@atlasauth/pca-mpc 0.0.0-stage → 0.1.0

package/dist/mascot.js

@@ -0,0 +1,322 @@
+"use strict";
+/**
+ * The NO-DEALER offline phase (MASCOT-style) — the last trust assumption removed.
+ *
+ * The SPDZ online layer (`spdz.ts`/`spdz-runner.ts`) is maliciously secure with abort, but until now
+ * its *preprocessing* — the global MAC key α, the authenticated Beaver triples, and the authenticated
+ * input sharings — came from a TRUSTED DEALER who knew α and generated everything. This module removes
+ * that dealer. All preprocessing is derived from real oblivious transfer (`ot.ts`), so:
+ *
+ *   • **The MAC key α is distributed, never reconstructed.** Each party i samples its own share α_i
+ *     locally; `α = Σ α_i` is a value no party ever holds and the protocol never forms. (The in-process
+ *     simulator can sum the shares for test assertions — see `MacContext.alpha` — but no per-party view
+ *     and no protocol step contains α.)
+ *
+ *   • **Beaver triples are generated by the parties from OT, no dealer.** Each party samples its own
+ *     shares a_i, b_i of two random values; the product share `c = a·b` is obtained by OT-multiplying
+ *     the share vectors (Gilboa), and the SPDZ MACs on a, b, c are obtained by OT-multiplying α's shares
+ *     against each value's shares. No party learns a, b or c; no party learns α.
+ *
+ * ## The one OT-based primitive: `otShareMultiply`
+ *
+ * Given additive sharings `⟨x⟩ = (x_0,…,x_{n−1})` and `⟨y⟩`, the parties want an additive sharing
+ * `⟨z⟩` with `Σ z = (Σ x)(Σ y)`, learning nothing else. Expand:
+ *
+ *     (Σ_i x_i)(Σ_j y_j) = Σ_i x_i·y_i  +  Σ_{i≠j} x_i·y_j.
+ *
+ * The diagonal `x_i·y_i` each party computes locally. Each cross term `x_i·y_j` (i≠j) is turned into an
+ * additive sharing between party i and party j by **Gilboa's OT multiplication**: party i (holding x_i)
+ * is the OT RECEIVER using the bits of x_i as choices; party j (holding y_j) is the OT SENDER. For bit
+ * k of x_i, the sender offers `(ρ_k, ρ_k + 2^k·y_j)` for a fresh random ρ_k; the receiver's choice bit
+ * `(x_i)_k` selects `ρ_k + (x_i)_k·2^k·y_j`. Summed over k the receiver gets `x_i·y_j + Σρ_k` and the
+ * sender keeps `−Σρ_k`, an additive sharing of `x_i·y_j`. Because the OT hides both the choice and the
+ * unchosen message, neither party learns the other's share.
+ *
+ * ## Malicious security (docs §7.1)
+ *
+ * The OT is now **malicious-secure**: Chou–Orlandi base OT + IKNP extension **with the KOS correlation
+ * check** (`ot.ts`), so a cheating OT-extension receiver is caught and the extension aborts. On top of
+ * that, triple generation runs the **MASCOT sacrifice**: every delivered triple is generated as a PAIR
+ * `(a,b,c)` and `(â,b,ĉ)` sharing `b`, and one is *sacrificed* to check the other under the MACs — a
+ * party that fed wrong OT inputs (producing `c ≠ a·b`, even one that is internally MAC-consistent) is
+ * caught when the sacrifice residual `τ = e·c − ĉ − (e·a−â)·b` opens to a non-zero value, or when the
+ * commit-then-open MAC-check on the sacrifice openings fails. There is also an **input-consistency
+ * check** (`checkInputConsistency`): a random masked combination of authenticated inputs is opened and
+ * MAC-checked, catching any input whose MAC does not match its value. Both the sacrifice and the input
+ * check ABORT (throw `MacCheckAbort`) rather than emit a bad triple / bad input.
+ *
+ * So the whole stack is now **malicious-with-abort, dishonest-majority** end to end: malicious-secure
+ * no-dealer OFFLINE (KOS OT + MASCOT sacrifice + input check, `α` never reconstructed) feeding the
+ * malicious-with-abort SPDZ ONLINE phase (the MAC-check still catches any online deviation). The base
+ * OTs are themselves malicious-secure (committed Chou–Orlandi: Schnorr PoK + point validation, `ot.ts`
+ * / `ec.ts`), and all randomness here is the CSPRNG by DEFAULT — construct `NoDealerOffline` WITHOUT a
+ * seed for production (`SecureFieldRng` + `secureOtRandom`); passing a seed selects the deterministic
+ * SplitMix64 stream for reproducible tests only. Residual boundary (docs §7.1): just two honestly
+ * unavoidable items — constant-time field arithmetic (a native/WASM workstream) and a real async
+ * network/transport (including the interactive secure coin-flip for the public MAC-check challenge).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoDealerOffline = void 0;
+exports.makeNoDealerOffline = makeNoDealerOffline;
+const field_1 = require("./field");
+const csprng_1 = require("./csprng");
+const sharing_1 = require("./sharing");
+const spdz_1 = require("./spdz");
+const ot_1 = require("./ot");
+/** Number of bits needed to represent any element of F_p (p = 2^61 − 1 ⇒ values use bits 0..60). */
+const FIELD_BITS = 61;
+/**
+ * The no-dealer offline phase for a fixed party count `n`. Holds the distributed MAC key (α_i only),
+ * and a reusable set of per-ordered-pair OT-extension channels so the κ base OTs are amortized across
+ * every triple and input it produces. Deterministic given its seed (production: a CSPRNG per party).
+ *
+ * MALICIOUS-secure: the OT extension carries the KOS correlation check (`ot.ts`), and every delivered
+ * triple survives the MASCOT sacrifice. `checkInputConsistency` provides the input check.
+ */
+class NoDealerOffline {
+    n;
+    /** α_i: party i's locally-sampled share of the MAC key. Σ α_i = α (never formed by any party). */
+    alphaShares;
+    rng;
+    seed;
+    /** Whether randomness is a deterministic (test) seed; when false, all randomness is the CSPRNG. */
+    deterministic;
+    /** OT channels keyed "i->j": receiver = party i, sender = party j. Base OTs run on first use. */
+    channels = new Map();
+    /** Whether to run the MASCOT sacrifice per delivered triple (malicious-secure when true). */
+    sacrificeOn;
+    /** Test-only offline deviation (a malicious party corrupting a product share). */
+    deviation;
+    /** Count of triple-product OT multiplications performed (for targeting `deviation.productMul`). */
+    productMulCount = 0;
+    constructor(n, seed, opts = {}) {
+        if (!Number.isInteger(n) || n < 1)
+            throw new Error('NoDealerOffline: n must be a positive integer');
+        this.n = n;
+        // CSPRNG by DEFAULT (production); a deterministic SplitMix64 stream ONLY when a test seed is given
+        // (docs §7.1 item c). `this.seed` is kept for per-pair OT-stream derivation in the deterministic case.
+        this.deterministic = seed !== undefined;
+        this.seed = seed ?? 0xabcdef12345n;
+        this.rng = this.deterministic ? new field_1.FieldRng(this.seed) : new csprng_1.SecureFieldRng();
+        this.sacrificeOn = opts.sacrifice ?? true;
+        this.deviation = opts.deviation;
+        // DISTRIBUTED MAC-KEY GENERATION: each party samples its own α_i locally. α is never reconstructed.
+        this.alphaShares = Array.from({ length: n }, () => this.rng.next());
+    }
+    /**
+     * The SPDZ MAC context the online runner consumes. It carries ONLY `alphaShares` for the protocol;
+     * `alpha` is the sum the in-process simulator computes for TEST ASSERTIONS and is never used by any
+     * protocol step or held by any party.
+     */
+    get macContext() {
+        let alpha = 0n;
+        for (const ai of this.alphaShares)
+            alpha = (0, field_1.fadd)(alpha, ai);
+        return { n: this.n, alphaShares: this.alphaShares.slice(), alpha };
+    }
+    channel(i, j) {
+        const key = `${i}->${j}`;
+        let ch = this.channels.get(key);
+        if (!ch) {
+            // CSPRNG by default; a distinct DETERMINISTIC OT stream per ordered pair only under a test seed.
+            const otRng = this.deterministic
+                ? (0, ot_1.otRandom)((0, ot_1.splitMix64)(this.seed ^ (BigInt(i + 1) * 0x100000001b3n) ^ (BigInt(j + 1) * 0x1000000000n)))
+                : (0, csprng_1.secureOtRandom)();
+            ch = new ot_1.OtChannel(otRng);
+            this.channels.set(key, ch);
+        }
+        return ch;
+    }
+    /**
+     * Gilboa OT multiplication of two scalars held by different parties. Party `i` holds `xi` (OT
+     * receiver, choice bits = bits of xi); party `j` holds `yj` (OT sender). Returns `[shareI, shareJ]`
+     * with `shareI + shareJ = xi·yj (mod p)`, neither party learning the other's input or share.
+     */
+    gilboa(i, j, xi, yj) {
+        const x = (0, field_1.mod)(xi);
+        const y = (0, field_1.mod)(yj);
+        // Sender draws fresh masks ρ_k and offers (ρ_k, ρ_k + 2^k·y) for each bit k.
+        const choiceBits = new Array(FIELD_BITS);
+        const msg0 = new Array(FIELD_BITS);
+        const msg1 = new Array(FIELD_BITS);
+        let senderSum = 0n; // Σ ρ_k
+        let pow = 1n; // 2^k mod p (k ≤ 60 ⇒ no wrap)
+        for (let k = 0; k < FIELD_BITS; k++) {
+            const rho = this.rng.next();
+            senderSum = (0, field_1.fadd)(senderSum, rho);
+            msg0[k] = rho;
+            msg1[k] = (0, field_1.fadd)(rho, (0, field_1.fmul)(pow, y));
+            choiceBits[k] = Number((x >> BigInt(k)) & 1n);
+            pow = (pow * 2n) % field_1.PRIME;
+        }
+        const { received } = this.channel(i, j).extend(choiceBits, msg0, msg1);
+        let receiverSum = 0n; // Σ (received_k mod p)
+        for (let k = 0; k < FIELD_BITS; k++)
+            receiverSum = (0, field_1.fadd)(receiverSum, (0, field_1.mod)(received[k]));
+        // shareI + shareJ = Σ received − Σ ρ = (xi·yj + Σρ) − Σρ = xi·yj.
+        return [receiverSum, (0, field_1.fneg)(senderSum)];
+    }
+    /**
+     * OT-based share multiplication: given additive sharings `x`, `y` (length n), returns an additive
+     * sharing `z` with `Σ z = (Σ x)(Σ y) mod p`. Diagonal terms are local; each cross term is a Gilboa OT
+     * multiplication. No party learns Σx, Σy, or Σz.
+     */
+    otShareMultiply(x, y) {
+        if (x.length !== this.n || y.length !== this.n)
+            throw new Error('otShareMultiply: wrong length');
+        const z = x.map((xi, i) => (0, field_1.fmul)(xi, y[i])); // diagonal x_i·y_i (local)
+        for (let i = 0; i < this.n; i++) {
+            for (let j = 0; j < this.n; j++) {
+                if (i === j)
+                    continue;
+                const [si, sj] = this.gilboa(i, j, x[i], y[j]); // sharing of x_i·y_j
+                z[i] = (0, field_1.fadd)(z[i], si);
+                z[j] = (0, field_1.fadd)(z[j], sj);
+            }
+        }
+        return z;
+    }
+    /** Authenticate a value sharing: produce MAC shares γ with Σ γ = α·(Σ value), via OT (no dealer). */
+    authenticate(valueShares) {
+        return this.otShareMultiply(this.alphaShares, valueShares);
+    }
+    /**
+     * The product sharing `c` (Σc = a·b) for a triple, via OT. Counts as a triple PRODUCT so a test
+     * `deviation` can corrupt one — modelling a malicious party that feeds a wrong OT input and gets a
+     * wrong-but-self-MAC-consistent product share (only the sacrifice catches this).
+     */
+    tripleProduct(x, y) {
+        const z = this.otShareMultiply(x, y);
+        const idx = this.productMulCount++;
+        const dev = this.deviation;
+        if (dev && dev.productMul === idx)
+            z[0] = (0, field_1.fadd)(z[0], dev.delta);
+        return z;
+    }
+    /** A RAW authenticated triple (a, b, c=a·b) from OT, before the sacrifice. No dealer. */
+    rawTriple() {
+        const aShares = Array.from({ length: this.n }, () => this.rng.next());
+        const bShares = Array.from({ length: this.n }, () => this.rng.next());
+        const cShares = this.tripleProduct(aShares, bShares);
+        return {
+            a: { value: aShares, mac: this.authenticate(aShares) },
+            b: { value: bShares, mac: this.authenticate(bShares) },
+            c: { value: cShares, mac: this.authenticate(cShares) },
+        };
+    }
+    /** A RAW authenticated triple (â, b, ĉ=â·b) SHARING the given authenticated `b` — the sacrifice pair. */
+    rawTripleWithB(b) {
+        const aShares = Array.from({ length: this.n }, () => this.rng.next());
+        const cShares = this.tripleProduct(aShares, b.value);
+        return {
+            a: { value: aShares, mac: this.authenticate(aShares) },
+            b,
+            c: { value: cShares, mac: this.authenticate(cShares) },
+        };
+    }
+    /**
+     * The MASCOT **sacrifice** check. Given two triples sharing `b`, `(a,b,c)` (the one to KEEP) and
+     * `(â,b,ĉ)` (the one to SACRIFICE), draw a public random challenge `e`, open `ρ = e·a − â`, form the
+     * authenticated residual `⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧`, open `τ`, run the commit-then-open MAC-check on
+     * both openings, and require `τ = 0`. If both triples are correct, `τ = e·(c−ab) − (ĉ−âb) = 0`; if the
+     * kept triple has `c = ab + δ`, then `τ = e·δ`, which is non-zero (e ≠ 0, δ ≠ 0) — ABORT. Lying in the
+     * `τ` opening to force a zero value is caught by the MAC-check (the forged MAC won't reconcile). The
+     * sacrificed triple is consumed by the check and discarded; the kept triple is certified `c = a·b`.
+     */
+    sacrifice(keep, sac) {
+        const ctx = this.macContext;
+        const engine = new spdz_1.SpdzEngine(ctx, []);
+        let e = this.rng.next();
+        if (e === 0n)
+            e = 1n; // public random challenge, non-zero
+        const rho = engine.open((0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.a, e), sac.a), 'sacrifice:rho');
+        let tau = (0, spdz_1.subAuth)((0, spdz_1.scaleAuth)(keep.c, e), sac.c);
+        tau = (0, spdz_1.subAuth)(tau, (0, spdz_1.scaleAuth)(keep.b, rho));
+        const tauValue = engine.open(tau, 'sacrifice:tau');
+        engine.macCheck(this.rng); // commit-then-open MAC-check on ρ and τ; throws MacCheckAbort on a forged MAC
+        if (tauValue !== 0n) {
+            throw new spdz_1.MacCheckAbort(`MASCOT sacrifice FAILED: residual τ=${tauValue} != 0 — a malformed Beaver triple (c != a·b) was detected in the offline phase; aborting with no triple emitted`);
+        }
+    }
+    /**
+     * Generate ONE authenticated Beaver triple with NO dealer, MALICIOUS-secure. Each party samples its
+     * own a_i, b_i; the product sharing c (Σc = a·b) comes from OT; every component is MAC'd via OT
+     * against the α shares. When the sacrifice is on (default), a SECOND triple sharing `b` is generated
+     * and sacrificed to certify `c = a·b` under the MACs, so a malformed triple ABORTS rather than being
+     * emitted. No party learns a, b, c, or α.
+     */
+    genAuthTriple() {
+        if (!this.sacrificeOn)
+            return this.rawTriple();
+        const keep = this.rawTriple();
+        const sac = this.rawTripleWithB(keep.b);
+        this.sacrifice(keep, sac);
+        return keep;
+    }
+    /** Generate `count` authenticated triples (channels/base-OTs amortized across all of them). */
+    genAuthTriples(count) {
+        const out = [];
+        for (let k = 0; k < count; k++)
+            out.push(this.genAuthTriple());
+        return out;
+    }
+    /**
+     * Authenticated input sharing of `value`, owned by party `owner`, with NO dealer. The owner splits
+     * its own value into additive shares (local); the MAC `α·value` is computed via OT against the α
+     * shares. A malicious owner can of course choose any value (inputs are unconstrained in SPDZ), but it
+     * cannot make the sharing inconsistent with its MAC — the online MAC-check binds it.
+     */
+    authInput(value, owner) {
+        if (owner < 0 || owner >= this.n)
+            throw new Error('authInput: owner out of range');
+        const valueShares = (0, sharing_1.share)((0, field_1.mod)(value), this.n, this.rng);
+        return { value: valueShares, mac: this.authenticate(valueShares) };
+    }
+    /**
+     * The MASCOT **input-consistency check**: verify that a batch of authenticated inputs each satisfy
+     * `Σγ = α·(Σvalue)` — i.e. their MACs match their values — WITHOUT revealing any value, and ABORT if
+     * not. A malicious party that produced an input whose MAC does not match its value (e.g. by feeding a
+     * bad OT input to the authentication) is caught here rather than only downstream.
+     *
+     * Method: draw public random coefficients `e_k`, generate ONE fresh OT-authenticated random mask
+     * `⟦r⟧`, form `⟦w⟧ = Σ_k e_k·⟦x_k⟧ + ⟦r⟧`, partial-open `w` (masked by the uniform `r`, so no input
+     * leaks), and run the commit-then-open MAC-check on that opening. If some input's MAC is off by `δ`,
+     * the opened `w` carries MAC residual `Σ e_k·δ_k ≠ 0` w.h.p. over the random `e_k`, and the MAC-check
+     * aborts. No-op for an empty batch.
+     */
+    checkInputConsistency(inputs) {
+        if (inputs.length === 0)
+            return;
+        for (const inp of inputs) {
+            if (inp.value.length !== this.n || inp.mac.length !== this.n) {
+                throw new Error('checkInputConsistency: input party count mismatch');
+            }
+        }
+        const ctx = this.macContext;
+        const engine = new spdz_1.SpdzEngine(ctx, []);
+        // Fresh OT-authenticated random mask ⟦r⟧ (hides w so no input value is revealed).
+        const rShares = Array.from({ length: this.n }, () => this.rng.next());
+        let w = { value: rShares, mac: this.authenticate(rShares) };
+        for (const inp of inputs) {
+            let e = this.rng.next(); // public random coefficient
+            if (e === 0n)
+                e = 1n; // weight every input (0 would skip one); bias is negligible (prob 1/p)
+            w = addAuthLocal(w, (0, spdz_1.scaleAuth)(inp, e));
+        }
+        engine.open(w, 'input-check:w');
+        engine.macCheck(this.rng); // throws MacCheckAbort if any input's MAC is inconsistent with its value
+    }
+}
+exports.NoDealerOffline = NoDealerOffline;
+/** Local authenticated addition (kept here to avoid widening mascot's spdz import surface). */
+function addAuthLocal(x, y) {
+    return {
+        value: x.value.map((xi, i) => (0, field_1.fadd)(xi, y.value[i])),
+        mac: x.mac.map((mi, i) => (0, field_1.fadd)(mi, y.mac[i])),
+    };
+}
+/** Convenience: a fresh no-dealer offline phase for `n` parties (malicious-secure by default). */
+function makeNoDealerOffline(n, seed, opts) {
+    return new NoDealerOffline(n, seed, opts);
+}
+//# sourceMappingURL=mascot.js.map

package/dist/mascot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mascot.js","sourceRoot":"","sources":["../src/mascot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;;AAsTH,kDAMC;AA1TD,mCAAiE;AACjE,qCAA0D;AAC1D,uCAAoD;AACpD,iCAQgB;AAChB,6BAAsE;AAEtE,oGAAoG;AACpG,MAAM,UAAU,GAAG,EAAE,CAAC;AAyBtB;;;;;;;GAOG;AACH,MAAa,eAAe;IACjB,CAAC,CAAS;IACnB,kGAAkG;IACzF,WAAW,CAAW;IACd,GAAG,CAAW;IACd,IAAI,CAAS;IAC9B,mGAAmG;IAClF,aAAa,CAAU;IACxC,iGAAiG;IAChF,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzD,6FAA6F;IAC5E,WAAW,CAAU;IACtC,kFAAkF;IACjE,SAAS,CAAoB;IAC9C,mGAAmG;IAC3F,eAAe,GAAG,CAAC,CAAC;IAE5B,YAAY,CAAS,EAAE,IAAa,EAAE,OAAwB,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,CAAC,aAAa,GAAG,IAAI,KAAK,SAAS,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,cAAc,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,uBAAc,EAAE,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,oGAAoG;QACpG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACH,IAAI,UAAU;QACZ,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,GAAG,IAAA,YAAI,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAEO,OAAO,CAAC,CAAS,EAAE,CAAS;QAClC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iGAAiG;YACjG,MAAM,KAAK,GAAa,IAAI,CAAC,aAAa;gBACxC,CAAC,CAAC,IAAA,aAAQ,EAAC,IAAA,eAAU,EAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBACtG,CAAC,CAAC,IAAA,uBAAc,GAAE,CAAC;YACrB,EAAE,GAAG,IAAI,cAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,EAAU;QACzD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC;QAClB,6EAA6E;QAC7E,MAAM,UAAU,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAa,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,QAAQ;QAC5B,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,+BAA+B;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5B,SAAS,GAAG,IAAA,YAAI,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,GAAG,EAAE,IAAA,YAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAClC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI,WAAW,GAAG,EAAE,CAAC,CAAC,uBAAuB;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE;YAAE,WAAW,GAAG,IAAA,YAAI,EAAC,WAAW,EAAE,IAAA,WAAG,EAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACxF,kEAAkE;QAClE,OAAO,CAAC,WAAW,EAAE,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,CAAc,EAAE,CAAc;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,qBAAqB;gBACvE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBACvB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qGAAqG;IAC7F,YAAY,CAAC,WAAwB;QAC3C,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,CAAc,EAAE,CAAc;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yFAAyF;IACjF,SAAS;QACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,cAAc,CAAC,CAAS;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO;YACL,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;YACtD,CAAC;YACD,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,SAAS,CAAC,IAAgB,EAAE,GAAe;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE;YAAE,CAAC,GAAG,EAAE,CAAC,CAAC,oCAAoC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,GAAG,GAAG,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,GAAG,GAAG,IAAA,cAAO,EAAC,GAAG,EAAE,IAAA,gBAAS,EAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8EAA8E;QACzG,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAa,CACrB,uCAAuC,QAAQ,iHAAiH,CACjK,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAC/F,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa,EAAE,KAAa;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,IAAA,eAAK,EAAC,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,qBAAqB,CAAC,MAA6B;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,kFAAkF;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,GAAW,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,4BAA4B;YACrD,IAAI,CAAC,KAAK,EAAE;gBAAE,CAAC,GAAG,EAAE,CAAC,CAAC,uEAAuE;YAC7F,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,IAAA,gBAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,yEAAyE;IACtG,CAAC;CACF;AA7OD,0CA6OC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAcD,kGAAkG;AAClG,SAAgB,mBAAmB,CACjC,CAAS,EACT,IAAa,EACb,IAAsB;IAEtB,OAAO,IAAI,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/ot.d.ts

@@ -0,0 +1,212 @@
+/**
+ * Oblivious transfer — the real cryptographic root of the no-dealer offline phase.
+ *
+ * A 1-out-of-2 OT lets a RECEIVER with a choice bit `c` obtain exactly message `m_c` from a SENDER's
+ * pair `(m_0, m_1)`, such that the sender learns nothing about `c` and the receiver learns nothing
+ * about `m_{1−c}`. That single primitive is enough to multiply two parties' secret shares without a
+ * dealer (Gilboa's trick, see `mascot.ts`), which is enough to generate Beaver triples and SPDZ MACs
+ * with no trusted party. This module provides OT two ways:
+ *
+ *  1. **Base OT — MALICIOUSLY-secure Chou–Orlandi over the Ed25519 subgroup (`ec.ts`).** The core is
+ *     "simplest OT": sender samples `y`, publishes `S = y·B`, holds `T = y·S`; receiver with choice `c`
+ *     samples `x`, publishes `R = x·B + c·S`, derives pad `k = H(x·S)`; sender derives `k_b = H(y·R − b·T)`
+ *     for `b∈{0,1}`; since `y·R = x·(y·B) + c·T`, `k_c = k` while `k_{1−c}` is `H` of a point the receiver
+ *     can't compute (it would need the discrete log). **Receiver-choice privacy is information-theoretic
+ *     in the transcript:** `R = x·B + c·S` with `x` uniform is a uniform subgroup element whatever `c` is
+ *     — for every observed `R` there is one `x` consistent with `c=0` and one with `c=1` (`x' = x − y`),
+ *     so the sender's view is identically distributed for both choices. Two additions upgrade this from
+ *     semi-honest to **malicious-secure against both a cheating sender AND a cheating receiver** (docs
+ *     §7.1 item a):
+ *       • **the sender proves knowledge of `y` with a Schnorr NIZK on `S = y·B`** (`ec.ts`), so a sender
+ *         cannot use an `S` it cannot open (e.g. one crafted to leak the receiver's choice) — the
+ *         receiver verifies the proof and ABORTS before forming `R`;
+ *       • **every received point is validated** (on-curve + prime-order-subgroup cofactor check +
+ *         non-identity): the receiver validates `S`, the sender validates every `R_i`, so neither party
+ *         can inject an off-curve / small-order / mixed-order point for a small-subgroup attack.
+ *     The IKNP setup consumes this as a **random OT** (`malBaseRandomOT`): the two transferred seeds ARE
+ *     the RO pads `(H(y·R), H(y·R − T))`, so there are **no sender-chosen ciphertexts** and hence no
+ *     selective-failure surface — the only abort (bad `S`/proof/`R_i`) is independent of the receiver's
+ *     selector, which is exactly what malicious security of the role-inverted base OTs requires. The
+ *     chosen-message `baseOT` wrapper (random OT + one-time-pad + a commit-to-message check) is used by
+ *     the direct OT tests; its commitment catches a sender that encrypts inconsistently with its commitment.
+ *
+ *  2. **OT extension — IKNP + the KOS consistency check (MALICIOUS-secure).** Base OT needs public-key
+ *     ops per transfer; the offline phase needs hundreds of thousands of OTs. IKNP turns `κ = 128` base
+ *     OTs (done once) into arbitrarily many OTs using only a hash/PRG. Roles invert for the base OTs:
+ *     the extension SENDER plays base-receiver with a secret selector `s ∈ {0,1}^κ`; the extension
+ *     RECEIVER plays base-sender with `κ` seed pairs. Thereafter each extension round of `m` OTs costs
+ *     `κ` PRG expansions plus `~3·m` hashes. Correctness: the receiver recovers exactly `m_{c_j}` for
+ *     every `j`; the sender's `s` (hidden by the base OTs) and the correlation-robust hash keep the
+ *     unchosen messages hidden.
+ *
+ *     Plain IKNP is only SEMI-HONEST: a cheating RECEIVER can send an extension matrix `u` that encodes
+ *     *different* choice vectors in different columns, which breaks the row correlation `q_j = t_j ⊕
+ *     (b_j·s)` and lets the receiver learn bits of the sender's selector `s` (and thus the unchosen
+ *     messages). The **KOS correlation check** (Keller–Orsini–Scholl, "Actively Secure OT Extension
+ *     with Optimal Overhead") closes exactly this: after `u` is on the wire, the parties draw public
+ *     random weights `χ_j ∈ GF(2^κ)` (one per row, bound to `u` by a Fiat–Shamir hash here), the
+ *     receiver reveals `x = Σ_j b_j·χ_j` and `t = Σ_j χ_j·t_j`, and the sender checks
+ *     `Σ_j χ_j·q_j == t ⊕ x·s` in GF(2^κ). Honestly this always holds (`q_j = t_j ⊕ b_j·s`); a receiver
+ *     who deviated in `u` satisfies it with probability ≤ `2^{-κ} = 2^{-128}`, so a deviation ABORTS.
+ *     The check is run over `m + κ + SSEC` rows — the extra `κ + SSEC` random "sacrifice" OT rows mask
+ *     the revealed combination (receiver privacy) and give statistical soundness. This makes the OT
+ *     extension **malicious-secure**, not just semi-honest.
+ *
+ * In-process model: both parties run in one process and the functions take *both* parties' inputs and
+ * return the receiver's outputs plus an inspectable transcript (the receiver's wire message `R`, the
+ * sender's ciphertexts, the IKNP `u` matrix). That is exactly what the tests assert over: receiver
+ * correctness, sender-side choice-hiding from the transcript, and the KOS check aborting on a tampered
+ * `u`. See docs §7.1 for the remaining boundary (real async transport, constant-time, CSPRNG).
+ */
+import { type Point, type SchnorrProof } from './ec';
+/** IKNP security parameter (number of base OTs / width of the selector s). */
+export declare const KAPPA = 128;
+/**
+ * KOS statistical-security parameter: the number of EXTRA random check-OT rows (beyond the `κ` that
+ * mask the revealed combination) appended to every extension round. Together `κ + SSEC` padding rows
+ * give the correlation check its receiver-privacy and statistical soundness margin.
+ */
+export declare const SSEC = 64;
+/** Raised when the KOS correlation check fails: a cheating OT-extension receiver is detected → ABORT. */
+export declare class MalOtAbort extends Error {
+    constructor(message: string);
+}
+/** A deterministic source of scalars/seeds; wraps the module FieldRng-style stream for OT needs. */
+export interface OtRandom {
+    /** A uniform scalar in [1, L) (for EC blinding) — never 0. */
+    scalar(): bigint;
+    /** `n` random bytes (for seeds). */
+    bytes(n: number): Uint8Array;
+}
+/** A raw SplitMix64 64-bit stream (deterministic). Production uses a CSPRNG with a secret seed. */
+export declare function splitMix64(seed: bigint): () => bigint;
+/** Build an OtRandom from a SplitMix64-style 64-bit stream (deterministic; CSPRNG in production). */
+export declare function otRandom(next64: () => bigint): OtRandom;
+/** Raised when a base OT aborts: a cheating sender (bad proof / inconsistent ciphertext) is detected. */
+export declare class BaseOtAbort extends Error {
+    constructor(message: string);
+}
+/**
+ * TEST-ONLY injection points modelling a malicious SENDER or RECEIVER in the base OT. Each hook mutates
+ * or replaces a value exactly where it would cross the wire, so the honest party's validation runs
+ * against the adversarial value — which is what the malicious-security checks must catch.
+ */
+export interface BaseOtTamper {
+    /** Malicious SENDER: replace `S` on the wire (the receiver still validates it + the proof). */
+    tamperS?: (S: Point) => Point;
+    /** Malicious SENDER: forge the Schnorr proof on the wire. */
+    tamperProof?: (p: SchnorrProof) => SchnorrProof;
+    /** Malicious RECEIVER: mutate the `R_i` points on the wire (the sender still validates each). */
+    tamperR?: (R: Point[]) => void;
+    /** Malicious SENDER: corrupt the ciphertexts on the wire (inconsistent with the commitment). */
+    tamperCiphertext?: (ct: Array<[Uint8Array, Uint8Array]>) => void;
+}
+/** The base-OT transcript: the sender's `S` + proof-of-knowledge, the receiver's `R_i`, and the ciphertexts/commitments. */
+export interface BaseOtTranscript {
+    /** Sender's public point S = y·B. */
+    S: Point;
+    /** Schnorr NIZK proving the sender knows `y` with `S = y·B` (malicious-sender hardening). */
+    proof: SchnorrProof;
+    /** Receiver's points R_i = x_i·B + c_i·S (uniform subgroup elements; independent of c_i). */
+    R: Point[];
+    /** Sender ciphertexts: for each i, [E_{i,0}, E_{i,1}] = [m_{i,0} ⊕ pad_{i,0}, m_{i,1} ⊕ pad_{i,1}]. */
+    ct: Array<[Uint8Array, Uint8Array]>;
+    /** Per-message RO commitments com_{i,b} = H(i ‖ b ‖ m_{i,b} ‖ pad_{i,b}); the receiver checks com_{i,c}. */
+    com: Array<[Uint8Array, Uint8Array]>;
+}
+export interface BaseOtResult {
+    /** Receiver's recovered messages m_{i, c_i}. */
+    received: Uint8Array[];
+    transcript: BaseOtTranscript;
+}
+/**
+ * A pluggable chosen-message base OT: `count = choices.length` 1-of-2 OTs returning the receiver's
+ * recovered messages. The EC `baseOT` above satisfies it, and so does the post-quantum `kemBaseOT`
+ * (`kem-ot.ts`) — letting `OtChannel` run its κ setup OTs over either base without touching the
+ * IKNP/KOS layer. Only `received` is required (the EC-specific `transcript` is not part of the contract,
+ * since a non-EC base has a different transcript shape).
+ */
+export type BaseOtFn = (messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng: OtRandom) => {
+    received: Uint8Array[];
+};
+/** The output of the malicious-secure RANDOM base OT: validated points + the two RO pads per index. */
+export interface MalRandomOtResult {
+    /** Sender's public point (as seen on the wire by the receiver). */
+    S: Point;
+    /** Sender's proof of knowledge of the discrete log of `S`. */
+    proof: SchnorrProof;
+    /** Receiver's points (as seen on the wire by the sender). */
+    R: Point[];
+    /** Sender's pad pairs: senderPads[i] = [H(y·R_i), H(y·R_i − T)]. */
+    senderPads: Array<[Uint8Array, Uint8Array]>;
+    /** Receiver's recovered pads: recvPads[i] = H(x_i·S) = senderPads[i][c_i] (honest run). */
+    recvPads: Uint8Array[];
+}
+/**
+ * The MALICIOUS-secure RANDOM base OT: `count = choices.length` 1-of-2 random OTs. The sender publishes
+ * `S = y·B` with a Schnorr proof of knowledge of `y`; the receiver validates `S` + the proof and
+ * ABORTS on failure, then forms its `R_i`; the sender validates every `R_i` and derives the pad pairs.
+ * No messages are transferred — the pads ARE the random output. `tamper` injects malicious behaviour
+ * for tests. Both parties are simulated in-process.
+ */
+export declare function malBaseRandomOT(choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): MalRandomOtResult;
+/**
+ * Run `count` MALICIOUS-secure base OTs in one batch (chosen-message, over the random OT above).
+ * `messages[i] = [m0, m1]` (SEED_BYTES each), the sender's pair; `choices[i] ∈ {0,1}` the receiver's
+ * choice. The sender one-time-pads each message under the random-OT pads and commits to each message;
+ * the receiver recovers `m_{i,c_i}` and checks the commitment, aborting (`BaseOtAbort`) on any
+ * inconsistency. Returns the receiver's recovered messages and the full transcript.
+ */
+export declare function baseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): BaseOtResult;
+/**
+ * An IKNP OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs). The
+ * κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap PRG+hash round. The
+ * channel is stateful (advances per-seed PRG counters) so many rounds compose into one amortized setup.
+ */
+export declare class OtChannel {
+    private readonly rng;
+    /** Optional post-quantum (or otherwise custom) base OT for the κ setup OTs; defaults to EC `baseOT`. */
+    private readonly baseOtFn?;
+    private ready;
+    private s;
+    private sBits;
+    private senderSeeds;
+    private senderBlk;
+    private recvSeed0;
+    private recvSeed1;
+    private recvBlk0;
+    private recvBlk1;
+    /** The base-OT transcript (available after setup) — exposed for inspection/tests. */
+    baseTranscript?: BaseOtTranscript;
+    /**
+     * TEST-ONLY injection modelling a MALICIOUS extension RECEIVER: if set, it is called with the honest
+     * `u` matrix (κ columns, each `mExt` bits) just before it goes "on the wire", and may mutate it (e.g.
+     * XOR a delta into one or more columns) to encode inconsistent choices. The KOS check is computed
+     * over the tampered `u` (what the sender sees) while the receiver's revealed `(x, t)` stay honest, so
+     * a non-trivial tamper is caught — the real malicious-receiver attack that KOS defeats.
+     */
+    tamperU?: (u: bigint[], round: number) => void;
+    private round;
+    /**
+     * `rng` defaults to the CSPRNG (`secureOtRandom`, `node:crypto`) — production randomness. Pass a
+     * deterministic `otRandom(splitMix64(seed))` ONLY to make a test bit-reproducible (docs §7.1 item c).
+     */
+    constructor(rng?: OtRandom, opts?: {
+        baseOtFn?: BaseOtFn;
+    });
+    private setup;
+    /** Selector s as a κ-bit bigint (sender-side secret; exposed only for tests). */
+    get selector(): bigint;
+    /**
+     * One MALICIOUS-secure extension round: `choiceBits[j] ∈ {0,1}` (receiver), `msg0[j]/msg1[j]`
+     * field-element messages (sender). Returns the receiver's chosen messages `msg_{choiceBits[j]}[j]`
+     * for the `m` real rows. The round transparently appends `κ + SSEC` random check-OT rows and runs the
+     * **KOS correlation check** over all `m + κ + SSEC` rows; a cheating receiver (tampered `u`) is caught
+     * there and the round throws `MalOtAbort`. `uMatrix` (the receiver→sender wire message, now
+     * `mExt`-bit) is returned for tests.
+     */
+    extend(choiceBits: number[], msg0: bigint[], msg1: bigint[]): {
+        received: bigint[];
+        uMatrix: bigint[];
+    };
+}