syntax = "proto3"; package quilibrium.node.ceremony.pb; option go_package = "source.quilibrium.com/quilibrium/monorepo/node/protobufs"; import "keys.proto"; // Describes the transcript of KZG ceremony execution message CeremonyTranscript { // The active collection of powers over G1 repeated quilibrium.node.keys.pb.BLS48581G1PublicKey g1_powers = 1; // The active collection of powers over G2 repeated quilibrium.node.keys.pb.BLS48581G2PublicKey g2_powers = 2; // The running s^256 G1 witnesses – the choice of the 256th power is to ensure // combinatorial birthday paradox-based attacks are not possible. In common // KZG ceremonies, the collection of witnesses to PoT pubkeys produce the // relationship of e(w*G1, s*G2) == (s'*G1, G2), where w*s == s'. The problem // with this is that there are n powers under G2 (excl. the case where PoT // ceremonies _only_ have the first G2 power), and so the chance of collision // by combination to a target value for s' is feasible such that a sum of a // permutation of valid G2 powers could forge witness values to reach a // a desired outcome, as there are matching pairs of the G1 and G2 powers to // permute. When the number of G2 powers is low, or one, this reduces to the // discrete log assumption and so the only viable attack is of // O(sqrt()) per Pollard's Rho (barring any advancements), but in // many cases the number of G2 powers is high enough such that n! naive // combinations of additions are greater (and cheap, since the additions are // first tested in G1) than the required time of testing the discrete log, // and combined with many generated target values, significantly reduces the // amount of time required to complete the attack. This means that in // traditional KZG ceremonies, the last contributor to a ceremony can // potentially control the secret. Or, we can just track the witnesses to the // highest power in the ceremony and avoid the whole problem. :) repeated quilibrium.node.keys.pb.BLS48581G1PublicKey running_g1_256_witnesses = 3; // The running s^256 G2 powers – see notes on running_g1_256_witnesses for why // we do this. repeated quilibrium.node.keys.pb.BLS48581G2PublicKey running_g2_256_powers = 4; }