Use Polynomial from generic-ec

Cargo.toml

@@ -4,3 +4,8 @@ members = [
     "tests",
 ]
 
+[patch."https://github.com/dfns-labs/generic-ec".generic-ec]
+path = "../generic-ec/generic-ec"
+
+[patch."https://github.com/dfns-labs/generic-ec".generic-ec-zkp]
+path = "../generic-ec/generic-ec-zkp"

cggmp21/Cargo.toml

@@ -8,8 +8,8 @@ license = "MIT OR Apache-2.0"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-generic-ec = { git = "https://github.com/dfns-labs/generic-ec", branch = "d", features = ["serde"] }
-generic-ec-zkp = { git = "https://github.com/dfns-labs/generic-ec", branch = "d", features = ["serde"] }
+generic-ec = { git = "https://github.com/dfns-labs/generic-ec", branch = "m", features = ["serde"] }
+generic-ec-zkp = { git = "https://github.com/dfns-labs/generic-ec", branch = "m", features = ["serde"] }
 round-based = { git = "https://github.com/Zengo-X/round-based-protocol", branch = "round-based2", features = ["derive"] }
 
 paillier-zk = { git = "https://github.com/dfns-labs/paillier-zk", branch = "m", default-features = false, features = ["serde"] }

cggmp21/src/key_share.rs

@@ -5,14 +5,14 @@ use std::{fmt, ops};
 
 use generic_ec::serde::{Compact, CurveName};
 use generic_ec::{Curve, NonZero, Point, Scalar, SecretScalar};
+use generic_ec_zkp::polynomial::lagrange_coefficient;
 use paillier_zk::libpaillier::unknown_order::BigNumber;
 use paillier_zk::paillier_encryption_in_range as π_enc;
 use serde::{Deserialize, Serialize};
 use serde_with::serde_as;
 use thiserror::Error;
 
 use crate::security_level::SecurityLevel;
-use crate::utils::lagrange_coefficient;
 
 /// Key share
 ///
@@ -169,7 +169,8 @@ impl<E: Curve> DirtyIncompleteKeyShare<E> {
         let first_t_shares = &self.public_shares[0..usize::from(t)];
         let indexes = &vss_setup.I[0..usize::from(t)];
         let interpolation = |x: Scalar<E>| {
-            let lagrange_coefficients = (0..t).map(|j| lagrange_coefficient(x, j, indexes));
+            let lagrange_coefficients =
+                (0..usize::from(t)).map(|j| lagrange_coefficient(x, j, indexes));
             lagrange_coefficients
                 .zip(first_t_shares)
                 .try_fold(Point::zero(), |acc, (lambda_j, X_j)| {
@@ -450,7 +451,8 @@ pub fn reconstruct_secret_key<E: Curve>(
     if let Some(VssSetup { I, .. }) = vss {
         let S = key_shares.iter().map(|s| s.core().i).collect::<Vec<_>>();
         let I = subset(&S, I).ok_or(ReconstructErrorReason::Subset)?;
-        let lagrange_coefficients = (0..t).map(|j| lagrange_coefficient(Scalar::zero(), j, &I));
+        let lagrange_coefficients =
+            (0..usize::from(t)).map(|j| lagrange_coefficient(Scalar::zero(), j, &I));
         let mut sk = lagrange_coefficients
             .zip(key_shares)
             .try_fold(Scalar::zero(), |acc, (lambda_j, key_share_j)| {

cggmp21/src/keygen/threshold.rs

@@ -4,6 +4,7 @@ use generic_ec::hash_to_curve::{self, FromHash};
 use generic_ec::{Curve, NonZero, Point, Scalar, SecretScalar};
 use generic_ec_zkp::{
     hash_commitment::{self, HashCommit},
+    polynomial::Polynomial,
     schnorr_pok,
 };
 use rand_core::{CryptoRng, RngCore};
@@ -49,7 +50,7 @@ pub struct MsgRound1<D: Digest> {
 pub struct MsgRound2Broad<E: Curve, L: SecurityLevel, D: Digest> {
     #[serde(with = "hex::serde")]
     pub rid: L::Rid,
-    pub Ss: Vec<Point<E>>,
+    pub F: Polynomial<Point<E>>,
     pub sch_commit: schnorr_pok::Commit<E>,
     pub decommit: hash_commitment::DecommitNonce<D>,
 }
@@ -115,15 +116,12 @@ where
 
     let (r, h) = schnorr_pok::prover_commits_ephemeral_secret::<E, _>(rng);
 
-    let ss = utils::sample_polynomial(usize::from(t), rng);
-    let Ss = ss
-        .iter()
-        .map(|s| Point::generator() * s)
-        .collect::<Vec<_>>();
+    let f = Polynomial::<SecretScalar<E>>::sample(rng, usize::from(t) - 1);
+    let F = &f * &Point::generator();
     let sigmas = (0..n)
         .map(|j| {
             let x = Scalar::from(j + 1);
-            utils::polynomial_value(Scalar::zero(), &x, &ss)
+            f.value(&x)
         })
         .collect::<Vec<_>>();
     debug_assert_eq!(sigmas.len(), usize::from(n));
@@ -135,7 +133,7 @@ where
         .mix(i)
         .mix(t)
         .mix_bytes(&rid)
-        .mix_many(Ss.iter())
+        .mix_many(F.coefs())
         .mix(h.0)
         .commit(rng);
 
@@ -200,7 +198,7 @@ where
     tracer.send_msg();
     let my_decommitment = MsgRound2Broad {
         rid,
-        Ss: Ss.clone(),
+        F: F.clone(),
         sch_commit: h,
         decommit,
     };
@@ -247,7 +245,7 @@ where
                 .mix(j)
                 .mix(t)
                 .mix_bytes(&decommitment.rid)
-                .mix_many(decommitment.Ss.iter())
+                .mix_many(decommitment.F.coefs())
                 .mix(decommitment.sch_commit.0)
                 .verify(&commitment.commitment, &decommitment.decommit)
                 .is_err()
@@ -261,7 +259,7 @@ where
     tracer.stage("Validate data size");
     let blame = decommitments
         .iter_indexed()
-        .filter(|(_, _, d)| d.Ss.len() != usize::from(t))
+        .filter(|(_, _, d)| d.F.degree() + 1 != usize::from(t))
         .map(|t| t.0)
         .collect::<Vec<_>>();
     if !blame.is_empty() {
@@ -273,8 +271,7 @@ where
         .iter_indexed()
         .zip(sigmas_msg.iter())
         .filter(|((_, _, d), s)| {
-            utils::polynomial_value(Point::zero(), &Scalar::from(i + 1), &d.Ss)
-                != Point::generator() * s.sigma
+            d.F.value::<_, Point<_>>(&Scalar::from(i + 1)) != Point::generator() * s.sigma
         })
         .map(|t| t.0 .0)
         .collect::<Vec<_>>();
@@ -288,15 +285,12 @@ where
         .map(|d| &d.rid)
         .fold(L::Rid::default(), xor_array);
     tracer.stage("Compute Ys");
+    let polynomial_sum = decommitments
+        .iter_including_me(&my_decommitment)
+        .map(|d| &d.F)
+        .sum::<Polynomial<_>>();
     let ys = (0..n)
-        .map(|l| {
-            let polynomial_sum = utils::polynomials_sum(
-                decommitments
-                    .iter_including_me(&my_decommitment)
-                    .map(|d| d.Ss.as_slice()),
-            );
-            utils::polynomial_value(Point::zero(), &Scalar::from(l + 1), &polynomial_sum)
-        })
+        .map(|l| polynomial_sum.value(&Scalar::from(l + 1)))
         .collect::<Vec<_>>();
     tracer.stage("Compute sigma");
     let sigma: Scalar<E> = sigmas_msg.iter().map(|msg| msg.sigma).sum();
@@ -370,7 +364,7 @@ where
     tracer.stage("Derive resulting public key and other data");
     let y: Point<E> = decommitments
         .iter_including_me(&my_decommitment)
-        .map(|d| d.Ss[0])
+        .map(|d| d.F.coefs()[0])
         .sum();
     let key_shares_indexes = (1..=n)
         .map(|i| NonZero::from_scalar(Scalar::from(i)))

cggmp21/src/signing.rs

@@ -3,6 +3,7 @@ use futures::SinkExt;
 use generic_ec::{
     coords::AlwaysHasAffineX, hash_to_curve::FromHash, Curve, NonZero, Point, Scalar, SecretScalar,
 };
+use generic_ec_zkp::polynomial::lagrange_coefficient;
 use paillier_zk::libpaillier::{unknown_order::BigNumber, DecryptionKey};
 use paillier_zk::{
     group_element_vs_paillier_encryption_in_range as pi_log,
@@ -20,7 +21,7 @@ use thiserror::Error;
 use crate::errors::IoError;
 use crate::key_share::{KeyShare, PartyAux, VssSetup};
 use crate::progress::Tracer;
-use crate::utils::{hash_message, iter_peers, lagrange_coefficient, subset, HashMessageError};
+use crate::utils::{hash_message, iter_peers, subset, HashMessageError};
 use crate::{
     key_share::InvalidKeyShare,
     security_level::SecurityLevel,
@@ -362,10 +363,11 @@ where
         let I = subset(S, I).ok_or(Bug::Subset)?;
         let X = subset(S, &key_share.core.public_shares).ok_or(Bug::Subset)?;
 
-        let lambda_i = lagrange_coefficient(Scalar::zero(), i, &I).ok_or(Bug::LagrangeCoef)?;
+        let lambda_i =
+            lagrange_coefficient(Scalar::zero(), usize::from(i), &I).ok_or(Bug::LagrangeCoef)?;
         let x_i = SecretScalar::new(&mut (lambda_i * &key_share.core.x));
 
-        let lambda = (0..t).map(|j| lagrange_coefficient(Scalar::zero(), j, &I));
+        let lambda = (0..t).map(|j| lagrange_coefficient(Scalar::zero(), usize::from(j), &I));
         let X = lambda
             .zip(&X)
             .map(|(lambda_j, X_j)| Some(lambda_j? * X_j))

cggmp21/src/trusted_dealer.rs

@@ -17,20 +17,20 @@
 
 use std::{iter, marker::PhantomData};
 
+use generic_ec::{Curve, NonZero, Point, Scalar, SecretScalar};
+use generic_ec_zkp::polynomial::Polynomial;
 use paillier_zk::libpaillier::unknown_order::BigNumber;
 use paillier_zk::BigNumberExt;
 use rand_core::{CryptoRng, RngCore};
 use thiserror::Error;
 
-use generic_ec::{Curve, NonZero, Point, Scalar, SecretScalar};
-
 use crate::{
     key_share::{
         DirtyAuxInfo, DirtyIncompleteKeyShare, DirtyKeyShare, IncompleteKeyShare, InvalidKeyShare,
         KeyShare, PartyAux, VssSetup,
     },
     security_level::SecurityLevel,
-    utils::{polynomial_value, sample_bigint_in_mult_group},
+    utils::sample_bigint_in_mult_group,
 };
 
 /// Construct a trusted dealer builder
@@ -110,14 +110,11 @@ impl<E: Curve, L: SecurityLevel> TrustedDealerBuilder<E, L> {
             .collect::<Option<Vec<_>>>()
             .ok_or(Reason::DeriveKeyShareIndex)?;
         let (shared_public_key, secret_shares) = if let Some(t) = self.t {
-            let polynomial_coef = iter::once(shared_secret_key)
-                .chain(iter::repeat_with(|| SecretScalar::<E>::random(rng)).take((t - 1).into()))
-                .collect::<Vec<_>>();
-            let f = |x: &Scalar<E>| polynomial_value(Scalar::zero(), x, &polynomial_coef);
-            let pk = Point::generator() * f(&Scalar::zero());
+            let f = Polynomial::sample_with_const_term(rng, usize::from(t) - 1, shared_secret_key);
+            let pk = Point::generator() * f.value::<_, Scalar<_>>(&Scalar::zero());
             let shares = key_shares_indexes
                 .iter()
-                .map(|I_i| f(I_i))
+                .map(|I_i| f.value(I_i))
                 .map(|mut x_i| SecretScalar::new(&mut x_i))
                 .collect::<Vec<_>>();
             (pk, shares)