Interface Ciphersuite

A FROST ciphersuite specifies the underlying prime-order group details and cryptographic hash function.

This is the unified Ciphersuite interface that combines both hierarchical access (via group) and flattened methods for convenience.

See

https://datatracker.ietf.org/doc/html/rfc9591#name-ciphersuites

interface Ciphersuite {
    ID: string;
    group: Group;
    Scalar: unknown;
    Element: unknown;
    VerifyingKey: unknown;
    SigningKey: unknown;
    SIGNATURE_LENGTH?: number;
    scalarZero(): unknown;
    scalarOne(): unknown;
    scalarInvert(scalar: unknown): unknown;
    scalarRandom(rng: { fill(array: Uint8Array): void }): unknown;
    serializeScalar(scalar: unknown): Uint8Array;
    deserializeScalar(bytes: Uint8Array): unknown;
    scalarAdd(a: unknown, b: unknown): unknown;
    scalarSub(a: unknown, b: unknown): unknown;
    scalarMul(a: unknown, b: unknown): unknown;
    scalarsEqual(a: unknown, b: unknown): boolean;
    elementSize(): number;
    scalarSize(): number;
    cofactor(): unknown;
    identity(): unknown;
    generator(): unknown;
    serializeElement(element: unknown): Uint8Array;
    deserializeElement(bytes: Uint8Array): unknown;
    elementAdd(a: unknown, b: unknown): unknown;
    elementSub(a: unknown, b: unknown): unknown;
    elementMul(element: unknown, scalar: unknown): unknown;
    scalarBaseMult(scalar: unknown): unknown;
    elementsEqual(a: unknown, b: unknown): boolean;
    isIdentity(element: unknown): boolean;
    H1(m: Uint8Array): unknown;
    H2(m: Uint8Array): unknown;
    H3(m: Uint8Array): unknown;
    H4(m: Uint8Array): Uint8Array;
    H5(m: Uint8Array): Uint8Array;
    HDKG?(m: Uint8Array): unknown;
    HID?(m: Uint8Array): unknown;
    singleSign?(
        signingKey: unknown,
        message: Uint8Array,
        rng: { fill(array: Uint8Array): void },
    ): unknown;
    verifySignature?(
        verifyingKey: unknown,
        message: Uint8Array,
        signature: unknown,
    ): boolean;
    serializeSignature?(signature: unknown): Uint8Array;
    deserializeSignature?(bytes: Uint8Array): unknown;
    challenge(
        R: unknown,
        verifyingKey: unknown,
        message: Uint8Array,
    ): Challenge<Ciphersuite>;
    preSign?<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        signerNonces: SigningNoncesLike<C>,
        keyPackage: KeyPackageLike<C>,
    ): {
        signingPackage: SigningPackage<C>;
        signerNonces: SigningNoncesLike<C>;
        keyPackage: KeyPackageLike<C>;
    };
    preCommitmentSign?<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        signingNonces: SigningNoncesLike<C>,
        bindingFactorList: BindingFactorList<C>,
    ): {
        signingPackage: SigningPackage<C>;
        signerNonces: SigningNoncesLike<C>;
    };
    computeSignatureShare?<C extends Ciphersuite>(
        groupCommitment: GroupCommitment<C>,
        signerNonces: SigningNoncesLike<C>,
        bindingFactor: BindingFactor<C>,
        lambdaI: unknown,
        keyPackage: KeyPackageLike<C>,
        challenge: Challenge<C>,
    ): SignatureShareLike<C>;
    verifyShare?<C extends Ciphersuite>(
        groupCommitment: GroupCommitment<C>,
        signatureShare: SignatureShareLike<C>,
        identifier: IdentifierLike<C>,
        groupCommitmentShare: GroupCommitmentShareLike<C>,
        verifyingShare: VerifyingShareLike<C>,
        lambdaI: unknown,
        challenge: Challenge<C>,
        groupVerifyingKey?: unknown,
    ): void;
    computeBindingFactorList<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        verifyingKey: unknown,
        additionalPrefix: Uint8Array,
    ): BindingFactorList<C>;
    computeGroupCommitment<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        bindingFactorList: BindingFactorList<C>,
    ): GroupCommitment<C>;
    deriveInterpolatingValue<C extends Ciphersuite>(
        signerId: IdentifierLike<C>,
        signingPackage: SigningPackage<C>,
    ): unknown;
    postDkg?<C extends Ciphersuite>(
        keyPackage: KeyPackageLike<C>,
        publicKeyPackage: PublicKeyPackageLike<C>,
    ): [KeyPackageLike<C>, PublicKeyPackageLike<C>];
}

Properties

`Readonly`ID

ID: string

The ciphersuite ID string. It should be equal to the contextString in the spec. For new ciphersuites, this should be a string that identifies the ciphersuite; it's recommended to use a similar format to the ciphersuites in the FROST spec, e.g. "FROST-RISTRETTO255-SHA512-v1".

`Readonly`group

group: Group

The prime order group (or subgroup) that this ciphersuite operates over. Provides access to Field and Group operations in a hierarchical manner.

Scalar

Scalar: unknown

The scalar type for this ciphersuite

Element

Element: unknown

The element type for this ciphersuite

VerifyingKey

VerifyingKey: unknown

The verifying key type

SigningKey

SigningKey: unknown

The signing key type

`Optional`SIGNATURE_LENGTH

SIGNATURE_LENGTH?: number

The length of a serialized signature in bytes. Defaults to elementSize() + scalarSize() if not specified. For BIP-340/Taproot ciphersuites this is typically 64 (2 * scalarSize).

Methods

scalarZero

scalarZero(): unknown
Returns the zero element of the field, the additive identity.

Returns unknown
- Defined in types.ts:251

scalarOne

scalarOne(): unknown
Returns the one element of the field, the multiplicative identity.

Returns unknown
- Defined in types.ts:256

scalarInvert

scalarInvert(scalar: unknown): unknown
Computes the multiplicative inverse of an element of the scalar field.
Parameters
- scalar: unknown
Returns unknown
Throws
Error if the element is zero
- Defined in types.ts:262

scalarRandom

scalarRandom(rng: { fill(array: Uint8Array): void }): unknown
Generate a random scalar from the entire space [0, l-1]
Parameters
- rng: { fill(array: Uint8Array): void }
Returns unknown
- Defined in types.ts:267

serializeScalar

serializeScalar(scalar: unknown): Uint8Array
Serialize a scalar to bytes.
Parameters
- scalar: unknown
Returns Uint8Array
- Defined in types.ts:272

deserializeScalar

deserializeScalar(bytes: Uint8Array): unknown
Deserialize a scalar from bytes.
Parameters
- bytes: Uint8Array
Returns unknown
Throws
Error if the bytes are not a valid scalar encoding
- Defined in types.ts:278

scalarAdd

scalarAdd(a: unknown, b: unknown): unknown
Add two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in types.ts:283

scalarSub

scalarSub(a: unknown, b: unknown): unknown
Subtract two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in types.ts:288

scalarMul

scalarMul(a: unknown, b: unknown): unknown
Multiply two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in types.ts:293

scalarsEqual

scalarsEqual(a: unknown, b: unknown): boolean
Check if two scalars are equal.
Parameters
- a: unknown
- b: unknown
Returns boolean
- Defined in types.ts:298

elementSize

elementSize(): number
Returns the size in bytes of a serialized element.

Returns number
- Defined in types.ts:305

scalarSize

scalarSize(): number
Returns the size in bytes of a serialized scalar.

Returns number
- Defined in types.ts:310

cofactor

cofactor(): unknown
The order of the quotient group when the prime order subgroup divides the order of the full curve group. For prime order curves, this should return 1.

Returns unknown
- Defined in types.ts:316

identity

identity(): unknown
Additive identity of the prime order group.

Returns unknown
- Defined in types.ts:321

generator

generator(): unknown
The fixed generator element of the prime order group.

Returns unknown
- Defined in types.ts:326

serializeElement

serializeElement(element: unknown): Uint8Array
Serialize an element to bytes.
Parameters
- element: unknown
Returns Uint8Array
Throws
Error if the element is the identity
- Defined in types.ts:332

deserializeElement

deserializeElement(bytes: Uint8Array): unknown
Deserialize an element from bytes.
Parameters
- bytes: Uint8Array
Returns unknown
Throws
Error if the bytes are not a valid element encoding or represent the identity
- Defined in types.ts:338

elementAdd

elementAdd(a: unknown, b: unknown): unknown
Add two group elements.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in types.ts:343

elementSub

elementSub(a: unknown, b: unknown): unknown
Subtract two group elements.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in types.ts:348

elementMul

elementMul(element: unknown, scalar: unknown): unknown
Multiply a group element by a scalar.
Parameters
- element: unknown
- scalar: unknown
Returns unknown
- Defined in types.ts:353

scalarBaseMult

scalarBaseMult(scalar: unknown): unknown
Scalar multiplication with the generator (g * scalar).
Parameters
- scalar: unknown
Returns unknown
- Defined in types.ts:358

elementsEqual

elementsEqual(a: unknown, b: unknown): boolean
Check if two elements are equal.
Parameters
- a: unknown
- b: unknown
Returns boolean
- Defined in types.ts:363

isIdentity

isIdentity(element: unknown): boolean
Check if an element is the identity.
Parameters
- element: unknown
Returns boolean
- Defined in types.ts:368

H1

H1(m: Uint8Array): unknown
H1 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in types.ts:379

H2

H2(m: Uint8Array): unknown
H2 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in types.ts:388

H3

H3(m: Uint8Array): unknown
H3 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in types.ts:397

H4

H4(m: Uint8Array): Uint8Array
H4 for a FROST ciphersuite.

Usually an alias for the ciphersuite hash function H with domain separation applied.
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in types.ts:406

H5

H5(m: Uint8Array): Uint8Array
H5 for a FROST ciphersuite.

Usually an alias for the ciphersuite hash function H with domain separation applied.
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in types.ts:415

`Optional`HDKG

HDKG?(m: Uint8Array): unknown
Hash function for a FROST ciphersuite, used for the DKG.

The DKG is not part of the specification, thus this is optional. Returns null if DKG is not supported by the Ciphersuite.

Maps arbitrary inputs to non-zero Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
- Defined in types.ts:425

`Optional`HID

HID?(m: Uint8Array): unknown
Hash function for a FROST ciphersuite, used for deriving identifiers from strings.

This feature is not part of the specification and is just a convenient way of creating identifiers. Returns null if this is not supported.

Maps arbitrary inputs to non-zero Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
- Defined in types.ts:435

`Optional`singleSign

singleSign?(
    signingKey: unknown,
    message: Uint8Array,
    rng: { fill(array: Uint8Array): void },
): unknown
Optional. Single-signer Schnorr signing. If provided, allows for optimized single-party signing without the full FROST protocol.
Parameters
- signingKey: unknown
- message: Uint8Array
- rng: { fill(array: Uint8Array): void }
Returns unknown
- Defined in types.ts:443

`Optional`verifySignature

verifySignature?(
    verifyingKey: unknown,
    message: Uint8Array,
    signature: unknown,
): boolean
Optional. Verify a Schnorr signature. If provided, allows for direct signature verification without going through FROST.
Parameters
- verifyingKey: unknown
- message: Uint8Array
- signature: unknown
Returns boolean
- Defined in types.ts:453

`Optional`serializeSignature

serializeSignature?(signature: unknown): Uint8Array
Optional. Serialize a signature to bytes. If provided, allows for custom signature serialization.
Parameters
- signature: unknown
Returns Uint8Array
- Defined in types.ts:463

`Optional`deserializeSignature

deserializeSignature?(bytes: Uint8Array): unknown
Optional. Deserialize a signature from bytes. If provided, allows for custom signature deserialization.
Parameters
- bytes: Uint8Array
Returns unknown
- Defined in types.ts:469

challenge

challenge(
    R: unknown,
    verifyingKey: unknown,
    message: Uint8Array,
): Challenge<Ciphersuite>
Optional. Generates the challenge as is required for Schnorr signatures. Called by round2.sign() and aggregate().
Parameters
- R: unknown
- verifyingKey: unknown
- message: Uint8Array
Returns Challenge<Ciphersuite>
- Defined in types.ts:477

`Optional`preSign

preSign?<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    signerNonces: SigningNoncesLike<C>,
    keyPackage: KeyPackageLike<C>,
): {
    signingPackage: SigningPackage<C>;
    signerNonces: SigningNoncesLike<C>;
    keyPackage: KeyPackageLike<C>;
}
Optional. Pre-process round2.sign() inputs. Returns the same values or modified versions.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- signerNonces: SigningNoncesLike<C>
- keyPackage: KeyPackageLike<C>
Returns {
    signingPackage: SigningPackage<C>;
    signerNonces: SigningNoncesLike<C>;
    keyPackage: KeyPackageLike<C>;
}
- Defined in types.ts:487

`Optional`preCommitmentSign

preCommitmentSign?<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    signingNonces: SigningNoncesLike<C>,
    bindingFactorList: BindingFactorList<C>,
): { signingPackage: SigningPackage<C>; signerNonces: SigningNoncesLike<C> }
Optional. Pre-process compute_group_commitment() inputs in round2.sign().
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- signingNonces: SigningNoncesLike<C>
- bindingFactorList: BindingFactorList<C>
Returns { signingPackage: SigningPackage<C>; signerNonces: SigningNoncesLike<C> }
- Defined in types.ts:500

`Optional`computeSignatureShare

computeSignatureShare?<C extends Ciphersuite>(
    groupCommitment: GroupCommitment<C>,
    signerNonces: SigningNoncesLike<C>,
    bindingFactor: BindingFactor<C>,
    lambdaI: unknown,
    keyPackage: KeyPackageLike<C>,
    challenge: Challenge<C>,
): SignatureShareLike<C>
Optional. Compute the signature share for a particular signer. Called by round2.sign().
Type Parameters
- C extends Ciphersuite
Parameters
- groupCommitment: GroupCommitment<C>
- signerNonces: SigningNoncesLike<C>
- bindingFactor: BindingFactor<C>
- lambdaI: unknown
- keyPackage: KeyPackageLike<C>
- challenge: Challenge<C>
Returns SignatureShareLike<C>
- Defined in types.ts:513

`Optional`verifyShare

verifyShare?<C extends Ciphersuite>(
    groupCommitment: GroupCommitment<C>,
    signatureShare: SignatureShareLike<C>,
    identifier: IdentifierLike<C>,
    groupCommitmentShare: GroupCommitmentShareLike<C>,
    verifyingShare: VerifyingShareLike<C>,
    lambdaI: unknown,
    challenge: Challenge<C>,
    groupVerifyingKey?: unknown,
): void
Optional. Verify a signing share. Called by aggregate() if cheater detection is enabled.
Type Parameters
- C extends Ciphersuite
Parameters
- groupCommitment: GroupCommitment<C>
- signatureShare: SignatureShareLike<C>
- identifier: IdentifierLike<C>
- groupCommitmentShare: GroupCommitmentShareLike<C>
- verifyingShare: VerifyingShareLike<C>
- lambdaI: unknown
- challenge: Challenge<C>
- OptionalgroupVerifyingKey: unknown
  Optional group verifying key for ciphersuites that need it (e.g., BIP-340)
Returns void
- Defined in types.ts:527

computeBindingFactorList

computeBindingFactorList<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    verifyingKey: unknown,
    additionalPrefix: Uint8Array,
): BindingFactorList<C>
Compute binding factors for all participants.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- verifyingKey: unknown
- additionalPrefix: Uint8Array
Returns BindingFactorList<C>
- Defined in types.ts:543

computeGroupCommitment

computeGroupCommitment<C extends Ciphersuite>(
signingPackage: SigningPackage<C>,
bindingFactorList: BindingFactorList<C>,
): GroupCommitment<C>
Compute the group commitment from all signing commitments.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- bindingFactorList: BindingFactorList<C>
Returns GroupCommitment<C>
- Defined in types.ts:552

deriveInterpolatingValue

deriveInterpolatingValue<C extends Ciphersuite>(
signerId: IdentifierLike<C>,
signingPackage: SigningPackage<C>,
): unknown
Compute the Lagrange coefficient for a participant.
Type Parameters
- C extends Ciphersuite
Parameters
- signerId: IdentifierLike<C>
- signingPackage: SigningPackage<C>
Returns unknown
- Defined in types.ts:560

`Optional`postDkg

postDkg?<C extends Ciphersuite>(
keyPackage: KeyPackageLike<C>,
publicKeyPackage: PublicKeyPackageLike<C>,
): [KeyPackageLike<C>, PublicKeyPackageLike<C>]
Optional. Post-process DKG output (called at the end of part3). Used for ciphersuites that need to apply transformations after DKG, such as taproot tweaking for secp256k1-tr.
Type Parameters
- C extends Ciphersuite
Parameters
- keyPackage: KeyPackageLike<C>
- publicKeyPackage: PublicKeyPackageLike<C>
Returns [KeyPackageLike<C>, PublicKeyPackageLike<C>]
- Defined in types.ts:570

Interface Ciphersuite

See

Index

Properties

Methods

Properties

ReadonlyID

Readonlygroup

Scalar

Element

VerifyingKey

SigningKey

OptionalSIGNATURE_LENGTH

Methods

scalarZero

Returns unknown

scalarOne

Returns unknown

scalarInvert

Parameters

Returns unknown

Throws

scalarRandom

Parameters

Returns unknown

serializeScalar

Parameters

Returns Uint8Array

deserializeScalar

Parameters

Returns unknown

Throws

scalarAdd

Parameters

Returns unknown

scalarSub

Parameters

Returns unknown

scalarMul

Parameters

Returns unknown

scalarsEqual

Parameters

Returns boolean

elementSize

Returns number

scalarSize

Returns number

cofactor

Returns unknown

identity

Returns unknown

generator

Returns unknown

serializeElement

Parameters

Returns Uint8Array

Throws

deserializeElement

Parameters

Returns unknown

Throws

elementAdd

Parameters

Returns unknown

elementSub

Parameters

Returns unknown

elementMul

Parameters

Returns unknown

scalarBaseMult

Parameters

Returns unknown

elementsEqual

Parameters

Returns boolean

isIdentity

Parameters

Returns boolean

`Readonly`ID

`Readonly`group

`Optional`SIGNATURE_LENGTH

`Optional`HDKG

`Optional`HID

`Optional`singleSign

`Optional`verifySignature

`Optional`serializeSignature

`Optional`deserializeSignature

`Optional`preSign

Returns {
signingPackage: SigningPackage<C>;
signerNonces: SigningNoncesLike<C>;
keyPackage: KeyPackageLike<C>;
}

`Optional`preCommitmentSign

`Optional`computeSignatureShare

`Optional`verifyShare

`Optional`postDkg