Struct Clsag 

pub struct Clsag {
    pub D: CompressedPoint,
    pub s: Vec<Scalar>,
    pub c1: Scalar,
}

The CLSAG signature, as used in Monero.

Fields

D: CompressedPoint

The difference of the commitment randomnesses, scaling the key image generator.

s: Vec<Scalar>

The responses for each ring member.

c1: Scalar

The first challenge in the ring.

Implementations

impl Clsag

pub fn sign<R: RngCore + CryptoRng>( rng: &mut R, inputs: Vec<(Zeroizing<Scalar>, ClsagContext)>, sum_outputs: Scalar, msg_hash: [u8; 32], ) -> Result<Vec<(Clsag, EdwardsPoint)>, ClsagError>

Sign CLSAG signatures for the provided inputs.

Monero ensures the rerandomized input commitments have the same value as the outputs by checking sum(rerandomized_input_commitments) - sum(output_commitments) == 0. This requires not only the amounts balance, yet also sum(input_commitment_masks) - sum(output_commitment_masks).

Monero solves this by following the wallet protocol to determine each output commitment’s randomness, then using random masks for all but the last input. The last input is rerandomized to the necessary mask for the equation to balance.

Due to Monero having this behavior, it only makes sense to sign CLSAGs as a list, hence this API being the way it is.

inputs is of the form (discrete logarithm of the key, context).

sum_outputs is for the sum of the output commitments’ masks.

WARNING: This follows the Fiat-Shamir transcript format used by the Monero protocol, which makes assumptions on what has already been transcripted and bound to within msg_hash. Do not use this if you don’t know what you’re doing.

pub fn verify( &self, ring: Vec<[CompressedPoint; 2]>, I: &CompressedPoint, pseudo_out: &CompressedPoint, msg_hash: &[u8; 32], ) -> Result<(), ClsagError>

Verify a CLSAG signature for the provided context.

WARNING: This follows the Fiat-Shamir transcript format used by the Monero protocol, which makes assumptions on what has already been transcripted and bound to within msg_hash. Do not use this if you don’t know what you’re doing.

pub fn write<W: Write>(&self, w: &mut W) -> Result<()>

Write a CLSAG.

pub fn read<R: Read>(decoys: usize, r: &mut R) -> Result<Clsag>

Read a CLSAG.

Trait Implementations

impl Clone for Clsag

fn clone(&self) -> Clsag

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Clsag

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Clsag

fn eq(&self, other: &Clsag) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for Clsag

impl StructuralPartialEq for Clsag

Layout

Note: Most layout information is completely unstable and may even differ between compilations. The only exception is types with certain repr(...) attributes. Please see the Rust Reference's “Type Layout” chapter for details on type layout guarantees.

Size: 88 bytes