mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
d1cc69af98
The signer and the verifier each built c = H(R || Y || m) by passing the concatenation to curve.FromHash, which does not hash: it truncates its input to the group order's byte length and reads it big-endian, the SECG convention for an ECDSA digest. Y and m fell off the end, so the challenge was a function of R alone and one signature verified under every message. The derivation now lives in one place and hashes, each piece length- and domain-separated, with the digest read wide.