Interface Ciphersuite

A FROST ciphersuite specifies the underlying prime-order group details and cryptographic hash function.

This is the unified Ciphersuite interface that combines both hierarchical access (via group) and flattened methods for convenience.

See

https://datatracker.ietf.org/doc/html/rfc9591#name-ciphersuites

interface Ciphersuite {
    ID: string;
    group: Group;
    Scalar: unknown;
    Element: unknown;
    VerifyingKey: unknown;
    SigningKey: unknown;
    SIGNATURE_LENGTH?: number;
    scalarZero(): unknown;
    scalarOne(): unknown;
    scalarInvert(scalar: unknown): unknown;
    scalarRandom(rng: { fill(array: Uint8Array): void }): unknown;
    serializeScalar(scalar: unknown): Uint8Array;
    deserializeScalar(bytes: Uint8Array): unknown;
    scalarAdd(a: unknown, b: unknown): unknown;
    scalarSub(a: unknown, b: unknown): unknown;
    scalarMul(a: unknown, b: unknown): unknown;
    scalarsEqual(a: unknown, b: unknown): boolean;
    elementSize(): number;
    scalarSize(): number;
    cofactor(): unknown;
    identity(): unknown;
    generator(): unknown;
    serializeElement(element: unknown): Uint8Array;
    deserializeElement(bytes: Uint8Array): unknown;
    elementAdd(a: unknown, b: unknown): unknown;
    elementSub(a: unknown, b: unknown): unknown;
    elementMul(element: unknown, scalar: unknown): unknown;
    scalarBaseMult(scalar: unknown): unknown;
    elementsEqual(a: unknown, b: unknown): boolean;
    isIdentity(element: unknown): boolean;
    H1(m: Uint8Array): unknown;
    H2(m: Uint8Array): unknown;
    H3(m: Uint8Array): unknown;
    H4(m: Uint8Array): Uint8Array;
    H5(m: Uint8Array): Uint8Array;
    HDKG?(m: Uint8Array): unknown;
    HID?(m: Uint8Array): unknown;
    singleSign?(
        signingKey: unknown,
        message: Uint8Array,
        rng: { fill(array: Uint8Array): void },
    ): unknown;
    verifySignature?(
        verifyingKey: unknown,
        message: Uint8Array,
        signature: unknown,
    ): boolean;
    serializeSignature?(signature: unknown): Uint8Array;
    deserializeSignature?(bytes: Uint8Array): unknown;
    challenge(
        R: unknown,
        verifyingKey: unknown,
        message: Uint8Array,
    ): Challenge<Ciphersuite>;
    preSign?<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        signerNonces: SigningNoncesLike<C>,
        keyPackage: KeyPackageLike<C>,
    ): {
        signingPackage: SigningPackage<C>;
        signerNonces: SigningNoncesLike<C>;
        keyPackage: KeyPackageLike<C>;
    };
    preCommitmentSign?<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        signingNonces: SigningNoncesLike<C>,
        bindingFactorList: BindingFactorList<C>,
    ): {
        signingPackage: SigningPackage<C>;
        signerNonces: SigningNoncesLike<C>;
    };
    computeSignatureShare?<C extends Ciphersuite>(
        groupCommitment: GroupCommitment<C>,
        signerNonces: SigningNoncesLike<C>,
        bindingFactor: BindingFactor<C>,
        lambdaI: unknown,
        keyPackage: KeyPackageLike<C>,
        challenge: Challenge<C>,
    ): SignatureShareLike<C>;
    verifyShare?<C extends Ciphersuite>(
        groupCommitment: GroupCommitment<C>,
        signatureShare: SignatureShareLike<C>,
        identifier: IdentifierLike<C>,
        groupCommitmentShare: GroupCommitmentShareLike<C>,
        verifyingShare: VerifyingShareLike<C>,
        lambdaI: unknown,
        challenge: Challenge<C>,
        groupVerifyingKey?: unknown,
    ): void;
    computeBindingFactorList<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        verifyingKey: unknown,
        additionalPrefix: Uint8Array,
    ): BindingFactorList<C>;
    computeGroupCommitment<C extends Ciphersuite>(
        signingPackage: SigningPackage<C>,
        bindingFactorList: BindingFactorList<C>,
    ): GroupCommitment<C>;
    deriveInterpolatingValue<C extends Ciphersuite>(
        signerId: IdentifierLike<C>,
        signingPackage: SigningPackage<C>,
    ): unknown;
    postDkg?<C extends Ciphersuite>(
        keyPackage: KeyPackageLike<C>,
        publicKeyPackage: PublicKeyPackageLike<C>,
    ): [KeyPackageLike<C>, PublicKeyPackageLike<C>];
}

Properties

`Readonly`ID

ID: string

The ciphersuite ID string. It should be equal to the contextString in the spec. For new ciphersuites, this should be a string that identifies the ciphersuite; it's recommended to use a similar format to the ciphersuites in the FROST spec, e.g. "FROST-RISTRETTO255-SHA512-v1".

`Readonly`group

group: Group

The prime order group (or subgroup) that this ciphersuite operates over. Provides access to Field and Group operations in a hierarchical manner.

Scalar

Scalar: unknown

The scalar type for this ciphersuite

Element

Element: unknown

The element type for this ciphersuite

VerifyingKey

VerifyingKey: unknown

The verifying key type

SigningKey

SigningKey: unknown

The signing key type

`Optional`SIGNATURE_LENGTH

SIGNATURE_LENGTH?: number

The length of a serialized signature in bytes. Defaults to elementSize() + scalarSize() if not specified. For BIP-340/Taproot ciphersuites this is typically 64 (2 * scalarSize).

Methods

scalarZero

scalarZero(): unknown
Returns the zero element of the field, the additive identity.

Returns unknown
- Defined in core/dist/index.d.ts:2013

scalarOne

scalarOne(): unknown
Returns the one element of the field, the multiplicative identity.

Returns unknown
- Defined in core/dist/index.d.ts:2017

scalarInvert

scalarInvert(scalar: unknown): unknown
Computes the multiplicative inverse of an element of the scalar field.
Parameters
- scalar: unknown
Returns unknown
Throws
Error if the element is zero
- Defined in core/dist/index.d.ts:2022

scalarRandom

scalarRandom(rng: { fill(array: Uint8Array): void }): unknown
Generate a random scalar from the entire space [0, l-1]
Parameters
- rng: { fill(array: Uint8Array): void }
Returns unknown
- Defined in core/dist/index.d.ts:2026

serializeScalar

serializeScalar(scalar: unknown): Uint8Array
Serialize a scalar to bytes.
Parameters
- scalar: unknown
Returns Uint8Array
- Defined in core/dist/index.d.ts:2032

deserializeScalar

deserializeScalar(bytes: Uint8Array): unknown
Deserialize a scalar from bytes.
Parameters
- bytes: Uint8Array
Returns unknown
Throws
Error if the bytes are not a valid scalar encoding
- Defined in core/dist/index.d.ts:2037

scalarAdd

scalarAdd(a: unknown, b: unknown): unknown
Add two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2041

scalarSub

scalarSub(a: unknown, b: unknown): unknown
Subtract two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2045

scalarMul

scalarMul(a: unknown, b: unknown): unknown
Multiply two scalars.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2049

scalarsEqual

scalarsEqual(a: unknown, b: unknown): boolean
Check if two scalars are equal.
Parameters
- a: unknown
- b: unknown
Returns boolean
- Defined in core/dist/index.d.ts:2053

elementSize

elementSize(): number
Returns the size in bytes of a serialized element.

Returns number
- Defined in core/dist/index.d.ts:2057

scalarSize

scalarSize(): number
Returns the size in bytes of a serialized scalar.

Returns number
- Defined in core/dist/index.d.ts:2061

cofactor

cofactor(): unknown
The order of the quotient group when the prime order subgroup divides the order of the full curve group. For prime order curves, this should return 1.

Returns unknown
- Defined in core/dist/index.d.ts:2066

identity

identity(): unknown
Additive identity of the prime order group.

Returns unknown
- Defined in core/dist/index.d.ts:2070

generator

generator(): unknown
The fixed generator element of the prime order group.

Returns unknown
- Defined in core/dist/index.d.ts:2074

serializeElement

serializeElement(element: unknown): Uint8Array
Serialize an element to bytes.
Parameters
- element: unknown
Returns Uint8Array
Throws
Error if the element is the identity
- Defined in core/dist/index.d.ts:2079

deserializeElement

deserializeElement(bytes: Uint8Array): unknown
Deserialize an element from bytes.
Parameters
- bytes: Uint8Array
Returns unknown
Throws
Error if the bytes are not a valid element encoding or represent the identity
- Defined in core/dist/index.d.ts:2084

elementAdd

elementAdd(a: unknown, b: unknown): unknown
Add two group elements.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2088

elementSub

elementSub(a: unknown, b: unknown): unknown
Subtract two group elements.
Parameters
- a: unknown
- b: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2092

elementMul

elementMul(element: unknown, scalar: unknown): unknown
Multiply a group element by a scalar.
Parameters
- element: unknown
- scalar: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2096

scalarBaseMult

scalarBaseMult(scalar: unknown): unknown
Scalar multiplication with the generator (g * scalar).
Parameters
- scalar: unknown
Returns unknown
- Defined in core/dist/index.d.ts:2100

elementsEqual

elementsEqual(a: unknown, b: unknown): boolean
Check if two elements are equal.
Parameters
- a: unknown
- b: unknown
Returns boolean
- Defined in core/dist/index.d.ts:2104

isIdentity

isIdentity(element: unknown): boolean
Check if an element is the identity.
Parameters
- element: unknown
Returns boolean
- Defined in core/dist/index.d.ts:2108

H1

H1(m: Uint8Array): unknown
H1 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in core/dist/index.d.ts:2116

H2

H2(m: Uint8Array): unknown
H2 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in core/dist/index.d.ts:2124

H3

H3(m: Uint8Array): unknown
H3 for a FROST ciphersuite.

Maps arbitrary inputs to Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in core/dist/index.d.ts:2132

H4

H4(m: Uint8Array): Uint8Array
H4 for a FROST ciphersuite.

Usually an alias for the ciphersuite hash function H with domain separation applied.
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in core/dist/index.d.ts:2140

H5

H5(m: Uint8Array): Uint8Array
H5 for a FROST ciphersuite.

Usually an alias for the ciphersuite hash function H with domain separation applied.
Parameters
- m: Uint8Array
Returns Uint8Array
See
https://datatracker.ietf.org/doc/html/rfc9591#name-cryptographic-hash-function
- Defined in core/dist/index.d.ts:2148

`Optional`HDKG

HDKG?(m: Uint8Array): unknown
Hash function for a FROST ciphersuite, used for the DKG.

The DKG is not part of the specification, thus this is optional. Returns null if DKG is not supported by the Ciphersuite.

Maps arbitrary inputs to non-zero Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
- Defined in core/dist/index.d.ts:2157

`Optional`HID

HID?(m: Uint8Array): unknown
Hash function for a FROST ciphersuite, used for deriving identifiers from strings.

This feature is not part of the specification and is just a convenient way of creating identifiers. Returns null if this is not supported.

Maps arbitrary inputs to non-zero Scalar elements of the prime-order group scalar field.
Parameters
- m: Uint8Array
Returns unknown
- Defined in core/dist/index.d.ts:2166

`Optional`singleSign

singleSign?(
    signingKey: unknown,
    message: Uint8Array,
    rng: { fill(array: Uint8Array): void },
): unknown
Optional. Single-signer Schnorr signing. If provided, allows for optimized single-party signing without the full FROST protocol.
Parameters
- signingKey: unknown
- message: Uint8Array
- rng: { fill(array: Uint8Array): void }
Returns unknown
- Defined in core/dist/index.d.ts:2171

`Optional`verifySignature

verifySignature?(
    verifyingKey: unknown,
    message: Uint8Array,
    signature: unknown,
): boolean
Optional. Verify a Schnorr signature. If provided, allows for direct signature verification without going through FROST.
Parameters
- verifyingKey: unknown
- message: Uint8Array
- signature: unknown
Returns boolean
- Defined in core/dist/index.d.ts:2178

`Optional`serializeSignature

serializeSignature?(signature: unknown): Uint8Array
Optional. Serialize a signature to bytes. If provided, allows for custom signature serialization.
Parameters
- signature: unknown
Returns Uint8Array
- Defined in core/dist/index.d.ts:2183

`Optional`deserializeSignature

deserializeSignature?(bytes: Uint8Array): unknown
Optional. Deserialize a signature from bytes. If provided, allows for custom signature deserialization.
Parameters
- bytes: Uint8Array
Returns unknown
- Defined in core/dist/index.d.ts:2188

challenge

challenge(
    R: unknown,
    verifyingKey: unknown,
    message: Uint8Array,
): Challenge<Ciphersuite>
Optional. Generates the challenge as is required for Schnorr signatures. Called by round2.sign() and aggregate().
Parameters
- R: unknown
- verifyingKey: unknown
- message: Uint8Array
Returns Challenge<Ciphersuite>
- Defined in core/dist/index.d.ts:2193

`Optional`preSign

preSign?<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    signerNonces: SigningNoncesLike<C>,
    keyPackage: KeyPackageLike<C>,
): {
    signingPackage: SigningPackage<C>;
    signerNonces: SigningNoncesLike<C>;
    keyPackage: KeyPackageLike<C>;
}
Optional. Pre-process round2.sign() inputs. Returns the same values or modified versions.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- signerNonces: SigningNoncesLike<C>
- keyPackage: KeyPackageLike<C>
Returns {
    signingPackage: SigningPackage<C>;
    signerNonces: SigningNoncesLike<C>;
    keyPackage: KeyPackageLike<C>;
}
- Defined in core/dist/index.d.ts:2198

`Optional`preCommitmentSign

preCommitmentSign?<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    signingNonces: SigningNoncesLike<C>,
    bindingFactorList: BindingFactorList<C>,
): { signingPackage: SigningPackage<C>; signerNonces: SigningNoncesLike<C> }
Optional. Pre-process compute_group_commitment() inputs in round2.sign().
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- signingNonces: SigningNoncesLike<C>
- bindingFactorList: BindingFactorList<C>
Returns { signingPackage: SigningPackage<C>; signerNonces: SigningNoncesLike<C> }
- Defined in core/dist/index.d.ts:2206

`Optional`computeSignatureShare

computeSignatureShare?<C extends Ciphersuite>(
    groupCommitment: GroupCommitment<C>,
    signerNonces: SigningNoncesLike<C>,
    bindingFactor: BindingFactor<C>,
    lambdaI: unknown,
    keyPackage: KeyPackageLike<C>,
    challenge: Challenge<C>,
): SignatureShareLike<C>
Optional. Compute the signature share for a particular signer. Called by round2.sign().
Type Parameters
- C extends Ciphersuite
Parameters
- groupCommitment: GroupCommitment<C>
- signerNonces: SigningNoncesLike<C>
- bindingFactor: BindingFactor<C>
- lambdaI: unknown
- keyPackage: KeyPackageLike<C>
- challenge: Challenge<C>
Returns SignatureShareLike<C>
- Defined in core/dist/index.d.ts:2214

`Optional`verifyShare

verifyShare?<C extends Ciphersuite>(
    groupCommitment: GroupCommitment<C>,
    signatureShare: SignatureShareLike<C>,
    identifier: IdentifierLike<C>,
    groupCommitmentShare: GroupCommitmentShareLike<C>,
    verifyingShare: VerifyingShareLike<C>,
    lambdaI: unknown,
    challenge: Challenge<C>,
    groupVerifyingKey?: unknown,
): void
Optional. Verify a signing share. Called by aggregate() if cheater detection is enabled.
Type Parameters
- C extends Ciphersuite
Parameters
- groupCommitment: GroupCommitment<C>
- signatureShare: SignatureShareLike<C>
- identifier: IdentifierLike<C>
- groupCommitmentShare: GroupCommitmentShareLike<C>
- verifyingShare: VerifyingShareLike<C>
- lambdaI: unknown
- challenge: Challenge<C>
- OptionalgroupVerifyingKey: unknown
  Optional group verifying key for ciphersuites that need it (e.g., BIP-340)
Returns void
- Defined in core/dist/index.d.ts:2220

computeBindingFactorList

computeBindingFactorList<C extends Ciphersuite>(
    signingPackage: SigningPackage<C>,
    verifyingKey: unknown,
    additionalPrefix: Uint8Array,
): BindingFactorList<C>
Compute binding factors for all participants.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- verifyingKey: unknown
- additionalPrefix: Uint8Array
Returns BindingFactorList<C>
- Defined in core/dist/index.d.ts:2224

computeGroupCommitment

computeGroupCommitment<C extends Ciphersuite>(
signingPackage: SigningPackage<C>,
bindingFactorList: BindingFactorList<C>,
): GroupCommitment<C>
Compute the group commitment from all signing commitments.
Type Parameters
- C extends Ciphersuite
Parameters
- signingPackage: SigningPackage<C>
- bindingFactorList: BindingFactorList<C>
Returns GroupCommitment<C>
- Defined in core/dist/index.d.ts:2228

deriveInterpolatingValue

deriveInterpolatingValue<C extends Ciphersuite>(
signerId: IdentifierLike<C>,
signingPackage: SigningPackage<C>,
): unknown
Compute the Lagrange coefficient for a participant.
Type Parameters
- C extends Ciphersuite
Parameters
- signerId: IdentifierLike<C>
- signingPackage: SigningPackage<C>
Returns unknown
- Defined in core/dist/index.d.ts:2232

`Optional`postDkg

postDkg?<C extends Ciphersuite>(
keyPackage: KeyPackageLike<C>,
publicKeyPackage: PublicKeyPackageLike<C>,
): [KeyPackageLike<C>, PublicKeyPackageLike<C>]
Optional. Post-process DKG output (called at the end of part3). Used for ciphersuites that need to apply transformations after DKG, such as taproot tweaking for secp256k1-tr.
Type Parameters
- C extends Ciphersuite
Parameters
- keyPackage: KeyPackageLike<C>
- publicKeyPackage: PublicKeyPackageLike<C>
Returns [KeyPackageLike<C>, PublicKeyPackageLike<C>]
- Defined in core/dist/index.d.ts:2238

Interface Ciphersuite

See

Index

Properties

Methods

Properties

ReadonlyID

Readonlygroup

Scalar

Element

VerifyingKey

SigningKey

OptionalSIGNATURE_LENGTH

Methods

scalarZero

Returns unknown

scalarOne

Returns unknown

scalarInvert

Parameters

Returns unknown

Throws

scalarRandom

Parameters

Returns unknown

serializeScalar

Parameters

Returns Uint8Array

deserializeScalar

Parameters

Returns unknown

Throws

scalarAdd

Parameters

Returns unknown

scalarSub

Parameters

Returns unknown

scalarMul

Parameters

Returns unknown

scalarsEqual

Parameters

Returns boolean

elementSize

Returns number

scalarSize

Returns number

cofactor

Returns unknown

identity

Returns unknown

generator

Returns unknown

serializeElement

Parameters

Returns Uint8Array

Throws

deserializeElement

Parameters

Returns unknown

Throws

elementAdd

Parameters

Returns unknown

elementSub

Parameters

Returns unknown

elementMul

Parameters

Returns unknown

scalarBaseMult

Parameters

Returns unknown

elementsEqual

Parameters

Returns boolean

isIdentity

Parameters

Returns boolean

`Readonly`ID

`Readonly`group

`Optional`SIGNATURE_LENGTH

`Optional`HDKG

`Optional`HID

`Optional`singleSign

`Optional`verifySignature

`Optional`serializeSignature

`Optional`deserializeSignature

`Optional`preSign

Returns {
signingPackage: SigningPackage<C>;
signerNonces: SigningNoncesLike<C>;
keyPackage: KeyPackageLike<C>;
}

`Optional`preCommitmentSign

`Optional`computeSignatureShare

`Optional`verifyShare

`Optional`postDkg