@atlasauth/pca-mpc 0.0.0-stage → 0.1.0

package/dist/kem-ot.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Post-quantum base OT from ML-KEM — a 1-of-2 oblivious transfer whose hardness rests on Module-LWE
+ * (ML-KEM-768, FIPS 203) instead of the curve25519 discrete log. This is the end-game plan's P3
+ * ("KEM-based OT from ML-KEM") so the MPC base OT no longer has a classical, quantum-breakable root.
+ *
+ * ─── THE CONSTRUCTION (be precise and honest) ──────────────────────────────────────────────────────
+ * This is the folklore semi-honest 1-of-2 OT from a key-encapsulation mechanism — the "dual-public-key
+ * KEM-OT" (closely related to endemic/Masny–Rindal-style OT, but WITHOUT any oblivious-key derivation):
+ *
+ *   RECEIVER, choice bit c, per transfer:
+ *     • generates TWO *real* ML-KEM keypairs, (pk_c, sk_c) and (pk', sk');
+ *     • places pk_c at wire index c and pk' at wire index 1−c, and sends the ordered pair (pk_0, pk_1);
+ *     • KEEPS sk_c and DISCARDS the other secret sk' (this discard is the whole semi-honest assumption).
+ *   SENDER, messages (m_0, m_1), per transfer:
+ *     • encapsulates under each received key: (ct_b, ss_b) ← Encaps(pk_b) for b ∈ {0,1};
+ *     • one-time-pads each message under a random-oracle key: E_b = m_b ⊕ H(b ‖ ss_b), and sends
+ *       (ct_0, E_0), (ct_1, E_1).
+ *   RECEIVER recovers ONLY m_c:  ss_c ← Decaps(ct_c, sk_c); m_c = E_c ⊕ H(c ‖ ss_c).
+ *   It cannot recover m_{1−c}: it discarded sk_{1−c}, so ss_{1−c} is hidden by ML-KEM IND-CCA security
+ *   and H(1−c ‖ ss_{1−c}) is a pseudorandom pad.
+ *
+ * ─── WHY *THIS* CONSTRUCTION (soundness) ───────────────────────────────────────────────────────────
+ * A tempting alternative is an "oblivious public key": derive pk_{1−c} by HASHING some public value so
+ * the receiver provably cannot invert it. That is sound for group-based KEMs where a public key is a
+ * group element you can hash-to. It is NOT soundly implementable for ML-KEM with the primitive we have:
+ * an ML-KEM public key is a structured Module-LWE object (a matrix seed ρ plus t = A·s + e); a hash
+ * output is not a valid encapsulation target, and there is no black-box "hash → valid pk whose secret is
+ * unknown-to-everyone" for ML-KEM without a trusted setup or a specialised lattice gadget. Rolling one
+ * by hand would be exactly the hand-rolled lattice crypto this module forbids. So we use the two-real-
+ * keypairs/discard-one-secret variant, which is sound with `ml_kem768` as an opaque IND-CCA KEM.
+ *
+ * ─── SECURITY MODEL (exactly what is and is not achieved) ──────────────────────────────────────────
+ *   • Receiver-choice privacy — UNCONDITIONAL, and holds even against a *malicious* sender. The wire
+ *     message (pk_0, pk_1) is two i.i.d. honest ML-KEM public keys; the choice c only decides which
+ *     secret the receiver keeps *locally*. The two orderings are therefore identically distributed, so
+ *     the sender's view is independent of c with probability 1 (no assumption, no abort needed).
+ *   • Sender privacy (receiver learns nothing about m_{1−c}) — SEMI-HONEST only, under ML-KEM IND-CCA
+ *     security + H modelled as a random oracle. An honest-but-curious receiver discards sk_{1−c}; given
+ *     only pk_{1−c} and ct_{1−c} it cannot distinguish ss_{1−c} from random (IND-CCA), so the pad hides
+ *     m_{1−c}. A MALICIOUS receiver that *keeps both* secrets learns BOTH messages — this base OT does
+ *     not stop that by itself.
+ *   • POST-QUANTUM: both guarantees are PQ. Choice privacy is information-theoretic; sender privacy
+ *     rests on Module-LWE (ML-KEM-768, NIST security level ~3) and a hash in the ROM — no classical
+ *     discrete-log anywhere, which is the entire point of P3.
+ *
+ * ─── LIFTING TOWARD MALICIOUS (how this plugs into the stack) ──────────────────────────────────────
+ * These base OTs feed the existing KOS OT-extension (`ot.ts`). KOS runs the base OTs with ROLES
+ * INVERTED (the extension *sender* is the base *receiver*, holding the secret selector s) and then adds
+ * the KOS correlation check over sacrifice rows, which catches an extension receiver that deviates. The
+ * malicious surface a semi-honest base OT leaves open — a base receiver keeping both secrets — maps to
+ * the extension *sender* learning the extension *receiver*'s seed pairs; KOS's consistency machinery and
+ * the correlation-robust hash are what constrain that, exactly as documented for the IKNP/KOS layer.
+ * HONEST CAVEAT: a semi-honest base OT does not give a fully malicious base OT on its own; a
+ * deployment wanting malicious base security would add a base-OT consistency/commitment round (as the
+ * EC `baseOT` wrapper does with its per-message RO commitment). The KOS layer above raises the overall
+ * extension to malicious-with-abort against a cheating *extension receiver*, which is the attack IKNP is
+ * vulnerable to; see `ot.ts` for that argument.
+ *
+ * No hand-rolled lattice crypto: all PQ operations go through `ml_kem768` (keygen/encapsulate/
+ * decapsulate) as a black box. Randomness follows the module policy — a CSPRNG (`secureOtRandom`) by
+ * default, a seeded deterministic stream ONLY when a test passes one.
+ */
+import { type OtChannel, type OtRandom } from './ot';
+/**
+ * The random-oracle pad for one slot: `H(TAG ‖ i ‖ b ‖ sharedSecret)` expanded (SHA-256 counter mode)
+ * to exactly `len` bytes. `i` binds the transfer index and `b` the slot, so the two pads of one transfer
+ * — and the pads across transfers — are domain-separated.
+ */
+export declare function kemOtPad(index: number, slot: number, sharedSecret: Uint8Array, len: number): Uint8Array;
+/** Receiver round-1 wire message: the ordered public-key pairs the sender encapsulates under. */
+export interface KemOtReceiverMessage {
+    /** For each transfer i, [pk_0, pk_1]; the chosen key sits at index `choices[i]`. */
+    publicKeys: Array<[Uint8Array, Uint8Array]>;
+}
+/**
+ * The receiver's RETAINED state after round 1. An honest receiver keeps ONLY the chosen secret key per
+ * transfer (`secretKeys[i]` is `sk_{choices[i]}`); the other secret has been discarded. This is exactly
+ * the state the semi-honest model assumes, and the one the tests assert over ("the non-chosen ciphertext
+ * does not decrypt under the receiver's state").
+ */
+export interface KemOtReceiverState {
+    /** The choice bits, one per transfer. */
+    choices: number[];
+    /** The chosen secret key per transfer (sk for slot `choices[i]`); the non-chosen secret is discarded. */
+    secretKeys: Uint8Array[];
+}
+/** Sender round wire message: the two ciphertexts + two padded messages per transfer. */
+export interface KemOtSenderMessage {
+    /** For each transfer i, the ML-KEM ciphertexts [ct_0, ct_1] under [pk_0, pk_1]. */
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, the one-time-padded messages [E_0, E_1] = [m_0 ⊕ H(0‖ss_0), m_1 ⊕ H(1‖ss_1)]. */
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+}
+/** A full KEM base-OT transcript (receiver message + sender message), exposed for inspection/tests. */
+export interface KemBaseOtTranscript extends KemOtReceiverMessage, KemOtSenderMessage {
+}
+export interface KemBaseOtResult {
+    /** Receiver's recovered messages m_{i, choices[i]}. */
+    received: Uint8Array[];
+    transcript: KemBaseOtTranscript;
+}
+/**
+ * RECEIVER round 1: for each choice bit, generate two real ML-KEM keypairs, send both public keys
+ * (chosen one at wire index `c`), and retain only the chosen secret key. Returns the wire message AND
+ * the retained receiver state.
+ */
+export declare function kemBaseOtReceive(choices: number[], rng?: OtRandom): {
+    message: KemOtReceiverMessage;
+    state: KemOtReceiverState;
+};
+/**
+ * SENDER round: encapsulate under each received public key and one-time-pad each message under
+ * `H(slot ‖ sharedSecret)`. `messages[i] = [m_0, m_1]`; the two messages of one transfer must be equal
+ * length (padding is derived to that length). Returns the sender wire message.
+ */
+export declare function kemBaseOtSend(messages: Array<[Uint8Array, Uint8Array]>, receiverMessage: KemOtReceiverMessage, rng?: OtRandom): KemOtSenderMessage;
+/**
+ * RECEIVER recovery: decapsulate ONLY the chosen ciphertext with the retained secret key and unmask the
+ * chosen message. The receiver never touches the non-chosen slot (it has no secret for it). Returns
+ * `received[i] = m_{i, choices[i]}`.
+ */
+export declare function kemBaseOtOpen(state: KemOtReceiverState, senderMessage: KemOtSenderMessage): Uint8Array[];
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT` in `ot.ts`:
+ * run `count = choices.length` KEM base OTs and return the receiver's recovered messages plus the full
+ * transcript. This is the drop-in the KOS extension consumes (see `OtChannel`'s `baseOtFn` option).
+ */
+export declare function kemBaseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom): KemBaseOtResult;
+/**
+ * Wire the ML-KEM base OT into the existing KOS OT-extension: returns the constructor option bag for
+ * `OtChannel` that makes it run its κ setup base OTs over `kemBaseOT` (post-quantum) instead of the
+ * classical EC Chou–Orlandi `baseOT`. Everything above the base OT (the IKNP matrix, the KOS correlation
+ * check, the correlation-robust hash) is unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withKemBaseOt());
+ */
+export declare function withKemBaseOt(): ConstructorParameters<typeof OtChannel>[1];

package/dist/kem-ot.js

@@ -0,0 +1,224 @@
+"use strict";
+/**
+ * Post-quantum base OT from ML-KEM — a 1-of-2 oblivious transfer whose hardness rests on Module-LWE
+ * (ML-KEM-768, FIPS 203) instead of the curve25519 discrete log. This is the end-game plan's P3
+ * ("KEM-based OT from ML-KEM") so the MPC base OT no longer has a classical, quantum-breakable root.
+ *
+ * ─── THE CONSTRUCTION (be precise and honest) ──────────────────────────────────────────────────────
+ * This is the folklore semi-honest 1-of-2 OT from a key-encapsulation mechanism — the "dual-public-key
+ * KEM-OT" (closely related to endemic/Masny–Rindal-style OT, but WITHOUT any oblivious-key derivation):
+ *
+ *   RECEIVER, choice bit c, per transfer:
+ *     • generates TWO *real* ML-KEM keypairs, (pk_c, sk_c) and (pk', sk');
+ *     • places pk_c at wire index c and pk' at wire index 1−c, and sends the ordered pair (pk_0, pk_1);
+ *     • KEEPS sk_c and DISCARDS the other secret sk' (this discard is the whole semi-honest assumption).
+ *   SENDER, messages (m_0, m_1), per transfer:
+ *     • encapsulates under each received key: (ct_b, ss_b) ← Encaps(pk_b) for b ∈ {0,1};
+ *     • one-time-pads each message under a random-oracle key: E_b = m_b ⊕ H(b ‖ ss_b), and sends
+ *       (ct_0, E_0), (ct_1, E_1).
+ *   RECEIVER recovers ONLY m_c:  ss_c ← Decaps(ct_c, sk_c); m_c = E_c ⊕ H(c ‖ ss_c).
+ *   It cannot recover m_{1−c}: it discarded sk_{1−c}, so ss_{1−c} is hidden by ML-KEM IND-CCA security
+ *   and H(1−c ‖ ss_{1−c}) is a pseudorandom pad.
+ *
+ * ─── WHY *THIS* CONSTRUCTION (soundness) ───────────────────────────────────────────────────────────
+ * A tempting alternative is an "oblivious public key": derive pk_{1−c} by HASHING some public value so
+ * the receiver provably cannot invert it. That is sound for group-based KEMs where a public key is a
+ * group element you can hash-to. It is NOT soundly implementable for ML-KEM with the primitive we have:
+ * an ML-KEM public key is a structured Module-LWE object (a matrix seed ρ plus t = A·s + e); a hash
+ * output is not a valid encapsulation target, and there is no black-box "hash → valid pk whose secret is
+ * unknown-to-everyone" for ML-KEM without a trusted setup or a specialised lattice gadget. Rolling one
+ * by hand would be exactly the hand-rolled lattice crypto this module forbids. So we use the two-real-
+ * keypairs/discard-one-secret variant, which is sound with `ml_kem768` as an opaque IND-CCA KEM.
+ *
+ * ─── SECURITY MODEL (exactly what is and is not achieved) ──────────────────────────────────────────
+ *   • Receiver-choice privacy — UNCONDITIONAL, and holds even against a *malicious* sender. The wire
+ *     message (pk_0, pk_1) is two i.i.d. honest ML-KEM public keys; the choice c only decides which
+ *     secret the receiver keeps *locally*. The two orderings are therefore identically distributed, so
+ *     the sender's view is independent of c with probability 1 (no assumption, no abort needed).
+ *   • Sender privacy (receiver learns nothing about m_{1−c}) — SEMI-HONEST only, under ML-KEM IND-CCA
+ *     security + H modelled as a random oracle. An honest-but-curious receiver discards sk_{1−c}; given
+ *     only pk_{1−c} and ct_{1−c} it cannot distinguish ss_{1−c} from random (IND-CCA), so the pad hides
+ *     m_{1−c}. A MALICIOUS receiver that *keeps both* secrets learns BOTH messages — this base OT does
+ *     not stop that by itself.
+ *   • POST-QUANTUM: both guarantees are PQ. Choice privacy is information-theoretic; sender privacy
+ *     rests on Module-LWE (ML-KEM-768, NIST security level ~3) and a hash in the ROM — no classical
+ *     discrete-log anywhere, which is the entire point of P3.
+ *
+ * ─── LIFTING TOWARD MALICIOUS (how this plugs into the stack) ──────────────────────────────────────
+ * These base OTs feed the existing KOS OT-extension (`ot.ts`). KOS runs the base OTs with ROLES
+ * INVERTED (the extension *sender* is the base *receiver*, holding the secret selector s) and then adds
+ * the KOS correlation check over sacrifice rows, which catches an extension receiver that deviates. The
+ * malicious surface a semi-honest base OT leaves open — a base receiver keeping both secrets — maps to
+ * the extension *sender* learning the extension *receiver*'s seed pairs; KOS's consistency machinery and
+ * the correlation-robust hash are what constrain that, exactly as documented for the IKNP/KOS layer.
+ * HONEST CAVEAT: a semi-honest base OT does not give a fully malicious base OT on its own; a
+ * deployment wanting malicious base security would add a base-OT consistency/commitment round (as the
+ * EC `baseOT` wrapper does with its per-message RO commitment). The KOS layer above raises the overall
+ * extension to malicious-with-abort against a cheating *extension receiver*, which is the attack IKNP is
+ * vulnerable to; see `ot.ts` for that argument.
+ *
+ * No hand-rolled lattice crypto: all PQ operations go through `ml_kem768` (keygen/encapsulate/
+ * decapsulate) as a black box. Randomness follows the module policy — a CSPRNG (`secureOtRandom`) by
+ * default, a seeded deterministic stream ONLY when a test passes one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kemOtPad = kemOtPad;
+exports.kemBaseOtReceive = kemBaseOtReceive;
+exports.kemBaseOtSend = kemBaseOtSend;
+exports.kemBaseOtOpen = kemBaseOtOpen;
+exports.kemBaseOT = kemBaseOT;
+exports.withKemBaseOt = withKemBaseOt;
+const node_crypto_1 = require("node:crypto");
+const ml_kem_js_1 = require("@noble/post-quantum/ml-kem.js");
+const csprng_1 = require("./csprng");
+/** Bytes of fresh randomness fed to ML-KEM keygen (d ‖ z, FIPS 203). */
+const KEYGEN_SEED_BYTES = 64;
+/** Bytes of fresh randomness fed to ML-KEM encapsulation (the message m, FIPS 203). */
+const ENCAPS_MSG_BYTES = ml_kem_js_1.ml_kem768.msgLen; // 32
+const TAG_KEMOT = new TextEncoder().encode('atlas-pca-mpc/kem-ot-pad');
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+/** XOR two equal-length byte arrays into a fresh array. */
+function xorBytes(a, b) {
+    if (a.length !== b.length)
+        throw new Error('kem-ot: XOR length mismatch');
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+/**
+ * The random-oracle pad for one slot: `H(TAG ‖ i ‖ b ‖ sharedSecret)` expanded (SHA-256 counter mode)
+ * to exactly `len` bytes. `i` binds the transfer index and `b` the slot, so the two pads of one transfer
+ * — and the pads across transfers — are domain-separated.
+ */
+function kemOtPad(index, slot, sharedSecret, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_KEMOT, u32(index), Uint8Array.of(slot & 1), u32(ctr), sharedSecret);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/**
+ * RECEIVER round 1: for each choice bit, generate two real ML-KEM keypairs, send both public keys
+ * (chosen one at wire index `c`), and retain only the chosen secret key. Returns the wire message AND
+ * the retained receiver state.
+ */
+function kemBaseOtReceive(choices, rng = (0, csprng_1.secureOtRandom)()) {
+    const publicKeys = [];
+    const secretKeys = [];
+    const retainedChoices = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const chosen = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        const other = ml_kem_js_1.ml_kem768.keygen(rng.bytes(KEYGEN_SEED_BYTES));
+        // Place the chosen public key at wire index c; the other at 1−c. The order is the only thing the
+        // sender sees, and both keys are i.i.d. honest keygen outputs, so it reveals nothing about c.
+        const pk0 = c === 0 ? chosen.publicKey : other.publicKey;
+        const pk1 = c === 0 ? other.publicKey : chosen.publicKey;
+        publicKeys.push([pk0, pk1]);
+        // Keep only the chosen secret; `other.secretKey` is deliberately dropped (never stored).
+        secretKeys.push(chosen.secretKey);
+        retainedChoices.push(c);
+    }
+    return { message: { publicKeys }, state: { choices: retainedChoices, secretKeys } };
+}
+/**
+ * SENDER round: encapsulate under each received public key and one-time-pad each message under
+ * `H(slot ‖ sharedSecret)`. `messages[i] = [m_0, m_1]`; the two messages of one transfer must be equal
+ * length (padding is derived to that length). Returns the sender wire message.
+ */
+function kemBaseOtSend(messages, receiverMessage, rng = (0, csprng_1.secureOtRandom)()) {
+    const { publicKeys } = receiverMessage;
+    if (messages.length !== publicKeys.length) {
+        throw new Error('kemBaseOtSend: messages/publicKeys length mismatch');
+    }
+    const ciphertexts = [];
+    const encrypted = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`kemBaseOtSend (index ${i}): the two messages must be equal length`);
+        }
+        const [pk0, pk1] = publicKeys[i];
+        // ml_kem768.encapsulate derandomised with fresh bytes so a seeded test stays reproducible.
+        const e0 = ml_kem_js_1.ml_kem768.encapsulate(pk0, rng.bytes(ENCAPS_MSG_BYTES));
+        const e1 = ml_kem_js_1.ml_kem768.encapsulate(pk1, rng.bytes(ENCAPS_MSG_BYTES));
+        ciphertexts.push([e0.cipherText, e1.cipherText]);
+        encrypted.push([
+            xorBytes(m0, kemOtPad(i, 0, e0.sharedSecret, m0.length)),
+            xorBytes(m1, kemOtPad(i, 1, e1.sharedSecret, m1.length)),
+        ]);
+    }
+    return { ciphertexts, encrypted };
+}
+/**
+ * RECEIVER recovery: decapsulate ONLY the chosen ciphertext with the retained secret key and unmask the
+ * chosen message. The receiver never touches the non-chosen slot (it has no secret for it). Returns
+ * `received[i] = m_{i, choices[i]}`.
+ */
+function kemBaseOtOpen(state, senderMessage) {
+    const { choices, secretKeys } = state;
+    const { ciphertexts, encrypted } = senderMessage;
+    if (ciphertexts.length !== choices.length || encrypted.length !== choices.length) {
+        throw new Error('kemBaseOtOpen: transcript/state length mismatch');
+    }
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const ss = ml_kem_js_1.ml_kem768.decapsulate(ciphertexts[i][c], secretKeys[i]);
+        const e = encrypted[i][c];
+        received.push(xorBytes(e, kemOtPad(i, c, ss, e.length)));
+    }
+    return received;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT` in `ot.ts`:
+ * run `count = choices.length` KEM base OTs and return the receiver's recovered messages plus the full
+ * transcript. This is the drop-in the KOS extension consumes (see `OtChannel`'s `baseOtFn` option).
+ */
+function kemBaseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)()) {
+    if (messages.length !== choices.length) {
+        throw new Error('kemBaseOT: messages/choices length mismatch');
+    }
+    const { message: receiverMessage, state } = kemBaseOtReceive(choices, rng);
+    const senderMessage = kemBaseOtSend(messages, receiverMessage, rng);
+    const received = kemBaseOtOpen(state, senderMessage);
+    return {
+        received,
+        transcript: {
+            publicKeys: receiverMessage.publicKeys,
+            ciphertexts: senderMessage.ciphertexts,
+            encrypted: senderMessage.encrypted,
+        },
+    };
+}
+/**
+ * Wire the ML-KEM base OT into the existing KOS OT-extension: returns the constructor option bag for
+ * `OtChannel` that makes it run its κ setup base OTs over `kemBaseOT` (post-quantum) instead of the
+ * classical EC Chou–Orlandi `baseOT`. Everything above the base OT (the IKNP matrix, the KOS correlation
+ * check, the correlation-robust hash) is unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withKemBaseOt());
+ */
+function withKemBaseOt() {
+    return { baseOtFn: kemBaseOT };
+}
+//# sourceMappingURL=kem-ot.js.map

package/dist/kem-ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kem-ot.js","sourceRoot":"","sources":["../src/kem-ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;;AA0CH,4BAUC;AA+CD,4CAqBC;AAOD,sCA2BC;AAOD,sCAiBC;AAOD,8BAmBC;AAUD,sCAEC;AAtND,6CAAyC;AACzC,6DAA0D;AAC1D,qCAA0C;AAG1C,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,qBAAS,CAAC,MAAM,CAAC,CAAC,KAAK;AAEhD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAEvE,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,YAAwB,EAAE,GAAW;IACzF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA0CD;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,MAAM,UAAU,GAAiB,EAAE,CAAC;IACpC,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,qBAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7D,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5B,yFAAyF;QACzF,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,QAAyC,EACzC,eAAqC,EACrC,MAAgB,IAAA,uBAAc,GAAE;IAEhC,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAClC,2FAA2F;QAC3F,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YACxD,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,KAAyB,EACzB,aAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IACjD,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,qBAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CACvB,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ;QACR,UAAU,EAAE;YACV,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa;IAC3B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/mascot.d.ts

@@ -0,0 +1,189 @@
+/**
+ * The NO-DEALER offline phase (MASCOT-style) — the last trust assumption removed.
+ *
+ * The SPDZ online layer (`spdz.ts`/`spdz-runner.ts`) is maliciously secure with abort, but until now
+ * its *preprocessing* — the global MAC key α, the authenticated Beaver triples, and the authenticated
+ * input sharings — came from a TRUSTED DEALER who knew α and generated everything. This module removes
+ * that dealer. All preprocessing is derived from real oblivious transfer (`ot.ts`), so:
+ *
+ *   • **The MAC key α is distributed, never reconstructed.** Each party i samples its own share α_i
+ *     locally; `α = Σ α_i` is a value no party ever holds and the protocol never forms. (The in-process
+ *     simulator can sum the shares for test assertions — see `MacContext.alpha` — but no per-party view
+ *     and no protocol step contains α.)
+ *
+ *   • **Beaver triples are generated by the parties from OT, no dealer.** Each party samples its own
+ *     shares a_i, b_i of two random values; the product share `c = a·b` is obtained by OT-multiplying
+ *     the share vectors (Gilboa), and the SPDZ MACs on a, b, c are obtained by OT-multiplying α's shares
+ *     against each value's shares. No party learns a, b or c; no party learns α.
+ *
+ * ## The one OT-based primitive: `otShareMultiply`
+ *
+ * Given additive sharings `⟨x⟩ = (x_0,…,x_{n−1})` and `⟨y⟩`, the parties want an additive sharing
+ * `⟨z⟩` with `Σ z = (Σ x)(Σ y)`, learning nothing else. Expand:
+ *
+ *     (Σ_i x_i)(Σ_j y_j) = Σ_i x_i·y_i  +  Σ_{i≠j} x_i·y_j.
+ *
+ * The diagonal `x_i·y_i` each party computes locally. Each cross term `x_i·y_j` (i≠j) is turned into an
+ * additive sharing between party i and party j by **Gilboa's OT multiplication**: party i (holding x_i)
+ * is the OT RECEIVER using the bits of x_i as choices; party j (holding y_j) is the OT SENDER. For bit
+ * k of x_i, the sender offers `(ρ_k, ρ_k + 2^k·y_j)` for a fresh random ρ_k; the receiver's choice bit
+ * `(x_i)_k` selects `ρ_k + (x_i)_k·2^k·y_j`. Summed over k the receiver gets `x_i·y_j + Σρ_k` and the
+ * sender keeps `−Σρ_k`, an additive sharing of `x_i·y_j`. Because the OT hides both the choice and the
+ * unchosen message, neither party learns the other's share.
+ *
+ * ## Malicious security (docs §7.1)
+ *
+ * The OT is now **malicious-secure**: Chou–Orlandi base OT + IKNP extension **with the KOS correlation
+ * check** (`ot.ts`), so a cheating OT-extension receiver is caught and the extension aborts. On top of
+ * that, triple generation runs the **MASCOT sacrifice**: every delivered triple is generated as a PAIR
+ * `(a,b,c)` and `(â,b,ĉ)` sharing `b`, and one is *sacrificed* to check the other under the MACs — a
+ * party that fed wrong OT inputs (producing `c ≠ a·b`, even one that is internally MAC-consistent) is
+ * caught when the sacrifice residual `τ = e·c − ĉ − (e·a−â)·b` opens to a non-zero value, or when the
+ * commit-then-open MAC-check on the sacrifice openings fails. There is also an **input-consistency
+ * check** (`checkInputConsistency`): a random masked combination of authenticated inputs is opened and
+ * MAC-checked, catching any input whose MAC does not match its value. Both the sacrifice and the input
+ * check ABORT (throw `MacCheckAbort`) rather than emit a bad triple / bad input.
+ *
+ * So the whole stack is now **malicious-with-abort, dishonest-majority** end to end: malicious-secure
+ * no-dealer OFFLINE (KOS OT + MASCOT sacrifice + input check, `α` never reconstructed) feeding the
+ * malicious-with-abort SPDZ ONLINE phase (the MAC-check still catches any online deviation). The base
+ * OTs are themselves malicious-secure (committed Chou–Orlandi: Schnorr PoK + point validation, `ot.ts`
+ * / `ec.ts`), and all randomness here is the CSPRNG by DEFAULT — construct `NoDealerOffline` WITHOUT a
+ * seed for production (`SecureFieldRng` + `secureOtRandom`); passing a seed selects the deterministic
+ * SplitMix64 stream for reproducible tests only. Residual boundary (docs §7.1): just two honestly
+ * unavoidable items — constant-time field arithmetic (a native/WASM workstream) and a real async
+ * network/transport (including the interactive secure coin-flip for the public MAC-check challenge).
+ */
+import { type SharedValue } from './sharing';
+import { type AuthSV, type AuthTriple, type MacContext } from './spdz';
+/**
+ * A TEST-ONLY injection modelling a MALICIOUS party in the OFFLINE phase: when the triple PRODUCT
+ * multiplication at index `productMul` runs (0-based, counting only the OT multiplications that form a
+ * triple's `c = a·b`), `delta` is XOR... added into one party's product share. The resulting triple has
+ * `c = a·b + delta` but is still internally MAC-consistent (the authentication runs on the corrupted
+ * share) — exactly the "bad OT input" a malicious party can mount, which MACs ALONE cannot catch and
+ * the MASCOT SACRIFICE is designed to catch. Models "corrupting an OT message/share in the offline".
+ */
+export interface OfflineDeviation {
+    /** Which triple-product OT multiplication to corrupt (0-based across all products this instance makes). */
+    productMul: number;
+    /** Field delta added to party 0's product share, making c = a·b + delta (self-consistently MAC'd). */
+    delta: bigint;
+}
+/** Options for the no-dealer offline phase. */
+export interface NoDealerOptions {
+    /** Run the MASCOT sacrifice on every delivered triple (default true = malicious-secure). */
+    sacrifice?: boolean;
+    /** A test-only offline deviation (a malicious party corrupting a product share). */
+    deviation?: OfflineDeviation;
+}
+/**
+ * The no-dealer offline phase for a fixed party count `n`. Holds the distributed MAC key (α_i only),
+ * and a reusable set of per-ordered-pair OT-extension channels so the κ base OTs are amortized across
+ * every triple and input it produces. Deterministic given its seed (production: a CSPRNG per party).
+ *
+ * MALICIOUS-secure: the OT extension carries the KOS correlation check (`ot.ts`), and every delivered
+ * triple survives the MASCOT sacrifice. `checkInputConsistency` provides the input check.
+ */
+export declare class NoDealerOffline {
+    readonly n: number;
+    /** α_i: party i's locally-sampled share of the MAC key. Σ α_i = α (never formed by any party). */
+    readonly alphaShares: bigint[];
+    private readonly rng;
+    private readonly seed;
+    /** Whether randomness is a deterministic (test) seed; when false, all randomness is the CSPRNG. */
+    private readonly deterministic;
+    /** OT channels keyed "i->j": receiver = party i, sender = party j. Base OTs run on first use. */
+    private readonly channels;
+    /** Whether to run the MASCOT sacrifice per delivered triple (malicious-secure when true). */
+    private readonly sacrificeOn;
+    /** Test-only offline deviation (a malicious party corrupting a product share). */
+    private readonly deviation?;
+    /** Count of triple-product OT multiplications performed (for targeting `deviation.productMul`). */
+    private productMulCount;
+    constructor(n: number, seed?: bigint, opts?: NoDealerOptions);
+    /**
+     * The SPDZ MAC context the online runner consumes. It carries ONLY `alphaShares` for the protocol;
+     * `alpha` is the sum the in-process simulator computes for TEST ASSERTIONS and is never used by any
+     * protocol step or held by any party.
+     */
+    get macContext(): MacContext;
+    private channel;
+    /**
+     * Gilboa OT multiplication of two scalars held by different parties. Party `i` holds `xi` (OT
+     * receiver, choice bits = bits of xi); party `j` holds `yj` (OT sender). Returns `[shareI, shareJ]`
+     * with `shareI + shareJ = xi·yj (mod p)`, neither party learning the other's input or share.
+     */
+    private gilboa;
+    /**
+     * OT-based share multiplication: given additive sharings `x`, `y` (length n), returns an additive
+     * sharing `z` with `Σ z = (Σ x)(Σ y) mod p`. Diagonal terms are local; each cross term is a Gilboa OT
+     * multiplication. No party learns Σx, Σy, or Σz.
+     */
+    otShareMultiply(x: SharedValue, y: SharedValue): SharedValue;
+    /** Authenticate a value sharing: produce MAC shares γ with Σ γ = α·(Σ value), via OT (no dealer). */
+    private authenticate;
+    /**
+     * The product sharing `c` (Σc = a·b) for a triple, via OT. Counts as a triple PRODUCT so a test
+     * `deviation` can corrupt one — modelling a malicious party that feeds a wrong OT input and gets a
+     * wrong-but-self-MAC-consistent product share (only the sacrifice catches this).
+     */
+    private tripleProduct;
+    /** A RAW authenticated triple (a, b, c=a·b) from OT, before the sacrifice. No dealer. */
+    private rawTriple;
+    /** A RAW authenticated triple (â, b, ĉ=â·b) SHARING the given authenticated `b` — the sacrifice pair. */
+    private rawTripleWithB;
+    /**
+     * The MASCOT **sacrifice** check. Given two triples sharing `b`, `(a,b,c)` (the one to KEEP) and
+     * `(â,b,ĉ)` (the one to SACRIFICE), draw a public random challenge `e`, open `ρ = e·a − â`, form the
+     * authenticated residual `⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧`, open `τ`, run the commit-then-open MAC-check on
+     * both openings, and require `τ = 0`. If both triples are correct, `τ = e·(c−ab) − (ĉ−âb) = 0`; if the
+     * kept triple has `c = ab + δ`, then `τ = e·δ`, which is non-zero (e ≠ 0, δ ≠ 0) — ABORT. Lying in the
+     * `τ` opening to force a zero value is caught by the MAC-check (the forged MAC won't reconcile). The
+     * sacrificed triple is consumed by the check and discarded; the kept triple is certified `c = a·b`.
+     */
+    private sacrifice;
+    /**
+     * Generate ONE authenticated Beaver triple with NO dealer, MALICIOUS-secure. Each party samples its
+     * own a_i, b_i; the product sharing c (Σc = a·b) comes from OT; every component is MAC'd via OT
+     * against the α shares. When the sacrifice is on (default), a SECOND triple sharing `b` is generated
+     * and sacrificed to certify `c = a·b` under the MACs, so a malformed triple ABORTS rather than being
+     * emitted. No party learns a, b, c, or α.
+     */
+    genAuthTriple(): AuthTriple;
+    /** Generate `count` authenticated triples (channels/base-OTs amortized across all of them). */
+    genAuthTriples(count: number): AuthTriple[];
+    /**
+     * Authenticated input sharing of `value`, owned by party `owner`, with NO dealer. The owner splits
+     * its own value into additive shares (local); the MAC `α·value` is computed via OT against the α
+     * shares. A malicious owner can of course choose any value (inputs are unconstrained in SPDZ), but it
+     * cannot make the sharing inconsistent with its MAC — the online MAC-check binds it.
+     */
+    authInput(value: bigint, owner: number): AuthSV;
+    /**
+     * The MASCOT **input-consistency check**: verify that a batch of authenticated inputs each satisfy
+     * `Σγ = α·(Σvalue)` — i.e. their MACs match their values — WITHOUT revealing any value, and ABORT if
+     * not. A malicious party that produced an input whose MAC does not match its value (e.g. by feeding a
+     * bad OT input to the authentication) is caught here rather than only downstream.
+     *
+     * Method: draw public random coefficients `e_k`, generate ONE fresh OT-authenticated random mask
+     * `⟦r⟧`, form `⟦w⟧ = Σ_k e_k·⟦x_k⟧ + ⟦r⟧`, partial-open `w` (masked by the uniform `r`, so no input
+     * leaks), and run the commit-then-open MAC-check on that opening. If some input's MAC is off by `δ`,
+     * the opened `w` carries MAC residual `Σ e_k·δ_k ≠ 0` w.h.p. over the random `e_k`, and the MAC-check
+     * aborts. No-op for an empty batch.
+     */
+    checkInputConsistency(inputs: ReadonlyArray<AuthSV>): void;
+}
+/**
+ * The offline material a malicious-secure runner consumes. A `NoDealerOffline` IS one of these
+ * (duck-typed by `macContext`/`genAuthTriple`/`authInput`), so the runner can take either this or the
+ * trusted-dealer functions behind the same tiny interface.
+ */
+export interface OfflineProvider {
+    readonly n: number;
+    readonly macContext: MacContext;
+    genAuthTriple(): AuthTriple;
+    authInput(value: bigint, owner: number): AuthSV;
+}
+/** Convenience: a fresh no-dealer offline phase for `n` parties (malicious-secure by default). */
+export declare function makeNoDealerOffline(n: number, seed?: bigint, opts?: NoDealerOptions): NoDealerOffline;