Skip to content

Commit 84ed1d6

Browse files
nickfarrownickfarrow
committed
use schnorr for pops
1 parent 23774c1 commit 84ed1d6

1 file changed

Lines changed: 58 additions & 59 deletions

File tree

‎schnorr_fun/src/frost.rs‎

Lines changed: 58 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ impl FrostKey {
310310
}
311311
}
312312

313-
impl<H: Digest<OutputSize = U32> + Clone, NG: AddTag> Frost<H, NG> {
313+
impl<H: Digest<OutputSize = U32> + Clone, NG: AddTag + NonceGen> Frost<H, NG> {
314314
/// Create secret shares and our proof-of-possession to be shared with other participants.
315315
///
316316
/// Secret shares are created for every other participant by evaluating our secret polynomial
@@ -322,31 +322,37 @@ impl<H: Digest<OutputSize = U32> + Clone, NG: AddTag> Frost<H, NG> {
322322
///
323323
/// ## Return value
324324
///
325-
/// Returns a vector of secret shares and a proof of possession, as a tupple.
325+
/// Returns a vector of secret shares and a proof of possession Signature
326326
/// The secret shares at index 0 is destined for participant 1.
327327
pub fn create_shares(
328328
&self,
329329
KeyGen: &KeyGen,
330330
scalar_poly: ScalarPoly,
331-
rng: &mut (impl RngCore + CryptoRng),
332-
) -> (Vec<Scalar<Secret, Zero>>, (Point, Scalar<Secret, Zero>)) {
333-
// Create proof of possession
334-
let pop_r = Scalar::random(rng);
335-
let pop_R = g!(pop_r * G).normalize();
336-
let pop_c = Scalar::from_hash(
337-
self.keygen_id_hash
338-
.clone()
339-
.add(g!({ scalar_poly.0[0].clone() } * G).normalize())
340-
.add(KeyGen.keygen_id)
341-
.add(pop_R),
342-
);
343-
let pop_z = s!(pop_c + pop_r);
331+
) -> (Vec<Scalar<Secret, Zero>>, Signature) {
332+
let key_pair = self.schnorr.new_keypair(scalar_poly.0[0].clone());
333+
let pop = self
334+
.schnorr
335+
.sign(&key_pair, Message::<Public>::plain("frost-pop", b""));
336+
337+
// /// TODO schnorr.sign -> sign empty message
338+
// // Create proof of possession
339+
// let pop_r = Scalar::random(rng);
340+
// let pop_R = g!(pop_r * G).normalize();
341+
// let pop_c = Scalar::from_hash(
342+
// self.keygen_id_hash
343+
// .clone()
344+
// .add(g!({ scalar_poly.0[0].clone() } * G).normalize())
345+
// .add(KeyGen.keygen_id)
346+
// .add(pop_R),
347+
// );
348+
// let pop_z = s!(pop_c + pop_r);
349+
// dbg!(&pop_R, &pop_c, g!({ scalar_poly.0[0].clone() } * G), &pop_z);
344350

345351
let shares = (1..=KeyGen.point_polys.len())
346352
.map(|i| scalar_poly.eval(i as u32))
347353
.collect();
348354

349-
(shares, (pop_R, pop_z))
355+
(shares, pop)
350356
}
351357
}
352358

@@ -356,22 +362,27 @@ impl<H: Digest<OutputSize = U32> + Clone, NG: AddTag> Frost<H, NG> {
356362
/// ## Return value
357363
///
358364
/// Returns `bool` true if the proof of possession matches this point poly,
359-
fn verify_pop(
360-
&self,
361-
keygen_id: Point<secp256kfun::marker::EvenY>,
362-
point_poly: &PointPoly,
363-
pop: (Point, Scalar<Secret, Zero>),
364-
) -> bool {
365-
let first_point = point_poly.0[0];
366-
let (pop_R, pop_z) = pop;
367-
let pop_c = Scalar::from_hash(
368-
self.keygen_id_hash
369-
.clone()
370-
.add(first_point)
371-
.add(keygen_id)
372-
.add(pop_R),
373-
);
374-
!g!(pop_R + pop_c * first_point - pop_z * G).is_zero()
365+
fn verify_pop(&self, point_poly: &PointPoly, pop: Signature) -> bool {
366+
let (even_poly_point, _) = point_poly.0[0].into_point_with_even_y();
367+
368+
self.schnorr.verify(
369+
&even_poly_point,
370+
Message::<Public>::plain("frost-pop", b""),
371+
&pop,
372+
)
373+
374+
// let first_point = point_poly.0[0];
375+
// let (pop_R, pop_z) = pop;
376+
// let pop_c = Scalar::from_hash(
377+
// self.keygen_id_hash
378+
// .clone()
379+
// .add(first_point)
380+
// .add(keygen_id)
381+
// .add(pop_R),
382+
// );
383+
// /// TODO debug why this fail
384+
// dbg!(&pop_R, &pop_c, &first_point, &pop_z);
385+
// g!(pop_R + pop_c * first_point - pop_z * G).is_zero()
375386
}
376387
}
377388

@@ -447,20 +458,21 @@ impl<H: Digest<OutputSize = U32> + Clone, NG: AddTag> Frost<H, NG> {
447458
KeyGen: KeyGen,
448459
my_index: u32,
449460
secret_shares: Vec<Scalar<Secret, Zero>>,
450-
proofs_of_possession: Vec<(Point, Scalar<Secret, Zero>)>,
461+
proofs_of_possession: Vec<Signature>,
451462
) -> Result<(Scalar, FrostKey), FinishKeyGenError> {
452463
assert_eq!(
453464
secret_shares.len(),
454465
KeyGen.frost_key.verification_shares.len()
455466
);
467+
assert_eq!(secret_shares.len(), proofs_of_possession.len());
456468

457469
for (i, (poly, pop)) in KeyGen
458470
.point_polys
459471
.iter()
460472
.zip(proofs_of_possession)
461473
.enumerate()
462474
{
463-
if !self.verify_pop(KeyGen.keygen_id, poly, pop) {
475+
if !self.verify_pop(poly, pop) {
464476
return Err(FinishKeyGenError::InvalidProofOfPossession(i));
465477
}
466478
}
@@ -711,25 +723,6 @@ impl<H: Digest<OutputSize = U32> + Clone, NG: NonceGen + AddTag> Frost<H, NG> {
711723
}
712724
}
713725

714-
/// Allows getting the FrostKey
715-
// TODO seal this trait
716-
pub trait GetFrostKey {
717-
/// Get Frost key
718-
fn get_frost_key(&self) -> &FrostKey;
719-
}
720-
721-
impl GetFrostKey for KeyGen {
722-
fn get_frost_key(&self) -> &FrostKey {
723-
&self.frost_key
724-
}
725-
}
726-
727-
impl GetFrostKey for FrostKey {
728-
fn get_frost_key(&self) -> &FrostKey {
729-
&self
730-
}
731-
}
732-
733726
#[cfg(test)]
734727
mod test {
735728
use super::*;
@@ -743,7 +736,12 @@ mod test {
743736

744737
proptest! {
745738
#[test]
746-
fn frost_prop_test(n_parties in 3u32..8, something in any::<u32>()) {
739+
fn frost_prop_test(n_parties in 3u32..8) {
740+
// Two tweaks
741+
// Threshold
742+
// Create shares -- use noncegen from schnorr
743+
// Threshold type for proptest ()
744+
747745
let mut rng = rand::thread_rng();
748746
let threshold = rng.gen_range(2..=n_parties);
749747
let frost = Frost::new(Schnorr::<Sha256, Deterministic<Sha256>>::new(
@@ -759,7 +757,7 @@ mod test {
759757
let mut proofs_of_possession= vec![];
760758
let mut shares_vec = vec![];
761759
for sp in scalar_polys {
762-
let (shares, pop) = frost.create_shares(&KeyGen, sp, &mut rng);
760+
let (shares, pop) = frost.create_shares(&KeyGen, sp);
763761
proofs_of_possession.push(pop);
764762
shares_vec.push(shares);
765763
}
@@ -791,8 +789,8 @@ mod test {
791789
} else {
792790
rng.gen_range(threshold..=n_parties)
793791
};
792+
/// Threshold mask
794793
let signer_indexes = (0..n_parties).choose_multiple(&mut rng, n_signers as usize);
795-
796794
let sid = frost_keys[0].joint_public_key.to_bytes();
797795

798796
let nonces: Vec<NonceKeyPair> = signer_indexes.iter().map(|i| frost.gen_nonce(&secret_shares[*i as usize], &sid)).collect();
@@ -816,6 +814,7 @@ mod test {
816814
}
817815

818816
// TODO get this session from loop above
817+
// assert same and use one
819818
let session = frost.start_sign_session(&frost_keys[signer_indexes[0] as usize], recieved_nonces.clone(), Message::plain("test", b"test"));
820819
let combined_sig = frost.combine_signature_shares(&frost_keys[signer_indexes[0] as usize], &session, signatures);
821820

@@ -847,9 +846,9 @@ mod test {
847846
];
848847

849848
let KeyGen = frost.new_keygen(point_polys).unwrap();
850-
let (shares1, pop1) = frost.create_shares(&KeyGen, sp1, &mut rng);
851-
let (shares2, pop2) = frost.create_shares(&KeyGen, sp2, &mut rng);
852-
let (shares3, pop3) = frost.create_shares(&KeyGen, sp3, &mut rng);
849+
let (shares1, pop1) = frost.create_shares(&KeyGen, sp1);
850+
let (shares2, pop2) = frost.create_shares(&KeyGen, sp2);
851+
let (shares3, pop3) = frost.create_shares(&KeyGen, sp3);
853852
let proofs_of_possession = vec![pop1, pop2, pop3];
854853

855854
let (secret_share1, mut frost_key) = frost

0 commit comments

Comments
 (0)