Data Structures
struct	ConflictContext
	Public context shared by conflicting statements in one slashable slot. More...
class	ScalarSignature
	Canonical 32-byte scalar response; carries no nonce or proof. More...
struct	PartialResponse
	Public session contribution; the raw full nonce is not normalized. More...
struct	SigningRosterMember
	An ordered individual signing key and its normalized public weight. More...
class	SigningRoster
	Experimental public key aggregation for one ordered coalition roster. More...

Functions
Result< std::array< unsigned char, 32 > >	nonce_evaluation_input (const ConflictContext &context, purify_secp_context *secp_context)
	Derive the candidate deterministic Purify input from the registered slot.
Result< FieldElement >	signature_challenge (const ConflictContext &context, std::span< const unsigned char > canonical_body, purify_secp_context *secp_context)
	Compute the versioned Q/U/T/body challenge, without a nonce point.
Result< std::array< unsigned char, 33 > >	reconstruct_nonce (const ConflictContext &context, std::span< const unsigned char > canonical_body, const ScalarSignature &signature, purify_secp_context *secp_context)
	Reconstruct the full nonce point as sigmaG - eQ, rejecting infinity.
Result< std::array< unsigned char, 32 > >	recover_same_slot_key (const ConflictContext &context, std::span< const unsigned char > first_body, const ScalarSignature &first_signature, std::span< const unsigned char > second_body, const ScalarSignature &second_signature, purify_secp_context *secp_context)
	Recover the exact signing scalar exposed by two same-slot responses.
Status	verify_partial_response (const SigningRoster &roster, std::size_t member_index, const ConflictContext &context, std::span< const unsigned char > canonical_body, const PartialResponse &partial, purify_secp_context *secp_context)
	Check sigma_iG = R_i + eb_i*P_i for one ordered roster member.
Result< ScalarSignature >	aggregate_responses (const SigningRoster &roster, const ConflictContext &context, std::span< const unsigned char > canonical_body, std::span< const PartialResponse > partials, purify_secp_context *secp_context)
	Check all ordered partial equations and sum their scalar responses.

Function Documentation

◆ aggregate_responses()

Result< ScalarSignature > purify::accountable::aggregate_responses	(	const SigningRoster &	roster,
		const ConflictContext &	context,
		std::span< const unsigned char >	canonical_body,
		std::span< const PartialResponse >	partials,
		purify_secp_context *	secp_context )

nodiscard

Exactly one contribution per roster member is required. Computes the common challenge once and rejects a final nonce at infinity. The returned scalar is not a verified signature: the caller still needs the reviewed nonce proof and application authorization/conflict checks before accepting a certificate.

Definition at line 69 of file accountable_responses.cpp.

References purify::accountable::ScalarSignature::deserialize(), purify::EmptyInput, purify::FieldElement::from_bytes32(), purify::FieldElement::from_u64(), purify::accountable::SigningRoster::members(), PURIFY_ASSIGN_OR_RETURN, PURIFY_RETURN_IF_ERROR, purify::accountable::SigningRoster::signing_key(), purify::SizeMismatch, and purify::unexpected_error().

◆ nonce_evaluation_input()

Result< std::array< unsigned char, 32 > > purify::accountable::nonce_evaluation_input	(	const ConflictContext &	context,
		purify_secp_context *	secp_context )

nodiscard

This input binds the signing key, host/roster commitment, and slot. It contains neither the decision body nor a nonce, proof, batch, or signing-attempt ID.

Definition at line 52 of file accountable.cpp.

References purify::TaggedHash::digest_many(), purify::accountable::ConflictContext::host_commitment, PURIFY_RETURN_IF_ERROR, purify::accountable::ConflictContext::signing_key, and purify::accountable::ConflictContext::slot.

◆ reconstruct_nonce()

Result< std::array< unsigned char, 33 > > purify::accountable::reconstruct_nonce	(	const ConflictContext &	context,
		std::span< const unsigned char >	canonical_body,
		const ScalarSignature &	signature,
		purify_secp_context *	secp_context )

nodiscard

This is NOT signature verification. A reviewed nonce proof must accept this exact compressed point and authenticated context before an endorsement counts. The nonce proof transcript must bind the point even though the challenge omits it.

Definition at line 82 of file accountable.cpp.

References purify::InternalMismatch, PURIFY_ASSIGN_OR_RETURN, purify_bppp_offset_commitment(), purify_point_scale(), purify::RangeViolation, purify::accountable::ScalarSignature::serialize(), signature_challenge(), purify::accountable::ConflictContext::signing_key, and purify::unexpected_error().

◆ recover_same_slot_key()

Result< std::array< unsigned char, 32 > > purify::accountable::recover_same_slot_key	(	const ConflictContext &	context,
		std::span< const unsigned char >	first_body,
		const ScalarSignature &	first_signature,
		std::span< const unsigned char >	second_body,
		const ScalarSignature &	second_signature,
		purify_secp_context *	secp_context )

nodiscard

Both responses are interpreted under the one supplied Q/U/T context. Rejects equal challenges, a recovered scalar whose full public point differs from the even-Y signing key, and a common nonce at infinity. The result is derived entirely from public input, so it is returned as ordinary scalar bytes.

This is NOT certificate or conflict verification. Before using the result for enforcement, the caller must validate both nonce proofs, authenticate each endorsement's context, and establish the application conflict/liability rules. Successful recovery alone does not authorize a penalty.

Definition at line 105 of file accountable.cpp.

References purify::BindingMismatch, purify::EquationMismatch, purify::FieldElement::from_bytes32(), purify::InternalMismatch, is_zero(), PURIFY_ASSIGN_OR_RETURN, purify_point_scale(), purify::RangeViolation, purify::accountable::ScalarSignature::serialize(), signature_challenge(), purify::accountable::ConflictContext::signing_key, and purify::unexpected_error().

◆ signature_challenge()

Result< FieldElement > purify::accountable::signature_challenge	(	const ConflictContext &	context,
		std::span< const unsigned char >	canonical_body,
		purify_secp_context *	secp_context )

nodiscard

The SHA-256 digest is reduced modulo the secp256k1 group order. A zero result rejects this statement; callers must not retry by changing its slot.

Definition at line 61 of file accountable.cpp.

References purify::TaggedHash::digest_many(), purify::detail::FieldElementAccess::from_raw(), purify::accountable::ConflictContext::host_commitment, PURIFY_RETURN_IF_ERROR, purify_scalar_set_b32(), purify::RangeViolation, purify::accountable::ConflictContext::signing_key, purify::size_fits_u64(), purify::accountable::ConflictContext::slot, and purify::unexpected_error().

Referenced by reconstruct_nonce(), and recover_same_slot_key().

◆ verify_partial_response()

Status purify::accountable::verify_partial_response	(	const SigningRoster &	roster,
		std::size_t	member_index,
		const ConflictContext &	context,
		std::span< const unsigned char >	canonical_body,
		const PartialResponse &	partial,
		purify_secp_context *	secp_context )

nodiscard

This checks public algebra only. It does not establish the Purify relation, member consent, authenticated hosts, or certificate validity. The effective coefficient b_i already includes aggregate-key parity; raw R_i retains its original sign. Context.Q must equal the roster's even-Y aggregate key.

Definition at line 57 of file accountable_responses.cpp.

References purify::IndexOutOfRange, purify::accountable::SigningRoster::members(), PURIFY_ASSIGN_OR_RETURN, and purify::unexpected_error().

Data Structures

Functions

Function Documentation

◆ aggregate_responses()

◆ nonce_evaluation_input()

◆ reconstruct_nonce()

◆ recover_same_slot_key()

◆ signature_challenge()

◆ verify_partial_response()