ceremonyclient/nekryptology/pkg/tecdsa/dkls/v1/refresh/refresh_test.go
2023-07-05 00:32:28 -05:00

188 lines
6.5 KiB
Go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//
package refresh_test
import (
"fmt"
"testing"
"github.com/stretchr/testify/require"
"golang.org/x/crypto/sha3"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/refresh"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/sign"
)
func performDKG(t *testing.T, curve *curves.Curve) (*dkg.Alice, *dkg.Bob) {
t.Helper()
alice := dkg.NewAlice(256, 80, curve)
bob := dkg.NewBob(256, 80, curve)
seed, err := bob.Round1GenerateRandomSeed()
require.NoError(t, err)
round3Output, err := alice.Round2CommitToProof(seed)
require.NoError(t, err)
proof, err := bob.Round3SchnorrProve(round3Output)
require.NoError(t, err)
proof, err = alice.Round4VerifyAndReveal(proof)
require.NoError(t, err)
proof, err = bob.Round5DecommitmentAndStartOt(proof)
require.NoError(t, err)
compressedReceiversMaskedChoice, err := alice.Round6DkgRound2Ot(proof)
require.NoError(t, err)
challenge, err := bob.Round7DkgRound3Ot(compressedReceiversMaskedChoice)
require.NoError(t, err)
challengeResponse, err := alice.Round8DkgRound4Ot(challenge)
require.NoError(t, err)
challengeOpenings, err := bob.Round9DkgRound5Ot(challengeResponse)
require.NoError(t, err)
err = alice.Round10DkgRound6Ot(challengeOpenings)
require.NoError(t, err)
return alice, bob
}
func performRefresh(t *testing.T, curve *curves.Curve, aliceSecretKeyShare, bobSecretKeyShare curves.Scalar) (*refresh.Alice, *refresh.Bob) {
t.Helper()
alice := refresh.NewAlice(256, 80, curve, &dkg.AliceOutput{SecretKeyShare: aliceSecretKeyShare})
bob := refresh.NewBob(256, 80, curve, &dkg.BobOutput{SecretKeyShare: bobSecretKeyShare})
round1Output := alice.Round1RefreshGenerateSeed()
require.False(t, round1Output.IsZero())
round2Output, err := bob.Round2RefreshProduceSeedAndMultiplyAndStartOT(round1Output)
require.NoError(t, err)
round3Output, err := alice.Round3RefreshMultiplyRound2Ot(round2Output)
require.NoError(t, err)
round4Output, err := bob.Round4RefreshRound3Ot(round3Output)
require.NoError(t, err)
round5Output, err := alice.Round5RefreshRound4Ot(round4Output)
require.NoError(t, err)
round6Output, err := bob.Round6RefreshRound5Ot(round5Output)
require.NoError(t, err)
err = alice.Round7DkgRound6Ot(round6Output)
require.NoError(t, err)
return alice, bob
}
func Test_RefreshLeadsToTheSamePublicKeyButDifferentPrivateMaterial(t *testing.T) {
t.Parallel()
curveInstances := []*curves.Curve{
curves.K256(),
curves.P256(),
}
for _, curve := range curveInstances {
boundCurve := curve
t.Run(fmt.Sprintf("testing refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
tt.Parallel()
alice, bob := performDKG(tt, boundCurve)
publicKey := alice.Output().PublicKey
require.True(tt, publicKey.Equal(bob.Output().PublicKey))
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)
require.NotEqual(tt, aliceRefreshed.Output().SecretKeyShare, alice.Output().SecretKeyShare)
require.NotEqual(tt, bobRefreshed.Output().SeedOtResult, bob.Output().SecretKeyShare)
require.NotEqualValues(
tt,
aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey,
alice.Output().SeedOtResult.OneTimePadDecryptionKey,
)
require.NotEqualValues(
tt,
aliceRefreshed.Output().SeedOtResult.PackedRandomChoiceBits,
alice.Output().SeedOtResult.PackedRandomChoiceBits,
)
require.NotEqualValues(
tt,
aliceRefreshed.Output().SeedOtResult.RandomChoiceBits,
alice.Output().SeedOtResult.RandomChoiceBits,
)
require.NotEqualValues(
tt,
bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys,
bob.Output().SeedOtResult.OneTimePadEncryptionKeys,
)
pkA := boundCurve.ScalarBaseMult(aliceRefreshed.Output().SecretKeyShare)
computedPublicKeyA := pkA.Mul(bobRefreshed.Output().SecretKeyShare)
require.True(tt, computedPublicKeyA.Equal(publicKey))
pkB := boundCurve.ScalarBaseMult(bobRefreshed.Output().SecretKeyShare)
computedPublicKeyB := pkB.Mul(aliceRefreshed.Output().SecretKeyShare)
require.True(tt, computedPublicKeyB.Equal(publicKey))
})
}
}
func Test_RefreshOTIsCorrect(t *testing.T) {
t.Parallel()
curveInstances := []*curves.Curve{
curves.K256(),
curves.P256(),
}
for _, curve := range curveInstances {
boundCurve := curve
t.Run(fmt.Sprintf("testing OT correctness of key refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
tt.Parallel()
alice, bob := performDKG(tt, boundCurve)
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)
for i := 0; i < 256; i++ {
if aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey[i] != bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys[i][aliceRefreshed.Output().SeedOtResult.RandomChoiceBits[i]] {
tt.Errorf("oblivious transfer is incorrect at index i=%v", i)
}
}
})
}
}
func Test_CanSignAfterRefresh(t *testing.T) {
t.Parallel()
curveInstances := []*curves.Curve{
curves.K256(),
curves.P256(),
}
for _, curve := range curveInstances {
boundCurve := curve
t.Run(fmt.Sprintf("testing sign after refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
tt.Parallel()
aliceDKG, bobDKG := performDKG(tt, boundCurve)
publicKey := aliceDKG.Output().PublicKey
require.True(tt, publicKey.Equal(bobDKG.Output().PublicKey))
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, aliceDKG.Output().SecretKeyShare, bobDKG.Output().SecretKeyShare)
alice := sign.NewAlice(256, 80, boundCurve, sha3.New256(), &dkg.AliceOutput{
SeedOtResult: aliceRefreshed.Output().SeedOtResult,
SecretKeyShare: aliceRefreshed.Output().SecretKeyShare,
PublicKey: publicKey,
})
bob := sign.NewBob(256, 80, boundCurve, sha3.New256(), &dkg.BobOutput{
SeedOtResult: bobRefreshed.Output().SeedOtResult,
SecretKeyShare: bobRefreshed.Output().SecretKeyShare,
PublicKey: publicKey,
})
message := []byte("A message.")
seed, err := alice.Round1GenerateRandomSeed()
require.NoError(tt, err)
round3Output, err := bob.Round2Initialize(seed)
require.NoError(tt, err)
round4Output, err := alice.Round3Sign(message, round3Output)
require.NoError(tt, err)
err = bob.Round4Final(message, round4Output)
require.NoError(tt, err, "curve: %s", boundCurve.Name)
})
}
}