ceremonyclient/nekryptology/pkg/tecdsa/dkls/v1/refresh/refresh.go
2023-07-05 00:32:28 -05:00

187 lines
6.6 KiB
Go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//
// This file implements the key refresh protocol of [DKLs18](https://eprint.iacr.org/2018/499.pdf).
// The key refresh protocol is defined as follows:
// 1. Key Share:
// 1.1. alice generates k_A <-- F_q; writes it to merlin transcript. sends it to bob.
// 1.2. bob receives k_A and writes it to merlin transcript. generates k_B <-- F_q and writes it to merlin transcript. reads k out of merlin transcript. overwrites sk_B *= k. sends k_B to Alice.
// 1.3. alice writes k_B to merlin transcript. reads k from it. overwrites sk_A *= k^{-1}.
// 2. OT: Redo OT (as it is done in the DKG)
package refresh
import (
"crypto/rand"
"github.com/gtank/merlin"
"github.com/pkg/errors"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/core/curves"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/ot/base/simplest"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/tecdsa/dkls/v1/dkg"
"source.quilibrium.com/quilibrium/monorepo/nekryptology/pkg/zkp/schnorr"
)
// Alice struct encoding Alice's state during one execution of the overall signing algorithm.
// At the end of the joint computation, Alice will NOT obtain the signature.
type Alice struct {
kappa int
s int
// receiver is the base OT receiver.
receiver *simplest.Receiver
// secretKeyShare is Alice's secret key for the joint public key.
secretKeyShare curves.Scalar
// publicKey is the joint public key of Alice and Bob.
publicKey curves.Point
curve *curves.Curve
transcript *merlin.Transcript
}
// Bob struct encoding Bob's state during one execution of the overall signing algorithm.
// At the end of the joint computation, Bob will obtain the signature.
type Bob struct {
kappa int
s int
// sender is the base OT sender.
sender *simplest.Sender
// secretKeyShare is Bob's secret key for the joint public key.
secretKeyShare curves.Scalar
// publicKey is the joint public key of Alice and Bob.
publicKey curves.Point
curve *curves.Curve
transcript *merlin.Transcript
}
type RefreshRound2Output struct {
SeedOTRound1Output *schnorr.Proof
BobMultiplier curves.Scalar
}
// NewAliceRefresh creates a party that can participate in 2-of-2 key refresh.
func NewAlice(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.AliceOutput) *Alice {
return &Alice{
kappa: kappa,
s: s,
curve: curve,
secretKeyShare: dkgOutput.SecretKeyShare,
publicKey: dkgOutput.PublicKey,
transcript: merlin.NewTranscript("Coinbase_DKLs_Refresh"),
}
}
// NewBobRefresh creates a party that can participate in 2-of-2 key refresh.
func NewBob(kappa int, s int, curve *curves.Curve, dkgOutput *dkg.BobOutput) *Bob {
return &Bob{
kappa: kappa,
s: s,
curve: curve,
secretKeyShare: dkgOutput.SecretKeyShare,
publicKey: dkgOutput.PublicKey,
transcript: merlin.NewTranscript("Coinbase_DKLs_Refresh"),
}
}
func (alice *Alice) Round1RefreshGenerateSeed() curves.Scalar {
refreshSeed := alice.curve.Scalar.Random(rand.Reader)
alice.transcript.AppendMessage([]byte("alice refresh seed"), refreshSeed.Bytes())
return refreshSeed
}
func (bob *Bob) Round2RefreshProduceSeedAndMultiplyAndStartOT(aliceSeed curves.Scalar) (*RefreshRound2Output, error) {
bob.transcript.AppendMessage([]byte("alice refresh seed"), aliceSeed.Bytes())
bobSeed := bob.curve.Scalar.Random(rand.Reader)
bob.transcript.AppendMessage([]byte("bob refresh seed"), bobSeed.Bytes())
k, err := bob.curve.NewScalar().SetBytes(
bob.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
)
if err != nil {
return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
}
bob.secretKeyShare = bob.secretKeyShare.Mul(k)
uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
copy(uniqueSessionId[:], bob.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
bob.sender, err = simplest.NewSender(bob.curve, bob.kappa, uniqueSessionId)
if err != nil {
return nil, errors.Wrap(err, "bob constructing new OT sender in refresh round 2")
}
seedOTRound1Output, err := bob.sender.Round1ComputeAndZkpToPublicKey()
if err != nil {
return nil, errors.Wrap(err, "bob computing round 1 of seed OT within refresh round 2")
}
return &RefreshRound2Output{
SeedOTRound1Output: seedOTRound1Output,
BobMultiplier: bobSeed,
}, nil
}
func (alice *Alice) Round3RefreshMultiplyRound2Ot(input *RefreshRound2Output) ([]simplest.ReceiversMaskedChoices, error) {
alice.transcript.AppendMessage([]byte("bob refresh seed"), input.BobMultiplier.Bytes())
k, err := alice.curve.NewScalar().SetBytes(
alice.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
)
if err != nil {
return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
}
kInverse, err := k.Invert()
if err != nil {
return nil, errors.Wrap(err, "couldn't produce k inverse (alice's secret key share)")
}
alice.secretKeyShare = alice.secretKeyShare.Mul(kInverse)
uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
copy(uniqueSessionId[:], alice.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
alice.receiver, err = simplest.NewReceiver(alice.curve, alice.kappa, uniqueSessionId)
if err != nil {
return nil, errors.Wrap(err, "couldn't construct OT receiver")
}
return alice.receiver.Round2VerifySchnorrAndPadTransfer(input.SeedOTRound1Output)
}
func (bob *Bob) Round4RefreshRound3Ot(compressedReceiversMaskedChoice []simplest.ReceiversMaskedChoices) ([]simplest.OtChallenge, error) {
return bob.sender.Round3PadTransfer(compressedReceiversMaskedChoice)
}
func (alice *Alice) Round5RefreshRound4Ot(challenge []simplest.OtChallenge) ([]simplest.OtChallengeResponse, error) {
return alice.receiver.Round4RespondToChallenge(challenge)
}
func (bob *Bob) Round6RefreshRound5Ot(challengeResponses []simplest.OtChallengeResponse) ([]simplest.ChallengeOpening, error) {
return bob.sender.Round5Verify(challengeResponses)
}
func (alice *Alice) Round7DkgRound6Ot(challengeOpenings []simplest.ChallengeOpening) error {
return alice.receiver.Round6Verify(challengeOpenings)
}
func (alice *Alice) Output() *dkg.AliceOutput {
return &dkg.AliceOutput{
PublicKey: alice.publicKey,
SecretKeyShare: alice.secretKeyShare,
SeedOtResult: alice.receiver.Output,
}
}
func (bob *Bob) Output() *dkg.BobOutput {
return &dkg.BobOutput{
PublicKey: bob.publicKey,
SecretKeyShare: bob.secretKeyShare,
SeedOtResult: bob.sender.Output,
}
}