Module nonce 

Threshold nonce derivation — deterministic per-party nonce shares.

Each party derives their nonce share deterministically from:

• Their private key share (secret scalar)
• The message hash being signed
• Their party index

This eliminates the interactive nonce commitment round (CMP20/GG18 round 1) and prevents nonce reuse attacks. The full nonce is the sum of all T nonce shares, reconstructed via Lagrange interpolation.

Security note

This is a simplified deterministic derivation suitable for testing and non-interactive signing modes. Production CMP20/GG18 signing uses interactive nonce generation for stronger security guarantees.

Functions

derive_full_nonce

Derive nonce shares for all parties and return the full nonce (their sum).

derive_nonce_share

Derive a deterministic nonce share for a party. The nonce is derived from the party’s secret scalar, the message hash, and their party index via HMAC-SHA256, reduced mod the P-256 group order.

sum_nonce_shares

Sum T nonce shares (via Lagrange-weighted addition) to get the full nonce. In threshold signing, the full nonce k = sum of Lagrange-weighted nonce shares.