mirror of
				https://source.quilibrium.com/quilibrium/ceremonyclient.git
				synced 2025-11-04 11:17:28 +00:00 
			
		
		
		
	
		
			
				
	
	
		
			187 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			187 lines
		
	
	
		
			6.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
//
 | 
						|
// Copyright Coinbase, Inc. All Rights Reserved.
 | 
						|
//
 | 
						|
// SPDX-License-Identifier: Apache-2.0
 | 
						|
//
 | 
						|
 | 
						|
// This file implements the key refresh protocol of [DKLs18](https://eprint.iacr.org/2018/499.pdf).
 | 
						|
// The key refresh protocol is defined as follows:
 | 
						|
// 1. Key Share:
 | 
						|
//   1.1. alice generates k_A <-- F_q; writes it to merlin transcript. sends it to bob.
 | 
						|
//   1.2. bob receives k_A and writes it to merlin transcript. generates k_B <-- F_q and writes it to merlin transcript. reads k out of merlin transcript. overwrites sk_B *= k. sends k_B to Alice.
 | 
						|
//   1.3. alice writes k_B to merlin transcript. reads k from it. overwrites sk_A *= k^{-1}.
 | 
						|
// 2. OT: Redo OT (as it is done in the DKG)
 | 
						|
package refresh
 | 
						|
 | 
						|
import (
 | 
						|
	"crypto/rand"
 | 
						|
 | 
						|
	"github.com/gtank/merlin"
 | 
						|
	"github.com/pkg/errors"
 | 
						|
 | 
						|
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
 | 
						|
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/base/simplest"
 | 
						|
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
 | 
						|
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/zkp/schnorr"
 | 
						|
)
 | 
						|
 | 
						|
// Alice struct encoding Alice's state during one execution of the overall signing algorithm.
 | 
						|
// At the end of the joint computation, Alice will NOT obtain the signature.
 | 
						|
type Alice struct {
 | 
						|
	kappa int
 | 
						|
	s     int
 | 
						|
 | 
						|
	// receiver is the base OT receiver.
 | 
						|
	receiver *simplest.Receiver
 | 
						|
 | 
						|
	// secretKeyShare is Alice's secret key for the joint public key.
 | 
						|
	secretKeyShare curves.Scalar
 | 
						|
 | 
						|
	// publicKey is the joint public key of Alice and Bob.
 | 
						|
	publicKey curves.Point
 | 
						|
 | 
						|
	curve *curves.Curve
 | 
						|
 | 
						|
	transcript *merlin.Transcript
 | 
						|
}
 | 
						|
 | 
						|
// Bob struct encoding Bob's state during one execution of the overall signing algorithm.
 | 
						|
// At the end of the joint computation, Bob will obtain the signature.
 | 
						|
type Bob struct {
 | 
						|
	kappa int
 | 
						|
	s     int
 | 
						|
 | 
						|
	// sender is the base OT sender.
 | 
						|
	sender *simplest.Sender
 | 
						|
 | 
						|
	// secretKeyShare is Bob's secret key for the joint public key.
 | 
						|
	secretKeyShare curves.Scalar
 | 
						|
 | 
						|
	// publicKey is the joint public key of Alice and Bob.
 | 
						|
	publicKey curves.Point
 | 
						|
 | 
						|
	curve *curves.Curve
 | 
						|
 | 
						|
	transcript *merlin.Transcript
 | 
						|
}
 | 
						|
 | 
						|
type RefreshRound2Output struct {
 | 
						|
	SeedOTRound1Output *schnorr.Proof
 | 
						|
	BobMultiplier      curves.Scalar
 | 
						|
}
 | 
						|
 | 
						|
// NewAliceRefresh creates a party that can participate in 2-of-2 key refresh.
 | 
						|
func NewAlice(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.AliceOutput) *Alice {
 | 
						|
	return &Alice{
 | 
						|
		kappa:          kappa,
 | 
						|
		s:              s,
 | 
						|
		curve:          curve,
 | 
						|
		secretKeyShare: dkgOutput.SecretKeyShare,
 | 
						|
		publicKey:      dkgOutput.PublicKey,
 | 
						|
		transcript:     merlin.NewTranscript("Coinbase_DKLs_Refresh"),
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
// NewBobRefresh creates a party that can participate in 2-of-2 key refresh.
 | 
						|
func NewBob(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.BobOutput) *Bob {
 | 
						|
	return &Bob{
 | 
						|
		kappa:          kappa,
 | 
						|
		s:              s,
 | 
						|
		curve:          curve,
 | 
						|
		secretKeyShare: dkgOutput.SecretKeyShare,
 | 
						|
		publicKey:      dkgOutput.PublicKey,
 | 
						|
		transcript:     merlin.NewTranscript("Coinbase_DKLs_Refresh"),
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
func (alice *Alice) Round1RefreshGenerateSeed() curves.Scalar {
 | 
						|
	refreshSeed := alice.curve.Scalar.Random(rand.Reader)
 | 
						|
	alice.transcript.AppendMessage([]byte("alice refresh seed"), refreshSeed.Bytes())
 | 
						|
	return refreshSeed
 | 
						|
}
 | 
						|
 | 
						|
func (bob *Bob) Round2RefreshProduceSeedAndMultiplyAndStartOT(aliceSeed curves.Scalar) (*RefreshRound2Output, error) {
 | 
						|
	bob.transcript.AppendMessage([]byte("alice refresh seed"), aliceSeed.Bytes())
 | 
						|
	bobSeed := bob.curve.Scalar.Random(rand.Reader)
 | 
						|
	bob.transcript.AppendMessage([]byte("bob refresh seed"), bobSeed.Bytes())
 | 
						|
	k, err := bob.curve.NewScalar().SetBytes(
 | 
						|
		bob.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
 | 
						|
	)
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
 | 
						|
	}
 | 
						|
	bob.secretKeyShare = bob.secretKeyShare.Mul(k)
 | 
						|
 | 
						|
	uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
 | 
						|
	copy(uniqueSessionId[:], bob.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
 | 
						|
	bob.sender, err = simplest.NewSender(bob.curve, bob.kappa, uniqueSessionId)
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "bob constructing new OT sender in refresh round 2")
 | 
						|
	}
 | 
						|
	seedOTRound1Output, err := bob.sender.Round1ComputeAndZkpToPublicKey()
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "bob computing round 1 of seed OT within refresh round 2")
 | 
						|
	}
 | 
						|
 | 
						|
	return &RefreshRound2Output{
 | 
						|
		SeedOTRound1Output: seedOTRound1Output,
 | 
						|
		BobMultiplier:      bobSeed,
 | 
						|
	}, nil
 | 
						|
}
 | 
						|
 | 
						|
func (alice *Alice) Round3RefreshMultiplyRound2Ot(input *RefreshRound2Output) ([]simplest.ReceiversMaskedChoices, error) {
 | 
						|
	alice.transcript.AppendMessage([]byte("bob refresh seed"), input.BobMultiplier.Bytes())
 | 
						|
	k, err := alice.curve.NewScalar().SetBytes(
 | 
						|
		alice.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
 | 
						|
	)
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
 | 
						|
	}
 | 
						|
	kInverse, err := k.Invert()
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "couldn't produce k inverse (alice's secret key share)")
 | 
						|
	}
 | 
						|
	alice.secretKeyShare = alice.secretKeyShare.Mul(kInverse)
 | 
						|
 | 
						|
	uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
 | 
						|
	copy(uniqueSessionId[:], alice.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
 | 
						|
	alice.receiver, err = simplest.NewReceiver(alice.curve, alice.kappa, uniqueSessionId)
 | 
						|
	if err != nil {
 | 
						|
		return nil, errors.Wrap(err, "couldn't construct OT receiver")
 | 
						|
	}
 | 
						|
 | 
						|
	return alice.receiver.Round2VerifySchnorrAndPadTransfer(input.SeedOTRound1Output)
 | 
						|
}
 | 
						|
 | 
						|
func (bob *Bob) Round4RefreshRound3Ot(compressedReceiversMaskedChoice []simplest.ReceiversMaskedChoices) ([]simplest.OtChallenge, error) {
 | 
						|
	return bob.sender.Round3PadTransfer(compressedReceiversMaskedChoice)
 | 
						|
}
 | 
						|
 | 
						|
func (alice *Alice) Round5RefreshRound4Ot(challenge []simplest.OtChallenge) ([]simplest.OtChallengeResponse, error) {
 | 
						|
	return alice.receiver.Round4RespondToChallenge(challenge)
 | 
						|
}
 | 
						|
 | 
						|
func (bob *Bob) Round6RefreshRound5Ot(challengeResponses []simplest.OtChallengeResponse) ([]simplest.ChallengeOpening, error) {
 | 
						|
	return bob.sender.Round5Verify(challengeResponses)
 | 
						|
}
 | 
						|
 | 
						|
func (alice *Alice) Round7DkgRound6Ot(challengeOpenings []simplest.ChallengeOpening) error {
 | 
						|
	return alice.receiver.Round6Verify(challengeOpenings)
 | 
						|
}
 | 
						|
 | 
						|
func (alice *Alice) Output() *dkg.AliceOutput {
 | 
						|
	return &dkg.AliceOutput{
 | 
						|
		PublicKey:      alice.publicKey,
 | 
						|
		SecretKeyShare: alice.secretKeyShare,
 | 
						|
		SeedOtResult:   alice.receiver.Output,
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
func (bob *Bob) Output() *dkg.BobOutput {
 | 
						|
	return &dkg.BobOutput{
 | 
						|
		PublicKey:      bob.publicKey,
 | 
						|
		SecretKeyShare: bob.secretKeyShare,
 | 
						|
		SeedOtResult:   bob.sender.Output,
 | 
						|
	}
 | 
						|
}
 |