Struct Schnorr 

pub struct Schnorr<H: Hashable> {
    pub hasher: Box<dyn Hasher<Message<H>>>,
    pub domain_param: H::D,
}

Schnorr signer context for the Mina signature algorithm

For details about the signature algorithm please see the schnorr documentation

Fields

hasher: Box<dyn Hasher<Message<H>>>

The hasher instance used to hash messages

domain_param: H::D

The domain parameter used for hashing

Implementations

impl<H: 'static + Hashable> Schnorr<H>

pub fn derive_nonce_chunked(&self, kp: &Keypair, input: &H) -> ScalarField

Chunked nonce derivation for zkApp transactions.

This function implements the deterministic nonce derivation algorithm used by Message.Chunked in the OCaml implementation. Use this for zkApp transactions that need to be compatible with o1js.

Compatibility

This implementation corresponds to Message.Chunked.derive in the OCaml implementation (src/lib/crypto/signature_lib/schnorr.ml).

It is also compatible with the TypeScript o1js implementation: https://github.com/o1-labs/o1js/blob/main/src/mina-signer/src/signature.ts

The private key conversion replicates the “Field.project” method with unpack from the OCaml implementation, which performs modular reduction when the scalar field value is larger than the base field modulus.

Algorithm

The nonce derivation follows this process:

1. Create ROInput from: message || public_key_x || public_key_y || private_key || network_id
2. Pack the ROInput into fields using Mina’s field packing
3. Convert packed fields to bits (255 bits per field)
4. Convert bits to bytes for BLAKE2b input
5. Hash with BLAKE2b-256
6. Drop the top 2 bits to create a valid scalar field element

Parameters

• kp - The keypair containing both public and private keys
• input - The message to be signed

Returns

A deterministic nonce as a scalar field element.

Test Vectors

For test vectors demonstrating this function’s usage, see the sign_fields_test in tests/signer.rs which uses NonceMode::Chunked.

Security

This function generates a cryptographically secure, deterministic nonce that:

• Depends on the private key, public key, message, and network context
• Ensures no two different messages share the same nonce (with the same key)
• Is compatible with existing Mina protocol implementations

Panics

Panics if the BLAKE2b variable-output hasher cannot be created with a 32-byte output size (should not happen).

fn derive_nonce_legacy(&self, kp: &Keypair, input: &H) -> ScalarField

Legacy nonce derivation for user commands (payments, delegations).

This function implements the deterministic nonce derivation algorithm used by Message.Legacy in the OCaml implementation. Use this for legacy Mina transactions (user commands) such as payments and delegations.

Compatibility

This implementation corresponds to Message.Legacy.derive in the OCaml implementation (src/lib/crypto/signature_lib/schnorr.ml).

Parameters

• kp - The keypair containing both public and private keys
• input - The message to be signed

Returns

A deterministic nonce as a scalar field element.

Usage

Use this method for legacy Mina transactions (user commands) such as payments and delegations. For zkApp transactions, use derive_nonce_chunked instead.

Differences from derive_nonce_chunked

This method differs from derive_nonce_chunked in several ways:

• Uses direct byte serialization (roi.to_bytes()) instead of field packing
• Appends private key as scalar field element instead of base field element
• Uses full network ID bytes instead of packed single byte
• Does not perform bit-level manipulation for BLAKE2b input

Security

This function generates a cryptographically secure, deterministic nonce that depends on the private key, public key, message, and network context.

fn message_hash( &mut self, pub_key: &PubKey, rx: BaseField, input: &H, ) -> ScalarField

This function uses a cryptographic hash function (based on a sponge construction) to convert the message to be signed (and some other information) into a uniformly and randomly distributed scalar field element. It uses Mina’s variant of the Poseidon SNARK-friendly cryptographic hash function. Details: https://github.com/o1-labs/cryptography-rfcs/blob/httpsnapps-notary-signatures/mina/001-poseidon-sponge.md

Trait Implementations

impl<H: 'static + Hashable> Signer<H> for Schnorr<H>

fn sign(&mut self, kp: &Keypair, input: &H, nonce_mode: NonceMode) -> Signature

Sign input (see [Hashable]) using keypair kp and return the corresponding signature.

fn verify(&mut self, sig: &Signature, public: &PubKey, input: &H) -> bool

Verify that the signature sig on input (see [Hashable]) is signed with the secret key corresponding to pub_key. Return true if the signature is valid and false otherwise.