Properly handle BIP-340 Schnorr signatures with or without BIP-341 taproot tweaked keys

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wsts"
-version = "9.2.0"
+version = "10.0.0"
 edition = "2021"
 authors = ["Joey Yandle <[email protected]>"]
 license = "Apache-2.0"

src/compute.rs

@@ -158,7 +158,12 @@ pub fn tweak(public_key: &Point, merkle_root: Option<[u8; 32]>) -> Scalar {
 
 /// Create a BIP341 compliant taproot tweak from a public key and merkle root
 pub fn tweaked_public_key(public_key: &Point, merkle_root: Option<[u8; 32]>) -> Point {
-    public_key + tweak(public_key, merkle_root) * G
+    tweaked_public_key_from_tweak(public_key, tweak(public_key, merkle_root))
+}
+
+/// Create a BIP341 compliant taproot tweak from a public key and a pre-calculated tweak
+pub fn tweaked_public_key_from_tweak(public_key: &Point, tweak: Scalar) -> Point {
+    Point::lift_x(&public_key.x()).unwrap() + tweak * G
 }
 
 /// Create a taproot style merkle root from the serialized script data

src/net.rs

@@ -273,10 +273,8 @@ pub struct NonceRequest {
     pub sign_iter_id: u64,
     /// The message to sign
     pub message: Vec<u8>,
-    /// Whether to make a taproot signature
-    pub is_taproot: bool,
-    /// Taproot merkle root
-    pub merkle_root: Option<MerkleRoot>,
+    /// What type of signature to create
+    pub signature_type: SignatureType,
 }
 
 impl Debug for NonceRequest {
@@ -286,8 +284,7 @@ impl Debug for NonceRequest {
             .field("sign_id", &self.sign_id)
             .field("sign_iter_id", &self.sign_iter_id)
             .field("message", &hex::encode(&self.message))
-            .field("is_taproot", &self.is_taproot)
-            .field("merkle_root", &self.merkle_root.as_ref().map(hex::encode))
+            .field("signature_type", &self.signature_type)
             .finish()
     }
 }
@@ -299,10 +296,7 @@ impl Signable for NonceRequest {
         hasher.update(self.sign_id.to_be_bytes());
         hasher.update(self.sign_iter_id.to_be_bytes());
         hasher.update(self.message.as_slice());
-        hasher.update((self.is_taproot as u16).to_be_bytes());
-        if let Some(merkle_root) = self.merkle_root {
-            hasher.update(merkle_root);
-        }
+        hasher.update(format!("{:?}", self.signature_type));
     }
 }
 
@@ -367,6 +361,17 @@ impl Signable for NonceResponse {
     }
 }
 
+#[derive(Clone, Serialize, Deserialize, Debug, PartialEq)]
+/// Signature type
+pub enum SignatureType {
+    /// FROST signature
+    Frost,
+    /// BIP-340 Schnorr proof
+    Schnorr,
+    /// BIP-341 Taproot style schnorr proof with a merkle root
+    Taproot(Option<MerkleRoot>),
+}
+
 #[derive(Clone, Serialize, Deserialize, PartialEq)]
 /// Signature share request message from coordinator to signers
 pub struct SignatureShareRequest {
@@ -380,10 +385,8 @@ pub struct SignatureShareRequest {
     pub nonce_responses: Vec<NonceResponse>,
     /// Bytes to sign
     pub message: Vec<u8>,
-    /// Whether to make a taproot signature
-    pub is_taproot: bool,
-    /// Taproot merkle root
-    pub merkle_root: Option<MerkleRoot>,
+    /// What type of signature to create
+    pub signature_type: SignatureType,
 }
 
 impl Debug for SignatureShareRequest {
@@ -394,8 +397,7 @@ impl Debug for SignatureShareRequest {
             .field("sign_iter_id", &self.sign_iter_id)
             .field("nonce_responses", &self.nonce_responses)
             .field("message", &hex::encode(&self.message))
-            .field("is_taproot", &self.is_taproot)
-            .field("merkle_root", &self.merkle_root.as_ref().map(hex::encode))
+            .field("signature_type", &self.signature_type)
             .finish()
     }
 }
@@ -411,11 +413,7 @@ impl Signable for SignatureShareRequest {
         }
 
         hasher.update(self.message.as_slice());
-
-        hasher.update((self.is_taproot as u16).to_be_bytes());
-        if let Some(merkle_root) = self.merkle_root {
-            hasher.update(merkle_root);
-        }
+        hasher.update(format!("{:?}", self.signature_type));
     }
 }
 
@@ -792,8 +790,7 @@ mod test {
             sign_id: 0,
             sign_iter_id: 0,
             message: vec![],
-            is_taproot: false,
-            merkle_root: None,
+            signature_type: SignatureType::Frost,
         };
         let msg = Message::NonceRequest(nonce_request.clone());
         let coordinator_packet_nonce_request = Packet {
@@ -862,8 +859,7 @@ mod test {
             sign_iter_id: 0,
             nonce_responses: vec![],
             message: vec![],
-            is_taproot: false,
-            merkle_root: None,
+            signature_type: SignatureType::Frost,
         };
         let msg = Message::SignatureShareRequest(signature_share_request.clone());
         let coordinator_packet_signature_share_request = Packet {