Module sign 

CMP20 threshold ECDSA signing over P-256.

Consumes shares from crate::keygen and produces a standard (r, s) ECDSA signature verifiable under p256::ecdsa::VerifyingKey.

Protocol (simplified — NOT production)

Three rounds (down from GG18’s four):

• Round 1 — nonce commit. Broadcast R_i = k_i * G + 1-based idx.
• Round 2 — nonce reveal. Broadcast k_i. CMP20 folds the MtA setup into this round (GG18 split these across rounds 2 and 3); here the MtA products are computed in the clear locally, so no extra sub-round is needed.
• Round 3 — partial sign + combine. From all reveals compute aggregate k = sum k_i, R = sum R_i, r = R.x mod n, Lagrange weights. Compute s_i = k^{-1} * r * lambda_i * x_i. Broadcast s_i. On receipt of all partials, verify each against its expected value (identifiable abort — a bad partial names the offender), then combine s = k^{-1} * z + sum s_i, verify (r, s) against the joint public key.

The arithmetic is identical to a real CMP20 run for honest coalitions. Nonces are revealed in the clear — this leaks the joint nonce k, which is safe for a single signature but would be catastrophic across multiple signatures over the same secret. Production CMP20 hides k via Paillier-based MtA. See crate::mta for the gap.

Identifiable abort

When the aggregate signature fails to verify, round 3 walks the partials and reports the offending party via Cmp20ErrorCode::IDENTIFIED_BYZANTINE. In the simplified setting the identification is by elimination (the party whose removal restores validity is the byzantine one); real CMP20 achieves it cryptographically via range proofs and per-partial consistency checks.

Structs

Cmp20SignP256

CMP20 signing scheme over P-256. Registered as CMP20-ECDSA-P256-SIGN.

Cmp20SignSession