Module transcript 

Fiat-Shamir transcript for FROST-ed25519.

The FROST spec (draft-irtf-cfrg-frost, §4.2 “Palette of operations”) names five domain-separated hash functions H1–H5 over a single underlying hash H. For the ed25519 instantiation the underlying hash is SHA-512 and the domain separator is the ASCII string "FROST-ed25519-SHA512-v1" prefixed into every input.

The five functions map onto the protocol’s needs as follows:

fn	role
H1	nonce derivation —rho binding factor input
H2	challenge scalar c (this MUST equal the ed25519 challenge
SHA-512(R ‖ A ‖ M) reduced mod ℓ, so the signature verifies
under any standard ed25519 verifier)
H3	nonce randomness extraction
H4	variable-length equality-check listings
H5	variable-length equality-check (alternate)

For the signing scheme implemented here we only need H1 (binding factor), H3 (nonce seed from (secret, nonce_seed, msg)), and the bare ed25519 challenge (H2). H4 / H5 are unused in 2-of-N signing without the optional pre-process round; they are included so future extensions match the spec’s H_n palette.

Constants

DOMAIN

Domain separator prefix used by every H1–H5 invocation. Matches the ciphersuite identifier in draft-irtf-cfrg-frost §7.3 (“FROST(ed25519, SHA-512)”).

Functions

challenge

The ed25519 challenge scalar c = SHA-512(R ‖ A ‖ M) reduced mod ℓ.

h1_binding_factor

H1 — the binding factor rho. Output: a scalar mod ℓ.

h3_nonce

H3 — nonce randomness. Maps a 32-byte seed + message to a scalar mod ℓ.

rho_input

Build the “rho input” for a signing instance — the canonical bytes that all participating parties hash to derive each rho_i.