Schnorr proof generation and verification.
Implements the core Schnorr identification protocol:
generate_keypair/1: pick random secretx, compute publicy = g^x mod pgenerate_commitment/1: pick randomk, computer = g^k mod prespond/4: computes = k + c*x mod qverify_interactive/7: checkg^s ≡ r * y^c (mod p)verify_non_interactive/9: timestamp check + Fiat-Shamir heuristic + verify
Summary
Functions
Convenience that generates a full proof in one call.
Convenience that generates a full proof from an existing secret key.
Generates a commitment for the proof.
Generates a Schnorr keypair.
SHA-256 hash of data reduced to a scalar in [1, q-1].
Computes the Schnorr response s = k + c*x mod q.
Verifies an interactive Schnorr proof.
Verifies a non-interactive (Fiat-Shamir) Schnorr proof.
Types
Functions
Convenience that generates a full proof in one call.
Generates a keypair, creates a commitment, hashes the transcript
g ‖ y ‖ r ‖ nonce, and produces s.
Returns %{public_y: y, r: r, s: s}.
Convenience that generates a full proof from an existing secret key.
Unlike compute_proof/2, this uses a caller-supplied secret_x and public_y.
Generates a commitment for the proof.
Picks a random k and returns {r, k} where r = g^k mod p.
Generates a Schnorr keypair.
Returns {secret_x, public_y} where public_y = g^secret_x mod p.
SHA-256 hash of data reduced to a scalar in [1, q-1].
Delegates to Snarkey.Crypto.hash_to_scalar/2.
Computes the Schnorr response s = k + c*x mod q.
Verifies an interactive Schnorr proof.
Checks g^s ≡ r * y^c (mod p). Returns :ok or {:error, :invalid_proof}.
Rejects proofs where r == 0, s == 0, or c == 0, or where any
value is outside the expected range.
Verifies a non-interactive (Fiat-Shamir) Schnorr proof.
Checks that the timestamp is within max_drift seconds of the current
system time, recomputes the Fiat-Shamir challenge c from the transcript
g ‖ y ‖ r ‖ user_id ‖ timestamp, and delegates to verify_interactive/7.
Options:
:max_drift— maximum allowed timestamp skew in seconds (default 5)