tsslib 0.2.7

Easy-to-use threshold signature schemes (FROST, ML-DSA, DKLs23) — wire- and save-data-compatible with the Go tss-lib.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

//! FROST(ristretto255, SHA-512) ciphersuite — RFC 9591 §6.2.

use super::{Ciphersuite, Scalar};
use purecrypto::ec::ristretto255::{CompressedRistretto, RistrettoPoint};
use purecrypto::hash::sha512;

/// The FROST(ristretto255, SHA-512) ciphersuite domain separator (RFC 9591 §6.2.4).
/// Unlike Ed25519, every H1..H5 includes this prefix — ristretto255 signatures
/// are FROST-specific, not constrained to verify under a stock verifier.
const CONTEXT_STRING: &[u8] = b"FROST-RISTRETTO255-SHA512-v1";

/// FROST(ristretto255, SHA-512). Signatures are 32-byte `R` || 32-byte `S` in
/// the natural Ristretto255 format; not Ed25519-compatible.
pub struct Ristretto255;

impl Ciphersuite for Ristretto255 {
    type Point = RistrettoPoint;

    const NAME: &'static str = "ristretto255";

    fn context_string() -> &'static [u8] {
        CONTEXT_STRING
    }

    fn generator() -> RistrettoPoint {
        RistrettoPoint::basepoint()
    }

    fn identity() -> RistrettoPoint {
        RistrettoPoint::identity()
    }

    fn add(a: &RistrettoPoint, b: &RistrettoPoint) -> RistrettoPoint {
        a.add(b)
    }

    fn negate(a: &RistrettoPoint) -> RistrettoPoint {
        a.negate()
    }

    fn scalar_mul(p: &RistrettoPoint, s: &Scalar) -> RistrettoPoint {
        p.mul(s)
    }

    fn mul_base(s: &Scalar) -> RistrettoPoint {
        RistrettoPoint::mul_base(s)
    }

    fn eq(a: &RistrettoPoint, b: &RistrettoPoint) -> bool {
        bool::from(a.ct_eq(b))
    }

    fn is_identity(p: &RistrettoPoint) -> bool {
        bool::from(p.ct_eq(&RistrettoPoint::identity()))
    }

    fn encode_point(p: &RistrettoPoint) -> [u8; 32] {
        p.compress().to_bytes()
    }

    fn decode_point(b: &[u8; 32]) -> Option<RistrettoPoint> {
        // Ristretto255 is a prime-order group: no cofactor clearing needed, and
        // decompress already rejects non-canonical encodings (RFC 9496 §4.3.1).
        CompressedRistretto::from_slice(b).decompress()
    }

    fn h1(msg: &[u8]) -> Scalar {
        hash_to_scalar(b"rho", msg)
    }

    fn h2(msg: &[u8]) -> Scalar {
        hash_to_scalar(b"chal", msg)
    }

    fn h3(msg: &[u8]) -> Scalar {
        hash_to_scalar(b"nonce", msg)
    }

    fn h4(msg: &[u8]) -> [u8; 64] {
        sha512(&concat(&[CONTEXT_STRING, b"msg", msg]))
    }

    fn h5(msg: &[u8]) -> [u8; 64] {
        sha512(&concat(&[CONTEXT_STRING, b"com", msg]))
    }
}

/// SHA-512(context || tag || msg) reduced mod L.
fn hash_to_scalar(tag: &[u8], msg: &[u8]) -> Scalar {
    Scalar::from_bytes_mod_order(&sha512(&concat(&[CONTEXT_STRING, tag, msg])))
}

fn concat(parts: &[&[u8]]) -> Vec<u8> {
    let mut buf = Vec::with_capacity(parts.iter().map(|p| p.len()).sum());
    for p in parts {
        buf.extend_from_slice(p);
    }
    buf
}

#[cfg(test)]
mod tests {
    use super::*;

    fn scalar(n: u8) -> Scalar {
        let mut b = [0u8; 32];
        b[0] = n;
        Scalar::from_bytes_canonical(&b).unwrap()
    }

    #[test]
    fn generator_roundtrips_through_encoding() {
        let g = Ristretto255::generator();
        let enc = Ristretto255::encode_point(&g);
        let dec = Ristretto255::decode_point(&enc).unwrap();
        assert!(Ristretto255::eq(&g, &dec));
    }

    #[test]
    fn scalar_base_mult_matches_repeated_add() {
        let lhs = Ristretto255::mul_base(&scalar(3));
        let g = Ristretto255::generator();
        let rhs = Ristretto255::add(&Ristretto255::add(&g, &g), &g);
        assert!(Ristretto255::eq(&lhs, &rhs));
    }

    #[test]
    fn identity_and_negate() {
        assert!(Ristretto255::is_identity(&Ristretto255::identity()));
        assert!(!Ristretto255::is_identity(&Ristretto255::generator()));
        let g = Ristretto255::generator();
        assert!(Ristretto255::is_identity(&Ristretto255::add(
            &g,
            &Ristretto255::negate(&g)
        )));
    }

    #[test]
    fn h2_uses_chal_domain_not_bare() {
        // Unlike Ed25519, H2 is domain-prefixed, so it differs from bare SHA-512.
        let msg = b"x";
        let got = Ristretto255::h2(msg);
        let bare = Scalar::from_bytes_mod_order(&sha512(msg));
        assert!(!bool::from(got.ct_eq(&bare)));
    }
}