pub fn aggregate(
    signing_package: &SigningPackage,
    signing_shares: &[SignatureShare],
    pubkeys: &PublicKeyPackage,
) -> Result<Signature<SpendAuth>, &'static str> {
    let mut bindings: HashMap<u64, Scalar> =
        HashMap::with_capacity(signing_package.signing_commitments.len());

    for comm in signing_package.signing_commitments.iter() {
        let rho_i = gen_rho_i(comm.index, &signing_package);
        bindings.insert(comm.index, rho_i);
    }

    let group_commitment = gen_group_commitment(&signing_package, &bindings)?;

    let challenge = gen_challenge(&signing_package, &group_commitment, &pubkeys.group_public);

    for signing_share in signing_shares {
        let signer_pubkey = pubkeys.signer_pubkeys[&signing_share.index];
        let lambda_i = gen_lagrange_coeff(signing_share.index, &signing_package)?;
        let signer_commitment = signing_package
            .signing_commitments
            .iter()
            .find(|comm| comm.index == signing_share.index)
            .ok_or("No matching signing commitment for signer")?;

        let commitment_i =
            signer_commitment.hiding + (signer_commitment.binding * bindings[&signing_share.index]);

        signing_share.check_is_valid(&signer_pubkey, lambda_i, commitment_i, challenge)?;
    }

    // The aggregation of the signature shares by summing them up, resulting in
    // a plain Schnorr signature.
    let mut z = Scalar::zero();
    for signature_share in signing_shares {
        z += signature_share.signature.0;
    }

    Ok(Signature {
        r_bytes: jubjub::AffinePoint::from(group_commitment.0).to_bytes(),
        s_bytes: z.to_bytes(),
        _marker: PhantomData,
    })
}
/// Verifies each participant's signature share, and if all are valid,
/// aggregates the shares into a signature to publish.
///
/// Resulting signature is compatible with verification of a plain SpendAuth
/// signature.
///
/// This operation is performed by a coordinator that can communicate with all
/// the signing participants before publishing the final signature. The
/// coordinator can be one of the participants or a semi-trusted third party
/// (who is trusted to not perform denial of service attacks, but does not learn
/// any secret information). Note that because the coordinator is trusted to
/// report misbehaving parties in order to avoid publishing an invalid
/// signature, if the coordinator themselves is a signer and misbehaves, they
/// can avoid that step. However, at worst, this results in a denial of
/// service attack due to publishing an invalid signature.
Verifies each participant's signature share, and if all are valid,
aggregates the shares into a signature to publish.

Resulting signature is compatible with verification of a plain SpendAuth
signature.

This operation is performed by a coordinator that can communicate with all
the signing participants before publishing the final signature. The
coordinator can be one of the participants or a semi-trusted third party
(who is trusted to not perform denial of service attacks, but does not learn
any secret information). Note that because the coordinator is trusted to
report misbehaving parties in order to avoid publishing an invalid
signature, if the coordinator themselves is a signer and misbehaves, they
can avoid that step. However, at worst, this results in a denial of
service attack due to publishing an invalid signature.
Verifies each participant ' s signature share and if all are valid aggregates the shares into a signature to publish . Resulting signature is compatible with verification of a plain SpendAuth signature . This operation is performed by a coordinator that can communicate with all the signing participants before publishing the final signature . The coordinator can be one of the participants or a semi - trusted third party ( who is trusted to not perform denial of service attacks but does not learn any secret information ) . Note that because the coordinator is trusted to report misbehaving parties in order to avoid publishing an invalid signature if the coordinator themselves is a signer and misbehaves they can avoid that step . However at worst this results in a denial of service attack due to publishing an invalid signature .
pub fn aggregate(
    signing_package: &SigningPackage,
    signing_shares: &[SignatureShare],
    pubkeys: &PublicKeyPackage,
) -> Result<Signature<SpendAuth>, &'static str> {
    let mut bindings: HashMap<u64, Scalar> =
        HashMap::with_capacity(signing_package.signing_commitments.len());
    for comm in signing_package.signing_commitments.iter() {
        let rho_i = gen_rho_i(comm.index, &signing_package);
        bindings.insert(comm.index, rho_i);
    }
    let group_commitment = gen_group_commitment(&signing_package, &bindings)?;
    let challenge = gen_challenge(&signing_package, &group_commitment, &pubkeys.group_public);
    for signing_share in signing_shares {
        let signer_pubkey = pubkeys.signer_pubkeys[&signing_share.index];
        let lambda_i = gen_lagrange_coeff(signing_share.index, &signing_package)?;
        let signer_commitment = signing_package
            .signing_commitments
            .iter()
            .find(|comm| comm.index == signing_share.index)
            .ok_or("No matching signing commitment for signer")?;
        let commitment_i =
            signer_commitment.hiding + (signer_commitment.binding * bindings[&signing_share.index]);
        signing_share.check_is_valid(&signer_pubkey, lambda_i, commitment_i, challenge)?;
    }
    // The aggregation of the signature shares by summing them up, resulting in
    // a plain Schnorr signature.
    let mut z = Scalar::zero();
    for signature_share in signing_shares {
        z += signature_share.signature.0;
    }
    Ok(Signature {
        r_bytes: jubjub::AffinePoint::from(group_commitment.0).to_bytes(),
        s_bytes: z.to_bytes(),
        _marker: PhantomData,
    })
}
pub fn aggregate ( signing_package : & SigningPackage , signing_shares : & [ SignatureShare ] , pubkeys : & PublicKeyPackage , ) -> Result < Signature < SpendAuth > , & ' static str > { let mut bindings : HashMap < u64 , Scalar > = HashMap :: with_capacity ( signing_package . signing_commitments . len ( ) ) ; for comm in signing_package . signing_commitments . iter ( ) { let rho_i = gen_rho_i ( comm . index , & signing_package ) ; bindings . insert ( comm . index , rho_i ) ; } let group_commitment = gen_group_commitment ( & signing_package , & bindings ) ? ; let challenge = gen_challenge ( & signing_package , & group_commitment , & pubkeys . group_public ) ; for signing_share in signing_shares { let signer_pubkey = pubkeys . signer_pubkeys [ & signing_share . index ] ; let lambda_i = gen_lagrange_coeff ( signing_share . index , & signing_package ) ? ; let signer_commitment = signing_package . signing_commitments . iter ( ) . find ( | comm | comm . index == signing_share . index ) . ok_or ( " " ) ? ; let commitment_i = signer_commitment . hiding + ( signer_commitment . binding * bindings [ & signing_share . index ] ) ; signing_share . check_is_valid ( & signer_pubkey , lambda_i , commitment_i , challenge ) ? ; } // The aggregation of the signature shares by summing them up, resulting in // a plain Schnorr signature. let mut z = Scalar :: zero ( ) ; for signature_share in signing_shares { z += signature_share . signature . 0 ; } Ok ( Signature { r_bytes : jubjub :: AffinePoint :: from ( group_commitment . 0 ) . to_bytes ( ) , s_bytes : z . to_bytes ( ) , _marker : PhantomData , } ) }
Verifies each participant's signature share, and if all are valid,
aggregates the shares into a signature to publish.
Verifies each participant ' s signature share and if all are valid aggregates the shares into a signature to publish .
signing_package
&SigningPackage
signing_shares
&[SignatureShare]
pubkeys
&PublicKeyPackage