NUT-11: `SIG_ALL` sign aggregated message all inputs and ouptuts by callebtc · Pull Request #149 · cashubtc/nuts

callebtc · 2024-07-13T13:00:14Z

This PR specifies the signature flag SIG_ALL for swap and for melt transactions involving P2PK-locked or HTLC-locked inputs. It also adds a new tag for P2PK (also used in HTLC) called n_sigs_refund that specifies the signature threshold for the refund pubkeys (enforced after a timelock).

SIG_ALL means that the witness of the first input must be a signature on an concatenated message of the form proof.secret_n.. . || output.B'_n... in the case of a swap covering all of the inputs' secret fields and all of the outputs' blinded message fields B_. In the case of a melt, we also need to include the quote_id in the signed message.

Aggregation for `swap`

If a swap transaction has n inputs and m outputs, the message to sign becomes:

msg = secret_0 || ... || secret_n || B_0 || ... || B_m

Aggregation for `melt`

For a melt transaction, the message to sign is composed of all the inputs, the quote ID being paid, and the [NUT-08][08] blank outputs.

If a melt transaction has n inputs, m blank outputs, and a quote ID quote_id, the message to sign becomes:

msg = secret_0 || ... || secret_n || B_0 || ... || B_m || quote_id

Here, || denotes string concatenation. The B_ of each output is a hex string.

Changes:

fix SIG_ALL
add n_sigs_refund
remove BlindedMessage.witness output witness

Todo:

specify if only valid for /swap or also for /melt (for both signature flags)
SIG_ALL test vectors
explicit error if no outputs are provided for SIG_ALL.

Tracking:

cdk-mintd (PR: feat: sig all cdk#862)
nutshell (PR: SIG_ALL signature flag for P2PK nutshell#735)

11.md

Co-authored-by: gudnuf <108303703+gudnuf@users.noreply.github.com>

callebtc · 2025-04-18T04:51:46Z

While this NUT is under review, it might be a good idea to codify the maximum secret length as many mints are enforcing 512 bytes

I think we should do that in NUT-0

11.md

 ### Multisig

-If the tag `n_sigs` is a positive integer, the mint will also consider signatures from public keys specified in the `pubkeys` tag additional to the public key in `Secret.data`. If the number of valid signatures is greater or equal to the number specified in `n_sigs`, the transaction is valid.
+If the tag `n_sigs` is a positive integer, the mint will require valid signatures from `n_sigs` public keys contained in the `Secret.data` field and the `pubkeys` tag.


robwoodgate

Have made some suggestions to clarify the multisig logic.
EDIT: Have PR'd these suggestions (#272)

11.md


-If the `locktime` is in the past and a tag `refund` is present, the `Proof` is spendable only if a valid signature by one of the the `refund` pubkeys is provided in `Proof.witness.signatures` and, depending on the signature flag, in `BlindedMessage.witness.signatures`.
+If the `locktime` is in the past and a tag `refund` is present, the `Proof` is spendable only if valid signatures are given by the `refund` pubkeys. The



11.md

 ### Multisig

-If the tag `n_sigs` is a positive integer, the mint will also consider signatures from public keys specified in the `pubkeys` tag additional to the public key in `Secret.data`. If the number of valid signatures is greater or equal to the number specified in `n_sigs`, the transaction is valid.
+If the tag `n_sigs` is a positive integer, the mint will require valid signatures from `n_sigs` public keys contained in the `Secret.data` field and the `pubkeys` tag.


robwoodgate · 2025-04-23T09:28:04Z

11.md

 #### Complex Example

-This is an example `secret` that locks a `Proof` with a Pay-to-Pubkey (P2PK) condition that requires 2-of-3 signatures from the public keys in the `data` field and the `pubkeys` tag. If the `timelock` has passed, the `Proof` becomes spendable with a single signature from the public key in the `refund` tag. The signature flag `sigflag` indicates that signatures are necessary on the `inputs` and the `outputs` of a transaction.
+This is an example `Secret` that locks a `Proof` with a Pay-to-Pubkey (P2PK) condition that requires 2-of-3 signatures from the public keys in the `data` field and the `pubkeys` tag. If the `timelock` has passed, the `Proof` becomes spendable with a single signature from the public key in the `refund` tag. The signature flag `sigflag` indicates that signatures are necessary on the `inputs` and the `outputs` of the transaction this `Proof` is spent by.


Would be good to add a second refund public key to make it clear the tag supports multiple keys.

Suggestion:

... becomes spendable with a single signature from one of the two public keys in the refund tag.

a1denvalu3 · 2025-04-26T08:48:12Z

NOTE: maybe it would be convenient to include a limit of len(pubkeys) + len(refund) == NUT11_LIMIT, since we already discussed it.

thesimplekid · 2025-05-16T15:06:48Z

Closes #148 and #180

thesimplekid · 2025-06-29T12:31:27Z

CDK PR: cashubtc/cdk#862

* Clarifications to multisig * Distinguish between Locktime MultiSig and Refund MultiSig

SIG_ALL: sign aggregated message all inputs and ouptuts

b763822

callebtc changed the title ~~SIG_ALL: sign aggregated message all inputs and ouptuts~~ NUT-11: SIG_ALL sign aggregated message all inputs and ouptuts Jul 13, 2024

callebtc added 2 commits April 15, 2025 16:22

aggregation

178a4a6

format

087c676

callebtc marked this pull request as ready for review April 15, 2025 09:24

gudnuf approved these changes Apr 15, 2025

View reviewed changes

11.md Outdated Show resolved Hide resolved

Update 11.md

6a77e1f

Co-authored-by: gudnuf <108303703+gudnuf@users.noreply.github.com>

This comment was marked as resolved.

Sign in to view

add n_sigs_refund

902d02b

cashubtc deleted a comment from robwoodgate Apr 18, 2025

robwoodgate approved these changes Apr 18, 2025

View reviewed changes

robwoodgate reviewed Apr 22, 2025

View reviewed changes

robwoodgate suggested changes Apr 23, 2025

View reviewed changes

robwoodgate mentioned this pull request Apr 23, 2025

Added NUT-11 P2PK multisig support and corresponding tests cashubtc/cashu-ts#284

Closed

3 tasks

robwoodgate mentioned this pull request May 8, 2025

Added NUT-11 P2PK multisig support and corresponding tests cashubtc/cashu-ts#299

Merged

3 tasks

robwoodgate mentioned this pull request Jun 23, 2025

Clarifications to multisig #272

Merged

feat: sig all test vectors

353c522

thesimplekid force-pushed the nut11-sigall branch from c99ce7b to 353c522 Compare June 29, 2025 12:30

thesimplekid mentioned this pull request Jul 9, 2025

NUT-11: Add n_sigs_refund tag #246

Open

Clarifications to multisig (#272)

26ffa2e

* Clarifications to multisig * Distinguish between Locktime MultiSig and Refund MultiSig

robwoodgate approved these changes Aug 19, 2025

View reviewed changes

thesimplekid approved these changes Aug 19, 2025

View reviewed changes

callebtc merged commit 76c631f into main Aug 19, 2025
2 checks passed

callebtc deleted the nut11-sigall branch August 19, 2025 22:48

ye0man added this to nuts Jan 13, 2026

github-project-automation bot moved this to Done in nuts Jan 13, 2026

ye0man removed this from nuts Jan 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NUT-11: `SIG_ALL` sign aggregated message all inputs and ouptuts#149

NUT-11: `SIG_ALL` sign aggregated message all inputs and ouptuts#149
callebtc merged 7 commits intomainfrom
nut11-sigall

callebtc commented Jul 13, 2024 •

edited by thesimplekid

Loading

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

callebtc commented Apr 18, 2025

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

robwoodgate left a comment •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

robwoodgate Apr 23, 2025

Uh oh!

a1denvalu3 commented Apr 26, 2025

Uh oh!

thesimplekid commented May 16, 2025 •

edited

Loading

Uh oh!

thesimplekid commented Jun 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		If the `locktime` is in the past and a tag `refund` is present, the `Proof` is spendable only if a valid signature by one of the the `refund` pubkeys is provided in `Proof.witness.signatures` and, depending on the signature flag, in `BlindedMessage.witness.signatures`.
		If the `locktime` is in the past and a tag `refund` is present, the `Proof` is spendable only if valid signatures are given by the `refund` pubkeys. The

Conversation

callebtc commented Jul 13, 2024 • edited by thesimplekid Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Aggregation for swap

Aggregation for melt

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

callebtc commented Apr 18, 2025

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

robwoodgate left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

robwoodgate Apr 23, 2025

Choose a reason for hiding this comment

Uh oh!

a1denvalu3 commented Apr 26, 2025

Uh oh!

thesimplekid commented May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thesimplekid commented Jun 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

callebtc commented Jul 13, 2024 •

edited by thesimplekid

Loading

Aggregation for `swap`

Aggregation for `melt`

robwoodgate left a comment •

edited

Loading

thesimplekid commented May 16, 2025 •

edited

Loading