Struct schnorrkel::context::XoFTranscript

pub struct XoFTranscript<H>(_)
 where
    H: Input + ExtendableOutput + Clone;

Very simple transcript construction from a modern hash fucntion.

We provide this transcript type to directly use conventional hash functions with an extensible output mode, like Shake128 and Blake2x.

We recommend using merlin::Transcript instead because merlin provides the transcript abstraction natively and might function better in low memory enviroments. We therefore do not provide conveniences like signing_context for this.

We note that merlin already uses Keccak, upon which Shak128 is based, and that no rust implementation for Blake2x currently exists.

We caution that our transcript abstractions cannot provide the protections agsint hash collisions that Ed25519 provides via double hashing, but that prehashed Ed25519 variants loose. As such, any hash function used here must be collision resistant. We strongly recommend agsint building XOFs from weaker hash functions like SHA1 with HKDF constructions or similar.

In XoFTranscript style, we never expose the hash function H underlying this type, so that developers cannot circument the domain seperartion provided by our methods. We do this to make &mut XoFTranscript : SigningTranscript safe.

Implementations

impl<H> XoFTranscript<H> where
    H: Input + ExtendableOutput + Clone, 

pub fn new(h: H) -> XoFTranscript<H>

Create a XoFTranscript from a conventional hash functions with an extensible output mode.

We intentionally consume and never reexpose the hash function provided, so that our domain seperation works correctly even when using &mut XoFTranscript : SigningTranscript.

Trait Implementations

impl<H> From<H> for XoFTranscript<H> where
    H: Input + ExtendableOutput + Clone, 

fn from(h: H) -> XoFTranscript<H>

Performs the conversion.

impl<H> SigningTranscript for XoFTranscript<H> where
    H: Input + ExtendableOutput + Clone, 

fn commit_bytes(&mut self, label: &'static [u8], bytes: &[u8])

Extend transcript with some bytes, shadowed by merlin::Transcript.

fn challenge_bytes(&mut self, label: &'static [u8], dest: &mut [u8])

Produce some challenge bytes, shadowed by merlin::Transcript.

fn witness_bytes_rng<R>(
    &self,
    label: &'static [u8],
    dest: &mut [u8],
    nonce_seeds: &[&[u8]],
    rng: R
) where
    R: RngCore + CryptoRng, 

Produce secret witness bytes from the protocol transcript and any "nonce seeds" kept with the secret keys.

fn proto_name(&mut self, label: &'static [u8])

Extend transcript with a protocol name

fn commit_point(
    &mut self,
    label: &'static [u8],
    compressed: &CompressedRistretto
)

Extend the transcript with a compressed Ristretto point

fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar

Produce the public challenge scalar e.

fn witness_scalar(&self, label: &'static [u8], nonce_seeds: &[&[u8]]) -> Scalar

Produce a secret witness scalar k, aka nonce, from the protocol transcript and any "nonce seeds" kept with the secret keys.

fn witness_bytes(
    &self,
    label: &'static [u8],
    dest: &mut [u8],
    nonce_seeds: &[&[u8]]
)

Produce secret witness bytes from the protocol transcript and any "nonce seeds" kept with the secret keys.