123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296 |
- use crate::lagrange::*;
- use crate::shine;
- use curve25519_dalek::ristretto::RistrettoPoint;
- use curve25519_dalek::scalar::Scalar;
- use sha2::Digest;
- use sha2::Sha256;
- type PubKey = RistrettoPoint;
- pub struct SecKey {
- n: u32,
- t: u32,
- k: u32,
- sk: Scalar,
- rk: shine::PreprocKey,
- }
- type Signature = (RistrettoPoint, Scalar);
- pub fn keygen(n: u32, t: u32) -> (PubKey, Vec<SecKey>) {
- assert!(t >= 1);
- assert!(n >= 2 * t - 1);
- let mut seckeys: Vec<SecKey> = Vec::new();
- // The Shine key shares
- let shinekeys = shine::Key::keygen(n, t);
- // The signature key shares
- let shamirpoly = ScalarPoly::rand((t as usize) - 1);
- let pubkey = shine::commit(&shamirpoly.coeffs[0]);
- for k in 1..=n {
- seckeys.push(SecKey {
- n,
- t,
- k,
- sk: shamirpoly.eval(&Scalar::from(k)),
- rk: shine::PreprocKey::preproc(&shinekeys[(k as usize) - 1]),
- });
- }
- (pubkey, seckeys)
- }
- fn hash2(combcomm: &RistrettoPoint, pk: &PubKey, msg: &[u8]) -> Scalar {
- let mut hash = Sha256::new();
- hash.update(combcomm.compress().as_bytes());
- hash.update(pk.compress().as_bytes());
- hash.update(msg);
- let mut hashval = [0u8; 32];
- hashval[0..32].copy_from_slice(&hash.finalize());
- Scalar::from_bytes_mod_order(hashval)
- }
- fn hash3(pk: &PubKey, coalition: &[u32], msg: &[u8]) -> [u8; 32] {
- let mut hash = Sha256::new();
- hash.update(pk.compress().as_bytes());
- hash.update(coalition.len().to_le_bytes());
- for c in coalition {
- hash.update(c.to_le_bytes());
- }
- hash.update(msg);
- hash.finalize().into()
- }
- pub fn sign1(pk: &PubKey, sk: &SecKey, coalition: &[u32], msg: &[u8]) -> RistrettoPoint {
- assert!(coalition.len() >= 2 * (sk.t as usize) - 1);
- let w = hash3(pk, coalition, msg);
- shine::commit(&sk.rk.partialeval(&w))
- }
- pub fn sign2_polys(
- pk: &PubKey,
- sk: &SecKey,
- coalition: &[u32],
- lag_polys: &[ScalarPoly],
- msg: &[u8],
- commitments: &[RistrettoPoint],
- ) -> Option<Scalar> {
- // If the inputs are _malformed_, abort
- assert!(coalition.len() == lag_polys.len());
- assert!(coalition.len() == commitments.len());
- assert!(coalition.len() >= 2 * (sk.t as usize) - 1);
- // Find my own entry in the coalition; abort if it's not there
- let kindex = coalition.iter().position(|&k| k == sk.k).unwrap();
- let w = hash3(pk, coalition, msg);
- let my_eval = sk.rk.partialeval(&w);
- let my_commit = shine::commit(&my_eval);
- assert!(commitments[kindex] == my_commit);
- // If the inputs are just corrupt values from malicious other
- // parties, return None but don't crash
- let combcomm = shine::combinecomm_polys(sk.t, lag_polys, commitments)?;
- let c = hash2(&combcomm, pk, msg);
- Some(my_eval + c * sk.sk)
- }
- pub fn sign2(
- pk: &PubKey,
- sk: &SecKey,
- coalition: &[u32],
- msg: &[u8],
- commitments: &[RistrettoPoint],
- ) -> Option<Scalar> {
- let polys = lagrange_polys(coalition);
- sign2_polys(pk, sk, coalition, &polys, msg, commitments)
- }
- pub fn combine_polys(
- pk: &PubKey,
- t: u32,
- coalition: &[u32],
- lag_polys: &[ScalarPoly],
- msg: &[u8],
- commitments: &[RistrettoPoint],
- sigshares: &[Scalar],
- ) -> Option<Signature> {
- assert!(coalition.len() == lag_polys.len());
- assert!(coalition.len() == commitments.len());
- assert!(coalition.len() == sigshares.len());
- assert!(coalition.len() >= 2 * (t as usize) - 1);
- let z = interpolate_polys_0(lag_polys, sigshares);
- // Check the answer
- let combcomm = shine::combinecomm_polys(t, lag_polys, commitments)?;
- let c = hash2(&combcomm, pk, msg);
- if shine::commit(&z) == combcomm + c * pk {
- return Some((combcomm, z));
- }
- None
- }
- pub fn combine(
- pk: &PubKey,
- t: u32,
- coalition: &[u32],
- msg: &[u8],
- commitments: &[RistrettoPoint],
- sigshares: &[Scalar],
- ) -> Option<Signature> {
- let polys = lagrange_polys(coalition);
- combine_polys(pk, t, coalition, &polys, msg, commitments, sigshares)
- }
- pub fn verify(pk: &PubKey, msg: &[u8], sig: &Signature) -> bool {
- let c = hash2(&sig.0, pk, msg);
- shine::commit(&sig.1) == sig.0 + c * pk
- }
- #[test]
- pub fn test_arctic_good() {
- let n = 7u32;
- let t = 4u32;
- let (pubkey, seckeys) = keygen(n, t);
- let coalition = (1..=n).collect::<Vec<u32>>();
- let msg = b"A message to be signed";
- let commits: Vec<RistrettoPoint> = seckeys
- .iter()
- .map(|key| sign1(&pubkey, key, &coalition, msg))
- .collect();
- let sigshares: Vec<Scalar> = seckeys
- .iter()
- .map(|key| sign2(&pubkey, key, &coalition, msg, &commits).unwrap())
- .collect();
- let sig = combine(&pubkey, t, &coalition, msg, &commits, &sigshares).unwrap();
- assert!(verify(&pubkey, msg, &sig));
- }
- #[test]
- #[should_panic]
- pub fn test_arctic_bad1() {
- let n = 7u32;
- let t = 4u32;
- let (pubkey, seckeys) = keygen(n, t);
- let coalition = (1..=n).collect::<Vec<u32>>();
- let msg = b"A message to be signed";
- let mut commits: Vec<RistrettoPoint> = seckeys
- .iter()
- .map(|key| sign1(&pubkey, key, &coalition, msg))
- .collect();
- // Modify player 1's commitment
- let v = commits[1];
- commits[0] += v;
- // Player 1 should abort because its own commit is no longer in the
- // list
- sign2(&pubkey, &seckeys[0], &coalition, msg, &commits);
- }
- #[test]
- pub fn test_arctic_bad2() {
- let n = 7u32;
- let t = 4u32;
- let (pubkey, seckeys) = keygen(n, t);
- let coalition = (1..=n).collect::<Vec<u32>>();
- let msg = b"A message to be signed";
- let mut commits: Vec<RistrettoPoint> = seckeys
- .iter()
- .map(|key| sign1(&pubkey, key, &coalition, msg))
- .collect();
- // Modify player 1's commitment
- let v = commits[1];
- commits[0] += v;
- // Player 2 should return None because the commitments are
- // inconsistent
- assert_eq!(sign2(&pubkey, &seckeys[1], &coalition, msg, &commits), None);
- }
- #[test]
- pub fn test_arctic_bad3() {
- let n = 7u32;
- let t = 4u32;
- let (pubkey, seckeys) = keygen(n, t);
- let coalition = (1..=n).collect::<Vec<u32>>();
- let msg = b"A message to be signed";
- let commits: Vec<RistrettoPoint> = seckeys
- .iter()
- .map(|key| sign1(&pubkey, key, &coalition, msg))
- .collect();
- let mut sigshares: Vec<Scalar> = seckeys
- .iter()
- .map(|key| sign2(&pubkey, key, &coalition, msg, &commits).unwrap())
- .collect();
- // Modify player 0's signature share
- sigshares[0] += Scalar::one();
- // Combine should return None because the shares don't combine to a
- // valid signature
- assert_eq!(
- combine(&pubkey, t, &coalition, msg, &commits, &sigshares),
- None
- );
- }
- #[test]
- pub fn test_arctic_bad4() {
- let n = 7u32;
- let t = 4u32;
- let (pubkey, seckeys) = keygen(n, t);
- let coalition = (1..=n).collect::<Vec<u32>>();
- let msg = b"A message to be signed";
- let commits: Vec<RistrettoPoint> = seckeys
- .iter()
- .map(|key| sign1(&pubkey, key, &coalition, msg))
- .collect();
- let sigshares: Vec<Scalar> = seckeys
- .iter()
- .map(|key| sign2(&pubkey, key, &coalition, msg, &commits).unwrap())
- .collect();
- // Modify the message
- let msg2 = b"A message to be signef";
- assert_eq!(
- combine(&pubkey, t, &coalition, msg2, &commits, &sigshares),
- None
- );
- }
|