Module signer 

Available on crate feature signer only.

The Signer role (capability holders can contribute).

• Needs the spend authorization randomizers to create signatures.
• Needs sufficient information to verify that the proof is over the correct data, without needing to verify the proof itself.
• A Signer should only need to implement:
  • Pedersen commitments using Jubjub / Pallas arithmetic (for note and value commitments)
  • BLAKE2b and BLAKE2s (and the various PRFs / CRHs they are used in)
  • Nullifier check (using Jubjub / Pallas arithmetic)
  • KDF plus note decryption (AEAD_CHACHA20_POLY1305)
  • SignatureHash algorithm
  • Signatures (RedJubjub / RedPallas)
  • A source of randomness.

Outputs a Signer must tolerate

A zero-valued Orchard-protocol output whose enc_ciphertext does not decrypt is well-formed. A Signer MUST classify it as a tolerable dummy output, and MUST NOT reconstruct an expected ciphertext and reject the mismatch.

After NU6.3 every Orchard-pool action is subject to the same-address restriction, so spending in the Orchard pool pairs each real spend with a fabricated zero-valued output addressed to the spent note’s own receiver. That output’s enc_ciphertext is random bytes rather than an encryption of the note plaintext (ZIP 326): a real encryption would trial-decrypt under the receiver’s incoming viewing key in the same action that carries the spend’s nullifier, letting any holder of that key link the nullifier to the address and so detect the spend.

Such an output carries explicit recipient, value, and rseed fields but no user_address, so a Signer reads a value of zero and recovers nothing from the ciphertext. The note and its commitment are unaffected, so cmx is derived and checked as for any other output.

Signing before the anchor and witnesses are known

For v6 and later transaction formats, a Signer MAY sign a spend whose witness is absent, in a bundle whose anchor is absent (ZIP 374).

A v6 txid digest excludes shielded anchors, committing them in the authorizing-data digest instead, and a witness never enters the transaction. The sighash therefore binds every economically meaningful field — nullifiers, value commitments, outputs, and value balances — while the anchor, witnesses, and proofs govern only whether the transaction can be mined, not what it does once it is. They are installed by Updater before proving.

This is what allows a chain of transactions to be signed in one session, before the parent whose outputs they spend has been mined or even broadcast. A Signer’s user interface should be able to convey that a batch contains transactions spending the outputs of an in-batch, not-yet-mined parent.

For v5 the sighash commits to the anchor, so it must be present before signing.

Re-exports

pub use crate::EffectsOnly;

Modules

batch

Postcard-encoded messages for batched external PCZT signing.

Structs

Signer

SpendAuthSignature

A spend authorization signature for an action in an Orchard-protocol value pool.

Enums

Error

Errors that can occur while creating signatures for a PCZT.

Functions

extract_orchard_spend_auth_signatures

Extracts the Orchard-protocol spend authorization signatures present in pczt.