Update KeyInit

entropyxyz · Jan 3, 2025 · 622fff1 · 622fff1
1 parent 3b49322
commit 622fff1
Show file tree

Hide file tree

Showing 7 changed files with 428 additions and 112 deletions.
diff --git a/synedrion/src/cggmp21.rs b/synedrion/src/cggmp21.rs
@@ -19,6 +19,9 @@ mod sigma;
 #[cfg(test)]
 mod signing_malicious;
 
+#[cfg(test)]
+mod key_init_malicious;
+
 pub use aux_gen::{AuxGen, AuxGenProtocol};
 pub use entities::{AuxInfo, KeyShare, KeyShareChange};
 pub use interactive_signing::{InteractiveSigning, InteractiveSigningProtocol, PrehashedMessage};

diff --git a/synedrion/src/cggmp21/entities.rs b/synedrion/src/cggmp21/entities.rs
@@ -24,12 +24,12 @@ use crate::{
 /// The result of the KeyInit protocol.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct KeyShare<P, I: Ord> {
-    pub(crate) owner: I,
+    owner: I,
     /// Secret key share of this node.
-    pub(crate) secret_share: Secret<Scalar>, // `x_i`
-    pub(crate) public_shares: BTreeMap<I, Point>, // `X_j`
+    secret_share: Secret<Scalar>, // `x_i`
+    public_shares: BTreeMap<I, Point>, // `X_j`
     // TODO (#27): this won't be needed when Scalar/Point are a part of `P`
-    pub(crate) phantom: PhantomData<P>,
+    phantom: PhantomData<P>,
 }
 
 /// The result of the AuxGen protocol.
@@ -125,7 +125,23 @@ pub(crate) struct PresigningValues<P: SchemeParams> {
     pub(crate) hat_cap_f: Ciphertext<P::Paillier>,
 }
 
-impl<P: SchemeParams, I: Clone + Ord + PartialEq + Debug> KeyShare<P, I> {
+impl<P: SchemeParams, I: Clone + Ord + Debug> KeyShare<P, I> {
+    pub(crate) fn new(
+        owner: I,
+        secret_share: Secret<Scalar>,
+        public_shares: BTreeMap<I, Point>,
+    ) -> Result<Self, LocalError> {
+        if public_shares.values().sum::<Point>() == Point::IDENTITY {
+            return Err(LocalError::new("Key shares add up to zero"));
+        }
+        Ok(KeyShare {
+            owner,
+            secret_share,
+            public_shares,
+            phantom: PhantomData,
+        })
+    }
+
     /// Updates a key share with a change obtained from KeyRefresh protocol.
     pub fn update(self, change: KeyShareChange<P, I>) -> Result<Self, LocalError> {
         if self.owner != change.owner {
@@ -217,6 +233,14 @@ impl<P: SchemeParams, I: Clone + Ord + PartialEq + Debug> KeyShare<P, I> {
         &self.owner
     }
 
+    pub(crate) fn secret_share(&self) -> &Secret<Scalar> {
+        &self.secret_share
+    }
+
+    pub(crate) fn public_shares(&self) -> &BTreeMap<I, Point> {
+        &self.public_shares
+    }
+
     /// Returns the set of parties holding other shares from the set.
     pub fn all_parties(&self) -> BTreeSet<I> {
         self.public_shares.keys().cloned().collect()

diff --git a/synedrion/src/cggmp21/interactive_signing.rs b/synedrion/src/cggmp21/interactive_signing.rs
@@ -152,7 +152,7 @@ impl<P: SchemeParams, I: PartyId> EntryPoint<I> for InteractiveSigning<P, I> {
         }
 
         let other_ids = key_share
-            .public_shares
+            .public_shares()
             .keys()
             .cloned()
             .collect::<BTreeSet<_>>()
@@ -164,7 +164,7 @@ impl<P: SchemeParams, I: PartyId> EntryPoint<I> for InteractiveSigning<P, I> {
         let ssid_hash = FofHasher::new_with_dst(b"ShareSetID")
             .chain_type::<P>()
             .chain(&shared_randomness)
-            .chain(&key_share.public_shares)
+            .chain(&key_share.public_shares())
             .chain(&aux_info.public_aux)
             .finalize();
 
@@ -221,11 +221,11 @@ struct Context<P: SchemeParams, I: Ord> {
 impl<P, I> Context<P, I>
 where
     P: SchemeParams,
-    I: Ord + Debug,
+    I: Clone + Ord + Debug,
 {
     pub fn public_share(&self, i: &I) -> Result<&Point, LocalError> {
         self.key_share
-            .public_shares
+            .public_shares()
             .get(i)
             .ok_or_else(|| LocalError::new("Missing public_share for party Id {i:?}"))
     }
@@ -507,7 +507,7 @@ impl<P: SchemeParams, I: PartyId> Round<I> for Round2<P, I> {
         let hat_s = Randomizer::random(rng, target_pk);
 
         let gamma = secret_signed_from_scalar::<P>(&self.context.gamma);
-        let x = secret_signed_from_scalar::<P>(&self.context.key_share.secret_share);
+        let x = secret_signed_from_scalar::<P>(self.context.key_share.secret_share());
 
         let others_cap_k = self
             .all_cap_k
@@ -518,7 +518,7 @@ impl<P: SchemeParams, I: PartyId> Round<I> for Round2<P, I> {
         let cap_d = others_cap_k * &gamma + Ciphertext::new_with_randomizer(target_pk, &-&beta, &s);
 
         let hat_cap_f = Ciphertext::new_with_randomizer(pk, &hat_beta, &hat_r);
-        let hat_cap_d = others_cap_k * &secret_signed_from_scalar::<P>(&self.context.key_share.secret_share)
+        let hat_cap_d = others_cap_k * &secret_signed_from_scalar::<P>(self.context.key_share.secret_share())
             + Ciphertext::new_with_randomizer(target_pk, &-&hat_beta, &hat_s);
 
         let cap_g = self.all_cap_g.get(&self.context.my_id).ok_or(LocalError::new(format!(
@@ -737,7 +737,7 @@ impl<P: SchemeParams, I: PartyId> Round<I> for Round2<P, I> {
 
         let hat_alpha_sum: SecretSigned<_> = payloads.values().map(|payload| &payload.hat_alpha).sum();
         let hat_beta_sum: SecretSigned<_> = artifacts.values().map(|artifact| &artifact.hat_beta).sum();
-        let chi = secret_signed_from_scalar::<P>(&self.context.key_share.secret_share)
+        let chi = secret_signed_from_scalar::<P>(self.context.key_share.secret_share())
             * secret_signed_from_scalar::<P>(&self.context.k)
             + &hat_alpha_sum
             + &hat_beta_sum;
@@ -1257,7 +1257,7 @@ impl<P: SchemeParams, I: PartyId> Round<I> for Round4<P, I> {
                 let p_aff_g = AffGProof::<P>::new(
                     rng,
                     AffGSecretInputs {
-                        x: &secret_signed_from_scalar::<P>(&self.context.key_share.secret_share),
+                        x: &secret_signed_from_scalar::<P>(self.context.key_share.secret_share()),
                         y: &values.hat_beta,
                         rho: &values.hat_s,
                         rho_y: &values.hat_r,
@@ -1293,7 +1293,7 @@ impl<P: SchemeParams, I: PartyId> Round<I> for Round4<P, I> {
 
         // mul* proofs
 
-        let x = &self.context.key_share.secret_share;
+        let x = &self.context.key_share.secret_share();
         let cap_x = self.context.public_share(&my_id)?;
 
         let rho = Randomizer::random(rng, pk);