frostrb 0.1.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09af4e893de9e1260635431b1feef84a9eb6273534f0f9e7e2e4bcde82d8788e'
-  data.tar.gz: 66f39e7bff887c34c65844ac42b94d8e77cdd7fb86caedb575d8ae0a7c0b12a1
+  metadata.gz: e3824b64152fafddb21b2189891156852ec6a3b079274d81cbe6e0d5732ee848
+  data.tar.gz: 8e28eeb4c71d9b4d9636e922fd71772c86b98819c4ed2f4ea7416dc085961a7b
 SHA512:
-  metadata.gz: ba8c33e24ace6174176ec30bb5afaf0222e6c5046df34960ca28c8772286c236611bdb119c3184448fc308f491d1408e57a7fa1c715e3a7e0036e557a6788c46
-  data.tar.gz: b738d2fe05fa151032e9ff877758f580d6d96153ce179b384a95d6e353ce3e5003638622afbdfd2a4c219825d45f77e78f3e5238484b4cb34de5f8e8de8b768a
+  metadata.gz: 26b6c5dbfa59991e7ab0f6bddb11ca1dd4219cdd5c6101fb62d106fd7d982c5afb2107149332cba55db3448afce3286b4807a32415f2bcc8b63b90e00871e298
+  data.tar.gz: b80e53aaaff5733bf0b5f1091f2a2a7c5903fbb008551e8924aa285b61e2e8044a2f594a481f5cfca2aefe5fd72de101b6ae9e4533e7b623a6c30687052a652f

data/README.md

@@ -80,26 +80,27 @@ DKG can be run as below.
 max_signer = 5
 min_signer = 3
 
-secrets = {}
+secret_packages = {}
 round1_outputs = {}
 # Round 1:
 # For each participant, perform the first part of the DKG protocol.
 1.upto(max_signer) do |i|
-  polynomial, package = FROST::DKG.part1(i, min_signer, max_signer, group)
-  secrets[i] = polynomial
-  round1_outputs[i] = package
+  secret_package = FROST::DKG.generate_secret(i, min_signer, max_signer, group)
+  secret_packages[i] = secret_package
+  round1_outputs[i] = secret_package.public_package
 end
 
 # Each participant sends their commitments and proof to other participants.
 received_package = {}
 1.upto(max_signer) do |i|
-  received_package[i] = round1_outputs.select {|k, _| k != i}.values
+  received_package[i] = round1_outputs.select { |k, _| k != i }.values
 end
 
 # Each participant verify knowledge of proof in received package.
 received_package.each do |id, packages|
+  secret_package = secret_packages[id]
   packages.each do |package|
-    expect(FROST::DKG.verify_proof_of_knowledge(package)).to be true
+    expect(FROST::DKG.verify_proof_of_knowledge(secret_package, package)).to be true
   end
 end
 
@@ -107,18 +108,18 @@ end
 # Each participant generate share for other participants and send it.
 received_shares = {}
 1.upto(max_signer) do |i|
-  polynomial = secrets[i] # own secret
+  secret_package = secret_packages[i] # own secret
   1.upto(max_signer) do |o|
     next if i == o
     received_shares[o] ||= []
-    received_shares[o] << [i, polynomial.gen_share(o)]
+    received_shares[o] << [i, secret_package.gen_share(o)]
   end
 end
 
 # Each participant verify received shares.
 1.upto(max_signer) do |i|
   received_shares[i].each do |send_by, share|
-    target_package = received_package[i].find{ |package| package.identifier == send_by }
+    target_package = received_package[i].find { |package| package.identifier == send_by }
     expect(target_package.verify_share(share)).to be true
   end
 end
@@ -126,12 +127,51 @@ end
 # Each participant compute signing share.
 signing_shares = {}
 1.upto(max_signer) do |i|
-  shares = received_shares[i].map{|_, share| share}
-  signing_shares[i] = FROST::DKG.compute_signing_share(secrets[i], shares)
+  shares = received_shares[i].map { |_, share| share }
+  signing_shares[i] = FROST::DKG.compute_signing_share(secret_packages[i], shares)
 end
 
 # Participant 1 compute group public key.
-group_pubkey = FROST::DKG.compute_group_pubkey(secrets[1], received_package[1])
+group_pubkey = FROST::DKG.compute_group_pubkey(secret_packages[1], received_package[1])
 
 # The subsequent signing phase is the same as above with signing_shares as the secret.
-```
+```
+
+### Share repair
+
+Using `FROST::Repairable` module, you can repair existing (or new) participant's share with the cooperation of T participants.
+
+```ruby
+# Dealer generate shares.
+FROST::SigningKey.generate(ECDSA::Group::Secp256k1)
+polynomial = dealer.gen_poly(min_signers - 1)
+shares = 1.upto(max_signers).map {|identifier| polynomial.gen_share(identifier) }
+
+# Signer 2 will lose their share
+# Signers (helpers) 1, 4 and 5 will help signer 2 (participant) to recover their share
+helper1 = shares[0]
+helper4 = shares[3]
+helper5 = shares[4]
+helper_shares = [helper1, helper4, helper5]
+helpers = helper_shares.map(&:identifier)
+participant_share = shares[1]
+
+# Each helper computes delta values.
+received_values = {}
+helper_shares.each do |helper_share|
+  delta_values = FROST::Repairable.step1(helpers, participant_share.identifier, helper_share)
+  delta_values.each do |target_id, value|
+    received_values[target_id] ||= []
+    received_values[target_id] << value
+  end
+end
+
+# Each helper send sum value to participant.
+participant_received_values = []
+received_values.each do |_, values|
+  participant_received_values << FROST::Repairable.step2(values, ECDSA::Group::Secp256k1)
+end
+
+# Participant can obtain his share.
+repair_share = FROST::Repairable.step3(2, participant_received_values, ECDSA::Group::Secp256k1)
+```

data/lib/frost/dkg/secret_package.rb

@@ -0,0 +1,53 @@
+module FROST
+  module DKG
+    # Package to hold participants' secret share.
+    class SecretPackage
+
+      attr_reader :identifier
+      attr_reader :polynomial
+      attr_reader :public_package
+      attr_reader :min_signers
+      attr_reader :max_signers
+
+      # Constructor.
+      # @param [Integer] identifier The identifier of this owner.
+      # @param [Integer] min_signers Minimum number of signers.
+      # @param [Integer] max_signers Maximum number of signers.
+      # @param [FROST::Polynomial] polynomial Polynomial with secret share.
+      def initialize(identifier, min_signers, max_signers, polynomial)
+        raise ArgumentError, "identifier must be Integer." unless identifier.is_a?(Integer)
+        raise ArgumentError, "identifier must be greater than 0." if identifier < 1
+        raise ArgumentError, "min_signers must be Integer." unless min_signers.is_a?(Integer)
+        raise ArgumentError, "max_signers must be Integer." unless max_signers.is_a?(Integer)
+        raise ArgumentError, "polynomial must be FROST::Polynomial." unless polynomial.is_a?(FROST::Polynomial)
+        raise ArgumentError, "max_signers must be greater than or equal to min_signers." if max_signers < min_signers
+        raise ArgumentError, "Number of coefficients of polynomial and min_signers do not match." unless min_signers == polynomial.coefficients.length
+
+        @identifier = identifier
+        @min_signers = min_signers
+        @max_signers = max_signers
+        @polynomial = polynomial
+        @public_package = Package.new(identifier, polynomial.gen_commitments, polynomial.gen_proof_of_knowledge(identifier))
+      end
+
+      # Generate secret share for identifier.
+      # @param [Integer] identifier
+      # @return [FROST::SecretShare] Generate share.
+      def gen_share(identifier)
+        polynomial.gen_share(identifier)
+      end
+
+      # Get group.
+      # @return [ECDSA::Group]
+      def group
+        polynomial.group
+      end
+
+      # Get verification point.
+      # @return [ECDSA::Point]
+      def verification_point
+        polynomial.verification_point
+      end
+    end
+  end
+end

data/lib/frost/dkg.rb

@@ -2,6 +2,7 @@ module FROST
   # Distributed Key Generation feature.
   module DKG
 
+    autoload :SecretPackage, "frost/dkg/secret_package"
     autoload :Package, "frost/dkg/package"
 
     module_function
@@ -10,17 +11,18 @@ module FROST
     # Participant generate key and commitments, proof of knowledge for secret.
     # @param [Integer] identifier
     # @param [ECDSA::Group] group Group of elliptic curve.
-    # @return [Array] The triple of polynomial and public package(FROST::DKG::Package)
-    def part1(identifier, min_signers, max_signers, group)
+    # @return [FROST::DKG::SecretPackage] Secret received_package for owner.
+    def generate_secret(identifier, min_signers, max_signers, group)
       raise ArgumentError, "identifier must be Integer" unless identifier.is_a?(Integer)
       raise ArgumentError, "identifier must be greater than 0." if identifier < 1
       raise ArgumentError, "group must be ECDSA::Group." unless group.is_a?(ECDSA::Group)
+      raise ArgumentError, "min_signers must be Integer." unless min_signers.is_a?(Integer)
+      raise ArgumentError, "max_singers must be Integer." unless max_signers.is_a?(Integer)
       raise ArgumentError, "max_signers must be greater than or equal to min_signers." if max_signers < min_signers
 
       secret = FROST::SigningKey.generate(group)
-      # Every participant P_i samples t random values (a_{i0}, ..., a_{i(t−1)}) ← Z_q
       polynomial = secret.gen_poly(min_signers - 1)
-      [polynomial, Package.new(identifier, polynomial.gen_commitments, polynomial.gen_proof_of_knowledge(identifier))]
+      SecretPackage.new(identifier, min_signers, max_signers, polynomial)
     end
 
     # Generate proof of knowledge for secret.
@@ -43,38 +45,45 @@ module FROST
     end
 
     # Verify proof of knowledge for received commitment.
-    # @param [FROST::DKG::Package] package Received package.
+    # @param [FROST::DKG::SecretPackage] secret_package Verifier's secret package.
+    # @param [FROST::DKG::Package] received_package Received received_package.
     # @return [Boolean]
-    def verify_proof_of_knowledge(package)
-      raise ArgumentError, "package must be FROST::DKG::Package." unless package.is_a?(FROST::DKG::Package)
+    def verify_proof_of_knowledge(secret_package, received_package)
+      raise ArgumentError, "secret_package must be FROST::DKG::SecretPackage." unless secret_package.is_a?(FROST::DKG::SecretPackage)
+      raise ArgumentError, "received_package must be FROST::DKG::Package." unless received_package.is_a?(FROST::DKG::Package)
+      raise FROST::Error, "Invalid number of commitments in package." unless secret_package.min_signers == received_package.commitments.length
 
-      verification_key = package.verification_key
-      msg = FROST.encode_identifier(package.identifier, verification_key.group) +
-        [verification_key.to_hex + package.proof.r.to_hex].pack("H*")
+      verification_key = received_package.verification_key
+      msg = FROST.encode_identifier(received_package.identifier, verification_key.group) +
+        [verification_key.to_hex + received_package.proof.r.to_hex].pack("H*")
       challenge = Hash.hdkg(msg, verification_key.group)
-      package.proof.r == verification_key.group.generator * package.proof.s + (verification_key * challenge).negate
+      received_package.proof.r == verification_key.group.generator * received_package.proof.s + (verification_key * challenge).negate
     end
 
     # Compute signing share using received shares from other participants
-    # @param [FROST::Polynomial] polynomial Own polynomial contains own secret.
+    # @param [FROST::DKG::SecretPackage] secret_package Own secret received_package.
     # @param [Array] received_shares Array of FROST::SecretShare received by other participants.
     # @return [FROST::SecretShare] Signing share.
-    def compute_signing_share(polynomial, received_shares)
-      raise ArgumentError, "polynomial must be FROST::Polynomial." unless polynomial.is_a?(FROST::Polynomial)
+    def compute_signing_share(secret_package, received_shares)
+      raise ArgumentError, "polynomial must be FROST::DKG::SecretPackage." unless secret_package.is_a?(FROST::DKG::SecretPackage)
+      raise FROST::Error, "Invalid number of received_shares." unless secret_package.max_signers - 1 == received_shares.length
+
       identifier = received_shares.first.identifier
       s_id = received_shares.sum {|share| share.share}
-      field = ECDSA::PrimeField.new(polynomial.group.order)
+      field = ECDSA::PrimeField.new(secret_package.group.order)
       FROST::SecretShare.new(
-        identifier, field.mod(s_id + polynomial.gen_share(identifier).share), polynomial.group)
+        identifier, field.mod(s_id + secret_package.gen_share(identifier).share), secret_package.group)
     end
 
     # Compute Group public key.
-    # @param [FROST::Polynomial] polynomial Own polynomial contains own secret.
+    # @param [FROST::DKG::SecretPackage] secret_package Own secret received_package.
     # @param [Array] received_packages Array of FROST::DKG::Package received by other participants.
     # @return [ECDSA::Point] Group public key.
-    def compute_group_pubkey(polynomial, received_packages)
-      raise ArgumentError, "polynomial must be FROST::Polynomial." unless polynomial.is_a?(FROST::Polynomial)
-      received_packages.inject(polynomial.verification_point) {|sum, package| sum + package.commitments.first }
+    def compute_group_pubkey(secret_package, received_packages)
+      raise ArgumentError, "polynomial must be FROST::DKG::SecretPackage." unless secret_package.is_a?(FROST::DKG::SecretPackage)
+      raise FROST::Error, "Invalid number of received_packages." unless secret_package.max_signers - 1 == received_packages.length
+
+      received_packages.inject(secret_package.verification_point) {|sum, package| sum + package.commitments.first }
     end
   end
 end

data/lib/frost/polynomial.rb

@@ -75,22 +75,34 @@ module FROST
     end
 
     # Generates the lagrange coefficient for the i'th participant.
+    # The Lagrange polynomial for a set of points (xj, yj) for 0 <= j <= k is
+    # ∑_{i=0}^k yi.ℓi(x), where ℓi(x) is the Lagrange basis polynomial:
+    # ℓi(x) = ∏_{0≤j≤k; j≠i} (x - xj) / (xi - xj).
+    # This computes ℓj(x) for the set of points `xs` and for the j corresponding to the given xj.
     # @param [Array] x_coordinates The list of x-coordinates.
     # @param [Integer] xi an x-coordinate contained in x_coordinates.
     # @param [ECDSA::Group] group Elliptic curve group.
+    # @param [Integer] x (Optional) if x is nil, it uses 0 for it (since Identifiers can't be 0).
     # @return [Integer] The lagrange coefficient.
-    def self.derive_interpolating_value(x_coordinates, xi, group)
+    def self.derive_interpolating_value(x_coordinates, xi, group, x: nil)
       raise ArgumentError, "xi is not included in x_coordinates." unless x_coordinates.include?(xi)
       raise ArgumentError, "Duplicate values in x_coordinates." if (x_coordinates.length - x_coordinates.uniq.length) > 0
       raise ArgumentError, "group must be ECDSA::Group." unless group.is_a?(ECDSA::Group)
+      raise ArgumentError, "x must be Integer." if x && !x.is_a?(Integer)
 
       field = ECDSA::PrimeField.new(group.order)
       numerator = 1
       denominator = 1
+
       x_coordinates.each do |xj|
         next if xi == xj
-        numerator *= xj
-        denominator *= (xj - xi)
+        if x
+          numerator *= (x - xj)
+          denominator *= (xi - xj)
+        else
+          numerator *= xj
+          denominator *= (xj - xi)
+        end
       end
 
       field.mod(numerator * field.inverse(denominator))

data/lib/frost/repairable.rb

@@ -0,0 +1,56 @@
+module FROST
+  # Implements the Repairable Threshold Scheme (RTS) from <https://eprint.iacr.org/2017/1155>
+  module Repairable
+    module_function
+
+    # Step 1 for RTS.
+    # Each helper computes delta_i,j for other helpers.
+    # @param [Array] helpers Array of helper's identifier.
+    # @param [Integer] participant Identifier of the participant whose shares you want to restore.
+    # @param [FROST::SecretShare] share Share of participant running this process.
+    # @return [Hash] Hash with helper ID as key and value as delta value.
+    def step1(helpers, participant, share)
+      raise ArgumentError, "helpers must be greater than 1." if helpers.length < 2
+      raise ArgumentError, "participant must be greater than 1." if participant < 1
+      raise ArgumentError, "helpers has duplicate identifier." unless helpers.uniq.length == helpers.length
+      raise ArgumentError, "helpers contains same identifier with participant." if helpers.include?(participant)
+
+      field = ECDSA::PrimeField.new(share.group.order)
+      random_values = (helpers.length - 1).times.map { SecureRandom.random_number(share.group.order - 1) }
+
+      # compute last random value
+      ## Calculate Lagrange Coefficient for helper_i
+      zeta_i = Polynomial.derive_interpolating_value(helpers, share.identifier, share.group, x: participant)
+      lhs = field.mod(zeta_i * share.share)
+      # last random value
+      last = field.mod(lhs - random_values.sum)
+      random_values << last
+
+      helpers.zip(random_values).to_h
+    end
+
+    # Step 2 for RTS.
+    # Each helper sum received delta values from other helpers.
+    # @param [Array] step1_values Array of delta values.
+    # @param [ECDSA::Group] group
+    # @return [Integer] Sum of delta values.
+    def step2(step1_values, group)
+      raise ArgumentError, "group must be ECDSA::Group" unless group.is_a?(ECDSA::Group)
+
+      field = ECDSA::PrimeField.new(group.order)
+      field.mod(step1_values.sum)
+    end
+
+    # Participant compute own share with received sum of delta value.
+    # @param [Integer] identifier Identifier of the participant whose shares you want to restore.
+    # @param [Array] step2_results Array of Step 2 results received from other helpers.
+    # @param [ECDSA::Group] group
+    # @return
+    def step3(identifier, step2_results, group)
+      raise ArgumentError, "group must be ECDSA::Group" unless group.is_a?(ECDSA::Group)
+
+      field = ECDSA::PrimeField.new(group.order)
+      FROST::SecretShare.new(identifier, field.mod(step2_results.sum), group)
+    end
+  end
+end

data/lib/frost/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module FROST
-  VERSION = "0.1.1"
+  VERSION = "0.3.0"
 end

data/lib/frost.rb

@@ -17,6 +17,7 @@ module FROST
   autoload :Polynomial, "frost/polynomial"
   autoload :SigningKey, "frost/signing_key"
   autoload :DKG, "frost/dkg"
+  autoload :Repairable, "frost/repairable"
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: frostrb
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.3.0
 platform: ruby
 authors:
 - azuchi
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-02-16 00:00:00.000000000 Z
+date: 2024-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa_ext
@@ -61,9 +61,11 @@ files:
 - lib/frost/commitments.rb
 - lib/frost/dkg.rb
 - lib/frost/dkg/package.rb
+- lib/frost/dkg/secret_package.rb
 - lib/frost/hash.rb
 - lib/frost/nonce.rb
 - lib/frost/polynomial.rb
+- lib/frost/repairable.rb
 - lib/frost/secret_share.rb
 - lib/frost/signature.rb
 - lib/frost/signing_key.rb