Cite CFRG sigma-protocols and Fiat-Shamir drafts as alignment references

The composite layer shares their shapes — commit/challenge/response phases,
labeled prefix-free single-squeeze transcript — but is not an instantiation:
AND composition is out of their scope, challenge derivation stays in the BBS
hash_to_scalar family (one derivation path), and only P-256 is normative.
Recorded in the draft (informative references), README, and REFERENCES.md.

Author: tmarkovski

README.md

@@ -75,6 +75,14 @@ The standards boundary is intentional:
 
 The draft is a reviewable description of the construction, not a standards-track proposal. It
 covers the composite presentation and predicate layers and summarizes the JSON-LD integration.
+It is structurally aligned with CFRG's emerging sigma-protocol work
+([draft-irtf-cfrg-sigma-protocols](https://datatracker.ietf.org/doc/draft-irtf-cfrg-sigma-protocols/),
+[draft-irtf-cfrg-fiat-shamir](https://datatracker.ietf.org/doc/draft-irtf-cfrg-fiat-shamir/)) —
+the same commit/challenge/response phases and the same labeled, single-squeeze transcript
+discipline — and cites both as informative references. It is not an instantiation of them:
+AND composition of statements is explicitly out of scope of those drafts, and challenge
+derivation stays in the BBS `hash_to_scalar` family so the BBS and composite layers share one
+derivation path.
 
 ## Getting started
 

docs/REFERENCES.md

@@ -21,6 +21,23 @@ convenience, not authoritative.
 `draft-irtf-cfrg-bbs-signatures` (currently -10) plus tooling. The base scheme our blind
 extension sits on. Also ships fixtures.
 
+### `draft-irtf-cfrg-sigma-protocols` + `draft-irtf-cfrg-fiat-shamir` — alignment, not adoption
+CFRG's generic sigma-protocol framework and its Fiat-Shamir companion, both Informational -02
+(March 2026). Cited as informative references in `draft-credkit-composite-proofs`. We match
+their shapes: the split-phase proof API is their `prover_commit`/`prover_response`
+decomposition, and our transcript enforces the same labeled prefix-free absorption /
+one-squeeze discipline the FS draft mandates.
+
+**Do not adopt their bytes.** Three hard blockers, re-verified July 2026: (1) AND composition —
+our entire composite layer — is explicitly out of scope of sigma-protocols ("NOT described in
+this specification"); (2) the FS draft mandates a Keccak/SHAKE duplex sponge with mod-p
+challenge reduction, a different derivation family than BBS `hash_to_scalar` — adopting it in
+the composite layer while the BBS layer keeps `hash_to_scalar` for fixture conformance would be
+the two-path Fiat-Shamir fork FINDINGS §11 refuses; (3) only P-256 is normative (BLS12-381
+appears in test-vector names only), and pairing equations / GT commitments are outside its
+linear-map scope. Re-check if the drafts grow BLS12-381 ciphersuites and composition — that
+would be the moment to re-align the transcript.
+
 ### `w3c/vc-di-bbs` — the W3C cryptosuite (structure donor, not a compliance target)
 [Data Integrity BBS Cryptosuites v1.0](https://www.w3.org/TR/vc-di-bbs/), **Candidate
 Recommendation Draft, 7 April 2026** — no longer the 2023 WD the incumbent stack implements.

docs/draft-credkit-composite-proofs.html

@@ -1631,6 +1631,27 @@ <h3 id="name-relationship-to-existing-sp">
 generation algorithm's per-message Schnorr blindings so an outer protocol can reuse them. Both
 are described precisely in <a href="#divergences-from-ietf-bbs" class="auto internal xref">Section 3</a>. Everything else in that layer is the
 IETF construction as written.<a href="#section-1.2-3" class="pilcrow">¶</a></p>
+<p id="section-1.2-4">Two adjacent CFRG efforts deserve precise situating. <span>[<a href="#I-D.irtf-cfrg-sigma-protocols" class="cite xref">I-D.irtf-cfrg-sigma-protocols</a>]</span>
+standardizes interactive sigma protocols proving knowledge of preimages of linear maps in
+prime-order groups, and <span>[<a href="#I-D.irtf-cfrg-fiat-shamir" class="cite xref">I-D.irtf-cfrg-fiat-shamir</a>]</span> standardizes their non-interactive form
+via a duplex-sponge transcript. This document is structurally aligned with both: each statement
+is proven in the same commit/challenge/response phases (the split-phase interface of
+<a href="#reachable-schnorr-blindings-and-split-phase-proof-generation" class="auto internal xref">Section 3.2</a> is that draft's
+<code>prover_commit</code>/<code>prover_response</code> decomposition), and the transcript of
+<a href="#the-merged-fiat-shamir-transcript" class="auto internal xref">Section 4</a> enforces the same discipline — labeled prefix-free
+absorption, protocol and ciphersuite binding, and exactly one challenge per transcript. This
+document is not, however, an instantiation of either draft, for three reasons. First, AND
+composition of statements under one challenge — the mechanism this document exists to describe —
+is explicitly out of scope of <span>[<a href="#I-D.irtf-cfrg-sigma-protocols" class="cite xref">I-D.irtf-cfrg-sigma-protocols</a>]</span>. Second, challenge derivation
+here stays in the BBS <code>hash_to_scalar</code> family rather than adopting the Keccak duplex sponge of
+<span>[<a href="#I-D.irtf-cfrg-fiat-shamir" class="cite xref">I-D.irtf-cfrg-fiat-shamir</a>]</span>: the BBS layer must derive challenges with <code>hash_to_scalar</code> to
+conform to <span>[<a href="#I-D.irtf-cfrg-bbs-signatures" class="cite xref">I-D.irtf-cfrg-bbs-signatures</a>]</span>, and running a second derivation primitive in the
+composite layer would be exactly the two-path Fiat-Shamir fork that <a href="#one-challenge" class="auto internal xref">Section 4.5</a> exists to
+prevent. Third, <span>[<a href="#I-D.irtf-cfrg-sigma-protocols" class="cite xref">I-D.irtf-cfrg-sigma-protocols</a>]</span> currently defines only P-256 normatively, and
+neither the BBS pairing verification equation nor the <code>GT</code>-valued predicate commitments of
+<a href="#predicates-over-hidden-messages" class="auto internal xref">Section 6</a> fall within its linear-map scope. Should those drafts mature
+to cover BLS12-381 and statement composition, re-aligning this layer's transcript with them is a
+natural future revision.<a href="#section-1.2-4" class="pilcrow">¶</a></p>
 </section>
 </div>
 <div id="terminology">
@@ -1889,6 +1910,11 @@ <h2 id="name-the-merged-fiat-shamir-tran">
 place where an ad-hoc <code>H(a || b || c)</code> concatenation would let a malicious Prover shift octets
 between fields and forge a proof over a different statement that hashes identically — the
 "Frozen Heart" bug class <span>[<a href="#FrozenHeart" class="cite xref">FrozenHeart</a>]</span>. The rules below exist to make that impossible.<a href="#section-4-1" class="pilcrow">¶</a></p>
+<p id="section-4-2">The construction follows the same transcript discipline as <span>[<a href="#I-D.irtf-cfrg-fiat-shamir" class="cite xref">I-D.irtf-cfrg-fiat-shamir</a>]</span> —
+labeled prefix-free absorption, initial protocol binding, one squeeze — but derives the
+challenge with the BBS <code>hash_to_scalar</code> rather than that draft's Keccak duplex sponge, keeping a
+single challenge-derivation primitive across the BBS and composite layers (see
+<a href="#relationship-to-existing-specifications" class="auto internal xref">Section 1.2</a>).<a href="#section-4-2" class="pilcrow">¶</a></p>
 <div id="absorption">
 <section id="section-4.1">
         <h3 id="name-absorption">
@@ -2597,6 +2623,14 @@ <h3 id="name-informative-references">
         <dd>
 <span class="refAuthor">Trail of Bits</span>, <span class="refTitle">"The Frozen Heart vulnerability in Fiat-Shamir implementations"</span>, <time datetime="2022" class="refDate">2022</time>, <span>&lt;<a href="https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/">https://blog.trailofbits.com/2022/04/13/part-1-coordinated-disclosure-of-vulnerabilities-affecting-girault-bulletproofs-and-plonk/</a>&gt;</span>. </dd>
 <dd class="break"></dd>
+<dt id="I-D.irtf-cfrg-fiat-shamir">[I-D.irtf-cfrg-fiat-shamir]</dt>
+        <dd>
+<span class="refAuthor">Orrù, M.</span>, <span class="refTitle">"Fiat-Shamir Transformation"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-irtf-cfrg-fiat-shamir-02</span>, <time datetime="2026-03-02" class="refDate">2 March 2026</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-fiat-shamir-02">https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-fiat-shamir-02</a>&gt;</span>. </dd>
+<dd class="break"></dd>
+<dt id="I-D.irtf-cfrg-sigma-protocols">[I-D.irtf-cfrg-sigma-protocols]</dt>
+        <dd>
+<span class="refAuthor">Orrù, M.</span> and <span class="refAuthor">C. Yun</span>, <span class="refTitle">"Interactive Sigma Proofs"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-irtf-cfrg-sigma-protocols-02</span>, <time datetime="2026-03-02" class="refDate">2 March 2026</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-sigma-protocols-02">https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-sigma-protocols-02</a>&gt;</span>. </dd>
+<dd class="break"></dd>
 <dt id="RFC2119">[RFC2119]</dt>
         <dd>
 <span class="refAuthor">Bradner, S.</span>, <span class="refTitle">"Key words for use in RFCs to Indicate Requirement Levels"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 2119</span>, <span class="seriesInfo">DOI 10.17487/RFC2119</span>, <time datetime="1997-03" class="refDate">March 1997</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc2119">https://www.rfc-editor.org/info/rfc2119</a>&gt;</span>. </dd>

docs/draft-credkit-composite-proofs.md

@@ -118,6 +118,28 @@ generation algorithm's per-message Schnorr blindings so an outer protocol can re
 are described precisely in (#divergences-from-ietf-bbs). Everything else in that layer is the
 IETF construction as written.
 
+Two adjacent CFRG efforts deserve precise situating. [@?I-D.irtf-cfrg-sigma-protocols]
+standardizes interactive sigma protocols proving knowledge of preimages of linear maps in
+prime-order groups, and [@?I-D.irtf-cfrg-fiat-shamir] standardizes their non-interactive form
+via a duplex-sponge transcript. This document is structurally aligned with both: each statement
+is proven in the same commit/challenge/response phases (the split-phase interface of
+(#reachable-schnorr-blindings-and-split-phase-proof-generation) is that draft's
+`prover_commit`/`prover_response` decomposition), and the transcript of
+(#the-merged-fiat-shamir-transcript) enforces the same discipline — labeled prefix-free
+absorption, protocol and ciphersuite binding, and exactly one challenge per transcript. This
+document is not, however, an instantiation of either draft, for three reasons. First, AND
+composition of statements under one challenge — the mechanism this document exists to describe —
+is explicitly out of scope of [@?I-D.irtf-cfrg-sigma-protocols]. Second, challenge derivation
+here stays in the BBS `hash_to_scalar` family rather than adopting the Keccak duplex sponge of
+[@?I-D.irtf-cfrg-fiat-shamir]: the BBS layer must derive challenges with `hash_to_scalar` to
+conform to [@!I-D.irtf-cfrg-bbs-signatures], and running a second derivation primitive in the
+composite layer would be exactly the two-path Fiat-Shamir fork that (#one-challenge) exists to
+prevent. Third, [@?I-D.irtf-cfrg-sigma-protocols] currently defines only P-256 normatively, and
+neither the BBS pairing verification equation nor the `GT`-valued predicate commitments of
+(#predicates-over-hidden-messages) fall within its linear-map scope. Should those drafts mature
+to cover BLS12-381 and statement composition, re-aligning this layer's transcript with them is a
+natural future revision.
+
 ## Terminology
 
 Holder, Issuer, Verifier, Prover, and the BBS operation names (`Sign`, `Commit`, `BlindSign`,
@@ -300,6 +322,12 @@ place where an ad-hoc `H(a || b || c)` concatenation would let a malicious Prove
 between fields and forge a proof over a different statement that hashes identically — the
 "Frozen Heart" bug class [@FrozenHeart]. The rules below exist to make that impossible.
 
+The construction follows the same transcript discipline as [@?I-D.irtf-cfrg-fiat-shamir] —
+labeled prefix-free absorption, initial protocol binding, one squeeze — but derives the
+challenge with the BBS `hash_to_scalar` rather than that draft's Keccak duplex sponge, keeping a
+single challenge-derivation primitive across the BBS and composite layers (see
+(#relationship-to-existing-specifications)).
+
 ## Absorption
 
 The transcript accumulates labeled, length-framed entries. Absorbing a labeled value appends: