ceremonyclient/nekryptology/pkg/tecdsa/dkls/v1/refresh/refresh.go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//

// This file implements the key refresh protocol of [DKLs18](https://eprint.iacr.org/2018/499.pdf).
// The key refresh protocol is defined as follows:
// 1. Key Share:
//   1.1. alice generates k_A <-- F_q; writes it to merlin transcript. sends it to bob.
//   1.2. bob receives k_A and writes it to merlin transcript. generates k_B <-- F_q and writes it to merlin transcript. reads k out of merlin transcript. overwrites sk_B *= k. sends k_B to Alice.
//   1.3. alice writes k_B to merlin transcript. reads k from it. overwrites sk_A *= k^{-1}.
// 2. OT: Redo OT (as it is done in the DKG)
package refresh

import (
	"crypto/rand"

	"github.com/gtank/merlin"
	"github.com/pkg/errors"

	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/base/simplest"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
	"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/zkp/schnorr"
)

// Alice struct encoding Alice's state during one execution of the overall signing algorithm.
// At the end of the joint computation, Alice will NOT obtain the signature.
type Alice struct {
	kappa int
	s     int

	// receiver is the base OT receiver.
	receiver *simplest.Receiver

	// secretKeyShare is Alice's secret key for the joint public key.
	secretKeyShare curves.Scalar

	// publicKey is the joint public key of Alice and Bob.
	publicKey curves.Point

	curve *curves.Curve

	transcript *merlin.Transcript
}

// Bob struct encoding Bob's state during one execution of the overall signing algorithm.
// At the end of the joint computation, Bob will obtain the signature.
type Bob struct {
	kappa int
	s     int

	// sender is the base OT sender.
	sender *simplest.Sender

	// secretKeyShare is Bob's secret key for the joint public key.
	secretKeyShare curves.Scalar

	// publicKey is the joint public key of Alice and Bob.
	publicKey curves.Point

	curve *curves.Curve

	transcript *merlin.Transcript
}

type RefreshRound2Output struct {
	SeedOTRound1Output *schnorr.Proof
	BobMultiplier      curves.Scalar
}

// NewAliceRefresh creates a party that can participate in 2-of-2 key refresh.
func NewAlice(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.AliceOutput) *Alice {
	return &Alice{
		kappa:          kappa,
		s:              s,
		curve:          curve,
		secretKeyShare: dkgOutput.SecretKeyShare,
		publicKey:      dkgOutput.PublicKey,
		transcript:     merlin.NewTranscript("Coinbase_DKLs_Refresh"),
	}
}

// NewBobRefresh creates a party that can participate in 2-of-2 key refresh.
func NewBob(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.BobOutput) *Bob {
	return &Bob{
		kappa:          kappa,
		s:              s,
		curve:          curve,
		secretKeyShare: dkgOutput.SecretKeyShare,
		publicKey:      dkgOutput.PublicKey,
		transcript:     merlin.NewTranscript("Coinbase_DKLs_Refresh"),
	}
}

func (alice *Alice) Round1RefreshGenerateSeed() curves.Scalar {
	refreshSeed := alice.curve.Scalar.Random(rand.Reader)
	alice.transcript.AppendMessage([]byte("alice refresh seed"), refreshSeed.Bytes())
	return refreshSeed
}

func (bob *Bob) Round2RefreshProduceSeedAndMultiplyAndStartOT(aliceSeed curves.Scalar) (*RefreshRound2Output, error) {
	bob.transcript.AppendMessage([]byte("alice refresh seed"), aliceSeed.Bytes())
	bobSeed := bob.curve.Scalar.Random(rand.Reader)
	bob.transcript.AppendMessage([]byte("bob refresh seed"), bobSeed.Bytes())
	k, err := bob.curve.NewScalar().SetBytes(
		bob.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
	)
	if err != nil {
		return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
	}
	bob.secretKeyShare = bob.secretKeyShare.Mul(k)

	uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
	copy(uniqueSessionId[:], bob.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
	bob.sender, err = simplest.NewSender(bob.curve, bob.kappa, uniqueSessionId)
	if err != nil {
		return nil, errors.Wrap(err, "bob constructing new OT sender in refresh round 2")
	}
	seedOTRound1Output, err := bob.sender.Round1ComputeAndZkpToPublicKey()
	if err != nil {
		return nil, errors.Wrap(err, "bob computing round 1 of seed OT within refresh round 2")
	}

	return &RefreshRound2Output{
		SeedOTRound1Output: seedOTRound1Output,
		BobMultiplier:      bobSeed,
	}, nil
}

func (alice *Alice) Round3RefreshMultiplyRound2Ot(input *RefreshRound2Output) ([]simplest.ReceiversMaskedChoices, error) {
	alice.transcript.AppendMessage([]byte("bob refresh seed"), input.BobMultiplier.Bytes())
	k, err := alice.curve.NewScalar().SetBytes(
		alice.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
	)
	if err != nil {
		return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
	}
	kInverse, err := k.Invert()
	if err != nil {
		return nil, errors.Wrap(err, "couldn't produce k inverse (alice's secret key share)")
	}
	alice.secretKeyShare = alice.secretKeyShare.Mul(kInverse)

	uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
	copy(uniqueSessionId[:], alice.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
	alice.receiver, err = simplest.NewReceiver(alice.curve, alice.kappa, uniqueSessionId)
	if err != nil {
		return nil, errors.Wrap(err, "couldn't construct OT receiver")
	}

	return alice.receiver.Round2VerifySchnorrAndPadTransfer(input.SeedOTRound1Output)
}

func (bob *Bob) Round4RefreshRound3Ot(compressedReceiversMaskedChoice []simplest.ReceiversMaskedChoices) ([]simplest.OtChallenge, error) {
	return bob.sender.Round3PadTransfer(compressedReceiversMaskedChoice)
}

func (alice *Alice) Round5RefreshRound4Ot(challenge []simplest.OtChallenge) ([]simplest.OtChallengeResponse, error) {
	return alice.receiver.Round4RespondToChallenge(challenge)
}

func (bob *Bob) Round6RefreshRound5Ot(challengeResponses []simplest.OtChallengeResponse) ([]simplest.ChallengeOpening, error) {
	return bob.sender.Round5Verify(challengeResponses)
}

func (alice *Alice) Round7DkgRound6Ot(challengeOpenings []simplest.ChallengeOpening) error {
	return alice.receiver.Round6Verify(challengeOpenings)
}

func (alice *Alice) Output() *dkg.AliceOutput {
	return &dkg.AliceOutput{
		PublicKey:      alice.publicKey,
		SecretKeyShare: alice.secretKeyShare,
		SeedOtResult:   alice.receiver.Output,
	}
}

func (bob *Bob) Output() *dkg.BobOutput {
	return &dkg.BobOutput{
		PublicKey:      bob.publicKey,
		SecretKeyShare: bob.secretKeyShare,
		SeedOtResult:   bob.sender.Output,
	}
}