Interface Ristretto255Sha512Impl

An implementation of the FROST(ristretto255, SHA-512) ciphersuite.

This ciphersuite uses:

ristretto255 group for group operations
SHA-512 for hashing
32-byte serialization for both scalars and points

The ciphersuite follows RFC 9591 Section 6.2 specification.

interface Ristretto255Sha512Impl {
    ID: "FROST-RISTRETTO255-SHA512-v1";
    group: RistrettoGroupImpl;
    Scalar: Ristretto255Scalar;
    Element: Ristretto255Point;
    VerifyingKey: VerifyingKey<Ristretto255Sha512Impl>;
    SigningKey: SigningKey<Ristretto255Sha512Impl>;
    scalarZero(): Ristretto255Scalar;
    scalarOne(): Ristretto255Scalar;
    scalarInvert(scalar: Ristretto255Scalar): Ristretto255Scalar;
    scalarRandom(rng: { fill(array: Uint8Array): void }): Ristretto255Scalar;
    serializeScalar(scalar: Ristretto255Scalar): Uint8Array;
    deserializeScalar(bytes: Uint8Array): Ristretto255Scalar;
    scalarAdd(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar;
    scalarSub(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar;
    scalarMul(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar;
    scalarsEqual(a: Ristretto255Scalar, b: Ristretto255Scalar): boolean;
    elementSize(): number;
    scalarSize(): number;
    cofactor(): Ristretto255Scalar;
    identity(): Ristretto255Point;
    generator(): Ristretto255Point;
    serializeElement(element: Ristretto255Point): Uint8Array;
    deserializeElement(bytes: Uint8Array): Ristretto255Point;
    elementAdd(a: Ristretto255Point, b: Ristretto255Point): Ristretto255Point;
    elementSub(a: Ristretto255Point, b: Ristretto255Point): Ristretto255Point;
    elementMul(
        element: Ristretto255Point,
        scalar: Ristretto255Scalar,
    ): Ristretto255Point;
    scalarBaseMult(scalar: Ristretto255Scalar): Ristretto255Point;
    elementsEqual(a: Ristretto255Point, b: Ristretto255Point): boolean;
    isIdentity(element: Ristretto255Point): boolean;
    H1(m: Uint8Array): Ristretto255Scalar;
    H2(m: Uint8Array): Ristretto255Scalar;
    H3(m: Uint8Array): Ristretto255Scalar;
    H4(m: Uint8Array): Uint8Array;
    H5(m: Uint8Array): Uint8Array;
    HDKG(m: Uint8Array): Ristretto255Scalar | null;
    HID(m: Uint8Array): Ristretto255Scalar | null;
    hashRandomizer(m: Uint8Array): Ristretto255Scalar | null;
    challenge(
        R: Ristretto255Point,
        verifyingKey: unknown,
        message: Uint8Array,
    ): Challenge<Ristretto255Sha512Impl>;
    computeBindingFactorList<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        verifyingKey: unknown,
        additionalPrefix: Uint8Array,
    ): BindingFactorList<C>;
    computeGroupCommitment<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        bindingFactorList: BindingFactorList<C>,
    ): GroupCommitment<C>;
    deriveInterpolatingValue<C extends Ciphersuite>(
        signerId: {
            toScalar(): unknown;
            serialize(): Uint8Array;
            clone(): unknown;
        },
        signingPackage: SigningPackage<C>,
    ): Ristretto255Scalar;
}

Implements

RandomizedCiphersuite

Properties

`Readonly`ID

ID: "FROST-RISTRETTO255-SHA512-v1" = CONTEXT_STRING

The ciphersuite ID string. It should be equal to the contextString in the spec. For new ciphersuites, this should be a string that identifies the ciphersuite; it's recommended to use a similar format to the ciphersuites in the FROST spec, e.g. "FROST-RISTRETTO255-SHA512-v1".

`Readonly`group

group: RistrettoGroupImpl

The prime order group (or subgroup) that this ciphersuite operates over. Provides access to Field and Group operations in a hierarchical manner.

Scalar

Scalar: Ristretto255Scalar

The scalar type for this ciphersuite

Element

Element: Ristretto255Point

The element type for this ciphersuite

VerifyingKey

VerifyingKey: VerifyingKey<Ristretto255Sha512Impl>

The verifying key type

SigningKey

SigningKey: SigningKey<Ristretto255Sha512Impl>

The signing key type

Methods

scalarZero

scalarZero(): Ristretto255Scalar
Returns the zero element of the field, the additive identity.

Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarZero
- Defined in ristretto255/src/index.ts:605

scalarOne

scalarOne(): Ristretto255Scalar
Returns the one element of the field, the multiplicative identity.

Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarOne
- Defined in ristretto255/src/index.ts:609

scalarInvert

scalarInvert(scalar: Ristretto255Scalar): Ristretto255Scalar
Computes the multiplicative inverse of an element of the scalar field.
Parameters
- scalar: Ristretto255Scalar
Returns Ristretto255Scalar
Throws
Error if the element is zero
Implementation of RandomizedCiphersuite.scalarInvert
- Defined in ristretto255/src/index.ts:613

scalarRandom

scalarRandom(rng: { fill(array: Uint8Array): void }): Ristretto255Scalar
Generate a random scalar from the entire space [0, l-1]
Parameters
- rng: { fill(array: Uint8Array): void }
Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarRandom
- Defined in ristretto255/src/index.ts:617

serializeScalar

serializeScalar(scalar: Ristretto255Scalar): Uint8Array
Serialize a scalar to bytes.
Parameters
- scalar: Ristretto255Scalar
Returns Uint8Array
Implementation of RandomizedCiphersuite.serializeScalar
- Defined in ristretto255/src/index.ts:621

deserializeScalar

deserializeScalar(bytes: Uint8Array): Ristretto255Scalar
Deserialize a scalar from bytes.
Parameters
- bytes: Uint8Array
Returns Ristretto255Scalar
Throws
Error if the bytes are not a valid scalar encoding
Implementation of RandomizedCiphersuite.deserializeScalar
- Defined in ristretto255/src/index.ts:625

scalarAdd

scalarAdd(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar
Add two scalars.
Parameters
- a: Ristretto255Scalar
- b: Ristretto255Scalar
Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarAdd
- Defined in ristretto255/src/index.ts:629

scalarSub

scalarSub(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar
Subtract two scalars.
Parameters
- a: Ristretto255Scalar
- b: Ristretto255Scalar
Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarSub
- Defined in ristretto255/src/index.ts:633

scalarMul

scalarMul(a: Ristretto255Scalar, b: Ristretto255Scalar): Ristretto255Scalar
Multiply two scalars.
Parameters
- a: Ristretto255Scalar
- b: Ristretto255Scalar
Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.scalarMul
- Defined in ristretto255/src/index.ts:637

scalarsEqual

scalarsEqual(a: Ristretto255Scalar, b: Ristretto255Scalar): boolean
Check if two scalars are equal.
Parameters
- a: Ristretto255Scalar
- b: Ristretto255Scalar
Returns boolean
Implementation of RandomizedCiphersuite.scalarsEqual
- Defined in ristretto255/src/index.ts:641

elementSize

elementSize(): number
Returns the size in bytes of a serialized element.

Returns number
Implementation of RandomizedCiphersuite.elementSize
- Defined in ristretto255/src/index.ts:649

scalarSize

scalarSize(): number
Returns the size in bytes of a serialized scalar.

Returns number
Implementation of RandomizedCiphersuite.scalarSize
- Defined in ristretto255/src/index.ts:653

cofactor

cofactor(): Ristretto255Scalar
The order of the quotient group when the prime order subgroup divides the order of the full curve group. For prime order curves, this should return 1.

Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.cofactor
- Defined in ristretto255/src/index.ts:657

identity

identity(): Ristretto255Point
Additive identity of the prime order group.

Returns Ristretto255Point
Implementation of RandomizedCiphersuite.identity
- Defined in ristretto255/src/index.ts:661

generator

generator(): Ristretto255Point
The fixed generator element of the prime order group.

Returns Ristretto255Point
Implementation of RandomizedCiphersuite.generator
- Defined in ristretto255/src/index.ts:665

serializeElement

serializeElement(element: Ristretto255Point): Uint8Array
Serialize an element to bytes.
Parameters
- element: Ristretto255Point
Returns Uint8Array
Throws
Error if the element is the identity
Implementation of RandomizedCiphersuite.serializeElement
- Defined in ristretto255/src/index.ts:669

deserializeElement

deserializeElement(bytes: Uint8Array): Ristretto255Point
Deserialize an element from bytes.
Parameters
- bytes: Uint8Array
Returns Ristretto255Point
Throws
Error if the bytes are not a valid element encoding or represent the identity
Implementation of RandomizedCiphersuite.deserializeElement
- Defined in ristretto255/src/index.ts:673

elementAdd

elementAdd(a: Ristretto255Point, b: Ristretto255Point): Ristretto255Point
Add two group elements.
Parameters
- a: Ristretto255Point
- b: Ristretto255Point
Returns Ristretto255Point
Implementation of RandomizedCiphersuite.elementAdd
- Defined in ristretto255/src/index.ts:677

elementSub

elementSub(a: Ristretto255Point, b: Ristretto255Point): Ristretto255Point
Subtract two group elements.
Parameters
- a: Ristretto255Point
- b: Ristretto255Point
Returns Ristretto255Point
Implementation of RandomizedCiphersuite.elementSub
- Defined in ristretto255/src/index.ts:681

elementMul

elementMul(
element: Ristretto255Point,
scalar: Ristretto255Scalar,
): Ristretto255Point
Multiply a group element by a scalar.
Parameters
- element: Ristretto255Point
- scalar: Ristretto255Scalar
Returns Ristretto255Point
Implementation of RandomizedCiphersuite.elementMul
- Defined in ristretto255/src/index.ts:685

scalarBaseMult

scalarBaseMult(scalar: Ristretto255Scalar): Ristretto255Point
Scalar multiplication with the generator (g * scalar).
Parameters
- scalar: Ristretto255Scalar
Returns Ristretto255Point
Implementation of RandomizedCiphersuite.scalarBaseMult
- Defined in ristretto255/src/index.ts:689

elementsEqual

elementsEqual(a: Ristretto255Point, b: Ristretto255Point): boolean
Check if two elements are equal.
Parameters
- a: Ristretto255Point
- b: Ristretto255Point
Returns boolean
Implementation of RandomizedCiphersuite.elementsEqual
- Defined in ristretto255/src/index.ts:693

isIdentity

isIdentity(element: Ristretto255Point): boolean
Check if an element is the identity.
Parameters
- element: Ristretto255Point
Returns boolean
Implementation of RandomizedCiphersuite.isIdentity
- Defined in ristretto255/src/index.ts:697

H1

H1(m: Uint8Array): Ristretto255Scalar
H1 for FROST(ristretto255, SHA-512)

H1(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "rho" || m)
Parameters
- m: Uint8Array
Returns Ristretto255Scalar
See
https://datatracker.ietf.org/doc/html/rfc9591#section-6.2-2.4.2.2
Implementation of RandomizedCiphersuite.H1
- Defined in ristretto255/src/index.ts:712

H2

H2(m: Uint8Array): Ristretto255Scalar
H2 for FROST(ristretto255, SHA-512)

H2(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "chal" || m)
Parameters
- m: Uint8Array
Returns Ristretto255Scalar
See
https://datatracker.ietf.org/doc/html/rfc9591#section-6.2-2.4.2.4
Implementation of RandomizedCiphersuite.H2
- Defined in ristretto255/src/index.ts:727

H3

H3(m: Uint8Array): Ristretto255Scalar
H3 for FROST(ristretto255, SHA-512)

H3(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "nonce" || m)
Parameters
- m: Uint8Array
Returns Ristretto255Scalar
See
https://datatracker.ietf.org/doc/html/rfc9591#section-6.2-2.4.2.6
Implementation of RandomizedCiphersuite.H3
- Defined in ristretto255/src/index.ts:742

H4

H4(m: Uint8Array): Uint8Array
H4 for FROST(ristretto255, SHA-512)

H4(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "msg" || m)
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#section-6.2-2.4.2.8
Implementation of RandomizedCiphersuite.H4
- Defined in ristretto255/src/index.ts:757

H5

H5(m: Uint8Array): Uint8Array
H5 for FROST(ristretto255, SHA-512)

H5(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "com" || m)
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#section-6.2-2.4.2.10
Implementation of RandomizedCiphersuite.H5
- Defined in ristretto255/src/index.ts:772

HDKG

HDKG(m: Uint8Array): Ristretto255Scalar | null
HDKG for FROST(ristretto255, SHA-512)

HDKG(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "dkg" || m)

Used for distributed key generation.
Parameters
- m: Uint8Array
Returns Ristretto255Scalar | null
Implementation of RandomizedCiphersuite.HDKG
- Defined in ristretto255/src/index.ts:787

HID

HID(m: Uint8Array): Ristretto255Scalar | null
HID for FROST(ristretto255, SHA-512)

HID(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "id" || m)

Used for deriving identifiers from arbitrary byte strings.
Parameters
- m: Uint8Array
Returns Ristretto255Scalar | null
Implementation of RandomizedCiphersuite.HID
- Defined in ristretto255/src/index.ts:802

hashRandomizer

hashRandomizer(m: Uint8Array): Ristretto255Scalar | null
hashRandomizer for RandomizedCiphersuite

hashRandomizer(m) = SHA-512("FROST-RISTRETTO255-SHA512-v1" || "randomizer" || m)

Used for re-randomized FROST signatures.
Parameters
- m: Uint8Array
Returns Ristretto255Scalar | null
Implementation of RandomizedCiphersuite.hashRandomizer
- Defined in ristretto255/src/index.ts:817

challenge

challenge(
    R: Ristretto255Point,
    verifyingKey: unknown,
    message: Uint8Array,
): Challenge<Ristretto255Sha512Impl>
Compute the signature challenge.

For ristretto255, this follows the FROST challenge computation from RFC 9591 Section 6.2.
Parameters
- R: Ristretto255Point
- verifyingKey: unknown
- message: Uint8Array
Returns Challenge<Ristretto255Sha512Impl>
Implementation of RandomizedCiphersuite.challenge
- Defined in ristretto255/src/index.ts:835

computeBindingFactorList

computeBindingFactorList<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    verifyingKey: unknown,
    additionalPrefix: Uint8Array,
): BindingFactorList<C>
Compute binding factors for all participants.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- verifyingKey: unknown
- additionalPrefix: Uint8Array
Returns BindingFactorList<C>
Implementation of RandomizedCiphersuite.computeBindingFactorList
- Defined in ristretto255/src/index.ts:867

computeGroupCommitment

computeGroupCommitment<C extends Ciphersuite>(
signingPackage: SigningPackage<C>,
bindingFactorList: BindingFactorList<C>,
): GroupCommitment<C>
Compute the group commitment from all signing commitments.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- bindingFactorList: BindingFactorList<C>
Returns GroupCommitment<C>
Implementation of RandomizedCiphersuite.computeGroupCommitment
- Defined in ristretto255/src/index.ts:950

deriveInterpolatingValue

deriveInterpolatingValue<C extends Ciphersuite>(
    signerId: {
        toScalar(): unknown;
        serialize(): Uint8Array;
        clone(): unknown;
    },
    signingPackage: SigningPackage<C>,
): Ristretto255Scalar
Derive the interpolating value (Lagrange coefficient) for a participant.
Type Parameters
- C extends Ciphersuite
Parameters
- signerId: { toScalar(): unknown; serialize(): Uint8Array; clone(): unknown }
- signingPackage: SigningPackage<C>
Returns Ristretto255Scalar
Implementation of RandomizedCiphersuite.deriveInterpolatingValue
- Defined in ristretto255/src/index.ts:982

Interface Ristretto255Sha512Impl

Implements

Index

Properties

Methods

Properties

ReadonlyID

Readonlygroup

Scalar

Element

VerifyingKey

SigningKey

Methods

scalarZero

Returns Ristretto255Scalar

scalarOne

Returns Ristretto255Scalar

scalarInvert

Parameters

Returns Ristretto255Scalar

Throws

scalarRandom

Parameters

Returns Ristretto255Scalar

serializeScalar

Parameters

Returns Uint8Array

deserializeScalar

Parameters

Returns Ristretto255Scalar

Throws

scalarAdd

Parameters

Returns Ristretto255Scalar

scalarSub

Parameters

Returns Ristretto255Scalar

scalarMul

Parameters

Returns Ristretto255Scalar

scalarsEqual

Parameters

Returns boolean

elementSize

Returns number

scalarSize

Returns number

cofactor

Returns Ristretto255Scalar

identity

Returns Ristretto255Point

generator

Returns Ristretto255Point

serializeElement

Parameters

Returns Uint8Array

Throws

deserializeElement

Parameters

Returns Ristretto255Point

Throws

elementAdd

Parameters

Returns Ristretto255Point

elementSub

Parameters

Returns Ristretto255Point

elementMul

Parameters

Returns Ristretto255Point

scalarBaseMult

Parameters

Returns Ristretto255Point

elementsEqual

Parameters

Returns boolean

isIdentity

Parameters

Returns boolean

H1

`Readonly`ID

`Readonly`group