partialSignature(for:pubnonce:secureNonce:publicNonceAggregate:xonlyKeyAggregate:)

Produces a P256K.Schnorr.PartialSignature via secp256k1_musig_partial_sign, consuming and zeroing the secret nonce to prevent reuse. The resulting partial signature is an opaque 36-byte in-memory struct; its stable wire format is 32 bytes (see dataRepresentation).

iOS 13.0+
macCatalyst 13.0+
macOS 10.15+
tvOS 13.0+
visionOS 1.0+
watchOS 6.0+

func partialSignature<D>(for digest: D, pubnonce: P256K.Schnorr.Nonce, secureNonce: consuming P256K.Schnorr.SecureNonce, publicNonceAggregate: P256K.MuSig.Nonce, xonlyKeyAggregate: P256K.MuSig.XonlyKey) throws -> P256K.Schnorr.PartialSignature where D : Digest

Parameters

digest: The message digest to sign.
pubnonce: This signer’s own public nonce from nonce generation.
secureNonce: This signer’s secret nonce (~Copyable); consumed and zeroed on return.
publicNonceAggregate: The P256K.MuSig.Nonce aggregated from all signers’ public nonces.
xonlyKeyAggregate: The x-only form of the aggregate(_:) result.

Return Value

A P256K.Schnorr.PartialSignature to send to the aggregator.

Discussion

Warning

The secret nonce is zeroed after this call. secp256k1_musig_partial_sign overwrites secureNonce with zeros as a best-effort defence against nonce reuse. Because P256K.Schnorr.SecureNonce is ~Copyable, the Swift layer additionally prevents static misuse. Nonce reuse leaks the secret signing key.

This method does not verify the output partial signature, deviating from the BIP-327 specification. Call isValidSignature(_:publicKey:nonce:for:) afterwards to detect computation errors.

Throws

secp256k1Error.underlyingCryptoError if signing fails or the secnonce was already used.