tsslib 0.2.2

Easy-to-use threshold signature schemes (FROST, ML-DSA, DKLs23) — wire- and save-data-compatible with the Go tss-lib.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

//! Feldman verifiable secret sharing over secp256k1 (for DKLs keygen).

use super::secp::{self, ProjectivePoint, Scalar};
use purecrypto::rng::RngCore;

/// Creates a degree-`t` sharing of `secret` for recipient ids `ids`. Returns the
/// Feldman commitments `v_0..v_t` (`v_0 = secret·G`) and `shares[k] = f(ids[k])`.
pub fn create(
    t: usize,
    secret: &Scalar,
    ids: &[Scalar],
    rng: &mut impl RngCore,
) -> (Vec<ProjectivePoint>, Vec<Scalar>) {
    let mut poly: Vec<Scalar> = Vec::with_capacity(t + 1);
    poly.push(secret.clone());
    for _ in 0..t {
        poly.push(secp::random_scalar(rng));
    }
    let commitments: Vec<ProjectivePoint> = poly.iter().map(secp::mul_base).collect();
    let shares: Vec<Scalar> = ids.iter().map(|id| eval(&poly, id)).collect();
    (commitments, shares)
}

/// Verifies `share = f(id)` against the commitments: `share·G == Σ_c id^c · v_c`.
pub fn verify(id: &Scalar, share: &Scalar, t: usize, commitments: &[ProjectivePoint]) -> bool {
    if commitments.len() != t + 1 {
        return false;
    }
    secp::point_eq(&secp::mul_base(share), &horner_eval_points(commitments, id))
}

/// `Σ_i (commitments[i] evaluated at id)` — the point `(Σ_i f_i(id))·G`.
pub fn evaluate_commitment_sum(
    commitments: &[Vec<ProjectivePoint>],
    id: &Scalar,
) -> ProjectivePoint {
    let mut acc: Option<ProjectivePoint> = None;
    for vs in commitments {
        let e = horner_eval_points(vs, id);
        acc = Some(match acc {
            None => e,
            Some(a) => a.add(&e),
        });
    }
    acc.expect("at least one commitment")
}

/// Horner evaluation of a committed polynomial at `id`: `Σ_c id^c · v_c`.
fn horner_eval_points(vs: &[ProjectivePoint], id: &Scalar) -> ProjectivePoint {
    let mut eval = vs[vs.len() - 1];
    for k in (0..vs.len() - 1).rev() {
        eval = eval.mul(id).add(&vs[k]);
    }
    eval
}

/// Evaluates `poly[0] + poly[1]·x + …` at `x` (mod n).
fn eval(poly: &[Scalar], x: &Scalar) -> Scalar {
    let mut result = poly[0].clone();
    let mut xpow = Scalar::ONE;
    for a in &poly[1..] {
        xpow = xpow.mul(x);
        result = result.add(&a.mul(&xpow));
    }
    result
}

#[cfg(test)]
mod tests {
    use super::*;
    use purecrypto::rng::OsRng;

    #[test]
    fn shares_verify() {
        let ids: Vec<Scalar> = (1u8..=4)
            .map(|i| secp::scalar_from_be_reduce(&[i]))
            .collect();
        let secret = secp::random_scalar(&mut OsRng);
        let (commitments, shares) = create(2, &secret, &ids, &mut OsRng);
        for (id, sh) in ids.iter().zip(shares.iter()) {
            assert!(verify(id, sh, 2, &commitments));
        }
        assert!(secp::point_eq(&commitments[0], &secp::mul_base(&secret)));
    }

    #[test]
    fn tampered_share_fails() {
        let ids: Vec<Scalar> = (1u8..=3)
            .map(|i| secp::scalar_from_be_reduce(&[i]))
            .collect();
        let secret = secp::random_scalar(&mut OsRng);
        let (commitments, shares) = create(1, &secret, &ids, &mut OsRng);
        let bad = shares[0].add(&Scalar::ONE);
        assert!(!verify(&ids[0], &bad, 1, &commitments));
    }
}