@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/field.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Arithmetic in the prime field F_p used for additive secret sharing.
+ *
+ * p = 2^61 - 1 (the Mersenne prime M61). It is wider than any value the composition ever shares
+ * (bits, thermometer bits, small sums), so no secret ever wraps; sharing randomness lives in the
+ * full field so that any single share is (information-theoretically) uniform and independent of the
+ * secret. All arithmetic is BigInt and exact — never floating point — so the protocol is
+ * bit-deterministic and verifier-reproducible.
+ *
+ * RANDOMNESS (docs §7.1 item "CSPRNG — done"): the `FieldRng` below is a deterministic SplitMix64, kept
+ * ONLY for bit-reproducible tests behind an explicit seed. It is NOT the default: the protocol draws
+ * all sharing/triple/MAC randomness from the CSPRNG `SecureFieldRng` / `secureOtRandom` in `csprng.ts`
+ * (`node:crypto.randomBytes`) unless a test explicitly asks for the seeded stream. `SecureFieldRng`
+ * extends this class and overrides `next()`, so it is a drop-in wherever a `FieldRng` is accepted.
+ */
+export declare const PRIME: bigint;
+/** Canonical representative in [0, p). */
+export declare function mod(x: bigint): bigint;
+export declare const fadd: (a: bigint, b: bigint) => bigint;
+export declare const fsub: (a: bigint, b: bigint) => bigint;
+export declare const fmul: (a: bigint, b: bigint) => bigint;
+export declare const fneg: (a: bigint) => bigint;
+/**
+ * Deterministic SplitMix64, drawing UNBIASED field elements by rejection sampling (reject the top
+ * 2^64 mod p = 8 residues so the modulo is exactly uniform). Deterministic for reproducible tests;
+ * see the security note above for production.
+ */
+export declare class FieldRng {
+    private s;
+    constructor(seed?: bigint);
+    private nextU64;
+    /** Uniform element of F_p (unbiased). */
+    next(): bigint;
+}

package/dist/field.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Arithmetic in the prime field F_p used for additive secret sharing.
+ *
+ * p = 2^61 - 1 (the Mersenne prime M61). It is wider than any value the composition ever shares
+ * (bits, thermometer bits, small sums), so no secret ever wraps; sharing randomness lives in the
+ * full field so that any single share is (information-theoretically) uniform and independent of the
+ * secret. All arithmetic is BigInt and exact — never floating point — so the protocol is
+ * bit-deterministic and verifier-reproducible.
+ *
+ * RANDOMNESS (docs §7.1 item "CSPRNG — done"): the `FieldRng` below is a deterministic SplitMix64, kept
+ * ONLY for bit-reproducible tests behind an explicit seed. It is NOT the default: the protocol draws
+ * all sharing/triple/MAC randomness from the CSPRNG `SecureFieldRng` / `secureOtRandom` in `csprng.ts`
+ * (`node:crypto.randomBytes`) unless a test explicitly asks for the seeded stream. `SecureFieldRng`
+ * extends this class and overrides `next()`, so it is a drop-in wherever a `FieldRng` is accepted.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRng = exports.fneg = exports.fmul = exports.fsub = exports.fadd = exports.PRIME = void 0;
+exports.mod = mod;
+exports.PRIME = 2n ** 61n - 1n;
+const MASK64 = (1n << 64n) - 1n;
+/** Canonical representative in [0, p). */
+function mod(x) {
+    const r = x % exports.PRIME;
+    return r >= 0n ? r : r + exports.PRIME;
+}
+const fadd = (a, b) => mod(a + b);
+exports.fadd = fadd;
+const fsub = (a, b) => mod(a - b);
+exports.fsub = fsub;
+const fmul = (a, b) => mod(a * b);
+exports.fmul = fmul;
+const fneg = (a) => mod(-a);
+exports.fneg = fneg;
+/**
+ * Deterministic SplitMix64, drawing UNBIASED field elements by rejection sampling (reject the top
+ * 2^64 mod p = 8 residues so the modulo is exactly uniform). Deterministic for reproducible tests;
+ * see the security note above for production.
+ */
+class FieldRng {
+    s;
+    constructor(seed = 0x243f6a8885a308d3n) {
+        this.s = seed & MASK64;
+    }
+    nextU64() {
+        this.s = (this.s + 0x9e3779b97f4a7c15n) & MASK64;
+        let z = this.s;
+        z = ((z ^ (z >> 30n)) * 0xbf58476d1ce4e5b9n) & MASK64;
+        z = ((z ^ (z >> 27n)) * 0x94d049bb133111ebn) & MASK64;
+        z = (z ^ (z >> 31n)) & MASK64;
+        return z;
+    }
+    /** Uniform element of F_p (unbiased). */
+    next() {
+        // Largest multiple of p that fits in 64 bits; drop anything at or above it so `% PRIME` is uniform.
+        const limit = ((MASK64 + 1n) / exports.PRIME) * exports.PRIME;
+        for (;;) {
+            const u = this.nextU64();
+            if (u < limit)
+                return u % exports.PRIME;
+        }
+    }
+}
+exports.FieldRng = FieldRng;
+//# sourceMappingURL=field.js.map

package/dist/field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field.js","sourceRoot":"","sources":["../src/field.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAOH,kBAGC;AARY,QAAA,KAAK,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAAC;AAEpC,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEhC,0CAA0C;AAC1C,SAAgB,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,aAAK,CAAC;IACpB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAK,CAAC;AACjC,CAAC;AAEM,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAAtC,QAAA,IAAI,QAAkC;AAEnD;;;;GAIG;AACH,MAAa,QAAQ;IACX,CAAC,CAAS;IAElB,YAAY,OAAe,mBAAmB;QAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;IACzB,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACf,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC,GAAG,aAAK,CAAC;QAC9C,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,GAAG,aAAK,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAzBD,4BAyBC"}

package/dist/gf128.d.ts

@@ -0,0 +1,23 @@
+/**
+ * GF(2^128) arithmetic — the field the KOS correlation check lives in (`ot.ts`).
+ *
+ * The malicious-secure OT-extension consistency check (KOS) folds every row of the extension matrix
+ * into a single random linear combination over GF(2^κ) with κ = 128, and verifies one field equation.
+ * A cheating receiver who deviates in the extension matrix passes that equation with probability at
+ * most `2^{-128}` (the field size), which is what upgrades IKNP from semi-honest to malicious-secure.
+ *
+ * We use the standard GF(2^128) with reduction polynomial `x^128 + x^7 + x^2 + x + 1` (the GCM /
+ * "0x87" polynomial). Elements are 128-bit `bigint`s, bit `i` = coefficient of `x^i`. Addition is XOR.
+ * Multiplication is schoolbook carryless multiply with reduction; `mulByXi` (multiply by `x^i`) is the
+ * repeated-shift form used by the column-domain check so the hot path pays no full 128×128 multiply
+ * per row. This is a textbook field (BigInt, not constant-time) — sound for the in-process prototype;
+ * see docs §7.1 for the constant-time boundary.
+ */
+/** Field addition in GF(2^128): XOR (masked to 128 bits). */
+export declare function gf128Add(a: bigint, b: bigint): bigint;
+/** Multiply by `x` (one step of the LFSR): shift left 1, reduce if it overflowed bit 127. */
+export declare function gf128MulX(v: bigint): bigint;
+/** Multiply by `x^i` (i ≥ 0): i LFSR steps. Used by the column-domain KOS fold. */
+export declare function gf128MulByXi(v: bigint, i: number): bigint;
+/** Full GF(2^128) multiplication (carryless multiply + reduction), right-to-left over the bits of `b`. */
+export declare function gf128Mul(a: bigint, b: bigint): bigint;

package/dist/gf128.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * GF(2^128) arithmetic — the field the KOS correlation check lives in (`ot.ts`).
+ *
+ * The malicious-secure OT-extension consistency check (KOS) folds every row of the extension matrix
+ * into a single random linear combination over GF(2^κ) with κ = 128, and verifies one field equation.
+ * A cheating receiver who deviates in the extension matrix passes that equation with probability at
+ * most `2^{-128}` (the field size), which is what upgrades IKNP from semi-honest to malicious-secure.
+ *
+ * We use the standard GF(2^128) with reduction polynomial `x^128 + x^7 + x^2 + x + 1` (the GCM /
+ * "0x87" polynomial). Elements are 128-bit `bigint`s, bit `i` = coefficient of `x^i`. Addition is XOR.
+ * Multiplication is schoolbook carryless multiply with reduction; `mulByXi` (multiply by `x^i`) is the
+ * repeated-shift form used by the column-domain check so the hot path pays no full 128×128 multiply
+ * per row. This is a textbook field (BigInt, not constant-time) — sound for the in-process prototype;
+ * see docs §7.1 for the constant-time boundary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gf128Add = gf128Add;
+exports.gf128MulX = gf128MulX;
+exports.gf128MulByXi = gf128MulByXi;
+exports.gf128Mul = gf128Mul;
+/** 128-bit mask. */
+const MASK128 = (1n << 128n) - 1n;
+/**
+ * The reduction tail for `x^128 + x^7 + x^2 + x + 1`: when a shift pushes a 1 past bit 127, we have
+ * `x^128 ≡ x^7 + x^2 + x + 1 = 0x87`, so we XOR `0x87` back in.
+ */
+const GF128_RED = (1n << 7n) | (1n << 2n) | (1n << 1n) | 1n; // 0x87
+/** Field addition in GF(2^128): XOR (masked to 128 bits). */
+function gf128Add(a, b) {
+    return (a ^ b) & MASK128;
+}
+/** Multiply by `x` (one step of the LFSR): shift left 1, reduce if it overflowed bit 127. */
+function gf128MulX(v) {
+    const carry = (v >> 127n) & 1n;
+    let r = (v << 1n) & MASK128;
+    if (carry)
+        r ^= GF128_RED;
+    return r;
+}
+/** Multiply by `x^i` (i ≥ 0): i LFSR steps. Used by the column-domain KOS fold. */
+function gf128MulByXi(v, i) {
+    let r = v & MASK128;
+    for (let k = 0; k < i; k++)
+        r = gf128MulX(r);
+    return r;
+}
+/** Full GF(2^128) multiplication (carryless multiply + reduction), right-to-left over the bits of `b`. */
+function gf128Mul(a, b) {
+    let res = 0n;
+    let v = a & MASK128;
+    for (let i = 0; i < 128; i++) {
+        if ((b >> BigInt(i)) & 1n)
+            res ^= v;
+        v = gf128MulX(v);
+    }
+    return res & MASK128;
+}
+//# sourceMappingURL=gf128.js.map

package/dist/gf128.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gf128.js","sourceRoot":"","sources":["../src/gf128.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAYH,4BAEC;AAGD,8BAKC;AAGD,oCAIC;AAGD,4BAQC;AAtCD,oBAAoB;AACpB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO;AAEpE,6DAA6D;AAC7D,SAAgB,QAAQ,CAAC,CAAS,EAAE,CAAS;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,6FAA6F;AAC7F,SAAgB,SAAS,CAAC,CAAS;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;IAC5B,IAAI,KAAK;QAAE,CAAC,IAAI,SAAS,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0GAA0G;AAC1G,SAAgB,QAAQ,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;YAAE,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,OAAO,CAAC;AACvB,CAAC"}

package/dist/hybrid-ot.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Hybrid base OT — a SOUND combiner of the malicious-secure EC base OT (`ot.ts`/`ec.ts`) and the
+ * post-quantum committed ML-KEM base OT (`kem-ot.ts`), run together so the stack inherits the BEST
+ * guarantee of each half instead of the weakest.
+ *
+ * ─── WHY A COMBINER ────────────────────────────────────────────────────────────────────────────────
+ * The two base OTs this package ships have complementary weaknesses:
+ *   • The EC base OT (`malBaseRandomOT`) is MALICIOUS-secure against both roles — a Schnorr NIZK proof
+ *     of knowledge of `y` on `S = y·B`, full prime-order-subgroup validation of every transmitted
+ *     point, and a random-OT core with no sender-chosen ciphertexts — but its hardness is the curve25519
+ *     discrete log, which a QUANTUM adversary breaks with Shor.
+ *   • The ML-KEM base OT (`kemBaseOtMalRandom`) is POST-QUANTUM (Module-LWE) and has unconditional,
+ *     even-against-a-quantum-sender choice privacy, but against an actively-malicious receiver it has an
+ *     IRREDUCIBLE residue from the opaque primitive: a receiver that runs keygen twice and keeps BOTH
+ *     secret keys learns both messages, and the decisional-MLWE indistinguishability that gives choice
+ *     privacy makes that cheat undetectable to the sender (see `kem-ot.ts` header).
+ *
+ * The combiner runs BOTH base OTs on the SAME choice bit and the SAME session, then derives each
+ * transfer key from BOTH halves' shared secrets:
+ *
+ *     k_b = H( DOMAIN_SEP ‖ sid ‖ i ‖ b ‖ ss_ec_b ‖ ss_kem_b )        for b ∈ {0, 1}
+ *
+ * where `ss_ec_b` is the EC random-OT pad (`malBaseRandomOT`) and `ss_kem_b` the committed ML-KEM
+ * random-OT secret (`kemBaseOtMalRandom`, the hardened variant — never the semi-honest one). The sender
+ * one-time-pads `m_b` under `k_b` and commits to it (`com_b`); the honest receiver reconstructs only
+ * `k_c` (it holds only `ss_ec_c` and `ss_kem_c`) and checks `com_c`.
+ *
+ * ─── WHAT THIS ACHIEVES (precise) ───────────────────────────────────────────────────────────────────
+ * To recover `m_{1−c}` an adversary needs `k_{1−c}`, hence BOTH `ss_ec_{1−c}` AND `ss_kem_{1−c}` (the
+ * hash is a random oracle; missing either input leaves the pad pseudorandom). Therefore:
+ *   • vs a CLASSICAL malicious receiver — MALICIOUS-secure. Even a receiver that defeats the KEM half
+ *     entirely by keeping both ML-KEM secrets (so it holds `ss_kem_{1−c}`) still cannot obtain
+ *     `ss_ec_{1−c}`: the EC base OT is malicious-secure and `ss_ec_{1−c} = H(y·R − T)` is a point the
+ *     receiver cannot compute without the discrete log of `S`. No `ss_ec_{1−c}` ⇒ no `k_{1−c}` ⇒ `m_{1−c}`
+ *     stays hidden. This is the KILLER property the tests prove.
+ *   • SENDER PRIVACY vs a SEMI-HONEST QUANTUM receiver — holds via the KEM half (Module-LWE): a quantum
+ *     receiver that follows the protocol (discards the non-chosen material) cannot get `ss_kem_{1−c}`,
+ *     so again `k_{1−c}` is unobtainable even though it could break the EC half with Shor.
+ *   • CHOICE PRIVACY — POST-QUANTUM. The KEM half's choice privacy is unconditional (two i.i.d. real
+ *     ML-KEM public keys on the wire); the EC half's is information-theoretic in its transcript (`R` is a
+ *     uniform subgroup element whatever `c` is). Neither leaks `c`, against any adversary.
+ *   • SESSION BINDING — both halves are bound to a COMMON `sid` derived from BOTH sub-protocols'
+ *     session material (the KEM `(rn, sn)` nonces and the EC point `S`), and `sid` is hashed into every
+ *     transfer key and commitment, so secrets from one session/opened-key-set cannot be replayed into
+ *     another. The KEM half additionally aborts (`KemBaseOtAbort`) if the receiver opens keys other than
+ *     the ones it committed to; the EC half aborts (`BaseOtAbort`/`PointValidationError`) on a bad proof
+ *     or an off-/small-order point; and the combiner aborts (`HybridOtAbort`) if a tampered ciphertext
+ *     fails its commitment.
+ *
+ * ─── THE HONEST BOUNDARY (NOT faked) ────────────────────────────────────────────────────────────────
+ * The one residue this combiner does NOT close is a receiver that is SIMULTANEOUSLY actively-malicious
+ * AND quantum: such a receiver could break the classical EC half with Shor (recovering `ss_ec_{1−c}`
+ * from the transcript) WHILE keeping both ML-KEM secrets (recovering `ss_kem_{1−c}`), and so assemble
+ * `k_{1−c}`. Closing THAT requires a base OT that is BOTH post-quantum AND malicious-secure in one
+ * primitive — i.e. an endemic/UC OT from Module-LWE with a CRS, which needs direct lattice module
+ * arithmetic (sampling / adding in ML-KEM's structured public-key space to plant a secretless slot).
+ * The opaque `ml_kem768` keygen/encaps/decaps interface this package is restricted to does NOT expose
+ * that arithmetic, and hand-rolling it is exactly the lattice crypto the module forbids. So this is the
+ * honest limit of what a KEM-opaque + EC combiner can reach; it is stated, not papered over.
+ *
+ * No hand-rolled crypto: the EC half goes through `malBaseRandomOT` (unchanged), the KEM half through
+ * `kemBaseOtMalRandom` (unchanged), and this module only hashes (SHA-256 RO) and XORs their outputs.
+ */
+import { type Point } from './ec';
+import { type BaseOtTamper, type OtChannel, type OtRandom } from './ot';
+import { type KemMalTamper } from './kem-ot';
+/** Raised when the hybrid combiner aborts: a sender ciphertext inconsistent with its commitment is caught. */
+export declare class HybridOtAbort extends Error {
+    constructor(message: string);
+}
+/**
+ * The COMMON session id binding both halves: `H(TAG ‖ kemSid ‖ encode(ecS))`. It folds the KEM
+ * sub-protocol's two-nonce session id (`rn, sn`) and the EC sub-protocol's point `S`, so neither party
+ * alone fixes it and secrets cannot be mixed across sessions. Both parties derive the same value from
+ * the public transcript.
+ */
+export declare function hybridSessionId(kemSid: Uint8Array, ecS: Point): Uint8Array;
+/**
+ * The hybrid transfer key for one slot: `H(TAG ‖ sid ‖ i ‖ slot ‖ ss_ec ‖ ss_kem)` expanded (SHA-256
+ * counter mode) to `len` bytes. Modelled as a random oracle: the key is pseudorandom unless BOTH
+ * `ss_ec` and `ss_kem` (for that exact slot/index/session) are supplied — the soundness crux of the
+ * combiner.
+ */
+export declare function hybridTransferKey(sid: Uint8Array, index: number, slot: number, ssEc: Uint8Array, ssKem: Uint8Array, len: number): Uint8Array;
+/** The sender's wire message of the hybrid combiner: one-time-padded messages + per-message commitments. */
+export interface HybridSenderMessage {
+    /** For each transfer i, `[E_0, E_1]` with `E_b = m_b ⊕ k_b`. */
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, `[com_0, com_1]` with `com_b = H(sid ‖ i ‖ b ‖ m_b ‖ k_b)`. */
+    commitments: Array<[Uint8Array, Uint8Array]>;
+}
+/**
+ * SENDER side of the combiner: given BOTH halves' per-slot shared secrets, derive both transfer keys,
+ * one-time-pad each message, and commit to each. `ecSecrets[i] = [ss_ec_0, ss_ec_1]` (the EC random-OT
+ * `senderPads`), `kemSecrets[i] = [ss_kem_0, ss_kem_1]` (the committed-KEM `senderSecrets`).
+ */
+export declare function hybridSenderEncrypt(sid: Uint8Array, messages: Array<[Uint8Array, Uint8Array]>, ecSecrets: Array<[Uint8Array, Uint8Array]>, kemSecrets: Array<[Uint8Array, Uint8Array]>): HybridSenderMessage;
+/**
+ * RECEIVER side of the combiner: reconstruct ONLY the chosen transfer key (from the chosen EC and KEM
+ * secrets the receiver legitimately holds), unmask the chosen message, and CHECK the commitment.
+ * `ecRecv[i] = ss_ec_{choices[i]}` (the EC `recvPads`), `kemRecv[i] = ss_kem_{choices[i]}` (the
+ * committed-KEM `recvSecrets`). Aborts (`HybridOtAbort`) if the recovered message fails its commitment.
+ */
+export declare function hybridReceiverRecover(sid: Uint8Array, choices: number[], sender: HybridSenderMessage, ecRecv: Uint8Array[], kemRecv: Uint8Array[]): Uint8Array[];
+/**
+ * TEST-ONLY injection points modelling malicious behaviour in the hybrid combiner. The `ec` / `kem`
+ * bags are forwarded to the respective sub-OTs (so each half's real malicious checks run against the
+ * adversarial value); `tamperEncrypted` corrupts the hybrid sender's ciphertexts on the wire (caught by
+ * the commitment check).
+ */
+export interface HybridBaseOtTamper {
+    /** Forwarded to the EC half (`malBaseRandomOT`): malicious sender/receiver on the EC sub-OT. */
+    ec?: BaseOtTamper;
+    /** Forwarded to the KEM half (`kemBaseOtMalRandom`): malicious receiver on the committed KEM sub-OT. */
+    kem?: KemMalTamper;
+    /** Malicious hybrid SENDER: corrupt the padded messages on the wire (inconsistent with the commitment). */
+    tamperEncrypted?: (encrypted: Array<[Uint8Array, Uint8Array]>) => void;
+}
+/** A full hybrid base-OT transcript, exposed for inspection/tests. */
+export interface HybridBaseOtTranscript {
+    /** The common session id both halves are bound to. */
+    sid: Uint8Array;
+    /** The EC sub-OT's public point `S` (with its Schnorr proof available via the EC half). */
+    ecS: Point;
+    /** The committed-KEM sub-OT session id `H(rn ‖ sn)`. */
+    kemSid: Uint8Array;
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+    commitments: Array<[Uint8Array, Uint8Array]>;
+}
+export interface HybridBaseOtResult {
+    /** Receiver's recovered messages `m_{i, choices[i]}`. */
+    received: Uint8Array[];
+    transcript: HybridBaseOtTranscript;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT`/`kemBaseOT`
+ * so it is a drop-in for `OtChannel`'s `baseOtFn` (`withHybridBaseOt`). Runs the malicious-secure EC
+ * base OT and the committed ML-KEM base OT on the SAME choices, binds both to a common `sid`, and
+ * combines their per-slot secrets into the transfer keys. A cheating party is caught by whichever
+ * half's check applies (EC proof/point validation, KEM commitment, or the hybrid ciphertext
+ * commitment). `tamper` injects malicious behaviour for tests.
+ */
+export declare function hybridBaseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: HybridBaseOtTamper): HybridBaseOtResult;
+/**
+ * Wire the HYBRID base OT into the KOS OT-extension: a drop-in for `withKemBaseOt`/`withKemBaseOtMal`
+ * that makes `OtChannel` run its κ setup base OTs over the combiner. The extension inherits the
+ * combiner's guarantee — malicious security vs a classical receiver, PQ sender-privacy vs a semi-honest
+ * quantum one, and PQ choice privacy — with everything above the base OT (IKNP matrix, KOS correlation
+ * check, correlation-robust hash) unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withHybridBaseOt());
+ */
+export declare function withHybridBaseOt(): ConstructorParameters<typeof OtChannel>[1];

package/dist/hybrid-ot.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * Hybrid base OT — a SOUND combiner of the malicious-secure EC base OT (`ot.ts`/`ec.ts`) and the
+ * post-quantum committed ML-KEM base OT (`kem-ot.ts`), run together so the stack inherits the BEST
+ * guarantee of each half instead of the weakest.
+ *
+ * ─── WHY A COMBINER ────────────────────────────────────────────────────────────────────────────────
+ * The two base OTs this package ships have complementary weaknesses:
+ *   • The EC base OT (`malBaseRandomOT`) is MALICIOUS-secure against both roles — a Schnorr NIZK proof
+ *     of knowledge of `y` on `S = y·B`, full prime-order-subgroup validation of every transmitted
+ *     point, and a random-OT core with no sender-chosen ciphertexts — but its hardness is the curve25519
+ *     discrete log, which a QUANTUM adversary breaks with Shor.
+ *   • The ML-KEM base OT (`kemBaseOtMalRandom`) is POST-QUANTUM (Module-LWE) and has unconditional,
+ *     even-against-a-quantum-sender choice privacy, but against an actively-malicious receiver it has an
+ *     IRREDUCIBLE residue from the opaque primitive: a receiver that runs keygen twice and keeps BOTH
+ *     secret keys learns both messages, and the decisional-MLWE indistinguishability that gives choice
+ *     privacy makes that cheat undetectable to the sender (see `kem-ot.ts` header).
+ *
+ * The combiner runs BOTH base OTs on the SAME choice bit and the SAME session, then derives each
+ * transfer key from BOTH halves' shared secrets:
+ *
+ *     k_b = H( DOMAIN_SEP ‖ sid ‖ i ‖ b ‖ ss_ec_b ‖ ss_kem_b )        for b ∈ {0, 1}
+ *
+ * where `ss_ec_b` is the EC random-OT pad (`malBaseRandomOT`) and `ss_kem_b` the committed ML-KEM
+ * random-OT secret (`kemBaseOtMalRandom`, the hardened variant — never the semi-honest one). The sender
+ * one-time-pads `m_b` under `k_b` and commits to it (`com_b`); the honest receiver reconstructs only
+ * `k_c` (it holds only `ss_ec_c` and `ss_kem_c`) and checks `com_c`.
+ *
+ * ─── WHAT THIS ACHIEVES (precise) ───────────────────────────────────────────────────────────────────
+ * To recover `m_{1−c}` an adversary needs `k_{1−c}`, hence BOTH `ss_ec_{1−c}` AND `ss_kem_{1−c}` (the
+ * hash is a random oracle; missing either input leaves the pad pseudorandom). Therefore:
+ *   • vs a CLASSICAL malicious receiver — MALICIOUS-secure. Even a receiver that defeats the KEM half
+ *     entirely by keeping both ML-KEM secrets (so it holds `ss_kem_{1−c}`) still cannot obtain
+ *     `ss_ec_{1−c}`: the EC base OT is malicious-secure and `ss_ec_{1−c} = H(y·R − T)` is a point the
+ *     receiver cannot compute without the discrete log of `S`. No `ss_ec_{1−c}` ⇒ no `k_{1−c}` ⇒ `m_{1−c}`
+ *     stays hidden. This is the KILLER property the tests prove.
+ *   • SENDER PRIVACY vs a SEMI-HONEST QUANTUM receiver — holds via the KEM half (Module-LWE): a quantum
+ *     receiver that follows the protocol (discards the non-chosen material) cannot get `ss_kem_{1−c}`,
+ *     so again `k_{1−c}` is unobtainable even though it could break the EC half with Shor.
+ *   • CHOICE PRIVACY — POST-QUANTUM. The KEM half's choice privacy is unconditional (two i.i.d. real
+ *     ML-KEM public keys on the wire); the EC half's is information-theoretic in its transcript (`R` is a
+ *     uniform subgroup element whatever `c` is). Neither leaks `c`, against any adversary.
+ *   • SESSION BINDING — both halves are bound to a COMMON `sid` derived from BOTH sub-protocols'
+ *     session material (the KEM `(rn, sn)` nonces and the EC point `S`), and `sid` is hashed into every
+ *     transfer key and commitment, so secrets from one session/opened-key-set cannot be replayed into
+ *     another. The KEM half additionally aborts (`KemBaseOtAbort`) if the receiver opens keys other than
+ *     the ones it committed to; the EC half aborts (`BaseOtAbort`/`PointValidationError`) on a bad proof
+ *     or an off-/small-order point; and the combiner aborts (`HybridOtAbort`) if a tampered ciphertext
+ *     fails its commitment.
+ *
+ * ─── THE HONEST BOUNDARY (NOT faked) ────────────────────────────────────────────────────────────────
+ * The one residue this combiner does NOT close is a receiver that is SIMULTANEOUSLY actively-malicious
+ * AND quantum: such a receiver could break the classical EC half with Shor (recovering `ss_ec_{1−c}`
+ * from the transcript) WHILE keeping both ML-KEM secrets (recovering `ss_kem_{1−c}`), and so assemble
+ * `k_{1−c}`. Closing THAT requires a base OT that is BOTH post-quantum AND malicious-secure in one
+ * primitive — i.e. an endemic/UC OT from Module-LWE with a CRS, which needs direct lattice module
+ * arithmetic (sampling / adding in ML-KEM's structured public-key space to plant a secretless slot).
+ * The opaque `ml_kem768` keygen/encaps/decaps interface this package is restricted to does NOT expose
+ * that arithmetic, and hand-rolling it is exactly the lattice crypto the module forbids. So this is the
+ * honest limit of what a KEM-opaque + EC combiner can reach; it is stated, not papered over.
+ *
+ * No hand-rolled crypto: the EC half goes through `malBaseRandomOT` (unchanged), the KEM half through
+ * `kemBaseOtMalRandom` (unchanged), and this module only hashes (SHA-256 RO) and XORs their outputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HybridOtAbort = void 0;
+exports.hybridSessionId = hybridSessionId;
+exports.hybridTransferKey = hybridTransferKey;
+exports.hybridSenderEncrypt = hybridSenderEncrypt;
+exports.hybridReceiverRecover = hybridReceiverRecover;
+exports.hybridBaseOT = hybridBaseOT;
+exports.withHybridBaseOt = withHybridBaseOt;
+const node_crypto_1 = require("node:crypto");
+const ec_1 = require("./ec");
+const ot_1 = require("./ot");
+const kem_ot_1 = require("./kem-ot");
+const csprng_1 = require("./csprng");
+const TAG_HYBRID_SID = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-sid');
+const TAG_HYBRID_KEY = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-transfer-key');
+const TAG_HYBRID_COMMIT = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-msg-commit');
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+function xorBytes(a, b) {
+    if (a.length !== b.length)
+        throw new Error('hybrid-ot: XOR length mismatch');
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+function ctEqual(a, b) {
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
+}
+/** Raised when the hybrid combiner aborts: a sender ciphertext inconsistent with its commitment is caught. */
+class HybridOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'HybridOtAbort';
+    }
+}
+exports.HybridOtAbort = HybridOtAbort;
+/**
+ * The COMMON session id binding both halves: `H(TAG ‖ kemSid ‖ encode(ecS))`. It folds the KEM
+ * sub-protocol's two-nonce session id (`rn, sn`) and the EC sub-protocol's point `S`, so neither party
+ * alone fixes it and secrets cannot be mixed across sessions. Both parties derive the same value from
+ * the public transcript.
+ */
+function hybridSessionId(kemSid, ecS) {
+    return sha256(TAG_HYBRID_SID, kemSid, (0, ec_1.encodePoint)(ecS));
+}
+/**
+ * The hybrid transfer key for one slot: `H(TAG ‖ sid ‖ i ‖ slot ‖ ss_ec ‖ ss_kem)` expanded (SHA-256
+ * counter mode) to `len` bytes. Modelled as a random oracle: the key is pseudorandom unless BOTH
+ * `ss_ec` and `ss_kem` (for that exact slot/index/session) are supplied — the soundness crux of the
+ * combiner.
+ */
+function hybridTransferKey(sid, index, slot, ssEc, ssKem, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_HYBRID_KEY, sid, u32(index), Uint8Array.of(slot & 1), u32(ctr), ssEc, ssKem);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/** Per-message RO commitment `com = H(TAG ‖ sid ‖ i ‖ slot ‖ msg ‖ key)`, bound to the session. */
+function hybridCommit(sid, index, slot, msg, key) {
+    return sha256(TAG_HYBRID_COMMIT, sid, u32(index), Uint8Array.of(slot & 1), msg, key);
+}
+/**
+ * SENDER side of the combiner: given BOTH halves' per-slot shared secrets, derive both transfer keys,
+ * one-time-pad each message, and commit to each. `ecSecrets[i] = [ss_ec_0, ss_ec_1]` (the EC random-OT
+ * `senderPads`), `kemSecrets[i] = [ss_kem_0, ss_kem_1]` (the committed-KEM `senderSecrets`).
+ */
+function hybridSenderEncrypt(sid, messages, ecSecrets, kemSecrets) {
+    if (messages.length !== ecSecrets.length || messages.length !== kemSecrets.length) {
+        throw new Error('hybridSenderEncrypt: messages/ecSecrets/kemSecrets length mismatch');
+    }
+    const encrypted = [];
+    const commitments = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`hybridSenderEncrypt (index ${i}): the two messages must be equal length`);
+        }
+        const k0 = hybridTransferKey(sid, i, 0, ecSecrets[i][0], kemSecrets[i][0], m0.length);
+        const k1 = hybridTransferKey(sid, i, 1, ecSecrets[i][1], kemSecrets[i][1], m1.length);
+        encrypted.push([xorBytes(m0, k0), xorBytes(m1, k1)]);
+        commitments.push([hybridCommit(sid, i, 0, m0, k0), hybridCommit(sid, i, 1, m1, k1)]);
+    }
+    return { encrypted, commitments };
+}
+/**
+ * RECEIVER side of the combiner: reconstruct ONLY the chosen transfer key (from the chosen EC and KEM
+ * secrets the receiver legitimately holds), unmask the chosen message, and CHECK the commitment.
+ * `ecRecv[i] = ss_ec_{choices[i]}` (the EC `recvPads`), `kemRecv[i] = ss_kem_{choices[i]}` (the
+ * committed-KEM `recvSecrets`). Aborts (`HybridOtAbort`) if the recovered message fails its commitment.
+ */
+function hybridReceiverRecover(sid, choices, sender, ecRecv, kemRecv) {
+    const { encrypted, commitments } = sender;
+    if (encrypted.length !== choices.length ||
+        commitments.length !== choices.length ||
+        ecRecv.length !== choices.length ||
+        kemRecv.length !== choices.length) {
+        throw new Error('hybridReceiverRecover: length mismatch');
+    }
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const e = encrypted[i][c];
+        const key = hybridTransferKey(sid, i, c, ecRecv[i], kemRecv[i], e.length);
+        const m = xorBytes(e, key);
+        const check = hybridCommit(sid, i, c, m, key);
+        if (!ctEqual(check, commitments[i][c])) {
+            throw new HybridOtAbort(`hybrid base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+        }
+        received.push(m);
+    }
+    return received;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT`/`kemBaseOT`
+ * so it is a drop-in for `OtChannel`'s `baseOtFn` (`withHybridBaseOt`). Runs the malicious-secure EC
+ * base OT and the committed ML-KEM base OT on the SAME choices, binds both to a common `sid`, and
+ * combines their per-slot secrets into the transfer keys. A cheating party is caught by whichever
+ * half's check applies (EC proof/point validation, KEM commitment, or the hybrid ciphertext
+ * commitment). `tamper` injects malicious behaviour for tests.
+ */
+function hybridBaseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    if (messages.length !== choices.length) {
+        throw new Error('hybridBaseOT: messages/choices length mismatch');
+    }
+    // EC half: malicious-secure random OT with ALL checks ON (Schnorr proof + subgroup validation).
+    const ec = (0, ot_1.malBaseRandomOT)(choices, rng, tamper?.ec);
+    // KEM half: the committed/session-bound random OT (aborts on an opened-key/commitment mismatch).
+    const kem = (0, kem_ot_1.kemBaseOtMalRandom)(choices, rng, tamper?.kem);
+    const sid = hybridSessionId(kem.sid, ec.S);
+    const sender = hybridSenderEncrypt(sid, messages, ec.senderPads, kem.senderSecrets);
+    // A malicious hybrid SENDER may corrupt the ciphertexts on the wire (test-injected).
+    if (tamper?.tamperEncrypted)
+        tamper.tamperEncrypted(sender.encrypted);
+    const received = hybridReceiverRecover(sid, choices, sender, ec.recvPads, kem.recvSecrets);
+    return {
+        received,
+        transcript: {
+            sid,
+            ecS: ec.S,
+            kemSid: kem.sid,
+            encrypted: sender.encrypted,
+            commitments: sender.commitments,
+        },
+    };
+}
+/**
+ * Wire the HYBRID base OT into the KOS OT-extension: a drop-in for `withKemBaseOt`/`withKemBaseOtMal`
+ * that makes `OtChannel` run its κ setup base OTs over the combiner. The extension inherits the
+ * combiner's guarantee — malicious security vs a classical receiver, PQ sender-privacy vs a semi-honest
+ * quantum one, and PQ choice privacy — with everything above the base OT (IKNP matrix, KOS correlation
+ * check, correlation-robust hash) unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withHybridBaseOt());
+ */
+function withHybridBaseOt() {
+    return { baseOtFn: (m, c, r) => ({ received: hybridBaseOT(m, c, r).received }) };
+}
+//# sourceMappingURL=hybrid-ot.js.map

package/dist/hybrid-ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid-ot.js","sourceRoot":"","sources":["../src/hybrid-ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;;;AA4DH,0CAEC;AAQD,8CAyBC;AA0BD,kDAsBC;AAQD,sDA+BC;AA2CD,oCA+BC;AAWD,4CAEC;AA3QD,6CAA0D;AAC1D,6BAA+C;AAC/C,6BAKc;AACd,qCAGkB;AAClB,qCAA0C;AAE1C,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAC/E,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;AACxF,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;AAEzF,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAa,EAAE,CAAa;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,8GAA8G;AAC9G,MAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAkB,EAAE,GAAU;IAC5D,OAAO,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAgB,EAChB,KAAiB,EACjB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAClB,cAAc,EACd,GAAG,EACH,GAAG,CAAC,KAAK,CAAC,EACV,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EACvB,GAAG,CAAC,GAAG,CAAC,EACR,IAAI,EACJ,KAAK,CACN,CAAC;QACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CACnB,GAAe,EACf,KAAa,EACb,IAAY,EACZ,GAAe,EACf,GAAe;IAEf,OAAO,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvF,CAAC;AAUD;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,QAAyC,EACzC,SAA0C,EAC1C,UAA2C;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,0CAA0C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACxF,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACxF,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,GAAe,EACf,OAAiB,EACjB,MAA2B,EAC3B,MAAoB,EACpB,OAAqB;IAErB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC1C,IACE,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACnC,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACrC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAChC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,aAAa,CACrB,yBAAyB,CAAC,iEAAiE,CAC5F,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmCD;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,gGAAgG;IAChG,MAAM,EAAE,GAAG,IAAA,oBAAe,EAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAA,2BAAkB,EAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAEpF,qFAAqF;IACrF,IAAI,MAAM,EAAE,eAAe;QAAE,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,UAAU,EAAE;YACV,GAAG;YACH,GAAG,EAAE,EAAE,CAAC,CAAC;YACT,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @atlasauth/pca-mpc — PCA evolution B5 reference prototype.
+ *
+ * A multi-stakeholder Policy VM composed under secure multi-party computation, so user + org +
+ * regulator decide allow / threshold jointly WITHOUT any party revealing its own policy. Two layers:
+ *   - SEMI-HONEST: additive secret sharing over a prime field + Beaver-triple multiplication
+ *     (`sharing.ts`, `beaver.ts`, `runner.ts`).
+ *   - MALICIOUS-WITH-ABORT (dishonest-majority): SPDZ-style authenticated sharing with
+ *     information-theoretic MACs + a commit-then-open MAC-check that ABORTS on any deviation
+ *     (`spdz.ts`, `spdz-runner.ts`). Result is correct, or an abort — never a silent wrong answer.
+ * See docs/specs/pca-mpc-policy-vm.md for the security model and the trusted-dealer / no-dealer boundary.
+ */
+export * from './field';
+export * from './sharing';
+export * from './beaver';
+export * from './thermometer';
+export * from './party';
+export * from './compose';
+export * from './runner';
+export * from './spdz';
+export * from './spdz-runner';
+export * from './ec';
+export * from './gf128';
+export * from './csprng';
+export * from './ot';
+export * from './kem-ot';
+export * from './hybrid-ot';
+export * from './mascot';
+export * from './endemic-ot';