ceremonyclient/nekryptology/pkg/ted25519/frost/round2.go
2023-07-05 00:32:28 -05:00

182 lines
4.8 KiB
Go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//
package frost
import (
"bytes"
"encoding/gob"
"fmt"
"github.com/pkg/errors"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/internal"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
)
// Round2Bcast contains values that will be broadcast to other signers after completion of round 2.
type Round2Bcast struct {
Zi curves.Scalar
Vki curves.Point
}
func (result *Round2Bcast) Encode() ([]byte, error) {
gob.Register(result.Zi)
gob.Register(result.Vki) // just the point for now
buf := &bytes.Buffer{}
enc := gob.NewEncoder(buf)
if err := enc.Encode(result); err != nil {
return nil, errors.Wrap(err, "couldn't encode round 1 broadcast")
}
return buf.Bytes(), nil
}
func (result *Round2Bcast) Decode(input []byte) error {
buf := bytes.NewBuffer(input)
dec := gob.NewDecoder(buf)
if err := dec.Decode(result); err != nil {
return errors.Wrap(err, "couldn't encode round 1 broadcast")
}
return nil
}
// SignRound2 implements FROST signing round 2.
func (signer *Signer) SignRound2(msg []byte, round2Input map[uint32]*Round1Bcast) (*Round2Bcast, error) {
// Make sure necessary items of signer are not empty
if signer == nil || signer.curve == nil || signer.state == nil {
return nil, internal.ErrNilArguments
}
// Make sure those private d is not empty and not zero
if signer.state.smallD == nil || signer.state.smallD.IsZero() {
return nil, fmt.Errorf("empty d or d is zero")
}
// Make sure those private e is not empty and not zero
if signer.state.smallE == nil || signer.state.smallE.IsZero() {
return nil, fmt.Errorf("empty e or e is zero")
}
// Make sure msg is not empty
if len(msg) == 0 {
return nil, internal.ErrNilArguments
}
// Make sure the round number is correct
if signer.round != 2 {
return nil, internal.ErrInvalidRound
}
// Check length of round2Input
if uint32(len(round2Input)) != signer.threshold {
return nil, fmt.Errorf("Invalid length of round2Input")
}
// Step 2 - Check Dj, Ej on the curve and Store round2Input
for id, input := range round2Input {
if input == nil || input.Di == nil || input.Ei == nil {
return nil, fmt.Errorf("round2Input is nil from participant with id %d\n", id)
}
if !input.Di.IsOnCurve() || input.Di.IsIdentity() {
return nil, fmt.Errorf("commitment Di is not on the curve with id %d\n", id)
}
if !input.Ei.IsOnCurve() || input.Ei.IsIdentity() {
return nil, fmt.Errorf("commitment Ei is not on the curve with id %d\n", id)
}
}
// Store Dj, Ej for further usage.
signer.state.commitments = round2Input
// Step 3-6
R := signer.curve.NewIdentityPoint()
var ri curves.Scalar
Rs := make(map[uint32]curves.Point, signer.threshold)
for id, data := range round2Input {
// Construct the blob (j, m, {Dj, Ej})
blob := concatHashArray(id, msg, round2Input, signer.cosigners)
// Step 4 - rj = H(j,m,{Dj,Ej}_{j in [1...t]})
rj := signer.curve.Scalar.Hash(blob)
if signer.id == id {
ri = rj
}
// Step 5 - R_j = D_j + r_j*E_j
rjEj := data.Ei.Mul(rj)
Rj := rjEj.Add(data.Di)
// assign Rj
Rs[id] = Rj
// Step 6 - R = R+Rj
R = R.Add(Rj)
}
// Step 7 - c = H(m, R)
c, err := signer.challengeDeriver.DeriveChallenge(msg, signer.verificationKey, R)
if err != nil {
return nil, err
}
// Step 8 - Record c, R, Rjs
signer.state.c = c
signer.state.capRs = Rs
signer.state.sumR = R
// Step 9 - zi = di + ei*ri + Li*ski*c
Li := signer.lCoeffs[signer.id]
Liski := Li.Mul(signer.skShare)
Liskic := Liski.Mul(c)
if R.IsNegative() {
signer.state.smallE = signer.state.smallE.Neg()
signer.state.smallD = signer.state.smallD.Neg()
}
eiri := signer.state.smallE.Mul(ri)
// Compute zi = di+ei*ri+Li*ski*c
zi := Liskic.Add(eiri)
zi = zi.Add(signer.state.smallD)
// Update round number and store message
signer.round = 3
signer.state.msg = msg
// set smallD and smallE to zero since they are one-time use
signer.state.smallD = signer.curve.NewScalar()
signer.state.smallE = signer.curve.NewScalar()
// Step 10 - Broadcast zi, vki to other participants
return &Round2Bcast{
zi,
signer.vkShare,
}, nil
}
// concatHashArray puts id, msg and (Dj,Ej), j=1...t into a byte array
func concatHashArray(id uint32, msg []byte, round2Input map[uint32]*Round1Bcast, cosigners []uint32) []byte {
var blob []byte
// Append identity id
blob = append(blob, byte(id))
// Append message msg
blob = append(blob, msg...)
// Append (Dj, Ej) for all j in [1...t]
for i := 0; i < len(cosigners); i++ {
id := cosigners[i]
bytesDi := round2Input[id].Di.ToAffineCompressed()
bytesEi := round2Input[id].Ei.ToAffineCompressed()
// Following the spec, we should add each party's identity.
blob = append(blob, byte(id))
blob = append(blob, bytesDi...)
blob = append(blob, bytesEi...)
}
return blob
}