Implement Schnorr half-aggregation from https://eprint.iacr.org/2021/350.pdf

Relevant to https://github.com/serai-dex/serai/issues/99.

crypto/schnorr/src/tests.rs

@@ -1,13 +1,19 @@
 use rand_core::OsRng;
 
+use blake2::{digest::typenum::U32, Blake2b};
+type Blake2b256 = Blake2b<U32>;
+
 use group::{ff::Field, Group};
 
 use multiexp::BatchVerifier;
 
 use ciphersuite::{Ciphersuite, Ristretto};
-use crate::SchnorrSignature;
+use crate::{
+  SchnorrSignature,
+  aggregate::{SchnorrAggregator, SchnorrAggregate},
+};
 
-pub(crate) fn core_sign<C: Ciphersuite>() {
+pub(crate) fn sign<C: Ciphersuite>() {
   let private_key = C::random_nonzero_F(&mut OsRng);
   let nonce = C::random_nonzero_F(&mut OsRng);
   let challenge = C::random_nonzero_F(&mut OsRng); // Doesn't bother to craft an HRAm
@@ -18,12 +24,12 @@ pub(crate) fn core_sign<C: Ciphersuite>() {
 // The above sign function verifies signing works
 // This verifies invalid signatures don't pass, using zero signatures, which should effectively be
 // random
-pub(crate) fn core_verify<C: Ciphersuite>() {
+pub(crate) fn verify<C: Ciphersuite>() {
   assert!(!SchnorrSignature::<C> { R: C::G::identity(), s: C::F::zero() }
     .verify(C::generator() * C::random_nonzero_F(&mut OsRng), C::random_nonzero_F(&mut OsRng)));
 }
 
-pub(crate) fn core_batch_verify<C: Ciphersuite>() {
+pub(crate) fn batch_verify<C: Ciphersuite>() {
   // Create 5 signatures
   let mut keys = vec![];
   let mut challenges = vec![];
@@ -64,9 +70,38 @@ pub(crate) fn core_batch_verify<C: Ciphersuite>() {
   }
 }
 
+pub(crate) fn aggregate<C: Ciphersuite>() {
+  // Create 5 signatures
+  let mut keys = vec![];
+  let mut challenges = vec![];
+  let mut aggregator = SchnorrAggregator::<Blake2b256, C>::new();
+  for i in 0 .. 5 {
+    keys.push(C::random_nonzero_F(&mut OsRng));
+    challenges.push(C::random_nonzero_F(&mut OsRng));
+    aggregator.aggregate(
+      C::generator() * keys[i],
+      challenges[i],
+      SchnorrSignature::<C>::sign(keys[i], C::random_nonzero_F(&mut OsRng), challenges[i]),
+    );
+  }
+
+  let aggregate = aggregator.complete().unwrap();
+  let aggregate =
+    SchnorrAggregate::<C>::read::<&[u8]>(&mut aggregate.serialize().as_ref()).unwrap();
+  assert!(aggregate.verify::<Blake2b256>(
+    keys
+      .iter()
+      .map(|key| C::generator() * key)
+      .zip(challenges.iter().cloned())
+      .collect::<Vec<_>>()
+      .as_ref()
+  ));
+}
+
 #[test]
 fn test() {
-  core_sign::<Ristretto>();
-  core_verify::<Ristretto>();
-  core_batch_verify::<Ristretto>();
+  sign::<Ristretto>();
+  verify::<Ristretto>();
+  batch_verify::<Ristretto>();
+  aggregate::<Ristretto>();
 }