Begin crate smashing

coins/monero/ringct/clsag/Cargo.toml

@@ -0,0 +1,66 @@
+[package]
+name = "monero-clsag"
+version = "0.1.0"
+description = "The CLSAG linkable ring signature, as defined by the Monero protocol"
+license = "MIT"
+repository = "https://github.com/serai-dex/serai/tree/develop/coins/monero/ringct/clsag"
+authors = ["Luke Parker <lukeparker5132@gmail.com>"]
+edition = "2021"
+rust-version = "1.79"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints]
+workspace = true
+
+[dependencies]
+std-shims = { path = "../../../../common/std-shims", version = "^0.1.1", default-features = false }
+
+thiserror = { version = "1", default-features = false, optional = true }
+
+rand_core = { version = "0.6", default-features = false }
+zeroize = { version = "^1.5", default-features = false, features = ["zeroize_derive"] }
+subtle = { version = "^2.4", default-features = false }
+
+# Cryptographic dependencies
+sha3 = { version = "0.10", default-features = false }
+curve25519-dalek = { version = "4", default-features = false, features = ["alloc", "zeroize"] }
+
+# Multisig dependencies
+rand_chacha = { version = "0.3", default-features = false, optional = true }
+transcript = { package = "flexible-transcript", path = "../../../../crypto/transcript", version = "0.3", default-features = false, features = ["recommended"], optional = true }
+group = { version = "0.13", default-features = false, optional = true }
+dalek-ff-group = { path = "../../../../crypto/dalek-ff-group", version = "0.4", default-features = false, optional = true }
+frost = { package = "modular-frost", path = "../../../../crypto/frost", default-features = false, features = ["ed25519"], optional = true }
+
+# Other Monero dependencies
+monero-io = { path = "../../io", version = "0.1", default-features = false }
+monero-generators = { path = "../../generators", version = "0.4", default-features = false }
+monero-primitives = { path = "../../primitives", version = "0.1", default-features = false }
+
+[features]
+std = [
+  "std-shims/std",
+
+  "thiserror",
+
+  "rand_core/std",
+  "zeroize/std",
+  "subtle/std",
+
+  "sha3/std",
+  "curve25519-dalek/precomputed-tables",
+
+  "rand_chacha?/std",
+  "transcript?/std",
+  "group?/alloc",
+  "dalek-ff-group?/std",
+
+  "monero-io/std",
+  "monero-generators/std",
+  "monero-primitives/std",
+]
+multisig = ["rand_chacha", "transcript", "group", "dalek-ff-group", "frost", "std"]
+default = ["std"]

coins/monero/ringct/clsag/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022-2024 Luke Parker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

coins/monero/ringct/clsag/README.md

@@ -0,0 +1,6 @@
+# Monero CLSAG
+
+The CLSAG linkable ring signature, as defined by the Monero protocol.
+
+This library is usable under no-std when the `std` feature (on by default) is
+disabled.

coins/monero/ringct/clsag/src/lib.rs

@@ -0,0 +1,371 @@
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![doc = include_str!("../README.md")]
+#![cfg_attr(not(feature = "std"), no_std)]
+#![allow(non_snake_case)]
+
+use core::ops::Deref;
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+use subtle::{ConstantTimeEq, ConditionallySelectable};
+
+use curve25519_dalek::{
+  constants::{ED25519_BASEPOINT_TABLE, ED25519_BASEPOINT_POINT},
+  scalar::Scalar,
+  traits::{IsIdentity, MultiscalarMul, VartimePrecomputedMultiscalarMul},
+  edwards::{EdwardsPoint, VartimeEdwardsPrecomputation},
+};
+
+use monero_io::*;
+use monero_generators::hash_to_point;
+use monero_primitives::{INV_EIGHT, BASEPOINT_PRECOMP, Commitment, Decoys, keccak256_to_scalar};
+
+#[cfg(feature = "multisig")]
+mod multisig;
+#[cfg(feature = "multisig")]
+pub use multisig::{ClsagDetails, ClsagAddendum, ClsagMultisig};
+
+/// Errors when working with CLSAGs.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[cfg_attr(feature = "std", derive(thiserror::Error))]
+pub enum ClsagError {
+  /// The ring was invalid (such as being too small or too large).
+  #[cfg_attr(feature = "std", error("invalid ring"))]
+  InvalidRing,
+  /// The specified ring member was invalid (index, ring size).
+  #[cfg_attr(feature = "std", error("invalid ring member (member {0}, ring size {1})"))]
+  InvalidRingMember(u8, u8),
+  /// The commitment opening provided did not match the ring member's.
+  #[cfg_attr(feature = "std", error("invalid commitment"))]
+  InvalidCommitment,
+  /// The key image was invalid (such as being identity or torsioned)
+  #[cfg_attr(feature = "std", error("invalid key image"))]
+  InvalidImage,
+  /// The `D` component was invalid.
+  #[cfg_attr(feature = "std", error("invalid D"))]
+  InvalidD,
+  /// The `s` vector was invalid.
+  #[cfg_attr(feature = "std", error("invalid s"))]
+  InvalidS,
+  /// The `c1` variable was invalid.
+  #[cfg_attr(feature = "std", error("invalid c1"))]
+  InvalidC1,
+}
+
+/// Context on the ring member being signed for.
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
+pub struct ClsagInput {
+  // The actual commitment for the true spend
+  pub commitment: Commitment,
+  // True spend index, offsets, and ring
+  pub decoys: Decoys,
+}
+
+impl ClsagInput {
+  pub fn new(commitment: Commitment, decoys: Decoys) -> Result<ClsagInput, ClsagError> {
+    let n = decoys.len();
+    if n > u8::MAX.into() {
+      Err(ClsagError::InvalidRing)?;
+    }
+    let n = u8::try_from(n).unwrap();
+    if decoys.i >= n {
+      Err(ClsagError::InvalidRingMember(decoys.i, n))?;
+    }
+
+    // Validate the commitment matches
+    if decoys.ring[usize::from(decoys.i)][1] != commitment.calculate() {
+      Err(ClsagError::InvalidCommitment)?;
+    }
+
+    Ok(ClsagInput { commitment, decoys })
+  }
+}
+
+#[allow(clippy::large_enum_variant)]
+enum Mode {
+  Sign(usize, EdwardsPoint, EdwardsPoint),
+  Verify(Scalar),
+}
+
+// Core of the CLSAG algorithm, applicable to both sign and verify with minimal differences
+// Said differences are covered via the above Mode
+fn core(
+  ring: &[[EdwardsPoint; 2]],
+  I: &EdwardsPoint,
+  pseudo_out: &EdwardsPoint,
+  msg: &[u8; 32],
+  D: &EdwardsPoint,
+  s: &[Scalar],
+  A_c1: &Mode,
+) -> ((EdwardsPoint, Scalar, Scalar), Scalar) {
+  let n = ring.len();
+
+  let images_precomp = match A_c1 {
+    Mode::Sign(..) => None,
+    Mode::Verify(..) => Some(VartimeEdwardsPrecomputation::new([I, D])),
+  };
+  let D_INV_EIGHT = D * INV_EIGHT();
+
+  // Generate the transcript
+  // Instead of generating multiple, a single transcript is created and then edited as needed
+  const PREFIX: &[u8] = b"CLSAG_";
+  #[rustfmt::skip]
+  const AGG_0: &[u8]  =       b"agg_0";
+  #[rustfmt::skip]
+  const ROUND: &[u8]  =       b"round";
+  const PREFIX_AGG_0_LEN: usize = PREFIX.len() + AGG_0.len();
+
+  let mut to_hash = Vec::with_capacity(((2 * n) + 5) * 32);
+  to_hash.extend(PREFIX);
+  to_hash.extend(AGG_0);
+  to_hash.extend([0; 32 - PREFIX_AGG_0_LEN]);
+
+  let mut P = Vec::with_capacity(n);
+  for member in ring {
+    P.push(member[0]);
+    to_hash.extend(member[0].compress().to_bytes());
+  }
+
+  let mut C = Vec::with_capacity(n);
+  for member in ring {
+    C.push(member[1] - pseudo_out);
+    to_hash.extend(member[1].compress().to_bytes());
+  }
+
+  to_hash.extend(I.compress().to_bytes());
+  to_hash.extend(D_INV_EIGHT.compress().to_bytes());
+  to_hash.extend(pseudo_out.compress().to_bytes());
+  // mu_P with agg_0
+  let mu_P = keccak256_to_scalar(&to_hash);
+  // mu_C with agg_1
+  to_hash[PREFIX_AGG_0_LEN - 1] = b'1';
+  let mu_C = keccak256_to_scalar(&to_hash);
+
+  // Truncate it for the round transcript, altering the DST as needed
+  to_hash.truncate(((2 * n) + 1) * 32);
+  for i in 0 .. ROUND.len() {
+    to_hash[PREFIX.len() + i] = ROUND[i];
+  }
+  // Unfortunately, it's I D pseudo_out instead of pseudo_out I D, meaning this needs to be
+  // truncated just to add it back
+  to_hash.extend(pseudo_out.compress().to_bytes());
+  to_hash.extend(msg);
+
+  // Configure the loop based on if we're signing or verifying
+  let start;
+  let end;
+  let mut c;
+  match A_c1 {
+    Mode::Sign(r, A, AH) => {
+      start = r + 1;
+      end = r + n;
+      to_hash.extend(A.compress().to_bytes());
+      to_hash.extend(AH.compress().to_bytes());
+      c = keccak256_to_scalar(&to_hash);
+    }
+
+    Mode::Verify(c1) => {
+      start = 0;
+      end = n;
+      c = *c1;
+    }
+  }
+
+  // Perform the core loop
+  let mut c1 = c;
+  for i in (start .. end).map(|i| i % n) {
+    let c_p = mu_P * c;
+    let c_c = mu_C * c;
+
+    // (s_i * G) + (c_p * P_i) + (c_c * C_i)
+    let L = match A_c1 {
+      Mode::Sign(..) => {
+        EdwardsPoint::multiscalar_mul([s[i], c_p, c_c], [ED25519_BASEPOINT_POINT, P[i], C[i]])
+      }
+      Mode::Verify(..) => {
+        BASEPOINT_PRECOMP().vartime_mixed_multiscalar_mul([s[i]], [c_p, c_c], [P[i], C[i]])
+      }
+    };
+
+    let PH = hash_to_point(P[i].compress().0);
+
+    // (c_p * I) + (c_c * D) + (s_i * PH)
+    let R = match A_c1 {
+      Mode::Sign(..) => EdwardsPoint::multiscalar_mul([c_p, c_c, s[i]], [I, D, &PH]),
+      Mode::Verify(..) => {
+        images_precomp.as_ref().unwrap().vartime_mixed_multiscalar_mul([c_p, c_c], [s[i]], [PH])
+      }
+    };
+
+    to_hash.truncate(((2 * n) + 3) * 32);
+    to_hash.extend(L.compress().to_bytes());
+    to_hash.extend(R.compress().to_bytes());
+    c = keccak256_to_scalar(&to_hash);
+
+    // This will only execute once and shouldn't need to be constant time. Making it constant time
+    // removes the risk of branch prediction creating timing differences depending on ring index
+    // however
+    c1.conditional_assign(&c, i.ct_eq(&(n - 1)));
+  }
+
+  // This first tuple is needed to continue signing, the latter is the c to be tested/worked with
+  ((D_INV_EIGHT, c * mu_P, c * mu_C), c1)
+}
+
+/// CLSAG signature, as used in Monero.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Clsag {
+  D: EdwardsPoint,
+  pub(crate) s: Vec<Scalar>,
+  pub c1: Scalar,
+}
+
+pub(crate) struct ClsagSignCore {
+  incomplete_clsag: Clsag,
+  pseudo_out: EdwardsPoint,
+  key_challenge: Scalar,
+  challenged_mask: Scalar,
+}
+
+impl Clsag {
+  // Sign core is the extension of core as needed for signing, yet is shared between single signer
+  // and multisig, hence why it's still core
+  pub(crate) fn sign_core<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    I: &EdwardsPoint,
+    input: &ClsagInput,
+    mask: Scalar,
+    msg: &[u8; 32],
+    A: EdwardsPoint,
+    AH: EdwardsPoint,
+  ) -> ClsagSignCore {
+    let r: usize = input.decoys.i.into();
+
+    let pseudo_out = Commitment::new(mask, input.commitment.amount).calculate();
+    let mask_delta = input.commitment.mask - mask;
+
+    let H = hash_to_point(input.decoys.ring[r][0].compress().0);
+    let D = H * mask_delta;
+    let mut s = Vec::with_capacity(input.decoys.ring.len());
+    for _ in 0 .. input.decoys.ring.len() {
+      s.push(Scalar::random(rng));
+    }
+    let ((D, c_p, c_c), c1) =
+      core(&input.decoys.ring, I, &pseudo_out, msg, &D, &s, &Mode::Sign(r, A, AH));
+
+    ClsagSignCore {
+      incomplete_clsag: Clsag { D, s, c1 },
+      pseudo_out,
+      key_challenge: c_p,
+      challenged_mask: c_c * mask_delta,
+    }
+  }
+
+  /// Generate CLSAG signatures for the given inputs.
+  ///
+  /// inputs is of the form (private key, key image, input).
+  /// sum_outputs is for the sum of the outputs' commitment masks.
+  pub fn sign<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    mut inputs: Vec<(Zeroizing<Scalar>, EdwardsPoint, ClsagInput)>,
+    sum_outputs: Scalar,
+    msg: [u8; 32],
+  ) -> Vec<(Clsag, EdwardsPoint)> {
+    let mut res = Vec::with_capacity(inputs.len());
+    let mut sum_pseudo_outs = Scalar::ZERO;
+    for i in 0 .. inputs.len() {
+      let mut mask = Scalar::random(rng);
+      if i == (inputs.len() - 1) {
+        mask = sum_outputs - sum_pseudo_outs;
+      } else {
+        sum_pseudo_outs += mask;
+      }
+
+      let mut nonce = Zeroizing::new(Scalar::random(rng));
+      let ClsagSignCore { mut incomplete_clsag, pseudo_out, key_challenge, challenged_mask } =
+        Clsag::sign_core(
+          rng,
+          &inputs[i].1,
+          &inputs[i].2,
+          mask,
+          &msg,
+          nonce.deref() * ED25519_BASEPOINT_TABLE,
+          nonce.deref() *
+            hash_to_point(
+              inputs[i].2.decoys.ring[usize::from(inputs[i].2.decoys.i)][0].compress().0,
+            ),
+        );
+      // Effectively r - cx, except cx is (c_p x) + (c_c z), where z is the delta between a ring
+      // member's commitment and our input commitment (which will only have a known discrete log
+      // over G if the amounts cancel out)
+      incomplete_clsag.s[usize::from(inputs[i].2.decoys.i)] =
+        nonce.deref() - ((key_challenge * inputs[i].0.deref()) + challenged_mask);
+      let clsag = incomplete_clsag;
+
+      // Zeroize private keys and nonces.
+      inputs[i].0.zeroize();
+      nonce.zeroize();
+
+      debug_assert!(clsag
+        .verify(&inputs[i].2.decoys.ring, &inputs[i].1, &pseudo_out, &msg)
+        .is_ok());
+
+      res.push((clsag, pseudo_out));
+    }
+
+    res
+  }
+
+  /// Verify the CLSAG signature against the given Transaction data.
+  pub fn verify(
+    &self,
+    ring: &[[EdwardsPoint; 2]],
+    I: &EdwardsPoint,
+    pseudo_out: &EdwardsPoint,
+    msg: &[u8; 32],
+  ) -> Result<(), ClsagError> {
+    // Preliminary checks. s, c1, and points must also be encoded canonically, which isn't checked
+    // here
+    if ring.is_empty() {
+      Err(ClsagError::InvalidRing)?;
+    }
+    if ring.len() != self.s.len() {
+      Err(ClsagError::InvalidS)?;
+    }
+    if I.is_identity() || (!I.is_torsion_free()) {
+      Err(ClsagError::InvalidImage)?;
+    }
+
+    let D = self.D.mul_by_cofactor();
+    if D.is_identity() {
+      Err(ClsagError::InvalidD)?;
+    }
+
+    let (_, c1) = core(ring, I, pseudo_out, msg, &D, &self.s, &Mode::Verify(self.c1));
+    if c1 != self.c1 {
+      Err(ClsagError::InvalidC1)?;
+    }
+    Ok(())
+  }
+
+  pub fn fee_weight(ring_len: usize) -> usize {
+    (ring_len * 32) + 32 + 32
+  }
+
+  /// Write the CLSAG to a writer.
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    write_raw_vec(write_scalar, &self.s, w)?;
+    w.write_all(&self.c1.to_bytes())?;
+    write_point(&self.D, w)
+  }
+
+  /// Read a CLSAG from a reader.
+  pub fn read<R: Read>(decoys: usize, r: &mut R) -> io::Result<Clsag> {
+    Ok(Clsag { s: read_raw_vec(read_scalar, decoys, r)?, c1: read_scalar(r)?, D: read_point(r)? })
+  }
+}

coins/monero/ringct/clsag/src/multisig.rs

@@ -0,0 +1,331 @@
+use core::{ops::Deref, fmt::Debug};
+use std_shims::{
+  io::{self, Read, Write},
+  collections::HashMap,
+};
+use std::sync::{Arc, RwLock};
+
+use rand_core::{RngCore, CryptoRng, SeedableRng};
+use rand_chacha::ChaCha20Rng;
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+
+use curve25519_dalek::{scalar::Scalar, edwards::EdwardsPoint};
+
+use group::{
+  ff::{Field, PrimeField},
+  Group, GroupEncoding,
+};
+
+use transcript::{Transcript, RecommendedTranscript};
+use dalek_ff_group as dfg;
+use frost::{
+  dkg::lagrange,
+  curve::Ed25519,
+  Participant, FrostError, ThresholdKeys, ThresholdView,
+  algorithm::{WriteAddendum, Algorithm},
+};
+
+use monero_generators::hash_to_point;
+
+use crate::{ClsagInput, Clsag};
+
+impl ClsagInput {
+  fn transcript<T: Transcript>(&self, transcript: &mut T) {
+    // Doesn't domain separate as this is considered part of the larger CLSAG proof
+
+    // Ring index
+    transcript.append_message(b"real_spend", [self.decoys.i]);
+
+    // Ring
+    for (i, pair) in self.decoys.ring.iter().enumerate() {
+      // Doesn't include global output indexes as CLSAG doesn't care and won't be affected by it
+      // They're just a unreliable reference to this data which will be included in the message
+      // if in use
+      transcript.append_message(b"member", [u8::try_from(i).expect("ring size exceeded 255")]);
+      // This also transcripts the key image generator since it's derived from this key
+      transcript.append_message(b"key", pair[0].compress().to_bytes());
+      transcript.append_message(b"commitment", pair[1].compress().to_bytes())
+    }
+
+    // Doesn't include the commitment's parts as the above ring + index includes the commitment
+    // The only potential malleability would be if the G/H relationship is known breaking the
+    // discrete log problem, which breaks everything already
+  }
+}
+
+/// CLSAG input and the mask to use for it.
+#[derive(Clone, Debug, Zeroize, ZeroizeOnDrop)]
+pub struct ClsagDetails {
+  input: ClsagInput,
+  mask: Scalar,
+}
+
+impl ClsagDetails {
+  pub fn new(input: ClsagInput, mask: Scalar) -> ClsagDetails {
+    ClsagDetails { input, mask }
+  }
+}
+
+/// Addendum produced during the FROST signing process with relevant data.
+#[derive(Clone, PartialEq, Eq, Zeroize, Debug)]
+pub struct ClsagAddendum {
+  pub key_image: dfg::EdwardsPoint,
+}
+
+impl WriteAddendum for ClsagAddendum {
+  fn write<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(self.key_image.compress().to_bytes().as_ref())
+  }
+}
+
+#[allow(non_snake_case)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+struct Interim {
+  p: Scalar,
+  c: Scalar,
+
+  clsag: Clsag,
+  pseudo_out: EdwardsPoint,
+}
+
+/// FROST algorithm for producing a CLSAG signature.
+#[allow(non_snake_case)]
+#[derive(Clone, Debug)]
+pub struct ClsagMultisig {
+  transcript: RecommendedTranscript,
+
+  pub H: EdwardsPoint,
+  key_image_shares: HashMap<[u8; 32], dfg::EdwardsPoint>,
+  image: Option<dfg::EdwardsPoint>,
+
+  details: Arc<RwLock<Option<ClsagDetails>>>,
+
+  msg: Option<[u8; 32]>,
+  interim: Option<Interim>,
+}
+
+impl ClsagMultisig {
+  pub fn new(
+    transcript: RecommendedTranscript,
+    output_key: EdwardsPoint,
+    details: Arc<RwLock<Option<ClsagDetails>>>,
+  ) -> ClsagMultisig {
+    ClsagMultisig {
+      transcript,
+
+      H: hash_to_point(output_key.compress().0),
+      key_image_shares: HashMap::new(),
+      image: None,
+
+      details,
+
+      msg: None,
+      interim: None,
+    }
+  }
+
+  fn input(&self) -> ClsagInput {
+    (*self.details.read().unwrap()).as_ref().unwrap().input.clone()
+  }
+
+  fn mask(&self) -> Scalar {
+    (*self.details.read().unwrap()).as_ref().unwrap().mask
+  }
+}
+
+impl Algorithm<Ed25519> for ClsagMultisig {
+  type Transcript = RecommendedTranscript;
+  type Addendum = ClsagAddendum;
+  type Signature = (Clsag, EdwardsPoint);
+
+  fn nonces(&self) -> Vec<Vec<dfg::EdwardsPoint>> {
+    vec![vec![dfg::EdwardsPoint::generator(), dfg::EdwardsPoint(self.H)]]
+  }
+
+  fn preprocess_addendum<R: RngCore + CryptoRng>(
+    &mut self,
+    _rng: &mut R,
+    keys: &ThresholdKeys<Ed25519>,
+  ) -> ClsagAddendum {
+    ClsagAddendum { key_image: dfg::EdwardsPoint(self.H) * keys.secret_share().deref() }
+  }
+
+  fn read_addendum<R: Read>(&self, reader: &mut R) -> io::Result<ClsagAddendum> {
+    let mut bytes = [0; 32];
+    reader.read_exact(&mut bytes)?;
+    // dfg ensures the point is torsion free
+    let xH = Option::<dfg::EdwardsPoint>::from(dfg::EdwardsPoint::from_bytes(&bytes))
+      .ok_or_else(|| io::Error::other("invalid key image"))?;
+    // Ensure this is a canonical point
+    if xH.to_bytes() != bytes {
+      Err(io::Error::other("non-canonical key image"))?;
+    }
+
+    Ok(ClsagAddendum { key_image: xH })
+  }
+
+  fn process_addendum(
+    &mut self,
+    view: &ThresholdView<Ed25519>,
+    l: Participant,
+    addendum: ClsagAddendum,
+  ) -> Result<(), FrostError> {
+    if self.image.is_none() {
+      self.transcript.domain_separate(b"CLSAG");
+      // Transcript the ring
+      self.input().transcript(&mut self.transcript);
+      // Transcript the mask
+      self.transcript.append_message(b"mask", self.mask().to_bytes());
+
+      // Init the image to the offset
+      self.image = Some(dfg::EdwardsPoint(self.H) * view.offset());
+    }
+
+    // Transcript this participant's contribution
+    self.transcript.append_message(b"participant", l.to_bytes());
+    self.transcript.append_message(b"key_image_share", addendum.key_image.compress().to_bytes());
+
+    // Accumulate the interpolated share
+    let interpolated_key_image_share =
+      addendum.key_image * lagrange::<dfg::Scalar>(l, view.included());
+    *self.image.as_mut().unwrap() += interpolated_key_image_share;
+
+    self
+      .key_image_shares
+      .insert(view.verification_share(l).to_bytes(), interpolated_key_image_share);
+
+    Ok(())
+  }
+
+  fn transcript(&mut self) -> &mut Self::Transcript {
+    &mut self.transcript
+  }
+
+  fn sign_share(
+    &mut self,
+    view: &ThresholdView<Ed25519>,
+    nonce_sums: &[Vec<dfg::EdwardsPoint>],
+    nonces: Vec<Zeroizing<dfg::Scalar>>,
+    msg: &[u8],
+  ) -> dfg::Scalar {
+    // Use the transcript to get a seeded random number generator
+    // The transcript contains private data, preventing passive adversaries from recreating this
+    // process even if they have access to commitments (specifically, the ring index being signed
+    // for, along with the mask which should not only require knowing the shared keys yet also the
+    // input commitment masks)
+    let mut rng = ChaCha20Rng::from_seed(self.transcript.rng_seed(b"decoy_responses"));
+
+    self.msg = Some(msg.try_into().expect("CLSAG message should be 32-bytes"));
+
+    let sign_core = Clsag::sign_core(
+      &mut rng,
+      &self.image.expect("verifying a share despite never processing any addendums").0,
+      &self.input(),
+      self.mask(),
+      self.msg.as_ref().unwrap(),
+      nonce_sums[0][0].0,
+      nonce_sums[0][1].0,
+    );
+    self.interim = Some(Interim {
+      p: sign_core.key_challenge,
+      c: sign_core.challenged_mask,
+      clsag: sign_core.incomplete_clsag,
+      pseudo_out: sign_core.pseudo_out,
+    });
+
+    // r - p x, where p is the challenge for the keys
+    *nonces[0] - dfg::Scalar(sign_core.key_challenge) * view.secret_share().deref()
+  }
+
+  #[must_use]
+  fn verify(
+    &self,
+    _: dfg::EdwardsPoint,
+    _: &[Vec<dfg::EdwardsPoint>],
+    sum: dfg::Scalar,
+  ) -> Option<Self::Signature> {
+    let interim = self.interim.as_ref().unwrap();
+    let mut clsag = interim.clsag.clone();
+    // We produced shares as `r - p x`, yet the signature is `r - p x - c x`
+    // Substract `c x` (saved as `c`) now
+    clsag.s[usize::from(self.input().decoys.i)] = sum.0 - interim.c;
+    if clsag
+      .verify(
+        &self.input().decoys.ring,
+        &self.image.expect("verifying a signature despite never processing any addendums").0,
+        &interim.pseudo_out,
+        self.msg.as_ref().unwrap(),
+      )
+      .is_ok()
+    {
+      return Some((clsag, interim.pseudo_out));
+    }
+    None
+  }
+
+  fn verify_share(
+    &self,
+    verification_share: dfg::EdwardsPoint,
+    nonces: &[Vec<dfg::EdwardsPoint>],
+    share: dfg::Scalar,
+  ) -> Result<Vec<(dfg::Scalar, dfg::EdwardsPoint)>, ()> {
+    let interim = self.interim.as_ref().unwrap();
+
+    // For a share `r - p x`, the following two equalities should hold:
+    // - `(r - p x)G == R.0 - pV`, where `V = xG`
+    // - `(r - p x)H == R.1 - pK`, where `K = xH` (the key image share)
+    //
+    // This is effectively a discrete log equality proof for:
+    // V, K over G, H
+    // with nonces
+    // R.0, R.1
+    // and solution
+    // s
+    //
+    // Which is a batch-verifiable rewrite of the traditional CP93 proof
+    // (and also writable as Generalized Schnorr Protocol)
+    //
+    // That means that given a proper challenge, this alone can be certainly argued to prove the
+    // key image share is well-formed and the provided signature so proves for that.
+
+    // This is a bit funky as it doesn't prove the nonces are well-formed however. They're part of
+    // the prover data/transcript for a CP93/GSP proof, not part of the statement. This practically
+    // is fine, for a variety of reasons (given a consistent `x`, a consistent `r` can be
+    // extracted, and the nonces as used in CLSAG are also part of its prover data/transcript).
+
+    let key_image_share = self.key_image_shares[&verification_share.to_bytes()];
+
+    // Hash every variable relevant here, using the hahs output as the random weight
+    let mut weight_transcript =
+      RecommendedTranscript::new(b"monero-serai v0.1 ClsagMultisig::verify_share");
+    weight_transcript.append_message(b"G", dfg::EdwardsPoint::generator().to_bytes());
+    weight_transcript.append_message(b"H", self.H.to_bytes());
+    weight_transcript.append_message(b"xG", verification_share.to_bytes());
+    weight_transcript.append_message(b"xH", key_image_share.to_bytes());
+    weight_transcript.append_message(b"rG", nonces[0][0].to_bytes());
+    weight_transcript.append_message(b"rH", nonces[0][1].to_bytes());
+    weight_transcript.append_message(b"c", dfg::Scalar(interim.p).to_repr());
+    weight_transcript.append_message(b"s", share.to_repr());
+    let weight = weight_transcript.challenge(b"weight");
+    let weight = dfg::Scalar(Scalar::from_bytes_mod_order_wide(&weight.into()));
+
+    let part_one = vec![
+      (share, dfg::EdwardsPoint::generator()),
+      // -(R.0 - pV) == -R.0 + pV
+      (-dfg::Scalar::ONE, nonces[0][0]),
+      (dfg::Scalar(interim.p), verification_share),
+    ];
+
+    let mut part_two = vec![
+      (weight * share, dfg::EdwardsPoint(self.H)),
+      // -(R.1 - pK) == -R.1 + pK
+      (-weight, nonces[0][1]),
+      (weight * dfg::Scalar(interim.p), key_image_share),
+    ];
+
+    let mut all = part_one;
+    all.append(&mut part_two);
+    Ok(all)
+  }
+}