ceremonyclient/nekryptology/pkg/tecdsa/dkls/v1/dkgserializers.go
2023-07-05 00:32:28 -05:00

452 lines
16 KiB
Go

package v1
import (
"bytes"
"encoding/gob"
"fmt"
"github.com/pkg/errors"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/protocol"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/base/simplest"
v0 "source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v0"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/zkp/schnorr"
)
const payloadKey = "direct"
func newDkgProtocolMessage(payload []byte, round string, version uint) *protocol.Message {
return &protocol.Message{
Protocol: protocol.Dkls18Dkg,
Version: version,
Payloads: map[string][]byte{payloadKey: payload},
Metadata: map[string]string{"round": round},
}
}
func registerTypes() {
gob.Register(&curves.ScalarK256{})
gob.Register(&curves.PointK256{})
gob.Register(&curves.ScalarP256{})
gob.Register(&curves.PointP256{})
}
func encodeDkgRound1Output(commitment [32]byte, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
registerTypes()
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(&commitment); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "1", version), nil
}
func decodeDkgRound2Input(m *protocol.Message) ([32]byte, error) {
if m.Version != protocol.Version1 {
return [32]byte{}, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := [32]byte{}
if err := dec.Decode(&decoded); err != nil {
return [32]byte{}, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound2Output(output *dkg.Round2Output, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(output); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "2", version), nil
}
func decodeDkgRound3Input(m *protocol.Message) (*dkg.Round2Output, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(dkg.Round2Output)
if err := dec.Decode(decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound3Output(proof *schnorr.Proof, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(proof); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "3", version), nil
}
func decodeDkgRound4Input(m *protocol.Message) (*schnorr.Proof, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(schnorr.Proof)
if err := dec.Decode(decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound4Output(proof *schnorr.Proof, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(proof); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "4", version), nil
}
func decodeDkgRound5Input(m *protocol.Message) (*schnorr.Proof, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(schnorr.Proof)
if err := dec.Decode(decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound5Output(proof *schnorr.Proof, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(proof); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "5", version), nil
}
func decodeDkgRound6Input(m *protocol.Message) (*schnorr.Proof, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(schnorr.Proof)
if err := dec.Decode(decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound6Output(choices []simplest.ReceiversMaskedChoices, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(choices); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "6", version), nil
}
func decodeDkgRound7Input(m *protocol.Message) ([]simplest.ReceiversMaskedChoices, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := []simplest.ReceiversMaskedChoices{}
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound7Output(challenge []simplest.OtChallenge, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(challenge); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "7", version), nil
}
func decodeDkgRound8Input(m *protocol.Message) ([]simplest.OtChallenge, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := []simplest.OtChallenge{}
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound8Output(responses []simplest.OtChallengeResponse, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(responses); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "8", version), nil
}
func decodeDkgRound9Input(m *protocol.Message) ([]simplest.OtChallengeResponse, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := []simplest.OtChallengeResponse{}
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
func encodeDkgRound9Output(opening []simplest.ChallengeOpening, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(opening); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "9", version), nil
}
func decodeDkgRound10Input(m *protocol.Message) ([]simplest.ChallengeOpening, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := []simplest.ChallengeOpening{}
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
// EncodeAliceDkgOutput serializes Alice DKG output based on the protocol version.
func EncodeAliceDkgOutput(result *dkg.AliceOutput, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
registerTypes()
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(result); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "alice-output", version), nil
}
// DecodeAliceDkgResult deserializes Alice DKG output.
func DecodeAliceDkgResult(m *protocol.Message) (*dkg.AliceOutput, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
registerTypes()
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(dkg.AliceOutput)
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
// EncodeBobDkgOutput serializes Bob DKG output based on the protocol version.
func EncodeBobDkgOutput(result *dkg.BobOutput, version uint) (*protocol.Message, error) {
if version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
registerTypes()
buf := bytes.NewBuffer([]byte{})
enc := gob.NewEncoder(buf)
if err := enc.Encode(result); err != nil {
return nil, errors.WithStack(err)
}
return newDkgProtocolMessage(buf.Bytes(), "bob-output", version), nil
}
// DecodeBobDkgResult deserializes Bob DKG output.
func DecodeBobDkgResult(m *protocol.Message) (*dkg.BobOutput, error) {
if m.Version != protocol.Version1 {
return nil, errors.New("only version 1 is supported")
}
buf := bytes.NewBuffer(m.Payloads[payloadKey])
dec := gob.NewDecoder(buf)
decoded := new(dkg.BobOutput)
if err := dec.Decode(&decoded); err != nil {
return nil, errors.WithStack(err)
}
return decoded, nil
}
// ConvertAliceDkgOutputToV1 converts the V0 output to V1 output.
// The V0 version of DKls `gob` encoded entire `Alice` object and returned it as DKG state and returned this state and
// the public key to the caller as the serialized version of DKG.
// In contrast, the V1 version of DKLs `gob` encodes only what is need for signing algorithm. Therefore, this function
// first decodes the V0 dkg result to Alice object and a public key. Then extracts the required data out of the Alice
// object and creates V1 Dkg output object.
// Note that in addition to extracting the required data, this function also performs type conversions on curve Scalar
// and Points. The reason is that between V0 and V1, the interface and data types for curve computation has changed.
//
// Furthermore, the new encoded value is represented as a `protocol.Message` which contains versioning and other
// metadata about the serialized values. This serialized value will be the input to the sign function.
//
// In summary, the following data mapping and conversion is performed.
// - v0.alice.Pk -> Converted to v1.PublicKey (a curve Point)
// - v0.alice.SkA -> Converted to v1.SecretKeyShare (a scalar value)
// - v0.alice.Receiver.Packed -> Converted to v1.SeedOtResult.PackedRandomChoiceBits (the random choice bits in OT)
// - v0.alice.Receiver.Packed -> Converted to v1.SeedOtResult.RandomChoiceBits (the random choice bits in OT in unpacked form)
// - v0.alice.Receiver.Rho -> Converted to v1.SeedOtResult.OneTimePadDecryptionKey (the Rho value in the paper)
func ConvertAliceDkgOutputToV1(params *v0.Params, dkgResult []byte) (*protocol.Message, error) {
alice, err := v0.DecodeAlice(params, dkgResult)
if err != nil {
return nil, errors.WithStack(err)
}
var curve *curves.Curve
if params.Curve.Params().Name == curves.K256Name {
curve = curves.K256()
} else if params.Curve.Params().Name == curves.P256Name {
curve = curves.P256()
} else {
return nil, fmt.Errorf("unsupported curve %s", params.Curve.Params().Name)
}
publicKey, err := curve.Point.Set(alice.Pk.X, alice.Pk.Y)
if err != nil {
return nil, errors.WithStack(err)
}
secretKey, err := curve.Scalar.SetBigInt(alice.SkA)
if err != nil {
return nil, errors.WithStack(err)
}
packedChoiceBits := make([]byte, len(alice.Receiver.Packed))
copy(packedChoiceBits, alice.Receiver.Packed[:])
// V0 was strictly 256
randomChoiceBits := make([]int, 256)
for i := 0; i < len(randomChoiceBits); i++ {
randomChoiceBits[i] = int(simplest.ExtractBitFromByteVector(packedChoiceBits, i))
}
decryptionPads := make([]simplest.OneTimePadDecryptionKey, 256)
for i := 0; i < 256; i++ {
for j := 0; j < simplest.DigestSize; j++ {
decryptionPads[i][j] = alice.Receiver.Rho[i][j]
}
}
dkgConvertedResult := &dkg.AliceOutput{
PublicKey: publicKey,
SecretKeyShare: secretKey,
SeedOtResult: &simplest.ReceiverOutput{
PackedRandomChoiceBits: packedChoiceBits,
RandomChoiceBits: randomChoiceBits,
OneTimePadDecryptionKey: decryptionPads,
},
}
return EncodeAliceDkgOutput(dkgConvertedResult, protocol.Version1)
}
// ConvertBobDkgOutputToV1 converts the V0 output to V1 output.
// The V0 version of DKls `gob` encoded entire `Bob` object and returned it as DKG state and returned this state and
// the public key to the caller as the serialized version of DKG.
// In contrast, the V1 version of DKLs `gob` encodes only what is need for signing algorithm. Therefore, this function
// first decodes the V0 dkg result to Bob object and a public key. Then extracts the required data out of the Bob
// object and creates V1 Dkg output object.
// Note that in addition to extracting the required data, this function also performs type conversions on curve Scalar
// and Points. The reason is that between V0 and V1, the interface and data types for curve computation has changed.
//
// Furthermore, the new encoded value is represented as a `protocol.Message` which contains versioning and other
// metadata about the serialized values. This serialized value will be the input to the sign function.
//
// In summary, the following data mapping and conversion is performed.
// - v0.bob.Pk -> Converted to v1.PublicKey (a curve Point)
// - v0.bob.SkA -> Converted to v1.SecretKeyShare (a scalar value)
// - v0.bob.Sender.Rho -> Converted to v1.SeedOtResult.OneTimePadEncryptionKeys (the Rho value in the paper)
func ConvertBobDkgOutputToV1(params *v0.Params, dkgResult []byte) (*protocol.Message, error) {
bob, err := v0.DecodeBob(params, dkgResult)
if err != nil {
return nil, errors.WithStack(err)
}
var curve *curves.Curve
if params.Curve.Params().Name == curves.K256Name {
curve = curves.K256()
} else if params.Curve.Params().Name == curves.P256Name {
curve = curves.P256()
} else {
return nil, fmt.Errorf("unsupported curve %s", params.Curve.Params().Name)
}
publicKey, err := curve.Point.Set(bob.Pk.X, bob.Pk.Y)
if err != nil {
return nil, errors.WithStack(err)
}
secretKey, err := curve.Scalar.SetBigInt(bob.SkB)
if err != nil {
return nil, errors.WithStack(err)
}
// V0 was strictly 256
encryptionPads := make([]simplest.OneTimePadEncryptionKeys, 256)
for i := 0; i < 256; i++ {
for k := 0; k < 2; k++ { // simplest.keyCount
for j := 0; j < simplest.DigestSize; j++ {
encryptionPads[i][k][j] = bob.Sender.Rho[i][k][j]
}
}
}
dkgConvertedResult := &dkg.BobOutput{
PublicKey: publicKey,
SecretKeyShare: secretKey,
SeedOtResult: &simplest.SenderOutput{
OneTimePadEncryptionKeys: encryptionPads,
},
}
return EncodeBobDkgOutput(dkgConvertedResult, protocol.Version1)
}