schnorr-blake3

Lace-009 Schnorr-BLAKE3 Marks and raw secp256k1 ECDH, shared independently of records, transports and runtimes. Curve operations use maintained C libsecp256k1 bundled by secp256k1-sys, through Rust secp256k1 0.33.1. There is no alternate arithmetic backend.

• SigningKey derives its scalar from a 32-byte Lace signing seed; the seed is not a raw secp256k1 scalar.
• VerificationKey validates the x-only even-y public key. Mark carries the 64-byte signature, checked against that key and a 32-byte digest.
• ECDH uses distinct raw-scalar and validated compressed-public-key types. Its raw shared x-coordinate needs the caller’s protocol-specific KDF.
• Callers supply auxiliary signing randomness. The crate owns no entropy source, text encoding, record parser, transport or runtime.

Lace-009 defines the signing algorithm and vectors. It is not BIP-340. Existing H3 record bytes remain defined by Lace-010; record assembly and validation stay in lace-sans-io. Lace protocol hashing uses BLAKE3; the maintained C library’s internal hashes are not a second protocol hash scheme.

Assurance boundary

The small custom adapter still needs independent cryptographic and side-channel review. It uses supported C scalar-tweak operations for exact modular reduction, including zero and overflow cases, and raw ECDH against the generator for constant-time parity selection during normalization. This route does not inherit generator-context blinding from built-in signing. Interoperability tests and WASM execution are not an audit or a universal constant-time guarantee.

Owned secret buffers use zeroize; temporary C secret-key values receive best-effort erasure. This does not promise erasure of caller copies, prior moves, compiler temporaries, registers, opaque hash state or all C-library scratch.

Build

Native builds need a C compiler. WASM builds need a wasm-capable Clang and the Rust wasm32-unknown-unknown target, not Emscripten. Select Clang explicitly when necessary with CC_wasm32_unknown_unknown=clang.

From the repository root:

timeout 60s cargo check -p schnorr-blake3 --locked
timeout 60s cargo test -p lace-sans-io --features internal --test record_construction recreates_static_seal --locked -- --exact
CC_wasm32_unknown_unknown=clang timeout 60s cargo check -p schnorr-blake3 --target wasm32-unknown-unknown --locked

The target check is compilation only; execute signing/verification vectors in a WASM host when validating target behavior. Miri does not execute this C backend.