Smash the singular Ciphersuite trait into multiple

This helps identify where the various functionalities are used, or rather, not used. The `Ciphersuite` trait present in `patches/ciphersuite`, facilitating the entire FCMP++ tree, only requires the markers _and_ canonical point decoding. I've opened a PR to upstream such a trait into `group` (https://github.com/zkcrypto/group/pull/68). `WrappedGroup` is still justified for as long as `Group::generator` exists. Moving `::generator()` to its own trait, on an independent structure (upstream) would be massively appreciated. @tarcieri also wanted to update from `fn generator()` to `const GENERATOR`, which would encourage further discussion on https://github.com/zkcrypto/group/issues/32 and https://github.com/zkcrypto/group/issues/45, which have been stagnant. The `Id` trait is occasionally used yet really should be first off the chopping block. Finally, `WithPreferredHash` is only actually used around a third of the time, which more than justifies it being a separate trait. --- Updates `dalek_ff_group::Scalar` to directly re-export `curve25519_dalek::Scalar`, as without issue. `dalek_ff_group::RistrettoPoint` also could be replaced with an export of `curve25519_dalek::RistrettoPoint`, yet the coordinator relies on how we implemented `Hash` on it for the hell of it so it isn't worth it at this time. `dalek_ff_group::EdwardsPoint` can't be replaced for an re-export of `curve25519_dalek::SubgroupPoint` as it doesn't implement `zeroize`, `subtle` traits within a released, non-yanked version. Relevance to https://github.com/serai-dex/serai/issues/201 and https://github.com/dalek-cryptography/curve25519-dalek/issues/811#issuecomment-3247732746. Also updates the `Ristretto` ciphersuite to prefer `Blake2b-512` over `SHA2-512`. In order to maintain compliance with FROST's IETF standard, `modular-frost` defines its own ciphersuite for Ristretto which still uses `SHA2-512`.
2025-12-09 12:49:23 +00:00 · 2025-09-03 12:25:37 -04:00
parent 215e41fdb6
commit a141deaf36
124 changed files with 1003 additions and 1211 deletions
--- a/crypto/dkg/dealer/src/lib.rs
+++ b/crypto/dkg/dealer/src/lib.rs
@@ -10,12 +10,12 @@ use rand_core::{RngCore, CryptoRng};

 use ciphersuite::{
  group::ff::{Field, PrimeField},
-  Ciphersuite,
+  GroupIo, Id,
 };
 pub use dkg::*;

 /// Create a key via a dealer key generation protocol.
-pub fn key_gen<R: RngCore + CryptoRng, C: Ciphersuite>(
+pub fn key_gen<R: RngCore + CryptoRng, C: GroupIo + Id>(
  rng: &mut R,
  threshold: u16,
  participants: u16,
--- a/crypto/dkg/evrf/Cargo.toml
+++ b/crypto/dkg/evrf/Cargo.toml
@@ -31,13 +31,13 @@ ciphersuite = { path = "../../ciphersuite", version = "^0.4.1", default-features
 multiexp = { path = "../../multiexp", version = "0.4", default-features = false }

 generic-array = { version = "1", default-features = false, features = ["alloc"] }
-blake2 = { version = "0.11.0-rc.0", default-features = false }
+blake2 = { version = "0.11.0-rc.2", default-features = false }
 rand_chacha = { version = "0.3", default-features = false }

-generalized-bulletproofs = { git = "https://github.com/monero-oxide/monero-oxide", rev = "a6f8797007e768488568b821435cf5006517a962", default-features = false }
-ec-divisors = { git = "https://github.com/monero-oxide/monero-oxide", rev = "a6f8797007e768488568b821435cf5006517a962", default-features = false }
-generalized-bulletproofs-circuit-abstraction = { git = "https://github.com/monero-oxide/monero-oxide", rev = "a6f8797007e768488568b821435cf5006517a962", default-features = false }
-generalized-bulletproofs-ec-gadgets = { git = "https://github.com/monero-oxide/monero-oxide", rev = "a6f8797007e768488568b821435cf5006517a962", default-features = false }
+generalized-bulletproofs = { git = "https://github.com/monero-oxide/monero-oxide", rev = "7216a2e84c7671c167c3d81eafe0d2b1f418f102", default-features = false }
+ec-divisors = { git = "https://github.com/monero-oxide/monero-oxide", rev = "7216a2e84c7671c167c3d81eafe0d2b1f418f102", default-features = false }
+generalized-bulletproofs-circuit-abstraction = { git = "https://github.com/monero-oxide/monero-oxide", rev = "7216a2e84c7671c167c3d81eafe0d2b1f418f102", default-features = false }
+generalized-bulletproofs-ec-gadgets = { git = "https://github.com/monero-oxide/monero-oxide", rev = "7216a2e84c7671c167c3d81eafe0d2b1f418f102", default-features = false }

 dkg = { path = "..", default-features = false }

@@ -52,7 +52,7 @@ rand = { version = "0.8", default-features = false, features = ["std"] }
 ciphersuite = { path = "../../ciphersuite", default-features = false, features = ["std"]  }
 embedwards25519 = { path = "../../embedwards25519", default-features = false, features = ["std"] }
 dalek-ff-group = { path = "../../dalek-ff-group", default-features = false, features = ["std"] }
-generalized-bulletproofs = { git = "https://github.com/monero-oxide/monero-oxide", rev = "a6f8797007e768488568b821435cf5006517a962", features = ["tests"] }
+generalized-bulletproofs = { git = "https://github.com/monero-oxide/monero-oxide", rev = "7216a2e84c7671c167c3d81eafe0d2b1f418f102", features = ["tests"] }
 dkg-recovery = { path = "../recovery" }

 [features]
@@ -86,6 +86,5 @@ std = [
 ]
 secp256k1 = ["ciphersuite-kp256", "secq256k1"]
 ed25519 = ["dalek-ff-group", "embedwards25519"]
-ristretto = ["dalek-ff-group", "embedwards25519"]
 tests = ["rand_core/getrandom"]
 default = ["std"]
--- a/crypto/dkg/evrf/src/curves.rs
+++ b/crypto/dkg/evrf/src/curves.rs
@@ -17,7 +17,7 @@ type Blake2s256Keyed = Blake2sMac<U32>;

 use ciphersuite::{
  group::{ff::FromUniformBytes, GroupEncoding},
-  Ciphersuite,
+  WrappedGroup, Id, GroupIo,
 };

 use ec_divisors::DivisorCurve;
@@ -27,10 +27,10 @@ use generalized_bulletproofs_ec_gadgets::*;
 /// A pair of curves to perform the eVRF with.
 pub trait Curves {
  /// The towering curve, for which the resulting key is on.
-  type ToweringCurve: Ciphersuite<F: FromUniformBytes<64>>;
+  type ToweringCurve: Id + GroupIo<F: FromUniformBytes<64>>;
  /// The embedded curve which participants represent their public keys over.
-  type EmbeddedCurve: Ciphersuite<
-    G: DivisorCurve<FieldElement = <Self::ToweringCurve as Ciphersuite>::F>,
+  type EmbeddedCurve: GroupIo<
+    G: DivisorCurve<FieldElement = <Self::ToweringCurve as WrappedGroup>::F>,
  >;
  /// The parameters to use the embedded curve with the discrete-log gadget.
  type EmbeddedCurveParameters: DiscreteLogParameters;
@@ -49,14 +49,14 @@ impl<C: Curves> Generators<C> {
  pub fn new(max_threshold: u16, max_participants: u16) -> Generators<C> {
    let entropy = <Blake2s256Keyed as KeyInit>::new(&{
      let mut key = Array::<u8, <Blake2s256Keyed as KeySizeUser>::KeySize>::default();
-      let key_len = key.len().min(<C::ToweringCurve as Ciphersuite>::ID.len());
+      let key_len = key.len().min(<C::ToweringCurve as Id>::ID.len());
      {
        let key: &mut [u8] = key.as_mut();
-        key[.. key_len].copy_from_slice(&<C::ToweringCurve as Ciphersuite>::ID[.. key_len])
+        key[.. key_len].copy_from_slice(&<C::ToweringCurve as Id>::ID[.. key_len])
      }
      key
    })
-    .chain_update(<C::ToweringCurve as Ciphersuite>::generator().to_bytes())
+    .chain_update(<C::ToweringCurve as WrappedGroup>::generator().to_bytes())
    .finalize()
    .into_bytes();
    let mut rng = ChaCha20Rng::from_seed(entropy.into());
@@ -71,7 +71,8 @@ impl<C: Curves> Generators<C> {
      h_bold.push(crate::sample_point::<C::ToweringCurve>(&mut rng));
    }
    Self(
-      BpGenerators::new(<C::ToweringCurve as Ciphersuite>::generator(), h, g_bold, h_bold).unwrap(),
+      BpGenerators::new(<C::ToweringCurve as WrappedGroup>::generator(), h, g_bold, h_bold)
+        .unwrap(),
    )
  }
 }
@@ -95,13 +96,3 @@ impl Curves for Ed25519 {
  type EmbeddedCurve = embedwards25519::Embedwards25519;
  type EmbeddedCurveParameters = embedwards25519::Embedwards25519;
 }
-
-/// Ristretto, and an elliptic curve defined over its scalar field (embedwards25519).
-#[cfg(any(test, feature = "ristretto"))]
-pub struct Ristretto;
-#[cfg(any(test, feature = "ristretto"))]
-impl Curves for Ristretto {
-  type ToweringCurve = dalek_ff_group::Ristretto;
-  type EmbeddedCurve = embedwards25519::Embedwards25519;
-  type EmbeddedCurveParameters = embedwards25519::Embedwards25519;
-}
--- a/crypto/dkg/evrf/src/lib.rs
+++ b/crypto/dkg/evrf/src/lib.rs
@@ -21,7 +21,7 @@ use ciphersuite::{
    ff::{Field, PrimeField},
    Group, GroupEncoding,
  },
-  Ciphersuite,
+  WrappedGroup, GroupIo,
 };
 use multiexp::multiexp_vartime;

@@ -49,7 +49,7 @@ mod tests;
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub struct Participation<C: Curves> {
  proof: Vec<u8>,
-  encrypted_secret_shares: HashMap<Participant, <C::ToweringCurve as Ciphersuite>::F>,
+  encrypted_secret_shares: HashMap<Participant, <C::ToweringCurve as WrappedGroup>::F>,
 }

 impl<C: Curves> Participation<C> {
@@ -79,7 +79,7 @@ impl<C: Curves> Participation<C> {

    let mut encrypted_secret_shares = HashMap::with_capacity(usize::from(n));
    for i in Participant::iter().take(usize::from(n)) {
-      encrypted_secret_shares.insert(i, <C::ToweringCurve as Ciphersuite>::read_F(reader)?);
+      encrypted_secret_shares.insert(i, <C::ToweringCurve as GroupIo>::read_F(reader)?);
    }

    Ok(Self { proof, encrypted_secret_shares })
@@ -151,14 +151,14 @@ pub enum VerifyResult<C: Curves> {
 pub struct Dkg<C: Curves> {
  t: u16,
  n: u16,
-  evrf_public_keys: Vec<<C::EmbeddedCurve as Ciphersuite>::G>,
-  verification_shares: HashMap<Participant, <C::ToweringCurve as Ciphersuite>::G>,
+  evrf_public_keys: Vec<<C::EmbeddedCurve as WrappedGroup>::G>,
+  verification_shares: HashMap<Participant, <C::ToweringCurve as WrappedGroup>::G>,
  #[allow(clippy::type_complexity)]
  encrypted_secret_shares: HashMap<
    Participant,
    HashMap<
      Participant,
-      ([<C::EmbeddedCurve as Ciphersuite>::G; 2], <C::ToweringCurve as Ciphersuite>::F),
+      ([<C::EmbeddedCurve as WrappedGroup>::G; 2], <C::ToweringCurve as WrappedGroup>::F),
    >,
  >,
 }
@@ -167,7 +167,7 @@ impl<C: Curves> Dkg<C> {
  // Form the initial transcript for the proofs.
  fn initial_transcript(
    invocation: [u8; 32],
-    evrf_public_keys: &[<C::EmbeddedCurve as Ciphersuite>::G],
+    evrf_public_keys: &[<C::EmbeddedCurve as WrappedGroup>::G],
    t: u16,
  ) -> [u8; 32] {
    let mut transcript = Blake2s256::new();
@@ -188,8 +188,8 @@ impl<C: Curves> Dkg<C> {
    generators: &Generators<C>,
    context: [u8; 32],
    t: u16,
-    evrf_public_keys: &[<C::EmbeddedCurve as Ciphersuite>::G],
-    evrf_private_key: &Zeroizing<<C::EmbeddedCurve as Ciphersuite>::F>,
+    evrf_public_keys: &[<C::EmbeddedCurve as WrappedGroup>::G],
+    evrf_private_key: &Zeroizing<<C::EmbeddedCurve as WrappedGroup>::F>,
  ) -> Result<Participation<C>, Error> {
    let Ok(n) = u16::try_from(evrf_public_keys.len()) else {
      Err(Error::TooManyParticipants { provided: evrf_public_keys.len() })?
@@ -202,7 +202,8 @@ impl<C: Curves> Dkg<C> {
    };
    // This also ensures the private key is not 0, due to the prior check the identity point wasn't
    // present
-    let evrf_public_key = <C::EmbeddedCurve as Ciphersuite>::generator() * evrf_private_key.deref();
+    let evrf_public_key =
+      <C::EmbeddedCurve as WrappedGroup>::generator() * evrf_private_key.deref();
    if !evrf_public_keys.contains(&evrf_public_key) {
      Err(Error::NotAParticipant)?;
    };
@@ -231,7 +232,7 @@ impl<C: Curves> Dkg<C> {

    let mut encrypted_secret_shares = HashMap::with_capacity(usize::from(n));
    for (l, encryption_key) in Participant::iter().take(usize::from(n)).zip(encryption_keys) {
-      let share = polynomial::<<C::ToweringCurve as Ciphersuite>::F>(&coefficients, l);
+      let share = polynomial::<<C::ToweringCurve as WrappedGroup>::F>(&coefficients, l);
      encrypted_secret_shares.insert(l, *share + *encryption_key);
    }

@@ -243,26 +244,26 @@ impl<C: Curves> Dkg<C> {
 #[allow(clippy::type_complexity)]
 fn verifiable_encryption_statements<C: Curves>(
  rng: &mut (impl RngCore + CryptoRng),
-  coefficients: &[<C::ToweringCurve as Ciphersuite>::G],
-  encryption_key_commitments: &[<C::ToweringCurve as Ciphersuite>::G],
-  encrypted_secret_shares: &HashMap<Participant, <C::ToweringCurve as Ciphersuite>::F>,
+  coefficients: &[<C::ToweringCurve as WrappedGroup>::G],
+  encryption_key_commitments: &[<C::ToweringCurve as WrappedGroup>::G],
+  encrypted_secret_shares: &HashMap<Participant, <C::ToweringCurve as WrappedGroup>::F>,
 ) -> (
-  <C::ToweringCurve as Ciphersuite>::F,
-  Vec<(<C::ToweringCurve as Ciphersuite>::F, <C::ToweringCurve as Ciphersuite>::G)>,
+  <C::ToweringCurve as WrappedGroup>::F,
+  Vec<(<C::ToweringCurve as WrappedGroup>::F, <C::ToweringCurve as WrappedGroup>::G)>,
 ) {
-  let mut g_scalar = <C::ToweringCurve as Ciphersuite>::F::ZERO;
+  let mut g_scalar = <C::ToweringCurve as WrappedGroup>::F::ZERO;
  let mut pairs = Vec::with_capacity(coefficients.len() + encryption_key_commitments.len());

  // Push on the commitments to the polynomial being secret-shared
  for coefficient in coefficients {
    // This uses `0` as we'll add to it later, given its fixed position
-    pairs.push((<C::ToweringCurve as Ciphersuite>::F::ZERO, *coefficient));
+    pairs.push((<C::ToweringCurve as WrappedGroup>::F::ZERO, *coefficient));
  }

  for (i, encrypted_secret_share) in encrypted_secret_shares {
    let encryption_key_commitment = encryption_key_commitments[usize::from(u16::from(*i)) - 1];

-    let weight = <C::ToweringCurve as Ciphersuite>::F::random(&mut *rng);
+    let weight = <C::ToweringCurve as WrappedGroup>::F::random(&mut *rng);

    /*
      The encrypted secret share scaling `G`, minus the encryption key commitment, minus the
@@ -274,7 +275,7 @@ fn verifiable_encryption_statements<C: Curves>(
    pairs.push((weight, encryption_key_commitment));
    // Calculate the commitment to the secret share via the commitments to the polynomial
    {
-      let i = <C::ToweringCurve as Ciphersuite>::F::from(u64::from(u16::from(*i)));
+      let i = <C::ToweringCurve as WrappedGroup>::F::from(u64::from(u16::from(*i)));
      (0 .. coefficients.len()).fold(weight, |exp, j| {
        pairs[j].0 += exp;
        exp * i
@@ -300,7 +301,7 @@ impl<C: Curves> Dkg<C> {
    generators: &Generators<C>,
    context: [u8; 32],
    t: u16,
-    evrf_public_keys: &[<C::EmbeddedCurve as Ciphersuite>::G],
+    evrf_public_keys: &[<C::EmbeddedCurve as WrappedGroup>::G],
    participations: &HashMap<Participant, Participation<C>>,
  ) -> Result<VerifyResult<C>, Error> {
    let Ok(n) = u16::try_from(evrf_public_keys.len()) else {
@@ -386,7 +387,7 @@ impl<C: Curves> Dkg<C> {
    {
      let mut share_verification_statements_actual = HashMap::with_capacity(valid.len());
      if !{
-        let mut g_scalar = <C::ToweringCurve as Ciphersuite>::F::ZERO;
+        let mut g_scalar = <C::ToweringCurve as WrappedGroup>::F::ZERO;
        let mut pairs = Vec::with_capacity(valid.len() * (usize::from(t) + evrf_public_keys.len()));
        for (i, (encrypted_secret_shares, data)) in &valid {
          let (this_g_scalar, mut these_pairs) = verifiable_encryption_statements::<C>(
@@ -417,9 +418,11 @@ impl<C: Curves> Dkg<C> {
            let sum_encrypted_secret_share = sum_encrypted_secret_shares
              .get(j)
              .copied()
-              .unwrap_or(<C::ToweringCurve as Ciphersuite>::F::ZERO);
-            let sum_mask =
-              sum_masks.get(j).copied().unwrap_or(<C::ToweringCurve as Ciphersuite>::G::identity());
+              .unwrap_or(<C::ToweringCurve as WrappedGroup>::F::ZERO);
+            let sum_mask = sum_masks
+              .get(j)
+              .copied()
+              .unwrap_or(<C::ToweringCurve as WrappedGroup>::G::identity());
            sum_encrypted_secret_shares.insert(*j, sum_encrypted_secret_share + enc_share);

            let j_index = usize::from(u16::from(*j)) - 1;
@@ -487,7 +490,7 @@ impl<C: Curves> Dkg<C> {
    for i in Participant::iter().take(usize::from(n)) {
      verification_shares.insert(
        i,
-        (<C::ToweringCurve as Ciphersuite>::generator() * sum_encrypted_secret_shares[&i]) -
+        (<C::ToweringCurve as WrappedGroup>::generator() * sum_encrypted_secret_shares[&i]) -
          sum_masks[&i],
      );
    }
@@ -506,9 +509,10 @@ impl<C: Curves> Dkg<C> {
  /// This will return _all_ keys belong to the participant.
  pub fn keys(
    &self,
-    evrf_private_key: &Zeroizing<<C::EmbeddedCurve as Ciphersuite>::F>,
+    evrf_private_key: &Zeroizing<<C::EmbeddedCurve as WrappedGroup>::F>,
  ) -> Vec<ThresholdKeys<C::ToweringCurve>> {
-    let evrf_public_key = <C::EmbeddedCurve as Ciphersuite>::generator() * evrf_private_key.deref();
+    let evrf_public_key =
+      <C::EmbeddedCurve as WrappedGroup>::generator() * evrf_private_key.deref();
    let mut is = Vec::with_capacity(1);
    for (i, evrf_key) in Participant::iter().zip(self.evrf_public_keys.iter()) {
      if *evrf_key == evrf_public_key {
@@ -518,14 +522,14 @@ impl<C: Curves> Dkg<C> {

    let mut res = Vec::with_capacity(is.len());
    for i in is {
-      let mut secret_share = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::ZERO);
+      let mut secret_share = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::ZERO);
      for shares in self.encrypted_secret_shares.values() {
        let (ecdh_commitments, encrypted_secret_share) = shares[&i];

-        let mut ecdh = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::ZERO);
+        let mut ecdh = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::ZERO);
        for point in ecdh_commitments {
          let (mut x, mut y) =
-            <C::EmbeddedCurve as Ciphersuite>::G::to_xy(point * evrf_private_key.deref()).unwrap();
+            <C::EmbeddedCurve as WrappedGroup>::G::to_xy(point * evrf_private_key.deref()).unwrap();
          *ecdh += x;
          x.zeroize();
          y.zeroize();
@@ -534,7 +538,7 @@ impl<C: Curves> Dkg<C> {
      }
      debug_assert_eq!(
        self.verification_shares[&i],
-        <C::ToweringCurve as Ciphersuite>::G::generator() * secret_share.deref()
+        <C::ToweringCurve as WrappedGroup>::generator() * secret_share.deref()
      );

      res.push(
--- a/crypto/dkg/evrf/src/proof/mod.rs
+++ b/crypto/dkg/evrf/src/proof/mod.rs
@@ -8,7 +8,7 @@ use zeroize::Zeroizing;
 use rand_core::{RngCore, CryptoRng, SeedableRng};
 use rand_chacha::ChaCha20Rng;

-use ciphersuite::{group::ff::Field, Ciphersuite};
+use ciphersuite::{group::ff::Field, WrappedGroup};

 use generalized_bulletproofs::{
  Generators, BatchVerifier, PedersenCommitment, PedersenVectorCommitment,
@@ -28,8 +28,8 @@ mod tape;
 use tape::*;

 type EmbeddedPoint<C> = (
-  <<<C as Curves>::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::FieldElement,
-  <<<C as Curves>::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::FieldElement,
+  <<<C as Curves>::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::FieldElement,
+  <<<C as Curves>::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::FieldElement,
 );

 #[allow(non_snake_case)]
@@ -37,14 +37,15 @@ struct Circuit<
  'a,
  C: Curves,
  CG: Iterator<
-    Item = ChallengedGenerator<<C::ToweringCurve as Ciphersuite>::F, C::EmbeddedCurveParameters>,
+    Item = ChallengedGenerator<<C::ToweringCurve as WrappedGroup>::F, C::EmbeddedCurveParameters>,
  >,
 > {
-  curve_spec: &'a CurveSpec<<<C::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::FieldElement>,
+  curve_spec: &'a CurveSpec<<<C::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::FieldElement>,
  circuit: &'a mut BpCircuit<C::ToweringCurve>,
-  challenge: DiscreteLogChallenge<<C::ToweringCurve as Ciphersuite>::F, C::EmbeddedCurveParameters>,
+  challenge:
+    DiscreteLogChallenge<<C::ToweringCurve as WrappedGroup>::F, C::EmbeddedCurveParameters>,
  challenged_G:
-    ChallengedGenerator<<C::ToweringCurve as Ciphersuite>::F, C::EmbeddedCurveParameters>,
+    ChallengedGenerator<<C::ToweringCurve as WrappedGroup>::F, C::EmbeddedCurveParameters>,
  challenged_generators: &'a mut CG,
  tape: Tape,
  pedersen_commitment_tape: PedersenCommitmentTape,
@@ -54,7 +55,7 @@ impl<
    'a,
    C: Curves,
    CG: Iterator<
-      Item = ChallengedGenerator<<C::ToweringCurve as Ciphersuite>::F, C::EmbeddedCurveParameters>,
+      Item = ChallengedGenerator<<C::ToweringCurve as WrappedGroup>::F, C::EmbeddedCurveParameters>,
    >,
  > Circuit<'a, C, CG>
 {
@@ -92,7 +93,7 @@ impl<
          &self.challenge,
          &challenged_generator,
        );
-        lincomb = lincomb.term(<C::ToweringCurve as Ciphersuite>::F::ONE, point.x());
+        lincomb = lincomb.term(<C::ToweringCurve as WrappedGroup>::F::ONE, point.x());
      }
      /*
        Constrain the sum of the two `x` coordinates to be equal to the value committed to in a
@@ -137,7 +138,7 @@ impl<
        &self.challenge,
        &challenged_public_key,
      );
-      lincomb = lincomb.term(<C::ToweringCurve as Ciphersuite>::F::ONE, point.x());
+      lincomb = lincomb.term(<C::ToweringCurve as WrappedGroup>::F::ONE, point.x());
      debug_assert!(point_with_dlogs.next().is_none());
    }

@@ -152,20 +153,20 @@ impl<
 /// The result of proving.
 pub(super) struct ProveResult<C: Curves> {
  /// The coefficients for use in the DKG.
-  pub(super) coefficients: Vec<Zeroizing<<C::ToweringCurve as Ciphersuite>::F>>,
+  pub(super) coefficients: Vec<Zeroizing<<C::ToweringCurve as WrappedGroup>::F>>,
  /// The masks to encrypt secret shares with.
-  pub(super) encryption_keys: Vec<Zeroizing<<C::ToweringCurve as Ciphersuite>::F>>,
+  pub(super) encryption_keys: Vec<Zeroizing<<C::ToweringCurve as WrappedGroup>::F>>,
  /// The proof itself.
  pub(super) proof: Vec<u8>,
 }

 pub(super) struct Verified<C: Curves> {
  /// The commitments to the coefficients used within the DKG.
-  pub(super) coefficients: Vec<<C::ToweringCurve as Ciphersuite>::G>,
+  pub(super) coefficients: Vec<<C::ToweringCurve as WrappedGroup>::G>,
  /// The ephemeral public keys to perform ECDHs with
-  pub(super) ecdh_commitments: Vec<[<C::EmbeddedCurve as Ciphersuite>::G; 2]>,
+  pub(super) ecdh_commitments: Vec<[<C::EmbeddedCurve as WrappedGroup>::G; 2]>,
  /// The commitments to the masks used to encrypt secret shares with.
-  pub(super) encryption_key_commitments: Vec<<C::ToweringCurve as Ciphersuite>::G>,
+  pub(super) encryption_key_commitments: Vec<<C::ToweringCurve as WrappedGroup>::G>,
 }

 impl<C: Curves> fmt::Debug for Verified<C> {
@@ -175,7 +176,7 @@ impl<C: Curves> fmt::Debug for Verified<C> {
 }

 type GeneratorTable<C> = generalized_bulletproofs_ec_gadgets::GeneratorTable<
-  <<<C as Curves>::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::FieldElement,
+  <<<C as Curves>::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::FieldElement,
  <C as Curves>::EmbeddedCurveParameters,
 >;

@@ -219,7 +220,7 @@ impl<C: Curves> Proof<C> {
  }

  fn circuit(
-    curve_spec: &CurveSpec<<<C::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::FieldElement>,
+    curve_spec: &CurveSpec<<<C::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::FieldElement>,
    evrf_public_key: EmbeddedPoint<C>,
    coefficients: usize,
    ecdh_commitments: &[[EmbeddedPoint<C>; 2]],
@@ -281,7 +282,7 @@ impl<C: Curves> Proof<C> {
  fn sample_coefficients_evrf_points(
    seed: [u8; 32],
    coefficients: usize,
-  ) -> Vec<<C::EmbeddedCurve as Ciphersuite>::G> {
+  ) -> Vec<<C::EmbeddedCurve as WrappedGroup>::G> {
    let mut rng = ChaCha20Rng::from_seed(seed);
    let quantity = 2 * coefficients;
    let mut res = Vec::with_capacity(quantity);
@@ -293,28 +294,29 @@ impl<C: Curves> Proof<C> {

  /// Create the required tables for the generators.
  fn generator_tables(
-    coefficients_evrf_points: &[<C::EmbeddedCurve as Ciphersuite>::G],
-    participants: &[<<C as Curves>::EmbeddedCurve as Ciphersuite>::G],
+    coefficients_evrf_points: &[<C::EmbeddedCurve as WrappedGroup>::G],
+    participants: &[<<C as Curves>::EmbeddedCurve as WrappedGroup>::G],
  ) -> Vec<GeneratorTable<C>> {
    let curve_spec = CurveSpec {
-      a: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::a(),
-      b: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::b(),
+      a: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::a(),
+      b: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::b(),
    };

    let mut generator_tables =
      Vec::with_capacity(1 + coefficients_evrf_points.len() + participants.len());
    {
-      let (x, y) =
-        <C::EmbeddedCurve as Ciphersuite>::G::to_xy(<C::EmbeddedCurve as Ciphersuite>::generator())
-          .unwrap();
+      let (x, y) = <C::EmbeddedCurve as WrappedGroup>::G::to_xy(
+        <C::EmbeddedCurve as WrappedGroup>::generator(),
+      )
+      .unwrap();
      generator_tables.push(GeneratorTable::<C>::new(&curve_spec, x, y));
    }
    for generator in coefficients_evrf_points {
-      let (x, y) = <C::EmbeddedCurve as Ciphersuite>::G::to_xy(*generator).unwrap();
+      let (x, y) = <C::EmbeddedCurve as WrappedGroup>::G::to_xy(*generator).unwrap();
      generator_tables.push(GeneratorTable::<C>::new(&curve_spec, x, y));
    }
    for generator in participants {
-      let (x, y) = <C::EmbeddedCurve as Ciphersuite>::G::to_xy(*generator).unwrap();
+      let (x, y) = <C::EmbeddedCurve as WrappedGroup>::G::to_xy(*generator).unwrap();
      generator_tables.push(GeneratorTable::<C>::new(&curve_spec, x, y));
    }
    generator_tables
@@ -325,12 +327,12 @@ impl<C: Curves> Proof<C> {
    generators: &Generators<C::ToweringCurve>,
    transcript: [u8; 32],
    coefficients: usize,
-    participant_public_keys: &[<<C as Curves>::EmbeddedCurve as Ciphersuite>::G],
-    evrf_private_key: &Zeroizing<<<C as Curves>::EmbeddedCurve as Ciphersuite>::F>,
+    participant_public_keys: &[<<C as Curves>::EmbeddedCurve as WrappedGroup>::G],
+    evrf_private_key: &Zeroizing<<<C as Curves>::EmbeddedCurve as WrappedGroup>::F>,
  ) -> Result<ProveResult<C>, AcProveError> {
    let curve_spec = CurveSpec {
-      a: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::a(),
-      b: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::b(),
+      a: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::a(),
+      b: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::b(),
    };

    let coefficients_evrf_points = Self::sample_coefficients_evrf_points(transcript, coefficients);
@@ -340,7 +342,7 @@ impl<C: Curves> Proof<C> {
    // Push a discrete logarithm onto the tape
    let discrete_log =
      |vector_commitment_tape: &mut Vec<_>,
-       dlog: &ScalarDecomposition<<<C as Curves>::EmbeddedCurve as Ciphersuite>::F>| {
+       dlog: &ScalarDecomposition<<<C as Curves>::EmbeddedCurve as WrappedGroup>::F>| {
        for coefficient in dlog.decomposition() {
          vector_commitment_tape.push(<_>::from(*coefficient));
        }
@@ -351,8 +353,8 @@ impl<C: Curves> Proof<C> {
    // Returns the point for which the claim was made.
    let discrete_log_claim =
      |vector_commitment_tape: &mut Vec<_>,
-       dlog: &ScalarDecomposition<<<C as Curves>::EmbeddedCurve as Ciphersuite>::F>,
-       generator: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G| {
+       dlog: &ScalarDecomposition<<<C as Curves>::EmbeddedCurve as WrappedGroup>::F>,
+       generator: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G| {
        {
          let divisor =
            Zeroizing::new(dlog.scalar_mul_divisor(generator).normalize_x_coefficient());
@@ -368,12 +370,12 @@ impl<C: Curves> Proof<C> {
              .y_coefficients
              .first()
              .copied()
-              .unwrap_or(<C::ToweringCurve as Ciphersuite>::F::ZERO),
+              .unwrap_or(<C::ToweringCurve as WrappedGroup>::F::ZERO),
          );
        }

        let dh = generator * dlog.scalar();
-        let (x, y) = <C::EmbeddedCurve as Ciphersuite>::G::to_xy(dh).unwrap();
+        let (x, y) = <C::EmbeddedCurve as WrappedGroup>::G::to_xy(dh).unwrap();
        vector_commitment_tape.push(x);
        vector_commitment_tape.push(y);
        (dh, (x, y))
@@ -387,7 +389,7 @@ impl<C: Curves> Proof<C> {
    let mut coefficients = Vec::with_capacity(coefficients);
    let evrf_public_key = {
      let evrf_private_key =
-        ScalarDecomposition::<<C::EmbeddedCurve as Ciphersuite>::F>::new(**evrf_private_key)
+        ScalarDecomposition::<<C::EmbeddedCurve as WrappedGroup>::F>::new(**evrf_private_key)
          .expect("eVRF private key was zero");

      discrete_log(&mut vector_commitment_tape, &evrf_private_key);
@@ -396,12 +398,12 @@ impl<C: Curves> Proof<C> {
      let (_, evrf_public_key) = discrete_log_claim(
        &mut vector_commitment_tape,
        &evrf_private_key,
-        <<C as Curves>::EmbeddedCurve as Ciphersuite>::generator(),
+        <<C as Curves>::EmbeddedCurve as WrappedGroup>::generator(),
      );

      // Push the divisor for each point we use in the eVRF
      for pair in coefficients_evrf_points.chunks(2) {
-        let mut coefficient = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::ZERO);
+        let mut coefficient = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::ZERO);
        for point in pair {
          let (_, (dh_x, _)) =
            discrete_log_claim(&mut vector_commitment_tape, &evrf_private_key, *point);
@@ -418,15 +420,16 @@ impl<C: Curves> Proof<C> {
    let mut ecdh_commitments = Vec::with_capacity(2 * participant_public_keys.len());
    let mut ecdh_commitments_xy = Vec::with_capacity(participant_public_keys.len());
    for participant_public_key in participant_public_keys {
-      let mut ecdh_commitments_xy_i =
-        [(<C::ToweringCurve as Ciphersuite>::F::ZERO, <C::ToweringCurve as Ciphersuite>::F::ZERO);
-          2];
-      let mut encryption_key = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::ZERO);
+      let mut ecdh_commitments_xy_i = [(
+        <C::ToweringCurve as WrappedGroup>::F::ZERO,
+        <C::ToweringCurve as WrappedGroup>::F::ZERO,
+      ); 2];
+      let mut encryption_key = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::ZERO);
      for ecdh_commitments_xy_i_j_dest in &mut ecdh_commitments_xy_i {
        let mut ecdh_ephemeral_secret;
        loop {
          ecdh_ephemeral_secret =
-            Zeroizing::new(<C::EmbeddedCurve as Ciphersuite>::F::random(&mut *rng));
+            Zeroizing::new(<C::EmbeddedCurve as WrappedGroup>::F::random(&mut *rng));
          // 0 would produce the identity, which isn't representable within the discrete-log proof.
          if bool::from(!ecdh_ephemeral_secret.is_zero()) {
            break;
@@ -434,7 +437,7 @@ impl<C: Curves> Proof<C> {
        }

        let ecdh_ephemeral_secret =
-          ScalarDecomposition::<<C::EmbeddedCurve as Ciphersuite>::F>::new(*ecdh_ephemeral_secret)
+          ScalarDecomposition::<<C::EmbeddedCurve as WrappedGroup>::F>::new(*ecdh_ephemeral_secret)
            .expect("ECDH ephemeral secret zero");
        discrete_log(&mut vector_commitment_tape, &ecdh_ephemeral_secret);

@@ -442,7 +445,7 @@ impl<C: Curves> Proof<C> {
        let (ecdh_commitment, ecdh_commitment_xy_i_j) = discrete_log_claim(
          &mut vector_commitment_tape,
          &ecdh_ephemeral_secret,
-          <<C as Curves>::EmbeddedCurve as Ciphersuite>::generator(),
+          <<C as Curves>::EmbeddedCurve as WrappedGroup>::generator(),
        );
        ecdh_commitments.push(ecdh_commitment);
        *ecdh_commitments_xy_i_j_dest = ecdh_commitment_xy_i_j;
@@ -470,7 +473,7 @@ impl<C: Curves> Proof<C> {
    for chunk in vector_commitment_tape.chunks(generators_to_use) {
      vector_commitments.push(PedersenVectorCommitment {
        g_values: chunk.into(),
-        mask: <C::ToweringCurve as Ciphersuite>::F::random(&mut *rng),
+        mask: <C::ToweringCurve as WrappedGroup>::F::random(&mut *rng),
      });
    }

@@ -479,13 +482,13 @@ impl<C: Curves> Proof<C> {
    for coefficient in &coefficients {
      commitments.push(PedersenCommitment {
        value: **coefficient,
-        mask: <C::ToweringCurve as Ciphersuite>::F::random(&mut *rng),
+        mask: <C::ToweringCurve as WrappedGroup>::F::random(&mut *rng),
      });
    }
    for enc_mask in &encryption_keys {
      commitments.push(PedersenCommitment {
        value: **enc_mask,
-        mask: <C::ToweringCurve as Ciphersuite>::F::random(&mut *rng),
+        mask: <C::ToweringCurve as WrappedGroup>::F::random(&mut *rng),
      });
    }

@@ -536,13 +539,13 @@ impl<C: Curves> Proof<C> {
    }

    // Prove the openings of the commitments were correct
-    let mut x = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::ZERO);
+    let mut x = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::ZERO);
    for commitment in commitments {
      *x += commitment.mask * transcript.challenge::<C::ToweringCurve>();
    }

    // Produce a Schnorr PoK for the weighted-sum of the Pedersen commitments' blinding factors
-    let r = Zeroizing::new(<C::ToweringCurve as Ciphersuite>::F::random(&mut *rng));
+    let r = Zeroizing::new(<C::ToweringCurve as WrappedGroup>::F::random(&mut *rng));
    transcript.push_point(&(generators.h() * r.deref()));
    let c = transcript.challenge::<C::ToweringCurve>();
    transcript.push_scalar((c * x.deref()) + r.deref());
@@ -557,14 +560,14 @@ impl<C: Curves> Proof<C> {
    verifier: &mut BatchVerifier<C::ToweringCurve>,
    transcript: [u8; 32],
    coefficients: usize,
-    participant_public_keys: &[<<C as Curves>::EmbeddedCurve as Ciphersuite>::G],
-    evrf_public_key: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G,
+    participant_public_keys: &[<<C as Curves>::EmbeddedCurve as WrappedGroup>::G],
+    evrf_public_key: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G,
    proof: &[u8],
  ) -> Result<Verified<C>, ()> {
    let (mut transcript, ecdh_commitments, pedersen_commitments) = {
      let curve_spec = CurveSpec {
-        a: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::a(),
-        b: <<C as Curves>::EmbeddedCurve as Ciphersuite>::G::b(),
+        a: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::a(),
+        b: <<C as Curves>::EmbeddedCurve as WrappedGroup>::G::b(),
      };

      let coefficients_evrf_points =
@@ -600,9 +603,9 @@ impl<C: Curves> Proof<C> {
        ecdh_commitments.push(ecdh_commitments_i);
        // This inherently bans using the identity point, as it won't have an affine representation
        ecdh_commitments_xy.push([
-          <<C::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::to_xy(ecdh_commitments_i[0])
+          <<C::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::to_xy(ecdh_commitments_i[0])
            .ok_or(())?,
-          <<C::EmbeddedCurve as Ciphersuite>::G as DivisorCurve>::to_xy(ecdh_commitments_i[1])
+          <<C::EmbeddedCurve as WrappedGroup>::G as DivisorCurve>::to_xy(ecdh_commitments_i[1])
            .ok_or(())?,
        ]);
      }
@@ -610,7 +613,7 @@ impl<C: Curves> Proof<C> {
      let mut circuit = BpCircuit::verify();
      Self::circuit(
        &curve_spec,
-        <C::EmbeddedCurve as Ciphersuite>::G::to_xy(evrf_public_key).ok_or(())?,
+        <C::EmbeddedCurve as WrappedGroup>::G::to_xy(evrf_public_key).ok_or(())?,
        coefficients,
        &ecdh_commitments_xy,
        &generator_tables.iter().collect::<Vec<_>>(),
--- a/crypto/dkg/evrf/src/tests/mod.rs
+++ b/crypto/dkg/evrf/src/tests/mod.rs
@@ -4,11 +4,11 @@ use zeroize::Zeroizing;
 use rand_core::OsRng;
 use rand::seq::SliceRandom;

-use ciphersuite::{group::ff::Field, Ciphersuite};
+use ciphersuite::{group::ff::Field, WrappedGroup};
 use embedwards25519::Embedwards25519;

 use dkg_recovery::recover_key;
-use crate::{Participant, Curves, Generators, VerifyResult, Dkg, Ristretto};
+use crate::{Participant, Curves, Generators, VerifyResult, Dkg, Ed25519};

 mod proof;

@@ -17,14 +17,14 @@ const PARTICIPANTS: u16 = 5;

 #[test]
 fn dkg() {
-  let generators = Generators::<Ristretto>::new(THRESHOLD, PARTICIPANTS);
+  let generators = Generators::<Ed25519>::new(THRESHOLD, PARTICIPANTS);
  let context = [0; 32];

  let mut priv_keys = vec![];
  let mut pub_keys = vec![];
  for i in 0 .. PARTICIPANTS {
-    let priv_key = <Embedwards25519 as Ciphersuite>::F::random(&mut OsRng);
-    pub_keys.push(<Embedwards25519 as Ciphersuite>::generator() * priv_key);
+    let priv_key = <Embedwards25519 as WrappedGroup>::F::random(&mut OsRng);
+    pub_keys.push(<Embedwards25519 as WrappedGroup>::generator() * priv_key);
    priv_keys.push((Participant::new(1 + i).unwrap(), Zeroizing::new(priv_key)));
  }

@@ -34,27 +34,15 @@ fn dkg() {
  for (i, priv_key) in priv_keys.iter().take(usize::from(THRESHOLD)) {
    participations.insert(
      *i,
-      Dkg::<Ristretto>::participate(
-        &mut OsRng,
-        &generators,
-        context,
-        THRESHOLD,
-        &pub_keys,
-        priv_key,
-      )
-      .unwrap(),
+      Dkg::<Ed25519>::participate(&mut OsRng, &generators, context, THRESHOLD, &pub_keys, priv_key)
+        .unwrap(),
    );
  }

-  let VerifyResult::Valid(dkg) = Dkg::<Ristretto>::verify(
-    &mut OsRng,
-    &generators,
-    context,
-    THRESHOLD,
-    &pub_keys,
-    &participations,
-  )
-  .unwrap() else {
+  let VerifyResult::Valid(dkg) =
+    Dkg::<Ed25519>::verify(&mut OsRng, &generators, context, THRESHOLD, &pub_keys, &participations)
+      .unwrap()
+  else {
    panic!("verify didn't return VerifyResult::Valid")
  };

@@ -80,7 +68,7 @@ fn dkg() {

  // TODO: Test for all possible combinations of keys
  assert_eq!(
-    <<Ristretto as Curves>::ToweringCurve as Ciphersuite>::generator() *
+    <<Ed25519 as Curves>::ToweringCurve as WrappedGroup>::generator() *
      *recover_key(&all_keys.values().cloned().collect::<Vec<_>>()).unwrap(),
    group_key.unwrap()
  );
--- a/crypto/dkg/evrf/src/tests/proof.rs
+++ b/crypto/dkg/evrf/src/tests/proof.rs
@@ -6,13 +6,13 @@ use zeroize::Zeroizing;

 use ciphersuite::{
  group::{ff::Field, Group},
-  Ciphersuite,
+  WrappedGroup,
 };

 use generalized_bulletproofs::{Generators, tests::insecure_test_generators};

 use crate::{
-  Curves, Ristretto,
+  Curves, Ed25519,
  proof::*,
  tests::{THRESHOLD, PARTICIPANTS},
 };
@@ -20,9 +20,9 @@ use crate::{
 fn proof<C: Curves>() {
  let generators = insecure_test_generators(&mut OsRng, 2048).unwrap();
  let embedded_private_key =
-    Zeroizing::new(<C::EmbeddedCurve as Ciphersuite>::F::random(&mut OsRng));
+    Zeroizing::new(<C::EmbeddedCurve as WrappedGroup>::F::random(&mut OsRng));
  let ecdh_public_keys: [_; PARTICIPANTS as usize] =
-    core::array::from_fn(|_| <C::EmbeddedCurve as Ciphersuite>::G::random(&mut OsRng));
+    core::array::from_fn(|_| <C::EmbeddedCurve as WrappedGroup>::G::random(&mut OsRng));
  let time = Instant::now();
  let res = Proof::<C>::prove(
    &mut OsRng,
@@ -54,5 +54,5 @@ fn proof<C: Curves>() {

 #[test]
 fn ristretto_proof() {
-  proof::<Ristretto>();
+  proof::<Ed25519>();
 }
--- a/crypto/dkg/evrf/src/utils.rs
+++ b/crypto/dkg/evrf/src/utils.rs
@@ -5,7 +5,7 @@ use rand_core::{RngCore, CryptoRng};

 use ciphersuite::{
  group::{ff::PrimeField, Group, GroupEncoding},
-  Ciphersuite,
+  GroupIo,
 };

 use dkg::Participant;
@@ -13,7 +13,7 @@ use dkg::Participant;
 /// Sample a random, unbiased point on the elliptic curve with an unknown discrete logarithm.
 ///
 /// This keeps it simple by using rejection sampling.
-pub(crate) fn sample_point<C: Ciphersuite>(rng: &mut (impl RngCore + CryptoRng)) -> C::G {
+pub(crate) fn sample_point<C: GroupIo>(rng: &mut (impl RngCore + CryptoRng)) -> C::G {
  let mut repr = <C::G as GroupEncoding>::Repr::default();
  loop {
    rng.fill_bytes(repr.as_mut());
--- a/crypto/dkg/musig/src/tests.rs
+++ b/crypto/dkg/musig/src/tests.rs
@@ -4,7 +4,7 @@ use zeroize::Zeroizing;
 use rand_core::OsRng;

 use dalek_ff_group::Ristretto;
-use ciphersuite::{group::ff::Field, Ciphersuite};
+use ciphersuite::WrappedGroup;

 use dkg_recovery::recover_key;
 use crate::*;
@@ -17,21 +17,21 @@ pub fn test_musig() {
  let mut keys = vec![];
  let mut pub_keys = vec![];
  for _ in 0 .. PARTICIPANTS {
-    let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
-    pub_keys.push(<Ristretto as Ciphersuite>::generator() * *key);
+    let key = Zeroizing::new(<Ristretto as WrappedGroup>::F::random(&mut OsRng));
+    pub_keys.push(<Ristretto as WrappedGroup>::generator() * *key);
    keys.push(key);
  }

  const CONTEXT: [u8; 32] = *b"MuSig Test                      ";

  // Empty signing set
-  musig::<Ristretto>(CONTEXT, Zeroizing::new(<Ristretto as Ciphersuite>::F::ZERO), &[])
+  musig::<Ristretto>(CONTEXT, Zeroizing::new(<Ristretto as WrappedGroup>::F::ZERO), &[])
    .unwrap_err();
  // Signing set we're not part of
  musig::<Ristretto>(
    CONTEXT,
-    Zeroizing::new(<Ristretto as Ciphersuite>::F::ZERO),
-    &[<Ristretto as Ciphersuite>::generator()],
+    Zeroizing::new(<Ristretto as WrappedGroup>::F::ZERO),
+    &[<Ristretto as WrappedGroup>::generator()],
  )
  .unwrap_err();

@@ -48,7 +48,7 @@ pub fn test_musig() {

      verification_shares.insert(
        these_keys.params().i(),
-        <Ristretto as Ciphersuite>::generator() * **these_keys.original_secret_share(),
+        <Ristretto as WrappedGroup>::generator() * **these_keys.original_secret_share(),
      );

      assert_eq!(these_keys.group_key(), group_key);
@@ -63,7 +63,7 @@ pub fn test_musig() {
    }

    assert_eq!(
-      <Ristretto as Ciphersuite>::generator() *
+      <Ristretto as WrappedGroup>::generator() *
        *recover_key(&created_keys.values().cloned().collect::<Vec<_>>()).unwrap(),
      group_key
    );
--- a/crypto/dkg/recovery/src/lib.rs
+++ b/crypto/dkg/recovery/src/lib.rs
@@ -8,7 +8,7 @@ use alloc::vec::Vec;

 use zeroize::Zeroizing;

-use ciphersuite::Ciphersuite;
+use ciphersuite::{GroupIo, Id};

 pub use dkg::*;

@@ -34,7 +34,7 @@ pub enum RecoveryError {
 }

 /// Recover a shared secret from a collection of `dkg::ThresholdKeys`.
-pub fn recover_key<C: Ciphersuite>(
+pub fn recover_key<C: GroupIo + Id>(
  keys: &[ThresholdKeys<C>],
 ) -> Result<Zeroizing<C::F>, RecoveryError> {
  let included = keys.iter().map(|keys| keys.params().i()).collect::<Vec<_>>();
--- a/crypto/dkg/src/lib.rs
+++ b/crypto/dkg/src/lib.rs
@@ -17,7 +17,7 @@ use ciphersuite::{
    ff::{Field, PrimeField},
    GroupEncoding,
  },
-  Ciphersuite,
+  GroupIo, Id,
 };

 /// The ID of a participant, defined as a non-zero u16.
@@ -268,7 +268,7 @@ impl<F: Zeroize + PrimeField> Interpolation<F> {
 /// heap-allocated pointer to minimize copies on the stack (`ThresholdKeys`, the publicly exposed
 /// type).
 #[derive(Clone, PartialEq, Eq)]
-struct ThresholdCore<C: Ciphersuite> {
+struct ThresholdCore<C: GroupIo + Id> {
  params: ThresholdParams,
  group_key: C::G,
  verification_shares: HashMap<Participant, C::G>,
@@ -276,7 +276,7 @@ struct ThresholdCore<C: Ciphersuite> {
  secret_share: Zeroizing<C::F>,
 }

-impl<C: Ciphersuite> fmt::Debug for ThresholdCore<C> {
+impl<C: GroupIo + Id> fmt::Debug for ThresholdCore<C> {
  fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
    fmt
      .debug_struct("ThresholdCore")
@@ -288,7 +288,7 @@ impl<C: Ciphersuite> fmt::Debug for ThresholdCore<C> {
  }
 }

-impl<C: Ciphersuite> Zeroize for ThresholdCore<C> {
+impl<C: GroupIo + Id> Zeroize for ThresholdCore<C> {
  fn zeroize(&mut self) {
    self.params.zeroize();
    self.group_key.zeroize();
@@ -302,7 +302,7 @@ impl<C: Ciphersuite> Zeroize for ThresholdCore<C> {

 /// Threshold keys usable for signing.
 #[derive(Clone, Debug, Zeroize)]
-pub struct ThresholdKeys<C: Ciphersuite> {
+pub struct ThresholdKeys<C: GroupIo + Id> {
  // Core keys.
  #[zeroize(skip)]
  core: Arc<Zeroizing<ThresholdCore<C>>>,
@@ -315,7 +315,7 @@ pub struct ThresholdKeys<C: Ciphersuite> {

 /// View of keys, interpolated and with the expected linear combination taken for usage.
 #[derive(Clone)]
-pub struct ThresholdView<C: Ciphersuite> {
+pub struct ThresholdView<C: GroupIo + Id> {
  interpolation: Interpolation<C::F>,
  scalar: C::F,
  offset: C::F,
@@ -326,7 +326,7 @@ pub struct ThresholdView<C: Ciphersuite> {
  verification_shares: HashMap<Participant, C::G>,
 }

-impl<C: Ciphersuite> fmt::Debug for ThresholdView<C> {
+impl<C: GroupIo + Id> fmt::Debug for ThresholdView<C> {
  fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
    fmt
      .debug_struct("ThresholdView")
@@ -341,7 +341,7 @@ impl<C: Ciphersuite> fmt::Debug for ThresholdView<C> {
  }
 }

-impl<C: Ciphersuite> Zeroize for ThresholdView<C> {
+impl<C: GroupIo + Id> Zeroize for ThresholdView<C> {
  fn zeroize(&mut self) {
    self.scalar.zeroize();
    self.offset.zeroize();
@@ -357,7 +357,7 @@ impl<C: Ciphersuite> Zeroize for ThresholdView<C> {
  }
 }

-impl<C: Ciphersuite> ThresholdKeys<C> {
+impl<C: GroupIo + Id> ThresholdKeys<C> {
  /// Create a new set of ThresholdKeys.
  pub fn new(
    params: ThresholdParams,
@@ -632,7 +632,7 @@ impl<C: Ciphersuite> ThresholdKeys<C> {

    let mut verification_shares = HashMap::new();
    for l in (1 ..= n).map(Participant) {
-      verification_shares.insert(l, <C as Ciphersuite>::read_G(reader)?);
+      verification_shares.insert(l, C::read_G(reader)?);
    }

    ThresholdKeys::new(
@@ -645,7 +645,7 @@ impl<C: Ciphersuite> ThresholdKeys<C> {
  }
 }

-impl<C: Ciphersuite> ThresholdView<C> {
+impl<C: GroupIo + Id> ThresholdView<C> {
  /// Return the scalar applied to this view.
  pub fn scalar(&self) -> C::F {
    self.scalar