zeekay d1cc69af98 Make the Schnorr challenge cover the message it signs ...

The signer and the verifier each built c = H(R || Y || m) by passing the
concatenation to curve.FromHash, which does not hash: it truncates its
input to the group order's byte length and reads it big-endian, the SECG
convention for an ECDSA digest. Y and m fell off the end, so the
challenge was a function of R alone and one signature verified under
every message.

The derivation now lives in one place and hashes, each piece length- and
domain-separated, with the digest read wide.

2026-09-01 19:31:18 -07:00

..

arith

…

curve

Make the Schnorr challenge cover the message it signs

2026-09-01 19:31:18 -07:00

polynomial

pkg/math/polynomial: add LagrangeAtZeroBigInt for tfhe combine

2026-06-01 21:24:48 +05:30

sample

fix(pool,protocol): close-vs-send race and Verify/Finalize serialization

2026-05-31 17:15:43 -07:00