ceremonyclient/nekryptology/pkg/tecdsa/dkls/v1/refresh/refresh_test.go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//

package refresh_test

import (
	"fmt"
	"testing"

	"github.com/stretchr/testify/require"
	"golang.org/x/crypto/sha3"

	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/refresh"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/sign"
)

func performDKG(t *testing.T, curve *curves.Curve) (*dkg.Alice, *dkg.Bob) {
	t.Helper()

	alice := dkg.NewAlice(256, 80, curve)
	bob := dkg.NewBob(256, 80, curve)

	seed, err := bob.Round1GenerateRandomSeed()
	require.NoError(t, err)
	round3Output, err := alice.Round2CommitToProof(seed)
	require.NoError(t, err)
	proof, err := bob.Round3SchnorrProve(round3Output)
	require.NoError(t, err)
	proof, err = alice.Round4VerifyAndReveal(proof)
	require.NoError(t, err)
	proof, err = bob.Round5DecommitmentAndStartOt(proof)
	require.NoError(t, err)
	compressedReceiversMaskedChoice, err := alice.Round6DkgRound2Ot(proof)
	require.NoError(t, err)
	challenge, err := bob.Round7DkgRound3Ot(compressedReceiversMaskedChoice)
	require.NoError(t, err)
	challengeResponse, err := alice.Round8DkgRound4Ot(challenge)
	require.NoError(t, err)
	challengeOpenings, err := bob.Round9DkgRound5Ot(challengeResponse)
	require.NoError(t, err)
	err = alice.Round10DkgRound6Ot(challengeOpenings)
	require.NoError(t, err)

	return alice, bob
}

func performRefresh(t *testing.T, curve *curves.Curve, aliceSecretKeyShare, bobSecretKeyShare curves.Scalar) (*refresh.Alice, *refresh.Bob) {
	t.Helper()
	alice := refresh.NewAlice(256, 80, curve, &dkg.AliceOutput{SecretKeyShare: aliceSecretKeyShare})
	bob := refresh.NewBob(256, 80, curve, &dkg.BobOutput{SecretKeyShare: bobSecretKeyShare})

	round1Output := alice.Round1RefreshGenerateSeed()
	require.False(t, round1Output.IsZero())
	round2Output, err := bob.Round2RefreshProduceSeedAndMultiplyAndStartOT(round1Output)
	require.NoError(t, err)
	round3Output, err := alice.Round3RefreshMultiplyRound2Ot(round2Output)
	require.NoError(t, err)
	round4Output, err := bob.Round4RefreshRound3Ot(round3Output)
	require.NoError(t, err)
	round5Output, err := alice.Round5RefreshRound4Ot(round4Output)
	require.NoError(t, err)
	round6Output, err := bob.Round6RefreshRound5Ot(round5Output)
	require.NoError(t, err)
	err = alice.Round7DkgRound6Ot(round6Output)
	require.NoError(t, err)
	return alice, bob
}

func Test_RefreshLeadsToTheSamePublicKeyButDifferentPrivateMaterial(t *testing.T) {
	t.Parallel()
	curveInstances := []*curves.Curve{
		curves.K256(),
		curves.P256(),
	}
	for _, curve := range curveInstances {
		boundCurve := curve
		t.Run(fmt.Sprintf("testing refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
			tt.Parallel()
			alice, bob := performDKG(tt, boundCurve)

			publicKey := alice.Output().PublicKey
			require.True(tt, publicKey.Equal(bob.Output().PublicKey))

			aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)

			require.NotEqual(tt, aliceRefreshed.Output().SecretKeyShare, alice.Output().SecretKeyShare)
			require.NotEqual(tt, bobRefreshed.Output().SeedOtResult, bob.Output().SecretKeyShare)
			require.NotEqualValues(
				tt,
				aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey,
				alice.Output().SeedOtResult.OneTimePadDecryptionKey,
			)
			require.NotEqualValues(
				tt,
				aliceRefreshed.Output().SeedOtResult.PackedRandomChoiceBits,
				alice.Output().SeedOtResult.PackedRandomChoiceBits,
			)
			require.NotEqualValues(
				tt,
				aliceRefreshed.Output().SeedOtResult.RandomChoiceBits,
				alice.Output().SeedOtResult.RandomChoiceBits,
			)
			require.NotEqualValues(
				tt,
				bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys,
				bob.Output().SeedOtResult.OneTimePadEncryptionKeys,
			)

			pkA := boundCurve.ScalarBaseMult(aliceRefreshed.Output().SecretKeyShare)
			computedPublicKeyA := pkA.Mul(bobRefreshed.Output().SecretKeyShare)
			require.True(tt, computedPublicKeyA.Equal(publicKey))

			pkB := boundCurve.ScalarBaseMult(bobRefreshed.Output().SecretKeyShare)
			computedPublicKeyB := pkB.Mul(aliceRefreshed.Output().SecretKeyShare)
			require.True(tt, computedPublicKeyB.Equal(publicKey))
		})
	}
}

func Test_RefreshOTIsCorrect(t *testing.T) {
	t.Parallel()
	curveInstances := []*curves.Curve{
		curves.K256(),
		curves.P256(),
	}
	for _, curve := range curveInstances {
		boundCurve := curve
		t.Run(fmt.Sprintf("testing OT correctness of key refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
			tt.Parallel()
			alice, bob := performDKG(tt, boundCurve)
			aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)
			for i := 0; i < 256; i++ {
				if aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey[i] != bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys[i][aliceRefreshed.Output().SeedOtResult.RandomChoiceBits[i]] {
					tt.Errorf("oblivious transfer is incorrect at index i=%v", i)
				}
			}

		})
	}

}

func Test_CanSignAfterRefresh(t *testing.T) {
	t.Parallel()
	curveInstances := []*curves.Curve{
		curves.K256(),
		curves.P256(),
	}
	for _, curve := range curveInstances {
		boundCurve := curve
		t.Run(fmt.Sprintf("testing sign after refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
			tt.Parallel()
			aliceDKG, bobDKG := performDKG(tt, boundCurve)

			publicKey := aliceDKG.Output().PublicKey
			require.True(tt, publicKey.Equal(bobDKG.Output().PublicKey))

			aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, aliceDKG.Output().SecretKeyShare, bobDKG.Output().SecretKeyShare)

			alice := sign.NewAlice(256, 80, boundCurve, sha3.New256(), &dkg.AliceOutput{
				SeedOtResult:   aliceRefreshed.Output().SeedOtResult,
				SecretKeyShare: aliceRefreshed.Output().SecretKeyShare,
				PublicKey:      publicKey,
			})
			bob := sign.NewBob(256, 80, boundCurve, sha3.New256(), &dkg.BobOutput{
				SeedOtResult:   bobRefreshed.Output().SeedOtResult,
				SecretKeyShare: bobRefreshed.Output().SecretKeyShare,
				PublicKey:      publicKey,
			})

			message := []byte("A message.")
			seed, err := alice.Round1GenerateRandomSeed()
			require.NoError(tt, err)
			round3Output, err := bob.Round2Initialize(seed)
			require.NoError(tt, err)
			round4Output, err := alice.Round3Sign(message, round3Output)
			require.NoError(tt, err)
			err = bob.Round4Final(message, round4Output)
			require.NoError(tt, err, "curve: %s", boundCurve.Name)
		})
	}
}