zafu remote signing + multisig: what we built over the last month
we’re in retroactive grant voting now ahead of the full release. to make it possible to evaluate the work without sideloading an APK or unpacking an extension zip, we recorded a set of short videos of the current state of remote signing and multisig management. links at the bottom.
remote signing moved to PCZT
until now, Zafu sent its cold signer (Zigner) a “simple” payload: a sighash, the per-action randomizers, and a human-readable summary string. the problem was that the summary was only a display hint and was not cryptographically bound to the sighash and as a new developer to ecosystem I only afterewards realized that there already is existing standards for what I was looking to do. brilliant!
so we migrated the entire single-signer flow to the standard Partially Created Zcash Transaction (PCZT) format. the cold device now recomputes the sighash from the PCZT contents itself, so the displayed action set and the signed bytes are derived from the same byte stream.
to rant about this a little bit; cold-signing a typical 1-spend Orchard tx round-trips ~3-4 KB both ways under zcash-pczt, about 30 frames per direction at 200 B/frame. the dominant chunk in it is the ~2.4 KB Halo 2 proof, which the signer never touches and the wallet already has locally. it’s all fine on phones where camera quality has been priority but laptop webcams are notoriously bad and in our testing the return does not reliably complete or takes at least a painful amount of time to hodl ur phone on camera. Keystone only defines one Zcash signing QR format (zcash-pczt), and the ZODL ↔ Keystone flow uses it identically in both directions: ZODL sends the unsigned PCZT, Keystone signs and sends the whole PCZT back. the proof crosses the channel twice even though the signer never touches it there either.
questions for librustzcash / ZODL / Keystone developers
is anyone already working on a redact_zkproof_for_transport pattern? the pczt crate already exposes clear_zkproof() and clear_bsk() on the orchard redactor, so it kinda looks like the design anticipated this. do you see a reason to keep the proof in transit that we are not seeing (for non-multisig cases)?
multisig management
the FROST 2-of-3 air-gapped multisig flow continues to work on the existing path and is shown in the videos. we deliberately scoped the PCZT migration to single-signer first. FROST over PCZT needs a custom round protocol because the standard PCZT signer role is single-signer only, so that will be postponed for now.
as part of ZecHub’s hackathon we’ve been working on our first FROST-utilizing application, poker with mental shuffle, that for now will use end-to-end encrypted messaging over our hosted relay but is designed to be functional as pure peer-to-peer.
videos:
happy to answer technical questions in the thread or receive feedback in general.
as you might notice from demo videos, there are still some bugs here and there which we`re trying our best to iron out to have poker playable Zafu beta version released out for the voting(maybe, Chrome store releases can take weeks for extensions with host permissions). i have slightly more hesitation to hold back on releasing zigner since once its out and in use, we are locked into maintaining backwards compatibility.
