@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/spdz.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * SPDZ-style authenticated secret sharing over F_p — the MALICIOUS-security layer.
+ *
+ * The semi-honest layer (`sharing.ts` + `beaver.ts`) is correct only if every party follows the
+ * protocol: a party that lies in an opening silently corrupts the result and is never caught. SPDZ
+ * closes that gap with *information-theoretic MACs*. A global MAC key `α ∈ F_p` is itself additively
+ * shared (`α = Σ_i α_i`, no single party knows `α`). Every authenticated value `⟦x⟧` carries, besides
+ * its value shares `x_i` (summing to `x`), a vector of MAC shares `γ_i` summing to `α·x`:
+ *
+ *     ⟦x⟧ = ( x_i , γ_i )   with   Σ x_i = x   and   Σ γ_i = α·x.
+ *
+ * Linear ops keep the invariant `Σ γ_i = α·(Σ x_i)` with NO interaction (add/sub of sharings,
+ * public-scalar multiply, and — the SPDZ trick — adding a PUBLIC constant updates each party's MAC
+ * share by `α_i·c`, which the party can do locally because it holds `α_i`). Beaver multiplication
+ * produces an authenticated product. Before any value is accepted as output the parties run the
+ * SPDZ **MAC-check** (random linear combination + commit-then-open of the residual `Σγ − α·a`); any
+ * party that fed an inconsistent value or MAC share into an opening makes the residual non-zero and
+ * the protocol ABORTS. The result is therefore *correct, or an abort* — never a silent wrong answer.
+ *
+ * Security upgrade: semi-honest → **malicious-with-abort, dishonest-majority** (secure against up to
+ * N−1 actively-corrupted parties; privacy and MAC-forgery-resistance both hold at the N−1 threshold).
+ * The MAC is information-theoretic: forging a MAC on a wrong value succeeds with probability ≤ 2/p
+ * (here ≈ 2^−60), independent of the adversary's computing power.
+ *
+ * OFFLINE-PHASE BOUNDARY (honest, see docs §7): the authenticated triples / input sharings below are
+ * produced by a TRUSTED DEALER that honestly knows `α`. That keeps the *online* phase — openings,
+ * MAC updates, and the MAC-check — the real, maliciously-secure thing, with the dealer as the one
+ * explicit trust assumption. A no-dealer offline phase (MASCOT/Overdrive: OT- or HE-based authenticated
+ * triple generation, itself maliciously secure, with a distributed `α` nobody ever reconstructs) is
+ * NOT implemented here; its interface is exactly `setupMac` + `genAuthTriple` + `authShare`, so it
+ * drops in under the same online protocol. The commitment below is SHA-256 (a real binding commitment,
+ * via `node:crypto`), modelling the commit-then-open round that defeats a rushing adversary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpdzEngine = exports.MacCheckAbort = void 0;
+exports.setupMac = setupMac;
+exports.authShare = authShare;
+exports.authConstant = authConstant;
+exports.addAuth = addAuth;
+exports.subAuth = subAuth;
+exports.negAuth = negAuth;
+exports.scaleAuth = scaleAuth;
+exports.addPublicAuth = addPublicAuth;
+exports.notBitAuth = notBitAuth;
+exports.genAuthTriple = genAuthTriple;
+exports.beaverMulAuth = beaverMulAuth;
+exports.authValue = authValue;
+const node_crypto_1 = require("node:crypto");
+const field_1 = require("./field");
+const sharing_1 = require("./sharing");
+/** Raised when the SPDZ MAC-check detects an inconsistent opening/MAC: the protocol ABORTS, no output. */
+class MacCheckAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MacCheckAbort';
+    }
+}
+exports.MacCheckAbort = MacCheckAbort;
+/** Dealer preprocessing: sample the global MAC key α and additively share it across n parties. */
+function setupMac(n, rng) {
+    if (!Number.isInteger(n) || n < 1)
+        throw new Error('setupMac: n must be a positive integer');
+    const alpha = rng.next();
+    return { n, alpha, alphaShares: (0, sharing_1.share)(alpha, n, rng) };
+}
+/** Authenticated sharing of `secret` (dealer-side): value shares sum to x, MAC shares sum to α·x. */
+function authShare(secret, ctx, rng) {
+    const v = (0, field_1.mod)(secret);
+    return { value: (0, sharing_1.share)(v, ctx.n, rng), mac: (0, sharing_1.share)((0, field_1.fmul)(ctx.alpha, v), ctx.n, rng) };
+}
+/** Authenticated sharing of a PUBLIC constant c: value = shareConstant(c), MAC = share of α·c (via α_i·c). */
+function authConstant(c, ctx) {
+    const v = (0, field_1.mod)(c);
+    const value = new Array(ctx.n).fill(0n);
+    value[0] = v;
+    // γ_i = α_i · c so that Σ γ_i = α·c, with no randomness and no interaction.
+    const mac = ctx.alphaShares.map((ai) => (0, field_1.fmul)(ai, v));
+    return { value, mac };
+}
+/** ⟦x⟧ + ⟦y⟧ (local; MAC shares add, preserving Σγ = α·(x+y)). */
+function addAuth(x, y) {
+    requireSame(x, y);
+    return {
+        value: x.value.map((xi, i) => (0, field_1.fadd)(xi, y.value[i])),
+        mac: x.mac.map((mi, i) => (0, field_1.fadd)(mi, y.mac[i])),
+    };
+}
+/** ⟦x⟧ − ⟦y⟧ (local). */
+function subAuth(x, y) {
+    requireSame(x, y);
+    return {
+        value: x.value.map((xi, i) => (0, field_1.fsub)(xi, y.value[i])),
+        mac: x.mac.map((mi, i) => (0, field_1.fsub)(mi, y.mac[i])),
+    };
+}
+/** −⟦x⟧ (local). */
+function negAuth(x) {
+    return { value: x.value.map(field_1.fneg), mac: x.mac.map(field_1.fneg) };
+}
+/** ⟦x⟧ · c for a PUBLIC scalar c (local): both value and MAC shares scale by c. */
+function scaleAuth(x, c) {
+    const k = (0, field_1.mod)(c);
+    return { value: x.value.map((xi) => (0, field_1.fmul)(xi, k)), mac: x.mac.map((mi) => (0, field_1.fmul)(mi, k)) };
+}
+/**
+ * ⟦x⟧ + c for a PUBLIC constant c (local). The SPDZ public-constant rule: add c to ONE party's value
+ * share, and add α_i·c to EVERY party's MAC share (each party holds α_i), so Σγ becomes α·x + α·c =
+ * α·(x+c). This is what lets affine gates stay authenticated without any interaction.
+ */
+function addPublicAuth(x, c, ctx) {
+    const k = (0, field_1.mod)(c);
+    const value = x.value.slice();
+    value[0] = (0, field_1.fadd)(value[0], k);
+    const mac = x.mac.map((mi, i) => (0, field_1.fadd)(mi, (0, field_1.fmul)(ctx.alphaShares[i], k)));
+    return { value, mac };
+}
+/** Logical NOT of an authenticated bit b: ⟦1 − b⟧ (local). */
+function notBitAuth(b, ctx) {
+    return addPublicAuth(negAuth(b), 1n, ctx);
+}
+/** Dealer preprocessing: one authenticated triple (a, b, c=a·b), every component MAC'd. */
+function genAuthTriple(ctx, rng) {
+    const a = rng.next();
+    const b = rng.next();
+    return {
+        a: authShare(a, ctx, rng),
+        b: authShare(b, ctx, rng),
+        c: authShare((0, field_1.fmul)(a, b), ctx, rng),
+    };
+}
+/**
+ * The SPDZ online engine: performs partial openings (broadcast value shares, sum to the public value,
+ * RETAIN the MAC shares for a single batched MAC-check at the end) and the MAC-check itself. A list of
+ * `Deviation`s models one or more actively-malicious parties corrupting their broadcasts; the engine
+ * records exactly what would reach the honest parties, so the MAC-check sees the tampered transcript.
+ */
+class SpdzEngine {
+    ctx;
+    deviations;
+    /** Each partial-open: the (possibly tampered) public value and the (possibly tampered) MAC shares. */
+    opened = [];
+    counter = 0;
+    constructor(ctx, deviations = []) {
+        this.ctx = ctx;
+        this.deviations = deviations;
+    }
+    /** How many opens have happened (lets tests target the last/output open by index). */
+    get openCount() {
+        return this.counter;
+    }
+    /**
+     * Partial-open ⟦x⟧: parties broadcast value shares, the public value is their sum, and the MAC
+     * shares are retained for the batched MAC-check. Does NOT check the MAC here (that is the whole
+     * point of SPDZ: open cheaply during the circuit, verify everything once at the end).
+     */
+    open(x, label = '') {
+        const idx = this.counter++;
+        const valueShares = x.value.slice();
+        const macShares = x.mac.slice();
+        for (const d of this.deviations) {
+            if (d.openIndex !== idx)
+                continue;
+            if (d.party < 0 || d.party >= this.ctx.n)
+                throw new Error('Deviation.party out of range');
+            if (d.valueDelta !== undefined)
+                valueShares[d.party] = (0, field_1.fadd)(valueShares[d.party], d.valueDelta);
+            if (d.macDelta !== undefined)
+                macShares[d.party] = (0, field_1.fadd)(macShares[d.party], d.macDelta);
+        }
+        const value = valueShares.reduce((a, b) => (0, field_1.fadd)(a, b), 0n);
+        this.opened.push({ value, macShares, label });
+        return value;
+    }
+    /**
+     * SPDZ MAC-check over every partial-open so far. Draws public random coefficients r_j (a secure
+     * coin-flip in the real protocol; a seeded RNG here, documented), forms the public combination
+     * a = Σ r_j·a_j and each party's residual share σ_i = (Σ r_j·γ_i(a_j)) − α_i·a, then runs
+     * commit-then-open on the σ_i and checks Σ σ_i = 0. Honest runs give exactly 0; ANY inconsistent
+     * opened value or forged MAC makes it non-zero with probability ≥ 1 − 2/p, and we ABORT.
+     *
+     * The commit-then-open (SHA-256 binding commitment) models the round that stops a *rushing*
+     * adversary from choosing its σ_i after seeing the others — it must commit before any are revealed.
+     */
+    macCheck(rng) {
+        if (this.opened.length === 0)
+            return;
+        const r = this.opened.map(() => rng.next());
+        let a = 0n;
+        for (let j = 0; j < this.opened.length; j++)
+            a = (0, field_1.fadd)(a, (0, field_1.fmul)(r[j], this.opened[j].value));
+        const sigma = [];
+        for (let i = 0; i < this.ctx.n; i++) {
+            let gamma = 0n;
+            for (let j = 0; j < this.opened.length; j++) {
+                gamma = (0, field_1.fadd)(gamma, (0, field_1.fmul)(r[j], this.opened[j].macShares[i]));
+            }
+            sigma.push((0, field_1.fsub)(gamma, (0, field_1.fmul)(this.ctx.alphaShares[i], a)));
+        }
+        // Commit-then-open: every party commits to σ_i (binding) before any σ is revealed.
+        const nonces = sigma.map(() => rng.next());
+        const commitments = sigma.map((s, i) => commit(s, nonces[i]));
+        for (let i = 0; i < sigma.length; i++) {
+            // Opening phase: a σ_i revealed inconsistent with its commitment is itself an abort.
+            if (commit(sigma[i], nonces[i]) !== commitments[i]) {
+                throw new MacCheckAbort(`MAC-check: commitment from party ${i} did not open consistently`);
+            }
+        }
+        const residual = sigma.reduce((x, y) => (0, field_1.fadd)(x, y), 0n);
+        if (residual !== 0n) {
+            throw new MacCheckAbort(`MAC-check FAILED: residual ${residual} != 0 — an actively-malicious party was detected; aborting with no output`);
+        }
+    }
+}
+exports.SpdzEngine = SpdzEngine;
+/**
+ * Authenticated Beaver multiplication: returns ⟦x·y⟧, consuming `triple`, via the engine's partial
+ * opens of d = x−a and e = y−b. The product sharing is assembled with the authenticated linear ops,
+ * so its MAC shares sum to α·(x·y). The two opens are recorded for the batched MAC-check: a party that
+ * opens d or e inconsistently is caught there.
+ */
+function beaverMulAuth(x, y, triple, ctx, engine, label = '') {
+    const d = engine.open(subAuth(x, triple.a), `${label}:d`);
+    const e = engine.open(subAuth(y, triple.b), `${label}:e`);
+    // ⟦z⟧ = ⟦c⟧ + d·⟦b⟧ + e·⟦a⟧ + d·e  (the last term is a public constant, MAC'd via α_i).
+    let z = addAuth(triple.c, addAuth(scaleAuth(triple.b, d), scaleAuth(triple.a, e)));
+    z = addPublicAuth(z, (0, field_1.fmul)(d, e), ctx);
+    return z;
+}
+/** Full-reconstruct an authenticated value's cleartext (sum of value shares). Used after MAC-check passes. */
+function authValue(x) {
+    return x.value.reduce((a, b) => (0, field_1.fadd)(a, b), 0n);
+}
+/** SHA-256 binding commitment to a field element under a nonce. Real (node:crypto); models commit-then-open. */
+function commit(value, nonce) {
+    return (0, node_crypto_1.createHash)('sha256').update(`${value.toString(16)}:${nonce.toString(16)}`).digest('hex');
+}
+function requireSame(x, y) {
+    if (x.value.length !== y.value.length || x.mac.length !== y.mac.length) {
+        throw new Error('authenticated shared values must have the same party count');
+    }
+}
+//# sourceMappingURL=spdz.js.map

package/dist/spdz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spdz.js","sourceRoot":"","sources":["../src/spdz.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;AAuCH,4BAIC;AAGD,8BAGC;AAGD,oCAOC;AAGD,0BAMC;AAGD,0BAMC;AAGD,0BAEC;AAGD,8BAGC;AAOD,sCAMC;AAGD,gCAEC;AAGD,sCAQC;AA4GD,sCAcC;AAGD,8BAEC;AAlPD,6CAAyC;AACzC,mCAAgE;AAChE,uCAAkC;AA0BlC,0GAA0G;AAC1G,MAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED,kGAAkG;AAClG,SAAgB,QAAQ,CAAC,CAAS,EAAE,GAAa;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAA,eAAK,EAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,qGAAqG;AACrG,SAAgB,SAAS,CAAC,MAAc,EAAE,GAAe,EAAE,GAAa;IACtE,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,IAAA,eAAK,EAAC,IAAA,YAAI,EAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,8GAA8G;AAC9G,SAAgB,YAAY,CAAC,CAAS,EAAE,GAAe;IACrD,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,4EAA4E;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,kEAAkE;AAClE,SAAgB,OAAO,CAAC,CAAS,EAAE,CAAS;IAC1C,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,SAAgB,OAAO,CAAC,CAAS,EAAE,CAAS;IAC1C,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,oBAAoB;AACpB,SAAgB,OAAO,CAAC,CAAS;IAC/B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAI,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,mFAAmF;AACnF,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC;IACjB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,GAAe;IACjE,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9B,KAAK,CAAC,CAAC,CAAC,GAAG,IAAA,YAAI,EAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,EAAE,EAAE,IAAA,YAAI,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,8DAA8D;AAC9D,SAAgB,UAAU,CAAC,CAAS,EAAE,GAAe;IACnD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,2FAA2F;AAC3F,SAAgB,aAAa,CAAC,GAAe,EAAE,GAAa;IAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,OAAO;QACL,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;QACzB,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;QACzB,CAAC,EAAE,SAAS,CAAC,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAa,UAAU;IACJ,GAAG,CAAa;IAChB,UAAU,CAAc;IACzC,sGAAsG;IACrF,MAAM,GAA4D,EAAE,CAAC;IAC9E,OAAO,GAAG,CAAC,CAAC;IAEpB,YAAY,GAAe,EAAE,aAA0B,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,sFAAsF;IACtF,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,CAAS,EAAE,KAAK,GAAG,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG;gBAAE,SAAS;YAClC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAA,YAAI,EAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;YACjG,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;gBAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAa;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,EAAE,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7F,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,KAAK,GAAG,IAAA,YAAI,EAAC,KAAK,EAAE,IAAA,YAAI,EAAC,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAA,YAAI,EAAC,KAAK,EAAE,IAAA,YAAI,EAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,qFAAqF;YACrF,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,4BAA4B,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CACrB,8BAA8B,QAAQ,2EAA2E,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAhFD,gCAgFC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,CAAS,EACT,CAAS,EACT,MAAkB,EAClB,GAAe,EACf,MAAkB,EAClB,KAAK,GAAG,EAAE;IAEV,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IAC1D,wFAAwF;IACxF,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8GAA8G;AAC9G,SAAgB,SAAS,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,gHAAgH;AAChH,SAAS,MAAM,CAAC,KAAa,EAAE,KAAa;IAC1C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/thermometer.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Thermometer (unary) encoding of a bounded integer, which is what lets us compute MAX securely
+ * using only the AND/OR primitive (hence only Beaver multiplication) — no comparison circuit.
+ *
+ * A value v in {0..M} is encoded as the bit vector ge[k] = [v >= k] for k = 1..M. Because v>=k
+ * implies v>=k-1, the vector is monotone: a block of 1s followed by 0s. Then:
+ *   - MAX of several values  = position-wise OR of their thermometers (OR preserves monotonicity,
+ *     and (max v)>=k  iff  some v_i >= k). Decoding = counting the leading 1s.
+ *   - OR of bits over N parties = 1 - Π_i (1 - b_i), i.e. built from multiplication.
+ *
+ * So "max over a small bounded domain" reduces to the same shared-multiplication primitive as "AND
+ * of allow bits", and we never reveal any party's individual thermometer — only the composed one,
+ * which encodes exactly the agreed MAX (the intended output).
+ */
+/** Encode v in {0..M} as ge[k] = (v >= k) for k=1..M. Clamps v into range (fail-safe). */
+export declare function thermometerEncode(v: number, M: number): number[];
+/**
+ * Decode a thermometer back to an integer = the number of 1s. For a well-formed (monotone)
+ * thermometer this is the encoded value; for the composed OR it is the MAX. Robust to non-monotone
+ * input (counts set bits), which only matters defensively.
+ */
+export declare function thermometerDecode(bits: ReadonlyArray<number | bigint>): number;

package/dist/thermometer.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Thermometer (unary) encoding of a bounded integer, which is what lets us compute MAX securely
+ * using only the AND/OR primitive (hence only Beaver multiplication) — no comparison circuit.
+ *
+ * A value v in {0..M} is encoded as the bit vector ge[k] = [v >= k] for k = 1..M. Because v>=k
+ * implies v>=k-1, the vector is monotone: a block of 1s followed by 0s. Then:
+ *   - MAX of several values  = position-wise OR of their thermometers (OR preserves monotonicity,
+ *     and (max v)>=k  iff  some v_i >= k). Decoding = counting the leading 1s.
+ *   - OR of bits over N parties = 1 - Π_i (1 - b_i), i.e. built from multiplication.
+ *
+ * So "max over a small bounded domain" reduces to the same shared-multiplication primitive as "AND
+ * of allow bits", and we never reveal any party's individual thermometer — only the composed one,
+ * which encodes exactly the agreed MAX (the intended output).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.thermometerEncode = thermometerEncode;
+exports.thermometerDecode = thermometerDecode;
+/** Encode v in {0..M} as ge[k] = (v >= k) for k=1..M. Clamps v into range (fail-safe). */
+function thermometerEncode(v, M) {
+    if (!Number.isInteger(M) || M < 0)
+        throw new Error('thermometerEncode: M must be a non-negative integer');
+    const clamped = Math.max(0, Math.min(M, Math.trunc(v)));
+    const bits = [];
+    for (let k = 1; k <= M; k++)
+        bits.push(clamped >= k ? 1 : 0);
+    return bits;
+}
+/**
+ * Decode a thermometer back to an integer = the number of 1s. For a well-formed (monotone)
+ * thermometer this is the encoded value; for the composed OR it is the MAX. Robust to non-monotone
+ * input (counts set bits), which only matters defensively.
+ */
+function thermometerDecode(bits) {
+    let count = 0;
+    for (const b of bits)
+        if (b === 1 || b === 1n)
+            count++;
+    return count;
+}
+//# sourceMappingURL=thermometer.js.map

package/dist/thermometer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thermometer.js","sourceRoot":"","sources":["../src/thermometer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAGH,8CAMC;AAOD,8CAIC;AAlBD,0FAA0F;AAC1F,SAAgB,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAoC;IACpE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;YAAE,KAAK,EAAE,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,61 @@
 {
   "name": "@atlasauth/pca-mpc",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Multi-stakeholder policy VM composed under secure multi-party computation (semi-honest additive secret sharing over a prime field) with a post-quantum base-OT. Experimental reference prototype.",
+  "keywords": [
+    "secure multi-party computation",
+    "mpc",
+    "oblivious transfer",
+    "policy vm",
+    "prototype",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-mpc"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@noble/post-quantum": "^0.4.1",
+    "@atlasauth/pca": "0.2.0",
+    "@atlasauth/pca-mpc-wasm": "0.2.0",
+    "@atlasauth/pca-mpc-lwe-ot-wasm": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }