@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,66 @@
-# Temporary Holding Version
+# @atlasauth/pca-mpc
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Experimental reference prototype: a multi-stakeholder policy VM composed under secure multi-party computation, for Proof-Carrying Authority (PCA). Several stakeholders (for example user, organization, regulator) each evaluate their own private PCA policy to a tiny decision vector `{ allow, t, rQuant }`, then compose them under MPC so only the joint result is revealed: allow if every party allows, the maximum required proof threshold, and the maximum quantized risk. No party reveals its own policy or its own vector.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-mpc @atlasauth/pca
+```
+
+## Usage
+
+```ts
+import { generateKeyPair, encodeKey, mintGrant, DEFAULT_RISK_POLICY } from '@atlasauth/pca';
+import { evaluateParty, composeSecure, composeSecureMalicious } from '@atlasauth/pca-mpc';
+
+const principal = generateKeyPair();
+const holder = generateKeyPair();
+
+// Each stakeholder builds a PartyPolicy from its own grant + decision input.
+function party(id: string, verb = '*') {
+  const { grant } = mintGrant({
+    principalSecret: principal.secretKey,
+    principalPublic: encodeKey(principal.publicKey),
+    holder: encodeKey(holder.publicKey),
+    goal: 'wire funds',
+    envelope: { predicates: [{ verb, resource: '*' }], caveats: [], agent_binding: {}, risk_policy: DEFAULT_RISK_POLICY },
+  });
+  return {
+    id,
+    decideInput: {
+      grant,
+      action: { action: { verb: 'wire', resource: 'acct:1', params: {} } },
+      risk: { semanticDistance: 0.1, reversibility: 1, blastRadius: 0.1, taint: 0, confidence: 1, age: 0 },
+      budget: { B: 1, tau: 0 },
+      now: Date.now(),
+    },
+  };
+}
+
+// Local step: each party reduces its private policy to a decision vector.
+const vectors = [party('user'), party('org'), party('regulator', 'read')].map((p) => evaluateParty(p));
+
+// Joint step: semi-honest MPC (additive sharing over a prime field + Beaver triples).
+const result = composeSecure(vectors);
+result.composed;   // { allow: 0, t: 3, rQuant: 5 }  (the regulator only permits 'read', so the joint answer is deny)
+
+// Malicious-with-abort variant (SPDZ-style MACs): correct result, or a thrown abort.
+const strict = composeSecureMalicious(vectors);
+```
+
+## API
+
+- `evaluateParty(policy, Q?)` - reduce a party's private PCA decision input to a `DecisionVector`.
+- `composeSecure(vectors, config?)` - semi-honest composition; returns `composed`, the public Beaver `opened` messages, and per-party views.
+- `composeSecureMalicious(vectors, config?)` - dishonest-majority layer with information-theoretic MACs and a MAC check that aborts on deviation; an optional no-dealer offline provider (OT-based) replaces the trusted dealer.
+- `composeClear(vectors)` - the cleartext reference that `composeSecure` must equal.
+- Lower-level building blocks (field arithmetic, sharing, Beaver triples, oblivious transfer including a post-quantum KEM-based base OT) are exported too.
+
+## Status
+
+This is a research prototype, not a production MPC system. All parties run in one process and exchange data through in-memory structures, so it demonstrates and tests the protocol logic but is not a networked deployment. The semi-honest layer assumes parties follow the protocol and uses a trusted dealer for triples; the malicious layer detects deviation by aborting and can use an OT-based offline phase instead of a dealer. The cryptography has not been audited. The composed verdict informs a decision; it does not authorize anything on its own - the resource server's verifier decides.
+
+## License
+
+MIT - see LICENSE

package/dist/beaver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Secure MULTIPLICATION of two additively-shared values via Beaver triples.
+ *
+ * Additive sharing gives addition and public-scalar ops for free, but NOT multiplication (the
+ * product of two secrets is quadratic in the shares and has no local form). Beaver's trick turns one
+ * multiplication into two PUBLIC openings plus local arithmetic, using a pre-shared random triple
+ * (a, b, c=a*b):
+ *
+ *   x*y = (d+a)(e+b) = d*e + d*b + e*a + a*b     where d = x-a, e = y-b
+ *
+ * The parties open d and e (reconstruct them in the clear). Because a and b are uniform and secret,
+ * d = x-a and e = y-b are uniform masks that reveal NOTHING about x or y. Given public d, e each
+ * party then forms its share of the product locally:
+ *
+ *   z_i = c_i + d*b_i + e*a_i     (and party 0 additionally adds the public term d*e)
+ *
+ * so Σ z_i = c + d*b + e*a + d*e = a*b + d*b + e*a + d*e = x*y.
+ *
+ * PREPROCESSING MODEL (prototype): a TRUSTED DEALER generates the triples and shares them. This is a
+ * standard and legitimate semi-honest preprocessing choice; the correctness/privacy of the ONLINE
+ * phase (what the parties exchange) does not depend on the dealer beyond "the triples are correct and
+ * the a,b stay secret." A production system removes the trusted dealer with an offline triple
+ * generation protocol (OT-based or homomorphic-encryption-based), and adds MACs (SPDZ) for malicious
+ * security. See the design doc.
+ */
+import { FieldRng } from './field';
+import { type SharedValue } from './sharing';
+/** A Beaver multiplication triple, each component additively shared across the N parties. */
+export interface Triple {
+    a: SharedValue;
+    b: SharedValue;
+    c: SharedValue;
+}
+/** One opened (reconstructed, public) protocol message. `shares` are the per-party broadcasts. */
+export interface OpenedMsg {
+    label: 'd' | 'e';
+    value: bigint;
+    shares: bigint[];
+}
+/** Trusted-dealer preprocessing: generate `count` correct multiplication triples for `n` parties. */
+export declare function genTriples(count: number, n: number, rng: FieldRng): Triple[];
+/** Trusted-dealer preprocessing: one correct triple (a, b, c=a*b), each component shared. */
+export declare function genTriple(n: number, rng: FieldRng): Triple;
+/**
+ * Secure multiply: returns a sharing of x*y, consuming `triple`. Every opened value (d, e) is pushed
+ * to `transcript` when provided — that transcript IS the adversary's view of the online messages, and
+ * the privacy tests assert it reveals nothing about the inputs.
+ */
+export declare function beaverMul(x: SharedValue, y: SharedValue, triple: Triple, transcript?: OpenedMsg[]): SharedValue;

package/dist/beaver.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Secure MULTIPLICATION of two additively-shared values via Beaver triples.
+ *
+ * Additive sharing gives addition and public-scalar ops for free, but NOT multiplication (the
+ * product of two secrets is quadratic in the shares and has no local form). Beaver's trick turns one
+ * multiplication into two PUBLIC openings plus local arithmetic, using a pre-shared random triple
+ * (a, b, c=a*b):
+ *
+ *   x*y = (d+a)(e+b) = d*e + d*b + e*a + a*b     where d = x-a, e = y-b
+ *
+ * The parties open d and e (reconstruct them in the clear). Because a and b are uniform and secret,
+ * d = x-a and e = y-b are uniform masks that reveal NOTHING about x or y. Given public d, e each
+ * party then forms its share of the product locally:
+ *
+ *   z_i = c_i + d*b_i + e*a_i     (and party 0 additionally adds the public term d*e)
+ *
+ * so Σ z_i = c + d*b + e*a + d*e = a*b + d*b + e*a + d*e = x*y.
+ *
+ * PREPROCESSING MODEL (prototype): a TRUSTED DEALER generates the triples and shares them. This is a
+ * standard and legitimate semi-honest preprocessing choice; the correctness/privacy of the ONLINE
+ * phase (what the parties exchange) does not depend on the dealer beyond "the triples are correct and
+ * the a,b stay secret." A production system removes the trusted dealer with an offline triple
+ * generation protocol (OT-based or homomorphic-encryption-based), and adds MACs (SPDZ) for malicious
+ * security. See the design doc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genTriples = genTriples;
+exports.genTriple = genTriple;
+exports.beaverMul = beaverMul;
+const field_1 = require("./field");
+const sharing_1 = require("./sharing");
+const sharing_2 = require("./sharing");
+/** Trusted-dealer preprocessing: generate `count` correct multiplication triples for `n` parties. */
+function genTriples(count, n, rng) {
+    const triples = [];
+    for (let i = 0; i < count; i++)
+        triples.push(genTriple(n, rng));
+    return triples;
+}
+/** Trusted-dealer preprocessing: one correct triple (a, b, c=a*b), each component shared. */
+function genTriple(n, rng) {
+    const a = rng.next();
+    const b = rng.next();
+    const c = (0, field_1.fmul)(a, b);
+    return { a: (0, sharing_2.share)(a, n, rng), b: (0, sharing_2.share)(b, n, rng), c: (0, sharing_2.share)(c, n, rng) };
+}
+/**
+ * Secure multiply: returns a sharing of x*y, consuming `triple`. Every opened value (d, e) is pushed
+ * to `transcript` when provided — that transcript IS the adversary's view of the online messages, and
+ * the privacy tests assert it reveals nothing about the inputs.
+ */
+function beaverMul(x, y, triple, transcript) {
+    if (x.length !== y.length)
+        throw new Error('beaverMul: operand party counts differ');
+    const dShares = (0, sharing_1.subSV)(x, triple.a);
+    const eShares = (0, sharing_1.subSV)(y, triple.b);
+    const d = (0, sharing_1.reconstruct)(dShares);
+    const e = (0, sharing_1.reconstruct)(eShares);
+    if (transcript) {
+        transcript.push({ label: 'd', value: d, shares: dShares });
+        transcript.push({ label: 'e', value: e, shares: eShares });
+    }
+    const de = (0, field_1.fmul)(d, e);
+    return triple.c.map((ci, i) => {
+        let zi = (0, field_1.fadd)(ci, (0, field_1.fadd)((0, field_1.fmul)(d, triple.b[i]), (0, field_1.fmul)(e, triple.a[i])));
+        if (i === 0)
+            zi = (0, field_1.fadd)(zi, de); // the public d*e term lives on exactly one party
+        return zi;
+    });
+}
+//# sourceMappingURL=beaver.js.map

package/dist/beaver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beaver.js","sourceRoot":"","sources":["../src/beaver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAqBH,gCAIC;AAGD,8BAKC;AAOD,8BAqBC;AA3DD,mCAA+C;AAC/C,uCAAiE;AACjE,uCAAkC;AAgBlC,qGAAqG;AACrG,SAAgB,UAAU,CAAC,KAAa,EAAE,CAAS,EAAE,GAAa;IAChE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6FAA6F;AAC7F,SAAgB,SAAS,CAAC,CAAS,EAAE,GAAa;IAChD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CACvB,CAAc,EACd,CAAc,EACd,MAAc,EACd,UAAwB;IAExB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,IAAA,eAAK,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAA,eAAK,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,EAAE,GAAG,IAAA,YAAI,EAAC,EAAE,EAAE,IAAA,YAAI,EAAC,IAAA,YAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,IAAA,YAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC;YAAE,EAAE,GAAG,IAAA,YAAI,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,iDAAiD;QACjF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/compose.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Composition semantics (the "meet" of stakeholder authorities) and the CLEARTEXT reference.
+ *
+ * Composition is deliberately conservative — it can only ever TIGHTEN, never loosen, matching PCA's
+ * fail-closed philosophy:
+ *   - allow  = AND over parties  (every stakeholder must admit; one deny => composed deny)
+ *   - t      = MAX over parties  (the strictest required proof strength wins)
+ *   - rQuant = MAX over parties  (the highest assessed risk wins)
+ *
+ * The secure runner (`runner.ts`) computes EXACTLY this function under MPC; `composeClear` is the
+ * ground truth the correctness tests check it against.
+ */
+import type { DecisionVector } from './party';
+/** The composed, revealed decision. */
+export interface ComposedDecision {
+    allow: 0 | 1;
+    t: 1 | 2 | 3;
+    rQuant: number;
+}
+/** Cleartext composition over the parties' decision vectors. Requires at least one party. */
+export declare function composeClear(vectors: ReadonlyArray<DecisionVector>): ComposedDecision;

package/dist/compose.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * Composition semantics (the "meet" of stakeholder authorities) and the CLEARTEXT reference.
+ *
+ * Composition is deliberately conservative — it can only ever TIGHTEN, never loosen, matching PCA's
+ * fail-closed philosophy:
+ *   - allow  = AND over parties  (every stakeholder must admit; one deny => composed deny)
+ *   - t      = MAX over parties  (the strictest required proof strength wins)
+ *   - rQuant = MAX over parties  (the highest assessed risk wins)
+ *
+ * The secure runner (`runner.ts`) computes EXACTLY this function under MPC; `composeClear` is the
+ * ground truth the correctness tests check it against.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composeClear = composeClear;
+/** Cleartext composition over the parties' decision vectors. Requires at least one party. */
+function composeClear(vectors) {
+    if (vectors.length === 0)
+        throw new Error('composeClear: no parties (fail closed)');
+    let allow = 1;
+    let t = 1;
+    let rQuant = 0;
+    for (const v of vectors) {
+        if (v.allow === 0)
+            allow = 0;
+        if (v.t > t)
+            t = v.t;
+        if (v.rQuant > rQuant)
+            rQuant = v.rQuant;
+    }
+    return { allow, t, rQuant };
+}
+//# sourceMappingURL=compose.js.map

package/dist/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAYH,oCAWC;AAZD,6FAA6F;AAC7F,SAAgB,YAAY,CAAC,OAAsC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,IAAI,KAAK,GAAU,CAAC,CAAC;IACrB,IAAI,CAAC,GAAc,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/csprng.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Cryptographically-secure randomness — the default source for ALL protocol randomness (docs §7.1
+ * item c). Every secret the protocol samples — base-OT scalars `x`/`y`, the Schnorr nonce, IKNP seeds,
+ * Gilboa masks `ρ`, the MAC key shares `α_i`, triple shares `a_i`/`b_i`, and the sacrifice / input /
+ * MAC-check coefficients — is drawn here from `node:crypto.randomBytes` unless a test explicitly asks
+ * for a reproducible seeded stream.
+ *
+ * The deterministic SplitMix64 path (`field.ts` / `ot.ts`) is retained ONLY behind an explicit
+ * `testSeed`, so tests stay bit-reproducible while production never silently runs on a deterministic
+ * PRNG. The one deliberately-NON-secret source is the KOS challenge `χ` (`ot.ts`), which is a
+ * public-coin Fiat–Shamir value derived from the committed transcript — it must be reproducible by
+ * both parties and is therefore a transcript hash by design, not a secret the CSPRNG governs.
+ *
+ * NOTE on the remaining boundary (honest, docs §7.1): a real deployment also needs a *secure coin-flip*
+ * among the parties for the public MAC-check / sacrifice coefficients (here a CSPRNG stands in for that
+ * interactive sub-protocol), and a secret per-session seed management story. Using `randomBytes` closes
+ * the "deterministic PRNG" caveat; it does not itself provide the multiparty coin-flip, which is a
+ * network/protocol layer (§7.1 item: real async network).
+ */
+import { FieldRng } from './field';
+import type { OtRandom } from './ot';
+/** A minimal field-random source: `next()` yields a uniform element of F_p. `FieldRng` satisfies it. */
+export interface FieldSource {
+    next(): bigint;
+}
+/**
+ * A CSPRNG-backed field RNG. Drop-in for `FieldRng` everywhere (it extends it and overrides `next()`),
+ * so `share` / `setupMac` / `macCheck` / the no-dealer offline all accept it with no signature change.
+ * Draws unbiased elements of F_p by rejection sampling over fresh `randomBytes`.
+ */
+export declare class SecureFieldRng extends FieldRng {
+    constructor();
+    next(): bigint;
+}
+/**
+ * A CSPRNG-backed `OtRandom` (scalars in `[1, L)` by rejection, raw bytes from `randomBytes`). This is
+ * the default randomness for every base OT / OT-extension / Schnorr nonce when no test seed is set.
+ */
+export declare function secureOtRandom(): OtRandom;
+/**
+ * The field-randomness policy for the whole package: a CSPRNG by default, or a reproducible seeded
+ * `FieldRng` ONLY when an explicit `testSeed` is given. Production calls this with no argument.
+ */
+export declare function fieldRandom(opts?: {
+    testSeed?: bigint;
+}): FieldSource;

package/dist/csprng.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * Cryptographically-secure randomness — the default source for ALL protocol randomness (docs §7.1
+ * item c). Every secret the protocol samples — base-OT scalars `x`/`y`, the Schnorr nonce, IKNP seeds,
+ * Gilboa masks `ρ`, the MAC key shares `α_i`, triple shares `a_i`/`b_i`, and the sacrifice / input /
+ * MAC-check coefficients — is drawn here from `node:crypto.randomBytes` unless a test explicitly asks
+ * for a reproducible seeded stream.
+ *
+ * The deterministic SplitMix64 path (`field.ts` / `ot.ts`) is retained ONLY behind an explicit
+ * `testSeed`, so tests stay bit-reproducible while production never silently runs on a deterministic
+ * PRNG. The one deliberately-NON-secret source is the KOS challenge `χ` (`ot.ts`), which is a
+ * public-coin Fiat–Shamir value derived from the committed transcript — it must be reproducible by
+ * both parties and is therefore a transcript hash by design, not a secret the CSPRNG governs.
+ *
+ * NOTE on the remaining boundary (honest, docs §7.1): a real deployment also needs a *secure coin-flip*
+ * among the parties for the public MAC-check / sacrifice coefficients (here a CSPRNG stands in for that
+ * interactive sub-protocol), and a secret per-session seed management story. Using `randomBytes` closes
+ * the "deterministic PRNG" caveat; it does not itself provide the multiparty coin-flip, which is a
+ * network/protocol layer (§7.1 item: real async network).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureFieldRng = void 0;
+exports.secureOtRandom = secureOtRandom;
+exports.fieldRandom = fieldRandom;
+const node_crypto_1 = require("node:crypto");
+const field_1 = require("./field");
+const ec_1 = require("./ec");
+const MASK64 = (1n << 64n) - 1n;
+/**
+ * A CSPRNG-backed field RNG. Drop-in for `FieldRng` everywhere (it extends it and overrides `next()`),
+ * so `share` / `setupMac` / `macCheck` / the no-dealer offline all accept it with no signature change.
+ * Draws unbiased elements of F_p by rejection sampling over fresh `randomBytes`.
+ */
+class SecureFieldRng extends field_1.FieldRng {
+    constructor() {
+        // The super ctor seeds the (now-unused) SplitMix64 state; `next()` below ignores it entirely.
+        super(0n);
+    }
+    next() {
+        // Largest multiple of p that fits in 64 bits; reject anything at/above it so `% p` is exactly uniform.
+        const limit = ((MASK64 + 1n) / field_1.PRIME) * field_1.PRIME;
+        for (;;) {
+            const buf = (0, node_crypto_1.randomBytes)(8);
+            let u = 0n;
+            for (let i = 0; i < 8; i++)
+                u = (u << 8n) | BigInt(buf[i]);
+            if (u < limit)
+                return u % field_1.PRIME;
+        }
+    }
+}
+exports.SecureFieldRng = SecureFieldRng;
+/**
+ * A CSPRNG-backed `OtRandom` (scalars in `[1, L)` by rejection, raw bytes from `randomBytes`). This is
+ * the default randomness for every base OT / OT-extension / Schnorr nonce when no test seed is set.
+ */
+function secureOtRandom() {
+    return {
+        scalar() {
+            // 32 bytes → reject the top `2^256 mod L` residues so reduction mod L is exactly uniform; reject 0.
+            const bound = (1n << 256n) - ((1n << 256n) % ec_1.L);
+            for (;;) {
+                const buf = (0, node_crypto_1.randomBytes)(32);
+                let acc = 0n;
+                for (let i = 0; i < 32; i++)
+                    acc = (acc << 8n) | BigInt(buf[i]);
+                if (acc >= bound)
+                    continue;
+                const s = acc % ec_1.L;
+                if (s !== 0n)
+                    return s;
+            }
+        },
+        bytes(n) {
+            return new Uint8Array((0, node_crypto_1.randomBytes)(n));
+        },
+    };
+}
+/**
+ * The field-randomness policy for the whole package: a CSPRNG by default, or a reproducible seeded
+ * `FieldRng` ONLY when an explicit `testSeed` is given. Production calls this with no argument.
+ */
+function fieldRandom(opts) {
+    return opts?.testSeed === undefined ? new SecureFieldRng() : new field_1.FieldRng(opts.testSeed);
+}
+//# sourceMappingURL=csprng.js.map

package/dist/csprng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csprng.js","sourceRoot":"","sources":["../src/csprng.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAyCH,wCAkBC;AAMD,kCAEC;AAjED,6CAA0C;AAC1C,mCAA0C;AAC1C,6BAAyB;AAGzB,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAOhC;;;;GAIG;AACH,MAAa,cAAe,SAAQ,gBAAQ;IAC1C;QACE,8FAA8F;QAC9F,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAEQ,IAAI;QACX,uGAAuG;QACvG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC,GAAG,aAAK,CAAC;QAC9C,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,GAAG,aAAK,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAhBD,wCAgBC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,OAAO;QACL,MAAM;YACJ,oGAAoG;YACpG,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,MAAC,CAAC,CAAC;YAChD,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;oBAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;gBACjE,IAAI,GAAG,IAAI,KAAK;oBAAE,SAAS;gBAC3B,MAAM,CAAC,GAAG,GAAG,GAAG,MAAC,CAAC;gBAClB,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,CAAS;YACb,OAAO,IAAI,UAAU,CAAC,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,IAA4B;IACtD,OAAO,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3F,CAAC"}

package/dist/ec.d.ts

@@ -0,0 +1,130 @@
+/**
+ * A small, self-contained prime-order elliptic-curve group, used by the base oblivious transfer in
+ * `ot.ts`. The no-dealer offline phase (MASCOT-style triple generation) rests on real OT, and real OT
+ * rests on a real group with a hard discrete log — this module provides that group with nothing but
+ * BigInt arithmetic, so the whole stack stays dependency-free and testable in-process.
+ *
+ * Curve: **Ed25519** (twisted Edwards `−x² + y² = 1 + d·x²·y²` over `F_q`, `q = 2^255 − 19`). We work
+ * exclusively in the prime-order subgroup of order `L = 2^252 + 27742317777372353535851937790883648493`
+ * generated by the standard base point `B`, keeping every scalar in `[0, L)`; all group elements we
+ * ever form are scalar multiples of subgroup points, so they stay in the subgroup. Points are held in
+ * **extended coordinates** `(X, Y, Z, T)` with `x = X/Z`, `y = Y/Z`, `T = XY/Z`, and combined with the
+ * unified ("hwcd-3") addition law, which is *complete* on the subgroup — there are no special cases to
+ * branch on, which is exactly what keeps the implementation free of the subtle point-at-infinity bugs
+ * that plague short-Weierstrass code.
+ *
+ * SECURITY NOTES (prototype honesty, mirrored in docs §7.1):
+ *  - **Point validation IS implemented** (`isOnCurve` / `hasPrimeOrder` / `assertInSubgroup`): every
+ *    point a party RECEIVES across the OT trust boundary is validated to be on the curve and in the
+ *    prime-order subgroup (cofactor check `[L]·P = O`), and non-identity, so a malicious party cannot
+ *    inject an off-curve / small-order / mixed-order point to mount a small-subgroup attack. A
+ *    `schnorrProve`/`schnorrVerify` NIZK of knowledge of the sender's discrete log `y` (`S = y·B`)
+ *    binds `S` to a known exponent, which — with validation — is what makes the base OT malicious-secure.
+ *  - **Constant-time: the secret-scalar multiplications now run in a constant-time WASM core by
+ *    DEFAULT.** BigInt modular arithmetic branches on operand size and is not constant-time; rather than
+ *    pretend otherwise, the security-critical ops (every secret-scalar multiply/point-combine: `mulBase`,
+ *    `mul`, `add`, `sub`, `neg`, and the `[L]·P` cofactor ladder) are routed through `@atlasauth/pca-mpc-wasm`
+ *    (a `curve25519-dalek` core compiled to WebAssembly) whenever it loads, which is the default. The
+ *    pure-BigInt path below is retained verbatim as a graceful fallback for when the WASM core is
+ *    unavailable, and is proven byte-for-byte equivalent to it (see the backend section and
+ *    `ec-wasm.test.ts`). The remaining BigInt marshalling (point compress/decompress) operates on
+ *    public point values, never the secret scalar, and is not claimed constant-time (docs §7.1).
+ *  - Discrete log in the order-`L` subgroup is the hardness the OT's receiver-choice privacy relies on.
+ */
+/** Field prime q = 2^255 − 19. */
+export declare const Q: bigint;
+/** Prime order of the base-point subgroup. Scalars live in [0, L). */
+export declare const L: bigint;
+/** A curve point in extended twisted-Edwards coordinates (X:Y:Z:T), x=X/Z, y=Y/Z, T=XY/Z. */
+export interface Point {
+    X: bigint;
+    Y: bigint;
+    Z: bigint;
+    T: bigint;
+}
+/** The identity (neutral) element, affine (0, 1). */
+export declare const IDENTITY: Point;
+/** The standard Ed25519 base point B (a generator of the order-L subgroup). */
+export declare const BASE: Point;
+/** Canonical representative in [0, q). */
+export declare function modFq(x: bigint): bigint;
+/**
+ * Dedicated doubling (twisted Edwards a=−1, "dbl-2008-hwcd") — cheaper than the unified add, used to
+ * speed up the scalar ladder. Complete on the subgroup.
+ */
+export declare function dbl(p: Point): Point;
+/** Whether the constant-time WASM curve backend is active (else the pure-BigInt path is in use). */
+export declare function isWasmCurveActive(): boolean;
+/**
+ * Canonical 32-byte compressed Ed25519 encoding of a point (little-endian `y`, sign of `x` in bit 255)
+ * — the wire form the WASM core speaks. Faithful for on-curve points; the matching inverse is
+ * `decompressPoint`.
+ */
+export declare function compressPoint(p: Point): Uint8Array;
+/**
+ * Decode a canonical 32-byte compressed encoding back into an extended-coordinate `Point` (RFC 8032
+ * §5.1.3 x-recovery). Used to bring a WASM-core result back into the `Point` representation so the rest
+ * of `ec.ts`/`ot.ts` (affine encoding, KDF hashing, equality) sees byte-identical values to the pure
+ * path. Throws `PointValidationError` on a non-canonical / off-curve encoding.
+ */
+export declare function decompressPoint(bytes: Uint8Array): Point;
+/**
+ * Unified complete addition P + Q. Routes through the constant-time WASM core when available (inputs
+ * are on-curve points everywhere the OT stack calls this), else the pure-BigInt `add-2008-hwcd-3`.
+ */
+export declare function add(p1: Point, p2: Point): Point;
+/** Scalar multiplication [k]P (k reduced mod L; k=0 ⇒ identity). WASM core when available. */
+export declare function mul(k: bigint, p: Point): Point;
+/** [k]·BASE. WASM core when available (the fixed-base secret-scalar multiply). */
+export declare function mulBase(k: bigint): Point;
+/** P − Q. WASM core when available. */
+export declare function sub(p1: Point, p2: Point): Point;
+/** −P. WASM core when available. */
+export declare function neg(p: Point): Point;
+/** Affine (x, y) of a point (one inversion). Identity ⇒ (0, 1). */
+export declare function toAffine(p: Point): {
+    x: bigint;
+    y: bigint;
+};
+/** Whether two points are equal as group elements (compare in affine). */
+export declare function equal(p1: Point, p2: Point): boolean;
+/** Canonical 64-byte encoding of a point (affine x‖y), the input to the OT key-derivation hash. */
+export declare function encodePoint(p: Point): Uint8Array;
+/** Raised when a received point fails on-curve / subgroup / identity validation. */
+export declare class PointValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Whether `p`'s extended coordinates lie on the Ed25519 curve. Checks projectively (no inversion):
+ *   - `Z ≠ 0` (a valid projective point),
+ *   - the T-invariant `T·Z ≡ X·Y`,
+ *   - the twisted-Edwards equation (`a = −1`) cleared of denominators: `(Y² − X²)·Z² ≡ Z⁴ + d·X²·Y²`.
+ * An off-curve / malformed point fails here before any scalar work.
+ */
+export declare function isOnCurve(p: Point): boolean;
+/** Whether `p` is the identity (neutral) element (affine `(0, 1)`). */
+export declare function isIdentity(p: Point): boolean;
+/**
+ * The cofactor check `[L]·P = O`. When the constant-time WASM core is loaded, the `[L]·P` scalar work
+ * runs inside it (the point is compressed to its canonical 32-byte form — faithful for ON-curve points,
+ * which is the only case this is reached with in the validation flow — and the core's torsion check is
+ * exactly `[L]·P = O`); otherwise it falls back to the pure-BigInt raw ladder. Both agree bit-for-bit
+ * (the `[L]·P = O ⟺ torsion-free ∨ identity` equivalence), so the observable result is identical.
+ */
+export declare function hasPrimeOrder(p: Point): boolean;
+/** Whether `p` is a valid non-identity point of the prime-order subgroup (the OT point contract). */
+export declare function isInSubgroup(p: Point): boolean;
+/** Assert `p` is a valid non-identity prime-order-subgroup point, else throw `PointValidationError`. */
+export declare function assertInSubgroup(p: Point, label?: string): void;
+/** A Fiat–Shamir Schnorr proof of knowledge of `y` s.t. `S = y·B`: commitment `U = r·B` and `z = r + e·y`. */
+export interface SchnorrProof {
+    U: Point;
+    z: bigint;
+}
+/** Prove knowledge of `y` with `S = y·B`. `rnd` draws the (secret) nonce `r ∈ [1, L)`. */
+export declare function schnorrProve(y: bigint, S: Point, rnd: () => bigint): SchnorrProof;
+/**
+ * Verify a Schnorr proof for `S`: `z` is in range, `U` is a valid subgroup point, and `z·B = U + e·S`
+ * for the recomputed challenge `e`. Returns false on any failure (the OT layer turns that into an abort).
+ */
+export declare function schnorrVerify(S: Point, proof: SchnorrProof): boolean;