Module zk_key_possession 

Experimental demonstration primitive — NOT AUDITED. The proof Schnorr proof of possession of a P-256 signing key.

Proves knowledge of the discrete logarithm x of a public key X = x·G, bound to an arbitrary context string through the Fiat-Shamir challenge. This is the standard rogue-key defense: key-aggregation schemes (MuSig-style multi-signatures, threshold enrollment) must require each contributor to prove possession of the key it submits — otherwise a malicious contributor crafts a share such that the aggregate key is one it controls alone.

The construction is a textbook Schnorr identification protocol made non-interactive with Fiat-Shamir. The statement (public key AND context) is bound into the challenge, so a proof does not transfer to another key or another context.

For proving possession of an ECDSA signature without revealing it, see zk_sig_possession — that statement contains the coordinate check x(R) ≡ r (mod n), which is a bit-decomposition relation no plain sigma-protocol can carry; it stays gated until a circuit-based construction lands.

Structs

KeyPossessionProof

A proof that the prover knows the signing key behind a public key.

Functions

prove_key_possession

Prove possession of the signing key behind signing_key, bound to context. The signing key itself never leaves the prover.

verify_key_possession

Verify a key-possession proof for public_key and context.