Add module “musig” that implements MuSig2 multi-signatures (BIP 327) #1479

252+ */
253+SECP256K1_API int secp256k1_pubkey_cmp(
254+    const secp256k1_context *ctx,
255+    const secp256k1_pubkey *pk1,
256+    const secp256k1_pubkey *pk2
257+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);

246@@ -247,8 +247,15 @@ static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge,
247     } else {

252+SECP256K1_API int secp256k1_pubkey_sort(
253+    const secp256k1_context *ctx,
254+    const secp256k1_pubkey **pubkeys,
255+    size_t n_pubkeys
256+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2);
257+

29+
30+/* musig_ge_to_bytes_ext and musig_ge_from_bytes_ext are identical to ge_save and ge_load
31+ * except that they allow saving and loading the point at infinity */
32+static void secp256k1_musig_ge_to_bytes_ext(unsigned char *data, secp256k1_ge *ge);
33+
34+static void secp256k1_musig_ge_from_bytes_ext(secp256k1_ge *ge, const unsigned char *data);

181+            return 1;
182+        }
183+        pubkeys_ptr[i] = &signers[i].pubkey;
184+    }
185+    printf("ok\n");
186+    printf("Combining public keys...");

320+ *  1. Each call to this function must have a UNIQUE session_id32 that must NOT BE
321+ *     REUSED in subsequent calls to this function.
322+ *     If you do not provide a seckey, session_id32 _must_ be UNIFORMLY RANDOM
323+ *     AND KEPT SECRET (even from other signers). If you do provide a seckey,
324+ *     session_id32 can instead be a counter (that must never repeat!). However,
325+ *     it is recommended to always choose session_id32 uniformly at random.

324- *     If you do not provide a seckey, session_id32 _must_ be UNIFORMLY RANDOM
325- *     AND KEPT SECRET (even from other signers). If you do provide a seckey,
326- *     session_id32 can instead be a counter (that must never repeat!). However,
327- *     it is recommended to always choose session_id32 uniformly at random.
328+ *     If you do not provide a seckey, session_secrand32 _must_ be UNIFORMLY RANDOM
329+ *     AND KEPT SECRET (even from other signers).

382+ *  1. The nonrepeating_cnt argument must be a counter value that never
383+ *     repeats, i.e., you must never call `secp256k1_musig_nonce_gen_counter`
384+ *     twice with the same seckey and nonrepeating_cnt value.
385+ *  2. If you already know the seckey, message or aggregate public key
386+ *     cache, they can be optionally provided to derive the nonce and increase
387+ *     misuse-resistance. The extra_input32 argument can be used to provide

379+ *  MuSig differs from regular Schnorr signing in that implementers _must_ take
380+ *  special care to not reuse a nonce. This can be ensured by following these rules:
381+ *
382+ *  1. The nonrepeating_cnt argument must be a counter value that never
383+ *     repeats, i.e., you must never call `secp256k1_musig_nonce_gen_counter`
384+ *     twice with the same seckey and nonrepeating_cnt value.

304+
305+    /* Suppress wrong warning (fixed in MSVC 19.33) */
306+    #if defined(_MSC_VER) && (_MSC_VER < 1933)
307+    #pragma warning(push)
308+    #pragma warning(disable: 4090)
309+    #endif

26+ * - 64 byte "second" public key (set to the point at infinity if not present)
27+ * - 32 byte hash of all public keys
28+ * - 1 byte the parity of the internal key (if tweaked, otherwise 0)
29+ * - 32 byte tweak
30+ */
31+/* Requires that cache_i->pk is not infinity and cache_i->second_pk_x to be normalized. */

143+        secp256k1_sha256_finalize(&sha, buf);
144+        secp256k1_scalar_set_b32(r, buf, NULL);
145+    }
146+}
147+
148+/* Assumes both field elements x and second_pk_x are normalized. */

214+        return 0;
215+    }
216+    secp256k1_ge_set_gej(&pkp, &pkj);
217+    secp256k1_fe_normalize_var(&pkp.y);
218+    /* The resulting public key is infinity with negligible probability */
219+    VERIFY_CHECK(!secp256k1_ge_is_infinity(&pkp));

476+int secp256k1_musig_nonce_gen_counter(const secp256k1_context* ctx, secp256k1_musig_secnonce *secnonce, secp256k1_musig_pubnonce *pubnonce, uint64_t nonrepeating_cnt, const unsigned char *seckey, const secp256k1_pubkey *pubkey, const unsigned char *msg32, const secp256k1_musig_keyagg_cache *keyagg_cache, const unsigned char *extra_input32) {
477+    unsigned char buf[32] = { 0 };
478+    int i;
479+
480+    VERIFY_CHECK(ctx != NULL);
481+    ARG_CHECK((seckey != NULL));

 6@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 7 
 8 ## [Unreleased]
 9 
10+#### Added
11+ - New module `musig` implements the MuSig2 multisignature scheme according to the [BIP 327 specification](https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki). See:
12+   - Header file `include/secp256k1_musig.h` which defines the new API.
13+   - Document `doc/musig.md` for further notes on API usage.
14+   - Usage example `examples/musig.c`.
15+ - Added `secp256k1_ec_pubkey_sort` which sorts an array of public keys (see `include/secp256k1.h`).

443@@ -432,6 +444,10 @@ if test x"$enable_module_ecdh" = x"yes"; then
444   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ECDH=1"
445 fi
446 
447+if test x"$enable_module_ellswift" = x"yes"; then
448+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_ELLSWIFT=1"
449+fi
450+

32+    secp256k1_musig_pubnonce pubnonce;
33+    secp256k1_musig_partial_sig partial_sig;
34+};
35+
36+ /* Number of public keys involved in creating the aggregate signature */
37+#define N_SIGNERS 3

39+static int create_keypair(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer) {
40+    unsigned char seckey[32];
41+    while (1) {
42+        if (!fill_random(seckey, sizeof(seckey))) {
43+            printf("Failed to generate randomness\n");
44+            return 1;

64+    /* Plain tweaking which, for example, allows deriving multiple child
65+     * public keys from a single aggregate key using BIP32 */
66+    if (!secp256k1_musig_pubkey_ec_tweak_add(ctx, NULL, cache, plain_tweak)) {
67+        return 0;
68+    }
69+    /* Note that we did not provided an output_pk argument, because the

195+    if (!tweak(ctx, &agg_pk, &cache)) {
196+        printf("FAILED\n");
197+        return 1;
198+    }
199+    printf("ok\n");
200+    printf("Signing message.........");

791+    for (i = 0; i < n_sigs; i++) {
792+        secp256k1_scalar term;
793+        if (!secp256k1_musig_partial_sig_load(ctx, &term, partial_sigs[i])) {
794+            return 0;
795+        }
796+        secp256k1_scalar_add(&session_i.s_part, &session_i.s_part, &term);

 7+ * EXAMPLES_COPYING or https://creativecommons.org/publicdomain/zero/1.0 *
 8+ *************************************************************************/
 9+
10+/** This file demonstrates how to use the MuSig module to create a
11+ *  3-of-3 multisignature. Additionally, see the documentation in
12+ *  include/secp256k1_musig.h and src/modules/musig/musig.md.

273+    VERIFY_CHECK(ctx != NULL);
274+    ARG_CHECK(out32 != NULL);
275+    ARG_CHECK(sig != NULL);
276+    memcpy(out32, &sig->data[4], 32);
277+    return 1;
278+}

235+ *  The tweaking method is the same as `secp256k1_ec_pubkey_tweak_add`. So after
236+ *  the following pseudocode buf and buf2 have identical contents (absent
237+ *  earlier failures).
238+ *
239+ *  secp256k1_musig_pubkey_agg(..., keyagg_cache, pubkeys, ...)
240+ *  secp256k1_musig_pubkey_get(..., agg_pk, keyagg_cache)

239+ *  secp256k1_musig_pubkey_agg(..., keyagg_cache, pubkeys, ...)
240+ *  secp256k1_musig_pubkey_get(..., agg_pk, keyagg_cache)
241+ *  secp256k1_musig_pubkey_ec_tweak_add(..., output_pk, tweak32, keyagg_cache)
242+ *  secp256k1_ec_pubkey_serialize(..., buf, output_pk)
243+ *  secp256k1_ec_pubkey_tweak_add(..., agg_pk, tweak32)
244+ *  secp256k1_ec_pubkey_serialize(..., buf2, agg_pk)

277+ *  The tweaking method is the same as `secp256k1_xonly_pubkey_tweak_add`. So in
278+ *  the following pseudocode xonly_pubkey_tweak_add_check (absent earlier
279+ *  failures) returns 1.
280+ *
281+ *  secp256k1_musig_pubkey_agg(..., agg_pk, keyagg_cache, pubkeys, ...)
282+ *  secp256k1_musig_pubkey_xonly_tweak_add(..., output_pk, tweak32, keyagg_cache)

182+
183+    VERIFY_CHECK(ctx != NULL);
184+    if (agg_pk != NULL) {
185+        memset(agg_pk, 0, sizeof(*agg_pk));
186+    }
187+    ARG_CHECK(pubkeys != NULL);

228+            secp256k1_pubkey tmp_output_pk;
229+            secp256k1_musig_keyagg_cache tmp_keyagg_cache = keyagg_cache;
230+            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, tweak) == 1);
231+            /* Reset keyagg_cache */
232+            tmp_keyagg_cache = keyagg_cache;
233+            CHECK((*tweak_func[i])(CTX, &tmp_output_pk, &tmp_keyagg_cache, tweak) == 1);

292+    CHECK(secp256k1_musig_nonce_gen_counter(CTX, &secnonce[0], &pubnonce[0], nonrepeating_cnt, sk[0], &pk[0], msg, NULL, max64) == 1);
293+    CHECK_ILLEGAL(CTX, secp256k1_musig_nonce_gen_counter(CTX, &secnonce[0], &pubnonce[0], nonrepeating_cnt, sk[0], &pk[0], msg, &invalid_keyagg_cache, max64));
294+    CHECK(memcmp_and_randomize(secnonce[0].data, zeros132, sizeof(secnonce[0].data)) == 0);
295+    CHECK(secp256k1_musig_nonce_gen_counter(CTX, &secnonce[0], &pubnonce[0], nonrepeating_cnt, sk[0], &pk[0], msg, &keyagg_cache, NULL) == 1);
296+
297+    /* Every in-argument except session_secrand, sk and pubkey can be NULL */

425+    const unsigned char *seckey,
426+    const secp256k1_pubkey *pubkey,
427+    const unsigned char *msg32,
428+    const secp256k1_musig_keyagg_cache *keyagg_cache,
429+    const unsigned char *extra_input32
430+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6);

295+/* Write optional inputs into the hash */
296+static void secp256k1_nonce_function_musig_helper(secp256k1_sha256 *sha, unsigned int prefix_size, const unsigned char *data, unsigned char len) {
297+    unsigned char zero[7] = { 0 };
298+    /* The spec requires length prefixes to be between 1 and 8 bytes
299+     * (inclusive) */
300+    VERIFY_CHECK(prefix_size <= 8);

480+    VERIFY_CHECK(ctx != NULL);
481+    ARG_CHECK((seckey != NULL));
482+
483+    for (i = 0; i < 8; ++i) {
484+        buf[7 - i] = (nonrepeating_cnt >> (i * 8)) & 0xFF;
485+    }

356+        }
357+    } else {
358+        memcpy(rand, session_secrand, sizeof(rand));
359+    }
360+
361+    /* Subtract one from `sizeof` to avoid hashing the implicit null byte */

608+        return 0;
609+    }
610+    secp256k1_gej_set_ge(&aggnonce_ptj[0], &aggnonce_pt[0]);
611+    secp256k1_gej_set_ge(&aggnonce_ptj[1], &aggnonce_pt[1]);
612+
613+    if (!secp256k1_musig_nonce_process_internal(&session_i.fin_nonce_parity, fin_nonce, &session_i.noncecoef, aggnonce_ptj, agg_pk32, msg32)) {

622+        secp256k1_scalar e_tmp;
623+        secp256k1_scalar_mul(&e_tmp, &session_i.challenge, &cache_i.tweak);
624+        if (secp256k1_fe_is_odd(&cache_i.pk.y)) {
625+            secp256k1_scalar_negate(&e_tmp, &e_tmp);
626+        }
627+        secp256k1_scalar_add(&session_i.s_part, &session_i.s_part, &e_tmp);

672+              && secp256k1_fe_equal(&pk.y, &keypair_pk.y));
673+    if (!secp256k1_keyagg_cache_load(ctx, &cache_i, keyagg_cache)) {
674+        secp256k1_musig_partial_sign_clear(&sk, k);
675+        return 0;
676+    }
677+    secp256k1_fe_normalize_var(&pk.y);

354+        for (i = 0; i < 32; i++) {
355+            rand[i] ^= seckey32[i];
356+        }
357+    } else {
358+        memcpy(rand, session_secrand, sizeof(rand));
359+    }

619+    CHECK(secp256k1_musig_pubkey_agg(CTX, &P_xonly[0], &keyagg_cache, pk_ptr, 2) == 1);
620+    musig_tweak_test_helper(&P_xonly[0], sk[0], sk[1], &keyagg_cache);
621+    CHECK(secp256k1_musig_pubkey_get(CTX, &P[0], &keyagg_cache));
622+
623+    /* Compute Pi = f(Pj) + tweaki*G where where j = i-1 and try signing for
624+     * that key. If xonly is set to true, the function f is normalizes the input

75+    unsigned char aggpk[32];
76+    int has_msg;
77+    unsigned char msg[32];
78+    int has_extra_in;
79+    unsigned char extra_in[32];
80+    unsigned char expected_secnonce[97];

0@@ -0,0 +1,346 @@
1+/**
2+ * Automatically generated by ./contrib/musig2-vectors.py.

0@@ -0,0 +1,51 @@
1+Notes on the musig module API
2+===========================
3+
4+The following sections contain additional notes on the API of the musig module (`include/secp256k1_musig.h`).
5+A usage example can be found in `examples/musig.c`.
6+
7+# API misuse

0@@ -0,0 +1,218 @@
1+/*************************************************************************
2+ * Written in 2018 by Jonas Nick                                         *

65+    if (!secp256k1_musig_pubkey_ec_tweak_add(ctx, NULL, cache, plain_tweak)) {
66+        return 0;
67+    }
68+    /* Note that we did not provide an output_pk argument, because the
69+     * resulting pk is also saved in the cache and so if one is just interested
70+     * in signing the output_pk argument is unnecessary. On the other hand, if

238+ *
239+ *  secp256k1_musig_pubkey_agg(..., agg_pk, keyagg_cache, pubkeys, ...)
240+ *  secp256k1_musig_pubkey_ec_tweak_add(..., output_pk, tweak32, keyagg_cache)
241+ *  secp256k1_ec_pubkey_serialize(..., buf, ..., output_pk, ...)
242+ *  secp256k1_ec_pubkey_tweak_add(..., agg_pk, tweak32)
243+ *  secp256k1_ec_pubkey_serialize(..., buf2, ..., agg_pk, ...)

183+    }
184+    printf("ok\n");
185+    printf("Combining public keys...");
186+    fflush(stdout);
187+    /* If you just want to aggregate and not sign the cache can be NULL */
188+    if (!secp256k1_musig_pubkey_agg(ctx, &agg_pk, &cache, pubkeys_ptr, N_SIGNERS)) {

212+        return 1;
213+    }
214+    printf("ok\n");
215+    secp256k1_context_destroy(ctx);
216+    return 0;
217+}

16+typedef struct {
17+    secp256k1_ge pk;
18+    /* If there is no "second" public key, second_pk is set to the point at
19+     * infinity */
20+    secp256k1_ge second_pk;
21+    unsigned char pk_hash[32];

109+    sha->s[7] = 0x4484be15ul;
110+    sha->bytes = 64;
111+}
112+
113+/* Compute KeyAgg coefficient which is constant 1 for the second pubkey and
114+ * otherwise tagged_hash(pk_hash, x) where pk_hash is the hash of public keys.

226+    }
227+
228+    secp256k1_extrakeys_ge_even_y(&pkp);
229+    if (agg_pk != NULL) {
230+        secp256k1_xonly_pubkey_save(agg_pk, &pkp);
231+    }

20+ *
21+ * It is recommended to read the documentation in this include file carefully.
22+ * Further notes on API usage can be found in doc/musig.md
23+ *
24+ * Since the first version of MuSig is essentially replaced by MuSig2, we use
25+ * MuSig, musig and MuSig2 synonymously unless noted otherwise.

48+ *
49+ *  WARNING: This structure MUST NOT be copied or read or written to directly. A
50+ *  signer who is online throughout the whole process and can keep this
51+ *  structure in memory can use the provided API functions for a safe standard
52+ *  workflow. See
53+ *  https://blockstream.com/2019/02/18/musig-a-new-multisignature-standard/ for

156+ *  Returns: 1 when the signature could be serialized, 0 otherwise
157+ *  Args:    ctx: pointer to a context object
158+ *  Out:   out32: pointer to a 32-byte array to store the serialized signature
159+ *  In:      sig: pointer to the signature
160+ */
161+SECP256K1_API int secp256k1_musig_partial_sig_serialize(

243+ *  secp256k1_ec_pubkey_serialize(..., buf2, ..., agg_pk, ...)
244+ *
245+ *  This function is required if you want to _sign_ for a tweaked aggregate key.
246+ *  On the other hand, if you are only computing a public key, but not intending
247+ *  to create a signature for it, you can just use
248+ *  `secp256k1_ec_pubkey_tweak_add`.

283+ *  secp256k1_xonly_pubkey_tweak_add_check(..., buf, ..., agg_pk, tweak32)
284+ *
285+ *  This function is required if you want to _sign_ for a tweaked aggregate key.
286+ *  On the other hand, if you are only computing a public key, but not intending
287+ *  to create a signature for it, you can just use
288+ *  `secp256k1_xonly_pubkey_tweak_add`.

26+ * - 32 byte hash of all public keys
27+ * - 1 byte the parity of the internal key (if tweaked, otherwise 0)
28+ * - 32 byte tweak
29+ */
30+/* Requires that cache_i->pk is not infinity. */
31+static void secp256k1_keyagg_cache_save(secp256k1_musig_keyagg_cache *cache, secp256k1_keyagg_cache_internal *cache_i) {

36+    ptr += 64;
37+    secp256k1_ge_to_bytes_ext(ptr, &cache_i->second_pk);
38+    ptr += 64;
39+    memcpy(ptr, cache_i->pk_hash, 32);
40+    ptr += 32;
41+    *ptr = cache_i->parity_acc;

74+    sha->s[7] = 0xab148a38ul;
75+    sha->bytes = 64;
76+}
77+
78+/* Computes pk_hash = tagged_hash(pk[0], ..., pk[np-1]) */
79+static int secp256k1_musig_compute_pk_hash(const secp256k1_context *ctx, unsigned char *pk_hash, const secp256k1_pubkey * const* pk, size_t np) {

81+    size_t i;
82+
83+    secp256k1_musig_keyagglist_sha256(&sha);
84+    for (i = 0; i < np; i++) {
85+        unsigned char ser[33];
86+        size_t ser_len = sizeof(ser);

120+
121+    VERIFY_CHECK(!secp256k1_ge_is_infinity(pk));
122+
123+    if (!secp256k1_ge_is_infinity(second_pk)
124+          && secp256k1_fe_equal(&pk->x, &second_pk->x)
125+          && secp256k1_fe_is_odd(&pk->y) == secp256k1_fe_is_odd(&second_pk->y)) {

41+    *ptr = cache_i->parity_acc;
42+    ptr += 1;
43+    secp256k1_scalar_get_b32(ptr, &cache_i->tweak);
44+}
45+
46+static int secp256k1_keyagg_cache_load(const secp256k1_context* ctx, secp256k1_keyagg_cache_internal *cache_i, const secp256k1_musig_keyagg_cache *cache) {

42+static int secp256k1_musig_ge_parse_ext(secp256k1_ge* ge, const unsigned char *in33) {
43+    unsigned char zeros[33] = { 0 };
44+
45+    if (secp256k1_memcmp_var(in33, zeros, sizeof(zeros)) == 0) {
46+        secp256k1_ge_set_infinity(ge);
47+        return 1;

49+    return secp256k1_eckey_pubkey_parse(ge, in33, 33);
50+}
51+
52+static const unsigned char secp256k1_musig_secnonce_magic[4] = { 0x22, 0x0e, 0xdc, 0xf1 };
53+
54+static void secp256k1_musig_secnonce_save(secp256k1_musig_secnonce *secnonce, const secp256k1_scalar *k, secp256k1_ge *pk) {

56+    secp256k1_scalar_get_b32(&secnonce->data[4], &k[0]);
57+    secp256k1_scalar_get_b32(&secnonce->data[36], &k[1]);
58+    secp256k1_ge_to_bytes(&secnonce->data[68], pk);
59+}
60+
61+static int secp256k1_musig_secnonce_load(const secp256k1_context* ctx, secp256k1_scalar *k, secp256k1_ge *pk, secp256k1_musig_secnonce *secnonce) {

254+    VERIFY_CHECK(ctx != NULL);
255+    if (output_pubkey != NULL) {
256+        memset(output_pubkey, 0, sizeof(*output_pubkey));
257+    }
258+    ARG_CHECK(keyagg_cache != NULL);
259+    ARG_CHECK(tweak32 != NULL);

284+
285+int secp256k1_musig_pubkey_ec_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, secp256k1_musig_keyagg_cache *keyagg_cache, const unsigned char *tweak32) {
286+    return secp256k1_musig_pubkey_tweak_add_internal(ctx, output_pubkey, keyagg_cache, tweak32, 0);
287+}
288+
289+int secp256k1_musig_pubkey_xonly_tweak_add(const secp256k1_context* ctx, secp256k1_pubkey *output_pubkey, secp256k1_musig_keyagg_cache *keyagg_cache, const unsigned char *tweak32) {

58+    secp256k1_ge_to_bytes(&secnonce->data[68], pk);
59+}
60+
61+static int secp256k1_musig_secnonce_load(const secp256k1_context* ctx, secp256k1_scalar *k, secp256k1_ge *pk, secp256k1_musig_secnonce *secnonce) {
62+    int is_zero;
63+    ARG_CHECK(secp256k1_memcmp_var(&secnonce->data[0], secp256k1_musig_secnonce_magic, 4) == 0);

39+    unsigned char seckey[32];
40+    while (1) {
41+        if (!fill_random(seckey, sizeof(seckey))) {
42+            printf("Failed to generate randomness\n");
43+            return 0;
44+        }

57+/* Tweak the pubkey corresponding to the provided keyagg cache, update the cache
58+ * and return the tweaked aggregate pk. */
59+static int tweak(const secp256k1_context* ctx, secp256k1_xonly_pubkey *agg_pk, secp256k1_musig_keyagg_cache *cache) {
60+    secp256k1_pubkey output_pk;
61+    unsigned char plain_tweak[32] = "this could be a BIP32 tweak....";
62+    unsigned char xonly_tweak[32] = "this could be a taproot tweak..";

139+         * you must _never_ reuse the secnonce (or use the same session_secrand to
140+         * create a secnonce). If you do, you effectively reuse the nonce and
141+         * leak the secret key. */
142+        if (!secp256k1_musig_partial_sign(ctx, &signer[i].partial_sig, &signer_secrets[i].secnonce, &signer_secrets[i].keypair, cache, &session)) {
143+            return 0;
144+        }

163+        }
164+    }
165+    return secp256k1_musig_partial_sig_agg(ctx, sig64, &session, partial_sigs, N_SIGNERS);
166+}
167+
168+ int main(void) {

15+#include <assert.h>
16+#include <string.h>
17+
18+#include <secp256k1.h>
19+#include <secp256k1_schnorrsig.h>
20+#include <secp256k1_musig.h>

155+ *  Out:     sig: pointer to a signature object
156+ *  In:     in32: pointer to the 32-byte signature to be parsed
157+ *
158+ *  After the call, sig will always be initialized. If parsing failed or the
159+ *  encoded numbers are out of range, signature verification with it is
160+ *  guaranteed to fail for every message and public key.

236+    VERIFY_CHECK(ctx != NULL);
237+    ARG_CHECK(agg_pk != NULL);
238+    memset(agg_pk, 0, sizeof(*agg_pk));
239+    ARG_CHECK(keyagg_cache != NULL);
240+
241+    if(!secp256k1_keyagg_cache_load(ctx, &cache_i, keyagg_cache)) {

421+        aggpk_ser_ptr = aggpk_ser;
422+    }
423+    if (!secp256k1_pubkey_load(ctx, &pk, pubkey)) {
424+        return 0;
425+    }
426+    pk_serialize_success = secp256k1_eckey_pubkey_serialize(&pk, pk_ser, &pk_ser_len, SECP256K1_EC_COMPRESSED);

384+    memset(rand, 0, sizeof(rand));
385+    memset(&sha, 0, sizeof(sha));
386+}
387+
388+int secp256k1_musig_nonce_gen_internal(const secp256k1_context* ctx, secp256k1_musig_secnonce *secnonce, secp256k1_musig_pubnonce *pubnonce, const unsigned char *input_nonce, const unsigned char *seckey, const secp256k1_pubkey *pubkey, const unsigned char *msg32, const secp256k1_musig_keyagg_cache *keyagg_cache, const unsigned char *extra_input32) {
389+    secp256k1_keyagg_cache_internal cache_i;

454+    const secp256k1_musig_pubnonce * const *pubnonces,
455+    size_t n_pubnonces
456+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
457+
458+/** Takes the public nonces of all signers and computes a session that is
459+ *  required for signing and verification of partial signatures.

469+ *                      aggregate (and potentially tweaked) pubkey
470+ */
471+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_nonce_process(
472+    const secp256k1_context *ctx,
473+    secp256k1_musig_session *session,
474+    const secp256k1_musig_aggnonce  *aggnonce,