NUT-11: Add SigAllSigningPackage transport format for multi-party SIG_ALL signing - #345
Open
KvngMikey wants to merge 4 commits into
Open
NUT-11: Add SigAllSigningPackage transport format for multi-party SIG_ALL signing#345KvngMikey wants to merge 4 commits into
KvngMikey wants to merge 4 commits into
Conversation
robwoodgate
reviewed
Feb 23, 2026
Collaborator
There was a problem hiding this comment.
I prefer this approach to #318 - great work. Have left a couple of suggestions to tighten things up, otherwise great!
robwoodgate
previously approved these changes
Feb 23, 2026
robwoodgate
left a comment
robwoodgate
left a comment
Collaborator
There was a problem hiding this comment.
Great work @KvngMikey.
robwoodgate
reviewed
Aug 10, 2026
robwoodgate
left a comment
robwoodgate
left a comment
Collaborator
There was a problem hiding this comment.
The old signing format (without amount binding) is insecure, so we should get rid of it, and with the proposed MTS change in #404, the digests naming falls apart. So better to calculate based on current MTS from the package than relying on a pre-computed digest
Member
Author
|
@robwoodgate - I removed |
There was a problem hiding this comment.
Pull request overview
Adds a wallet-to-wallet transport format (“SigAllSigningPackage”) to NUT-11 to support coordinating multi-party SIG_ALL signing, along with worked test vectors for implementer verification.
Changes:
- Specify a
SigAllSigningPackageJSON shape forswap/meltand describe a serialization scheme (sigallAprefix + base64url(JSON)). - Add a concrete worked example and serialized
sigallA...test vector totests/11-test.md. - Add a
[tests]reference link from11.mdto the test vectors.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| 11.md | Defines the SigAllSigningPackage structure and its serialization format, plus a sample serialized string and link to vectors. |
| tests/11-test.md | Adds worked example inputs/outputs and a full serialized sigallA... string as an implementation test vector. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
75 tasks
The digests object is computable from the rest of the package, so carrying it added nothing a signer could not derive itself. Worse, a signer that trusts a supplied digest signs a message it has never checked against the transaction it is approving. The legacy entry hashed the pre-amount-binding format (secret||C||B_), which NUT-11 no longer specifies. Without amount binding a signature commits to which blinded outputs exist but not to their values, letting amounts be reordered across outputs while the signature and the mint's balance check both still pass. Carrying that digest gave a superseded format renewed standing. The current entry hashed today's aggregation format, a label that goes stale the moment the message format changes (see cashubtc#404). Dropping both leaves the package independent of any aggregation scheme. Adds a normative requirement that signers derive the message to sign from the package contents themselves, and regenerates the sigallA vector without digests. Also clarifies the witness encoding. NUT-11 defines Proof.witness as a serialized JSON string, but the package schema showed witness as a JSON object without saying which representation applied. An implementer could serialize it before putting it in the package, or pass the package's object straight into Proof.witness; both parse as valid JSON and fail only later. The object form is correct and is what the vector already encodes, so this documents the field rather than changing it. The accompanying note also states that inputs[].secret keeps the representation it has in Proof.secret, since documenting only witness invites the opposite mistake. Addresses review feedback from @robwoodgate and Copilot. Serialized vector matches the one pinned in cashubtc/cashu-ts#947.
KvngMikey
force-pushed
the
sigall_package
branch
from
August 12, 2026 13:39
9c5c090 to
c8e54bb
Compare
52 tasks
70 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #319
Adds a
SigAllSigningPackagesection to NUT-11 defining the wallet-ledtransport format for coordinating multi-party
SIG_ALLsigning.Implementations:
Defines:
SigAllSigningPackageshape, using existing NUT types (BlindedMessage)sigallAprefixsigallAstring forimplementation verification, added to
tests/11-test.mdSigning logic, merge behaviour, and coordination flow are intentionally omitted as implementation detail.
Related: [SigAll Signing Package -> cashubtc/cashu-ts/pull/485]