implemented by computing BLAKE2b-512("Zcash_RedPallasH", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. (This is equivalent to $\mathsf{H}^\circledast(m)$, as defined by the $\mathsf{RedPallas}$ scheme instantiated in [#protocol-concretereddsa]_.) - H3(m): Implemented by computing BLAKE2b-512("FROST_RedPallasN", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. - H4(m): Implemented by computing BLAKE2b-512("FROST_RedPallasM", m). - H5(m): Implemented by computing BLAKE2b-512("FROST_RedPallasC", m). - HR(m): Implemented by computing BLAKE2b-512("FROST_RedPallasA", m), interpreting the 64 bytes as a little-endian integer, and reducing the resulting integer - modulo ``G.Order()``. + modulo $\mathsf{G.Order}()$. Signature verification is as specified in [#protocol-concretespendauthsig]_ for RedPallas. @@ -364,25 +545,26 @@ practice this entails making sure that the generated signature can be verified by the $\mathsf{RedDSA.Validate}$ function specified in [#protocol-concretereddsa]_: -- The FROST signature, when split into R and S in the first step of +- The FROST signature, when split into $R$ and $S$ in the first step of $\mathsf{RedDSA.Validate}$, must yield the values expected by the - function. This is ensured by defining SerializeElement and SerializeScalar in - each ciphersuite to yield those values. + function. This is ensured by defining $\mathsf{SerializeElement}$ and + $\mathsf{SerializeScalar}$ in each ciphersuite to yield those values. -- The challenge c used during FROST signing must be equal to the challenge c - computed during $\mathsf{RedDSA.Validate}$. This requires defining the +- The challenge $c$ used during FROST signing must be equal to the challenge + $c$ computed during $\mathsf{RedDSA.Validate}$. This requires defining the ciphersuite H2 function as the $\mathsf{H}^\circledast(m)$ Zcash function in the ciphersuites, and making sure its input will be the same. - Fortunately FROST and Zcash use the same input order (R, public key, message) - so we just need to make sure that SerializeElement (used to compute the - encoded public key before passing to the hash function) matches what - $\mathsf{RedDSA.Validate}$ expects; which is possible since both `R` and - `vk` (the public key) are encoded in the same way as in Zcash. - -- Note that ``r`` (and thus ``R``) will not be generated as specified in RedDSA.Sign. - This is not an issue however, since with Schnorr signatures it does not matter - for the verifier how the ``r`` value was chosen, it just needs to be generated - uniformly at random, which is true for FROST. + Fortunately FROST and Zcash use the same input order ($R$, public key, message) + so we just need to make sure that $\mathsf{SerializeElement}$ (used to compute + the encoded public key before passing to the hash function) matches what + $\mathsf{RedDSA.Validate}$ expects; which is possible since both $R$ and + $\mathsf{vk}$ (the public key) are encoded in the same way as in Zcash. + +- Note that $r$ (and thus $R$) will not be generated as specified in + $\mathsf{RedDSA.Sign}$. This is not an issue however, since with Schnorr + signatures it does not matter for the verifier how the $r$ value was chosen, + it just needs to be a uniformly distributed random element, which is true for + FROST. - The above will ensure that the verification equation in $\mathsf{RedDSA.Validate}$ will pass, since FROST ensures the exact same @@ -395,59 +577,79 @@ signing generates a re-randomized signature: This is exactly what is done in the functions defined above. - The re-randomization must be done in each signature share generation, such that the aggregated signature must be valid under verification with the - randomized public key. The ``R`` value from the signature is not influenced by - the randomizer so we just need to focus on the ``z`` value (using FROST - notation). Recall that ``z`` must equal to ``r + (c * sk)``, and that each - signature share is ``z_i = (hiding_nonce + (binding_nonce * binding_factor)) + - (lambda_i * c * sk_i)``. The first terms are not influenced by the randomizer - so we can only look into the second term of each top-level addition, i.e. ``c - * sk`` must be equal to ``sum(lambda_i * c * sk_i)`` for each participant - ``i``. Under re-randomization these become ``c * (sk + randomizer)`` (see - $\mathsf{RedDSA.RandomizedPrivate}$, which refers to the randomizer as - $\alpha$) and ``sum(lambda_i * c * (sk_i + randomizer))``. The latter - can be rewritten as ``c * (sum(lambda_i * sk_i) + randomizer * - sum(lambda_i)``. Since ``sum(lambda_i * sk_i) == sk`` per the Shamir secret - sharing mechanism used by FROST, and since ``sum(lambda_i) == 1`` - [#sum-lambda-proof]_, we arrive at ``c * (sk + randomizer)`` as required. + randomized public key. This is shown to be true in [#frost-rerandomized]_. - The re-randomization procedure must be exactly the same as in [#protocol-concretereddsa]_ to ensure that re-randomized keys are uniformly distributed and signatures are unlinkable. This is also true; observe that - ``randomizer_generate`` generates randomizer uniformly at random as required - by $\mathsf{RedDSA.GenRandom}$; and signature generation is compatible - with $\mathsf{RedDSA.RandomizedPrivate}$, - $\mathsf{RedDSA.RandomizedPublic}$, $\mathsf{RedDSA.Sign}$ and - $\mathsf{RedDSA.Validate}$ as explained in the previous item. + $\mathtt{randomizer\_generate} generates randomizer uniformly at random as + required by $\mathsf{RedDSA.GenRandom}$; and signature generation is compatible + with $\mathsf{RedDSA.RandomizePrivate}$, $\mathsf{RedDSA.RandomizePublic}$, + $\mathsf{RedDSA.Sign}$ and $\mathsf{RedDSA.Validate}$ as explained in the + previous item. The security of Re-Randomized FROST with respect to the security assumptions of regular FROST is shown in [#frost-rerandomized]_. +Regarding randomizer handling, in Zcash, the $\mathtt{randomizer}$ is called +$\alpha$ and is usually generated using the $\mathsf{RedDSA.GenRandom}$ function +as defined in the Zcash specification [#protocol-spendauthsig]_. Note that the +choice of $\alpha$ influences the SIGHASH computation, so it is impossible to +compute the $\mathtt{randomizer}$ based on the message (SIGHASH), as suggested +in [#frost-rerandomized]_. This is not an issue as long as the +$\mathtt{randomizer}$ is generated with the same security properties as +$\mathsf{RedDSA.GenRandom}$. We ensure that by using a very similar approach; +while the original $\mathsf{RedDSA.GenRandom}$ uses $\mathsf{H}^\circledast(T)$ +where $T$ is a random byte sequence with a certain size, in this ZIP we +effectively use $\mathsf{H}^\circledast(T || \mathsf{signing\_commitments\_enc})$, +i.e. we concatenate the random bytes with the encoding of the signing +commitments. This preserves the security assumptions and also hedges against +issues in the Coordinator random byte generator and prevents the Coordinator +from fully influencing the randomizer, reducing its trust assumptions. + Reference implementation ======================== -The `reddsa` crate [#crate-reddsa]_ contains a re-randomized FROST implementation of -both ciphersuites. +The `reddsa` crate [#crate-reddsa]_ contains a re-randomized FROST implementation +of both ciphersuites. References ========== +.. [#BCP14] `Information on BCP 14 — "RFC 2119: Key words for use in RFCs to Indicate Requirement Levels" and "RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words" <https://www.rfc-editor.org/info/bcp14>`_ .. [#BLAKE] `BLAKE2: simpler, smaller, fast as MD5 <https://blake2.net/#sp>`_ -.. [#RFC2119] `RFC 2119: Key words for use in RFCs to Indicate Requirement Levels <https://www.rfc-editor.org/rfc/rfc2119.html>`_ .. [#FROST] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures <https://www.rfc-editor.org/rfc/rfc9591.html>`_ -.. [#frost-rerandomized] `Re-Randomized FROST <https://eprint.iacr.org/2024/436>`_ -.. [#frost-protocol] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 5: Two-Round FROST Signing Protocol <https://www.rfc-editor.org/rfc/rfc9591.html#name-two-round-frost-signing-pro>`_ -.. [#frost-removingcoordinator] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 7.3: Removing the Coordinator Role <https://www.rfc-editor.org/rfc/rfc9591.html#name-removing-the-coordinator-ro>`_ +.. [#frost-rerandomized] `Re-Randomized FROST (ePrint 2024/436) <https://eprint.iacr.org/2024/436>`_ +.. [#frost-serialization] `The ZF FROST Book, Serialization Format <https://frost.zfnd.org/user/serialization.html>`_ +.. [#frost-term-broadcast-channel] `The ZF FROST Book, Terminology — Broadcast Channel <https://frost.zfnd.org/terminology.html#broadcast-channel>`_ +.. [#frost-conventions] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 2: Conventions and Definitions <https://www.rfc-editor.org/rfc/rfc9591.html#name-conventions-and-definitions>`_ .. [#frost-primeordergroup] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 3.1: Prime-Order Group <https://www.rfc-editor.org/rfc/rfc9591.html#name-prime-order-group>`_ +.. [#frost-hash] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 3.2: Cryptographic Hash Function <https://www.rfc-editor.org/rfc/rfc9591.html#name-cryptographic-hash-function>`_ +.. [#frost-listoperations] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 4.3: List Operations <https://www.rfc-editor.org/rfc/rfc9591.html#name-list-operations>`_ +.. [#frost-protocol] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 5: Two-Round FROST Signing Protocol <https://www.rfc-editor.org/rfc/rfc9591.html#name-two-round-frost-signing-pro>`_ +.. [#frost-sign] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 5.2: Round Two - Signature Share Generation <https://www.rfc-editor.org/rfc/rfc9591.html#name-round-two-signature-share-g>`_ +.. [#frost-aggregate] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 5.3: Signature Share Aggregation <https://www.rfc-editor.org/rfc/rfc9591.html#name-signature-share-aggregation>`_ +.. [#frost-removingcoordinator] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Section 7.5: Removing the Coordinator Role <https://www.rfc-editor.org/rfc/rfc9591.html#name-removing-the-coordinator-ro>`_ .. [#frost-primeorderverify] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Appendix B: Schnorr Signature Generation and Verification for Prime-Order Groups <https://www.ietf.org/archive/id/draft-irtf-cfrg-frost-11.html#name-schnorr-signature-generatio>`_ -.. [#frost-tdkg] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Appendix B: Trusted Dealer Key Generation <https://www.rfc-editor.org/rfc/rfc9591.html#name-trusted-dealer-key-generati>`_ -.. [#frost-randomscalar] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Appendix C: Random Scalar Generation <https://www.rfc-editor.org/rfc/rfc9591.html#name-random-scalar-generation>`_ -.. [#frost-serialization] `The ZF FROST Book, Serialization Format <https://frost.zfnd.org/user/serialization.html>`_ -.. [#protocol-concretereddsa] `Zcash Protocol Specification, Version 2022.3.4 [NU5]. Section 5.4.7: RedDSA, RedJubjub, and RedPallas <protocol/protocol.pdf#concretereddsa>`_ -.. [#protocol-concretespendauthsig] `Zcash Protocol Specification, Version 2022.3.4 [NU5]. Section 5.4.7.1: Spend Authorization Signature (Sapling and Orchard) <protocol/protocol.pdf#concretespendauthsig>`_ -.. [#protocol-spendauthsig] `Zcash Protocol Specification, Version 2022.3.4 [NU5]. Section 4.15: Spend Authorization Signature (Sapling and Orchard) <protocol/protocol.pdf#spendauthsig>`_ -.. [#protocol-jubjub] `Zcash Protocol Specification, Version 2022.3.4 [NU5]. Section 5.4.9.3: Jubjub <protocol/protocol.pdf#jubjub>`_ -.. [#protocol-pallasandvesta] `Zcash Protocol Specification, Version 2022.3.4 [NU5]. Section 5.4.9.6: Pallas and Vesta <protocol/protocol.pdf#pallasandvesta>`_ -.. [#crate-reddsa] `reddsa <https://github.com/ZcashFoundation/reddsa>`_ +.. [#frost-tdkg] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Appendix C: Trusted Dealer Key Generation <https://www.rfc-editor.org/rfc/rfc9591.html#name-trusted-dealer-key-generati>`_ +.. [#frost-randomscalar] `RFC 9591: The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two-Round Schnorr Signatures. Appendix D: Random Scalar Generation <https://www.rfc-editor.org/rfc/rfc9591.html#name-random-scalar-generation>`_ +.. [#protocol-addressesandkeys] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 3.1: Payment Addresses and Keys <protocol/protocol.pdf#addressesandkeys>`_ +.. [#protocol-abstractsigrerand] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 4.1.7.1: Signature with Re-Randomizable Keys <protocol/protocol.pdf#abstractsigrerand>`_ +.. [#protocol-abstractgroup] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 4.1.9: Represented Group <protocol/protocol.pdf#abstractgroup>`_ +.. [#protocol-saplingkeycomponents] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 4.2.2: Sapling Key Components <protocol/protocol.pdf#saplingkeycomponents>`_ +.. [#protocol-orchardkeycomponents] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 4.2.3: Orchard Key Components <protocol/protocol.pdf#orchardkeycomponents>`_ +.. [#protocol-spendauthsig] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 4.15: Spend Authorization Signature (Sapling and Orchard) <protocol/protocol.pdf#spendauthsig>`_ +.. [#protocol-concretereddsa] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 5.4.7: RedDSA, RedJubjub, and RedPallas <protocol/protocol.pdf#concretereddsa>`_ +.. [#protocol-concretespendauthsig] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 5.4.7.1: Spend Authorization Signature (Sapling and Orchard) <protocol/protocol.pdf#concretespendauthsig>`_ +.. [#protocol-jubjub] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 5.4.9.3: Jubjub <protocol/protocol.pdf#jubjub>`_ +.. [#protocol-pallasandvesta] `Zcash Protocol Specification, Version 2025.6.1 [NU6.1]. Section 5.4.9.6: Pallas and Vesta <protocol/protocol.pdf#pallasandvesta>`_ +.. [#crate-reddsa] `reddsa Rust crate <https://github.com/ZcashFoundation/reddsa>`_ .. [#sum-lambda-proof] `Prove that the sum of the Lagrange (interpolation) coefficients is equal to 1 <https://math.stackexchange.com/questions/1325292/prove-that-the-sum-of-the-lagrange-interpolation-coefficients-is-equal-to-1/1325342#1325342>`_ +.. [#zf-frost-dkg] `FROST reference implementation (ZcashFoundation/frost) — Distributed Key Generation <https://github.com/ZcashFoundation/frost/blob/main/frost-core/src/keys/dkg.rs>`_ +.. [#cocktail-dkg] `COCKTAIL-DKG: Distributed Key Generation protocol for FROST <https://c2sp.org/cocktail-dkg>`_ (v0.2.0 draft at [#cocktail-dkg-draft]_) +.. [#cocktail-dkg-draft] `C2SP Pull Request 194 — cocktail-dkg: add application-specific data to transcript hash <https://github.com/C2SP/C2SP/pull/194>`_ +.. [#draft-zip-0374] `Draft ZIP 374 (zcash/zips PR 1063): Partially Created Zcash Transaction Format <https://github.com/zcash/zips/pull/1063>`_ +.. [#zip-2005] `ZIP 2005: Quantum recoverability <zip-2005.md>`_ +.. [#zip-2005-usage-with-frost] `ZIP 2005: Quantum recoverability - Usage with FROST <zip-2005.md#usage-with-frost>`_
zips/zip-guide-markdown.md +11 −10
@@ -158,19 +158,20 @@ ZIP editors will catch any inconsistencies in review. <div class="note"></div> -"`.. note::`" in reStructuredText or "`<div class="note"></div>`" in Markdown -(followed by a blank line in either case), can be used for an aside from the main -text. The rendering of notes is colourful and may be distracting, so they should -only be used for important points. +"`.. note::`" (followed by a block indented 4 spaces) in reStructuredText, or +"`<div class="note"></div>`" (with a blank line before the following paragraph) +in Markdown, can be used for an aside from the main text. The rendering of notes +is colourful and may be distracting, so they should only be used for important +points. <div class="warning"></div> -"`.. warning::`" in reStructuredText or "`<div class="warning"></div>`" in -Markdown (followed by a blank line in either case), can be used for warnings. -Warnings should be used very sparingly — for example to signal that a -entire specification, or part of it, may be inapplicable or could cause -significant interoperability or security problems. In most cases, a "MUST" -or "SHOULD" conformance requirement is more appropriate. +"`.. warning::`" (followed by a block indented 4 spaces) in reStructuredText, or +"`<div class="warning"></div>`" (with a blank line before the following paragraph) +in Markdown, can be used for warnings. Warnings should be used very sparingly — +for example to signal that an entire specification, or part of it, may be +inapplicable or could cause significant interoperability or security problems. +In most cases, a "MUST" or "SHOULD" conformance requirement is more appropriate. In Markdown, notes and warnings can currently only be a single paragraph.
zips/zip-guide.rst +7 −6
@@ -167,18 +167,19 @@ Notes and warnings ------------------ .. note:: - "``.. note::``" in reStructuredText or "``<div class="note"></div>``" in - Markdown (followed by a blank line in either case), can be used for an aside - from the main text. + "``.. note::``" (followed by a block indented 4 spaces) in reStructuredText, + or "``<div class="note"></div>``" (with a blank line before the following + paragraph) in Markdown, can be used for an aside from the main text. The rendering of notes is colourful and may be distracting, so they should only be used for important points. .. warning:: - "``.. warning::``" in reStructuredText, or "``<div class="warning"></div>``" - in Markdown (followed by a blank line in either case), can be used for warnings. + "``.. warning::``" (followed by a block indented 4 spaces) in reStructuredText, + or "``<div class="warning"></div>``" (with a blank line before the following + paragraph) in Markdown, can be used for warnings. - Warnings should be used very sparingly — for example to signal that a + Warnings should be used very sparingly — for example to signal that an entire specification, or part of it, may be inapplicable or could cause significant interoperability or security problems. In most cases, a "MUST" or "SHOULD" conformance requirement is more appropriate.