FROST-secp256k1 / Taproot Ciphersuite
FROST threshold signature ciphersuite over secp256k1 with BIP-340/341 Taproot binding (RFC 9591 §6.5), used for Bitcoin bridge custody on M-Chain.
Implementation status (code-audited 2026-07-03): SHIPPED KeygenTaproot/SignTaproot over Secp256k1 with BIP-340 x-only output (threshold/protocols/frost/frost.go:58,128).
Provenance
Originally LP-7320, renumbered 2026-05-18 to consolidate all cryptographic primitives into the 4xxx range with family sub-ranges (threshold + MPC primitives 4700-4799; FROST ciphersuites at 4711/4712). The 7320 slot is retained as a permanent pointer to this LP.
Abstract
FROST-secp256k1 is the FROST (Flexible Round-Optimized Schnorr Threshold) ciphersuite over secp256k1 with BIP-340 (Schnorr signatures for secp256k1) and BIP-341 (Taproot) binding, as standardized in IETF RFC 9591 §6.5. This LP pins the ciphersuite identifier, the SHA-256 challenge hash with BIP-340 tagged-hash domain separation tags, the x-only public-key encoding, the even-Y normalization rule, the Taproot output-key tweak protocol (MAST root commitment), and the implementation pointer; the underlying FROST protocol is defined in LP-7321. Output signatures are 64-byte BIP-340 Schnorr signatures verifiable by any standard Bitcoin Taproot consensus implementation, with no threshold-aware code required on the Bitcoin side. Use FROST-secp256k1 for Bitcoin bridge custody on M-Chain (LP-7100) and for any Lux EVM consumer preferring Schnorr/Taproot over CGGMP21 ECDSA (LP-7322).
Reference implementation
- Primitive:
luxfi/threshold/frost/secp256k1 - Verification: standard BIP-340 Schnorr verifier (or LP-3666 secp256k1)
- Chain home: LP-7100 (M-Chain)
- Taproot tweak: BIP-341
- Test vectors: RFC 9591 §6.5 + BIP-340 test vectors
Copyright
Copyright and related rights waived via CC0.