musig: rename Musig coefficient to KeyAgg coefficient

This is done to be consistent with the MuSig2 paper

src/modules/musig/main_impl.h

@@ -30,25 +30,25 @@ static int secp256k1_musig_compute_ell(const secp256k1_context *ctx, unsigned ch
 }
 
 /* Initializes SHA256 with fixed midstate. This midstate was computed by applying
- * SHA256 to SHA256("MuSig coefficient")||SHA256("MuSig coefficient"). */
+ * SHA256 to SHA256("KeyAgg coefficient")||SHA256("KeyAgg coefficient"). */
 static void secp256k1_musig_sha256_init_tagged(secp256k1_sha256 *sha) {
     secp256k1_sha256_initialize(sha);
 
-    sha->s[0] = 0x0fd0690cul;
-    sha->s[1] = 0xfefeae97ul;
-    sha->s[2] = 0x996eac7ful;
-    sha->s[3] = 0x5c30d864ul;
-    sha->s[4] = 0x8c4a0573ul;
-    sha->s[5] = 0xaca1a22ful;
-    sha->s[6] = 0x6f43b801ul;
-    sha->s[7] = 0x85ce27cdul;
+    sha->s[0] = 0x6ef02c5aul;
+    sha->s[1] = 0x06a480deul;
+    sha->s[2] = 0x1f298665ul;
+    sha->s[3] = 0x1d1134f2ul;
+    sha->s[4] = 0x56a0b063ul;
+    sha->s[5] = 0x52da4147ul;
+    sha->s[6] = 0xf280d9d4ul;
+    sha->s[7] = 0x4484be15ul;
     sha->bytes = 64;
 }
 
-/* Compute MuSig coefficient which is constant 1 for the second pubkey and
+/* Compute KeyAgg coefficient which is constant 1 for the second pubkey and
  * SHA256(ell, x) otherwise. second_pk_x can be NULL in case there is no
  * second_pk. Assumes both field elements x and second_pk_x are normalized. */
-static void secp256k1_musig_coefficient_internal(secp256k1_scalar *r, const unsigned char *ell, secp256k1_fe *x, const secp256k1_fe *second_pk_x) {
+static void secp256k1_musig_keyaggcoef_internal(secp256k1_scalar *r, const unsigned char *ell, secp256k1_fe *x, const secp256k1_fe *second_pk_x) {
     secp256k1_sha256 sha;
     unsigned char buf[32];
 
@@ -65,10 +65,10 @@ static void secp256k1_musig_coefficient_internal(secp256k1_scalar *r, const unsi
 }
 
 /* Assumes both field elements x and second_pk_x are normalized. */
-static void secp256k1_musig_coefficient(secp256k1_scalar *r, const secp256k1_musig_pre_session *pre_session, secp256k1_fe *x) {
+static void secp256k1_musig_keyaggcoef(secp256k1_scalar *r, const secp256k1_musig_pre_session *pre_session, secp256k1_fe *x) {
     secp256k1_fe second_pk_x;
     secp256k1_fe_set_b32(&second_pk_x, pre_session->second_pk);
-    secp256k1_musig_coefficient_internal(r, pre_session->pk_hash, x, &second_pk_x);
+    secp256k1_musig_keyaggcoef_internal(r, pre_session->pk_hash, x, &second_pk_x);
 }
 
 typedef struct {
@@ -84,7 +84,7 @@ static int secp256k1_musig_pubkey_combine_callback(secp256k1_scalar *sc, secp256
     if (!secp256k1_xonly_pubkey_load(ctx->ctx, pt, &ctx->pks[idx])) {
         return 0;
     }
-    secp256k1_musig_coefficient_internal(sc, ctx->ell, &pt->x, &ctx->second_pk_x);
+    secp256k1_musig_keyaggcoef_internal(sc, ctx->ell, &pt->x, &ctx->second_pk_x);
     return 1;
 }
 
@@ -224,7 +224,7 @@ int secp256k1_musig_session_init(const secp256k1_context* ctx, secp256k1_musig_s
     secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pj, &secret);
     secp256k1_ge_set_gej(&p, &pj);
     secp256k1_fe_normalize_var(&p.x);
-    secp256k1_musig_coefficient(&mu, &session->pre_session, &p.x);
+    secp256k1_musig_keyaggcoef(&mu, &session->pre_session, &p.x);
     /* Compute the signer's public key point and determine if the secret is
      * negated before signing. That happens if if the signer's pubkey has an odd
      * Y coordinate XOR the MuSig-combined pubkey has an odd Y coordinate XOR
@@ -233,7 +233,7 @@ int secp256k1_musig_session_init(const secp256k1_context* ctx, secp256k1_musig_s
      * This can be seen by looking at the secret key belonging to `combined_pk`.
      * Let's define
      * P' := mu_0*|P_0| + ... + mu_n*|P_n| where P_i is the i-th public key
-     * point x_i*G, mu_i is the i-th musig coefficient and |.| is a function
+     * point x_i*G, mu_i is the i-th KeyAgg coefficient and |.| is a function
      * that normalizes a point to an even Y by negating if necessary similar to
      * secp256k1_extrakeys_ge_even_y. Then we have
      * P := |P'| + t*G where t is the tweak.
@@ -615,10 +615,10 @@ int secp256k1_musig_partial_sig_verify(const secp256k1_context* ctx, const secp2
     if (!secp256k1_xonly_pubkey_load(ctx, &pkp, pubkey)) {
         return 0;
     }
-    /* Multiplying the messagehash by the musig coefficient is equivalent
+    /* Multiplying the messagehash by the KeyAgg coefficient is equivalent
      * to multiplying the signer's public key by the coefficient, except
      * much easier to do. */
-    secp256k1_musig_coefficient(&mu, &session->pre_session, &pkp.x);
+    secp256k1_musig_keyaggcoef(&mu, &session->pre_session, &pkp.x);
     secp256k1_scalar_mul(&e, &e, &mu);
 
     if (!secp256k1_xonly_pubkey_load(ctx, &rp, &signer->nonce)) {

src/modules/musig/tests_impl.h

@@ -829,17 +829,17 @@ void scriptless_atomic_swap(secp256k1_scratch_space *scratch) {
 /* Checks that hash initialized by secp256k1_musig_sha256_init_tagged has the
  * expected state. */
 void sha256_tag_test(void) {
-    char tag[17] = "MuSig coefficient";
+    char tag[18] = "KeyAgg coefficient";
     secp256k1_sha256 sha;
     secp256k1_sha256 sha_tagged;
     unsigned char buf[32];
     unsigned char buf2[32];
     size_t i;
 
     secp256k1_sha256_initialize(&sha);
-    secp256k1_sha256_write(&sha, (unsigned char *) tag, 17);
+    secp256k1_sha256_write(&sha, (unsigned char *) tag, sizeof(tag));
     secp256k1_sha256_finalize(&sha, buf);
-    /* buf = SHA256("MuSig coefficient") */
+    /* buf = SHA256("KeyAgg coefficient") */
 
     secp256k1_sha256_initialize(&sha);
     secp256k1_sha256_write(&sha, buf, 32);
@@ -1012,28 +1012,28 @@ void musig_test_vectors(void) {
     };
     const unsigned char combined_pk_expected[4][32] = {
         { /* 0 */
-            0xF1, 0x94, 0x7D, 0x65, 0x53, 0x3A, 0x1D, 0x9E,
-            0x46, 0xDD, 0x16, 0x60, 0x3C, 0x95, 0x04, 0x66,
-            0x34, 0x31, 0xDC, 0x7E, 0xF8, 0x3B, 0x64, 0xC9,
-            0xD5, 0x1C, 0xE6, 0x71, 0x8E, 0x6E, 0x57, 0x1C,
+            0xEA, 0x06, 0x7B, 0x01, 0x67, 0x24, 0x5A, 0x6F,
+            0xED, 0xB1, 0xB1, 0x22, 0xBB, 0x03, 0xAB, 0x7E,
+            0x5D, 0x48, 0x6C, 0x81, 0x83, 0x42, 0xE0, 0xE9,
+            0xB6, 0x41, 0x79, 0xAD, 0x32, 0x8D, 0x9D, 0x19,
         },
         { /* 1 */
-            0xA5, 0x1C, 0x71, 0x3F, 0xD4, 0xC3, 0x29, 0xCD,
-            0x6D, 0x35, 0x69, 0xBC, 0x36, 0x67, 0xE4, 0x9A,
-            0xC6, 0xD4, 0x75, 0x4E, 0xC2, 0x66, 0x25, 0xED,
-            0x12, 0x2B, 0x24, 0x28, 0x40, 0x57, 0xC9, 0xD4,
+            0x14, 0xE1, 0xF8, 0x3E, 0x9E, 0x25, 0x60, 0xFB,
+            0x2A, 0x6C, 0x04, 0x24, 0x55, 0x6C, 0x86, 0x8D,
+            0x9F, 0xB4, 0x63, 0x35, 0xD4, 0xF7, 0x8D, 0x22,
+            0x7D, 0x5D, 0x1D, 0x3C, 0x89, 0x90, 0x6F, 0x1E,
         },
         { /* 2 */
-            0xA0, 0xFD, 0x5D, 0x2F, 0xCC, 0x4F, 0x90, 0xDF,
-            0x42, 0xD4, 0x26, 0x38, 0x31, 0x73, 0x0B, 0x21,
-            0xC4, 0xAB, 0x0E, 0xFA, 0xD2, 0x09, 0x10, 0xD0,
-            0x07, 0xED, 0xCB, 0x69, 0x1D, 0xD5, 0xD1, 0x82,
+            0x70, 0x28, 0x8D, 0xF2, 0xB7, 0x60, 0x3D, 0xBE,
+            0xA0, 0xC7, 0xB7, 0x41, 0xDD, 0xAA, 0xB9, 0x46,
+            0x81, 0x14, 0x4E, 0x0B, 0x19, 0x08, 0x6C, 0x69,
+            0xB2, 0x34, 0x89, 0xE4, 0xF5, 0xB7, 0x01, 0x9A,
         },
         { /* 3 */
-            0x2E, 0x58, 0x3B, 0x3C, 0x30, 0x8B, 0x14, 0x28,
-            0x81, 0x36, 0x57, 0x9B, 0x3A, 0x63, 0xDB, 0x71,
-            0x82, 0xB0, 0xFB, 0xE6, 0xE4, 0x25, 0xE7, 0xD0,
-            0x30, 0x68, 0xC5, 0x9C, 0xFC, 0xAD, 0x12, 0xF3,
+            0x93, 0xEE, 0xD8, 0x24, 0xF2, 0x3C, 0x5A, 0xE1,
+            0xC1, 0x05, 0xE7, 0x31, 0x09, 0x97, 0x3F, 0xCD,
+            0x4A, 0xE3, 0x3A, 0x9F, 0xA0, 0x2F, 0x0A, 0xC8,
+            0x5A, 0x3E, 0x55, 0x89, 0x07, 0x53, 0xB0, 0x67,
         },
     };