Skip to content

Commit 735811d

Browse files
armfazharmfazh
committed
New tss package, and includes tss/frost threshold signature scheme
Changes: - The package tss will provide the threshold signature schemes. - The package tss/frost implements the FROST threshold signature scheme for Schnorr signatures. This scheme is under standardization process at IETF/CFRG [2]. Test vectors from [3] are passing for P256 and Ristretto255 groups. - Version supported: v11 References: [1] frost paper: https://eprint.iacr.org/2020/852 [2] draft-irtf-cfrg-frost: https://datatracker.ietf.org/doc/draft-irtf-cfrg-frost [3] test-vectors: https://github.com/cfrg/draft-irtf-cfrg-frost
1 parent 9c3d94b commit 735811d

10 files changed

+1073
-0
lines changed

‎tss/frost/combiner.go

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
package frost
2+
3+
import (
4+
"errors"
5+
"fmt"
6+
)
7+
8+
type Combiner struct {
9+
Suite
10+
threshold uint
11+
maxSigners uint
12+
}
13+
14+
func NewCombiner(s Suite, threshold, maxSigners uint) (*Combiner, error) {
15+
if threshold > maxSigners {
16+
return nil, errors.New("frost: invalid parameters")
17+
}
18+
19+
return &Combiner{Suite: s, threshold: threshold, maxSigners: maxSigners}, nil
20+
}
21+
22+
func (c Combiner) CheckSignShares(
23+
signShares []*SignShare,
24+
pubKeySigners []*PublicKey,
25+
coms []*Commitment,
26+
pubKeyGroup *PublicKey,
27+
msg []byte,
28+
) bool {
29+
if l := len(signShares); !(int(c.threshold) < l && l <= int(c.maxSigners)) {
30+
return false
31+
}
32+
if l := len(pubKeySigners); !(int(c.threshold) < l && l <= int(c.maxSigners)) {
33+
return false
34+
}
35+
if l := len(coms); !(int(c.threshold) < l && l <= int(c.maxSigners)) {
36+
return false
37+
}
38+
39+
for i := range signShares {
40+
if !signShares[i].Verify(c.Suite, pubKeySigners[i], coms[i], coms, pubKeyGroup, msg) {
41+
return false
42+
}
43+
}
44+
45+
return true
46+
}
47+
48+
func (c Combiner) Sign(msg []byte, coms []*Commitment, signShares []*SignShare) ([]byte, error) {
49+
if l := len(coms); l <= int(c.threshold) {
50+
return nil, fmt.Errorf("frost: only %v shares of %v required", l, c.threshold)
51+
}
52+
53+
bindingFactors, err := c.Suite.getBindingFactors(coms, msg)
54+
if err != nil {
55+
return nil, err
56+
}
57+
58+
groupCom, err := c.Suite.getGroupCommitment(coms, bindingFactors)
59+
if err != nil {
60+
return nil, err
61+
}
62+
63+
gcEnc, err := groupCom.MarshalBinaryCompress()
64+
if err != nil {
65+
return nil, err
66+
}
67+
68+
z := c.Suite.g.NewScalar()
69+
for i := range signShares {
70+
z.Add(z, signShares[i].s.Value)
71+
}
72+
73+
zEnc, err := z.MarshalBinary()
74+
if err != nil {
75+
return nil, err
76+
}
77+
78+
return append(append([]byte{}, gcEnc...), zEnc...), nil
79+
}

‎tss/frost/commit.go

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
package frost
2+
3+
import (
4+
"errors"
5+
"fmt"
6+
"io"
7+
"sort"
8+
9+
"github.com/cloudflare/circl/group"
10+
)
11+
12+
type Nonce struct {
13+
ID group.Scalar
14+
hiding, binding group.Scalar
15+
}
16+
17+
func (s Suite) nonceGenerate(rnd io.Reader, secret group.Scalar) (group.Scalar, error) {
18+
randomBytes := make([]byte, 32)
19+
_, err := io.ReadFull(rnd, randomBytes)
20+
if err != nil {
21+
return nil, err
22+
}
23+
secretEnc, err := secret.MarshalBinary()
24+
if err != nil {
25+
return nil, err
26+
}
27+
28+
return s.hasher.h3(append(randomBytes, secretEnc...)), nil
29+
}
30+
31+
type Commitment struct {
32+
ID group.Scalar
33+
hiding, binding group.Element
34+
}
35+
36+
func (c Commitment) MarshalBinary() ([]byte, error) {
37+
id, err := c.ID.MarshalBinary()
38+
if err != nil {
39+
return nil, err
40+
}
41+
h, err := c.hiding.MarshalBinaryCompress()
42+
if err != nil {
43+
return nil, err
44+
}
45+
b, err := c.binding.MarshalBinaryCompress()
46+
if err != nil {
47+
return nil, err
48+
}
49+
50+
return append(append(id, h...), b...), nil
51+
}
52+
53+
func encodeCommitments(coms []*Commitment) ([]byte, error) {
54+
sort.SliceStable(coms, func(i, j int) bool {
55+
return coms[i].ID.(fmt.Stringer).String() < coms[j].ID.(fmt.Stringer).String()
56+
})
57+
58+
var out []byte
59+
for i := range coms {
60+
cEnc, err := coms[i].MarshalBinary()
61+
if err != nil {
62+
return nil, err
63+
}
64+
out = append(out, cEnc...)
65+
}
66+
return out, nil
67+
}
68+
69+
type bindingFactor struct {
70+
ID group.Scalar
71+
factor group.Scalar
72+
}
73+
74+
func (s Suite) getBindingFactorFromID(bindingFactors []bindingFactor, id group.Scalar) (group.Scalar, error) {
75+
for i := range bindingFactors {
76+
if bindingFactors[i].ID.IsEqual(id) {
77+
return bindingFactors[i].factor, nil
78+
}
79+
}
80+
return nil, errors.New("frost: id not found")
81+
}
82+
83+
func (s Suite) getBindingFactors(coms []*Commitment, msg []byte) ([]bindingFactor, error) {
84+
msgHash := s.hasher.h4(msg)
85+
encodeComs, err := encodeCommitments(coms)
86+
if err != nil {
87+
return nil, err
88+
}
89+
encodeComsHash := s.hasher.h5(encodeComs)
90+
rhoInputPrefix := append(msgHash, encodeComsHash...)
91+
92+
bindingFactors := make([]bindingFactor, len(coms))
93+
for i := range coms {
94+
id, err := coms[i].ID.MarshalBinary()
95+
if err != nil {
96+
return nil, err
97+
}
98+
rhoInput := append(append([]byte{}, rhoInputPrefix...), id...)
99+
bf := s.hasher.h1(rhoInput)
100+
bindingFactors[i] = bindingFactor{ID: coms[i].ID, factor: bf}
101+
}
102+
103+
return bindingFactors, nil
104+
}
105+
106+
func (s Suite) getGroupCommitment(coms []*Commitment, bindingFactors []bindingFactor) (group.Element, error) {
107+
gc := s.g.NewElement()
108+
tmp := s.g.NewElement()
109+
for i := range coms {
110+
bf, err := s.getBindingFactorFromID(bindingFactors, coms[i].ID)
111+
if err != nil {
112+
return nil, err
113+
}
114+
tmp.Mul(coms[i].binding, bf)
115+
tmp.Add(tmp, coms[i].hiding)
116+
gc.Add(gc, tmp)
117+
}
118+
119+
return gc, nil
120+
}
121+
122+
func (s Suite) getChallenge(groupCom group.Element, pubKey *PublicKey, msg []byte) (group.Scalar, error) {
123+
gcEnc, err := groupCom.MarshalBinaryCompress()
124+
if err != nil {
125+
return nil, err
126+
}
127+
pkEnc, err := pubKey.key.MarshalBinaryCompress()
128+
if err != nil {
129+
return nil, err
130+
}
131+
chInput := append(append(append([]byte{}, gcEnc...), pkEnc...), msg...)
132+
133+
return s.hasher.h2(chInput), nil
134+
}

‎tss/frost/frost.go

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// Package frost provides the FROST threshold signature scheme for Schnorr signatures.
2+
//
3+
// References
4+
//
5+
// FROST paper: https://eprint.iacr.org/2020/852
6+
// draft-irtf-cfrg-frost: https://datatracker.ietf.org/doc/draft-irtf-cfrg-frost
7+
//
8+
// Version supported: v11
9+
package frost
10+
11+
import (
12+
"io"
13+
14+
"github.com/cloudflare/circl/group"
15+
"github.com/cloudflare/circl/secretsharing"
16+
)
17+
18+
type PrivateKey struct {
19+
Suite
20+
key group.Scalar
21+
pubKey *PublicKey
22+
}
23+
24+
type PublicKey struct {
25+
Suite
26+
key group.Element
27+
}
28+
29+
func GenerateKey(s Suite, rnd io.Reader) *PrivateKey {
30+
return &PrivateKey{s, s.g.RandomNonZeroScalar(rnd), nil}
31+
}
32+
33+
func (k *PrivateKey) Public() *PublicKey {
34+
return &PublicKey{k.Suite, k.Suite.g.NewElement().MulGen(k.key)}
35+
}
36+
37+
func (k *PrivateKey) Split(rnd io.Reader, threshold, maxSigners uint) (
38+
[]PeerSigner, secretsharing.SecretCommitment, error,
39+
) {
40+
ss := secretsharing.New(rnd, threshold, k.key)
41+
shares := ss.Share(maxSigners)
42+
43+
peers := make([]PeerSigner, len(shares))
44+
for i := range shares {
45+
peers[i] = PeerSigner{
46+
Suite: k.Suite,
47+
threshold: uint16(threshold),
48+
maxSigners: uint16(maxSigners),
49+
keyShare: secretsharing.Share{
50+
ID: shares[i].ID,
51+
Value: shares[i].Value,
52+
},
53+
myPubKey: nil,
54+
}
55+
}
56+
57+
return peers, ss.CommitSecret(), nil
58+
}
59+
60+
func Verify(s Suite, pubKey *PublicKey, msg, signature []byte) bool {
61+
params := s.g.Params()
62+
Ne, Ns := params.CompressedElementLength, params.ScalarLength
63+
if len(signature) < int(Ne+Ns) {
64+
return false
65+
}
66+
67+
REnc := signature[:Ne]
68+
R := s.g.NewElement()
69+
err := R.UnmarshalBinary(REnc)
70+
if err != nil {
71+
return false
72+
}
73+
74+
zEnc := signature[Ne : Ne+Ns]
75+
z := s.g.NewScalar()
76+
err = z.UnmarshalBinary(zEnc)
77+
if err != nil {
78+
return false
79+
}
80+
81+
pubKeyEnc, err := pubKey.key.MarshalBinaryCompress()
82+
if err != nil {
83+
return false
84+
}
85+
86+
chInput := append(append(append([]byte{}, REnc...), pubKeyEnc...), msg...)
87+
c := s.hasher.h2(chInput)
88+
89+
l := s.g.NewElement().MulGen(z)
90+
r := s.g.NewElement().Mul(pubKey.key, c)
91+
r.Add(r, R)
92+
93+
return l.IsEqual(r)
94+
}

0 commit comments

Comments
 (0)