@atlasauth/pca-mpc 0.0.0-stage → 0.2.0

package/dist/ot.d.ts

@@ -0,0 +1,212 @@
+/**
+ * Oblivious transfer — the real cryptographic root of the no-dealer offline phase.
+ *
+ * A 1-out-of-2 OT lets a RECEIVER with a choice bit `c` obtain exactly message `m_c` from a SENDER's
+ * pair `(m_0, m_1)`, such that the sender learns nothing about `c` and the receiver learns nothing
+ * about `m_{1−c}`. That single primitive is enough to multiply two parties' secret shares without a
+ * dealer (Gilboa's trick, see `mascot.ts`), which is enough to generate Beaver triples and SPDZ MACs
+ * with no trusted party. This module provides OT two ways:
+ *
+ *  1. **Base OT — MALICIOUSLY-secure Chou–Orlandi over the Ed25519 subgroup (`ec.ts`).** The core is
+ *     "simplest OT": sender samples `y`, publishes `S = y·B`, holds `T = y·S`; receiver with choice `c`
+ *     samples `x`, publishes `R = x·B + c·S`, derives pad `k = H(x·S)`; sender derives `k_b = H(y·R − b·T)`
+ *     for `b∈{0,1}`; since `y·R = x·(y·B) + c·T`, `k_c = k` while `k_{1−c}` is `H` of a point the receiver
+ *     can't compute (it would need the discrete log). **Receiver-choice privacy is information-theoretic
+ *     in the transcript:** `R = x·B + c·S` with `x` uniform is a uniform subgroup element whatever `c` is
+ *     — for every observed `R` there is one `x` consistent with `c=0` and one with `c=1` (`x' = x − y`),
+ *     so the sender's view is identically distributed for both choices. Two additions upgrade this from
+ *     semi-honest to **malicious-secure against both a cheating sender AND a cheating receiver** (docs
+ *     §7.1 item a):
+ *       • **the sender proves knowledge of `y` with a Schnorr NIZK on `S = y·B`** (`ec.ts`), so a sender
+ *         cannot use an `S` it cannot open (e.g. one crafted to leak the receiver's choice) — the
+ *         receiver verifies the proof and ABORTS before forming `R`;
+ *       • **every received point is validated** (on-curve + prime-order-subgroup cofactor check +
+ *         non-identity): the receiver validates `S`, the sender validates every `R_i`, so neither party
+ *         can inject an off-curve / small-order / mixed-order point for a small-subgroup attack.
+ *     The IKNP setup consumes this as a **random OT** (`malBaseRandomOT`): the two transferred seeds ARE
+ *     the RO pads `(H(y·R), H(y·R − T))`, so there are **no sender-chosen ciphertexts** and hence no
+ *     selective-failure surface — the only abort (bad `S`/proof/`R_i`) is independent of the receiver's
+ *     selector, which is exactly what malicious security of the role-inverted base OTs requires. The
+ *     chosen-message `baseOT` wrapper (random OT + one-time-pad + a commit-to-message check) is used by
+ *     the direct OT tests; its commitment catches a sender that encrypts inconsistently with its commitment.
+ *
+ *  2. **OT extension — IKNP + the KOS consistency check (MALICIOUS-secure).** Base OT needs public-key
+ *     ops per transfer; the offline phase needs hundreds of thousands of OTs. IKNP turns `κ = 128` base
+ *     OTs (done once) into arbitrarily many OTs using only a hash/PRG. Roles invert for the base OTs:
+ *     the extension SENDER plays base-receiver with a secret selector `s ∈ {0,1}^κ`; the extension
+ *     RECEIVER plays base-sender with `κ` seed pairs. Thereafter each extension round of `m` OTs costs
+ *     `κ` PRG expansions plus `~3·m` hashes. Correctness: the receiver recovers exactly `m_{c_j}` for
+ *     every `j`; the sender's `s` (hidden by the base OTs) and the correlation-robust hash keep the
+ *     unchosen messages hidden.
+ *
+ *     Plain IKNP is only SEMI-HONEST: a cheating RECEIVER can send an extension matrix `u` that encodes
+ *     *different* choice vectors in different columns, which breaks the row correlation `q_j = t_j ⊕
+ *     (b_j·s)` and lets the receiver learn bits of the sender's selector `s` (and thus the unchosen
+ *     messages). The **KOS correlation check** (Keller–Orsini–Scholl, "Actively Secure OT Extension
+ *     with Optimal Overhead") closes exactly this: after `u` is on the wire, the parties draw public
+ *     random weights `χ_j ∈ GF(2^κ)` (one per row, bound to `u` by a Fiat–Shamir hash here), the
+ *     receiver reveals `x = Σ_j b_j·χ_j` and `t = Σ_j χ_j·t_j`, and the sender checks
+ *     `Σ_j χ_j·q_j == t ⊕ x·s` in GF(2^κ). Honestly this always holds (`q_j = t_j ⊕ b_j·s`); a receiver
+ *     who deviated in `u` satisfies it with probability ≤ `2^{-κ} = 2^{-128}`, so a deviation ABORTS.
+ *     The check is run over `m + κ + SSEC` rows — the extra `κ + SSEC` random "sacrifice" OT rows mask
+ *     the revealed combination (receiver privacy) and give statistical soundness. This makes the OT
+ *     extension **malicious-secure**, not just semi-honest.
+ *
+ * In-process model: both parties run in one process and the functions take *both* parties' inputs and
+ * return the receiver's outputs plus an inspectable transcript (the receiver's wire message `R`, the
+ * sender's ciphertexts, the IKNP `u` matrix). That is exactly what the tests assert over: receiver
+ * correctness, sender-side choice-hiding from the transcript, and the KOS check aborting on a tampered
+ * `u`. See docs §7.1 for the remaining boundary (real async transport, constant-time, CSPRNG).
+ */
+import { type Point, type SchnorrProof } from './ec';
+/** IKNP security parameter (number of base OTs / width of the selector s). */
+export declare const KAPPA = 128;
+/**
+ * KOS statistical-security parameter: the number of EXTRA random check-OT rows (beyond the `κ` that
+ * mask the revealed combination) appended to every extension round. Together `κ + SSEC` padding rows
+ * give the correlation check its receiver-privacy and statistical soundness margin.
+ */
+export declare const SSEC = 64;
+/** Raised when the KOS correlation check fails: a cheating OT-extension receiver is detected → ABORT. */
+export declare class MalOtAbort extends Error {
+    constructor(message: string);
+}
+/** A deterministic source of scalars/seeds; wraps the module FieldRng-style stream for OT needs. */
+export interface OtRandom {
+    /** A uniform scalar in [1, L) (for EC blinding) — never 0. */
+    scalar(): bigint;
+    /** `n` random bytes (for seeds). */
+    bytes(n: number): Uint8Array;
+}
+/** A raw SplitMix64 64-bit stream (deterministic). Production uses a CSPRNG with a secret seed. */
+export declare function splitMix64(seed: bigint): () => bigint;
+/** Build an OtRandom from a SplitMix64-style 64-bit stream (deterministic; CSPRNG in production). */
+export declare function otRandom(next64: () => bigint): OtRandom;
+/** Raised when a base OT aborts: a cheating sender (bad proof / inconsistent ciphertext) is detected. */
+export declare class BaseOtAbort extends Error {
+    constructor(message: string);
+}
+/**
+ * TEST-ONLY injection points modelling a malicious SENDER or RECEIVER in the base OT. Each hook mutates
+ * or replaces a value exactly where it would cross the wire, so the honest party's validation runs
+ * against the adversarial value — which is what the malicious-security checks must catch.
+ */
+export interface BaseOtTamper {
+    /** Malicious SENDER: replace `S` on the wire (the receiver still validates it + the proof). */
+    tamperS?: (S: Point) => Point;
+    /** Malicious SENDER: forge the Schnorr proof on the wire. */
+    tamperProof?: (p: SchnorrProof) => SchnorrProof;
+    /** Malicious RECEIVER: mutate the `R_i` points on the wire (the sender still validates each). */
+    tamperR?: (R: Point[]) => void;
+    /** Malicious SENDER: corrupt the ciphertexts on the wire (inconsistent with the commitment). */
+    tamperCiphertext?: (ct: Array<[Uint8Array, Uint8Array]>) => void;
+}
+/** The base-OT transcript: the sender's `S` + proof-of-knowledge, the receiver's `R_i`, and the ciphertexts/commitments. */
+export interface BaseOtTranscript {
+    /** Sender's public point S = y·B. */
+    S: Point;
+    /** Schnorr NIZK proving the sender knows `y` with `S = y·B` (malicious-sender hardening). */
+    proof: SchnorrProof;
+    /** Receiver's points R_i = x_i·B + c_i·S (uniform subgroup elements; independent of c_i). */
+    R: Point[];
+    /** Sender ciphertexts: for each i, [E_{i,0}, E_{i,1}] = [m_{i,0} ⊕ pad_{i,0}, m_{i,1} ⊕ pad_{i,1}]. */
+    ct: Array<[Uint8Array, Uint8Array]>;
+    /** Per-message RO commitments com_{i,b} = H(i ‖ b ‖ m_{i,b} ‖ pad_{i,b}); the receiver checks com_{i,c}. */
+    com: Array<[Uint8Array, Uint8Array]>;
+}
+export interface BaseOtResult {
+    /** Receiver's recovered messages m_{i, c_i}. */
+    received: Uint8Array[];
+    transcript: BaseOtTranscript;
+}
+/**
+ * A pluggable chosen-message base OT: `count = choices.length` 1-of-2 OTs returning the receiver's
+ * recovered messages. The EC `baseOT` above satisfies it, and so does the post-quantum `kemBaseOT`
+ * (`kem-ot.ts`) — letting `OtChannel` run its κ setup OTs over either base without touching the
+ * IKNP/KOS layer. Only `received` is required (the EC-specific `transcript` is not part of the contract,
+ * since a non-EC base has a different transcript shape).
+ */
+export type BaseOtFn = (messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng: OtRandom) => {
+    received: Uint8Array[];
+};
+/** The output of the malicious-secure RANDOM base OT: validated points + the two RO pads per index. */
+export interface MalRandomOtResult {
+    /** Sender's public point (as seen on the wire by the receiver). */
+    S: Point;
+    /** Sender's proof of knowledge of the discrete log of `S`. */
+    proof: SchnorrProof;
+    /** Receiver's points (as seen on the wire by the sender). */
+    R: Point[];
+    /** Sender's pad pairs: senderPads[i] = [H(y·R_i), H(y·R_i − T)]. */
+    senderPads: Array<[Uint8Array, Uint8Array]>;
+    /** Receiver's recovered pads: recvPads[i] = H(x_i·S) = senderPads[i][c_i] (honest run). */
+    recvPads: Uint8Array[];
+}
+/**
+ * The MALICIOUS-secure RANDOM base OT: `count = choices.length` 1-of-2 random OTs. The sender publishes
+ * `S = y·B` with a Schnorr proof of knowledge of `y`; the receiver validates `S` + the proof and
+ * ABORTS on failure, then forms its `R_i`; the sender validates every `R_i` and derives the pad pairs.
+ * No messages are transferred — the pads ARE the random output. `tamper` injects malicious behaviour
+ * for tests. Both parties are simulated in-process.
+ */
+export declare function malBaseRandomOT(choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): MalRandomOtResult;
+/**
+ * Run `count` MALICIOUS-secure base OTs in one batch (chosen-message, over the random OT above).
+ * `messages[i] = [m0, m1]` (SEED_BYTES each), the sender's pair; `choices[i] ∈ {0,1}` the receiver's
+ * choice. The sender one-time-pads each message under the random-OT pads and commits to each message;
+ * the receiver recovers `m_{i,c_i}` and checks the commitment, aborting (`BaseOtAbort`) on any
+ * inconsistency. Returns the receiver's recovered messages and the full transcript.
+ */
+export declare function baseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): BaseOtResult;
+/**
+ * An IKNP OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs). The
+ * κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap PRG+hash round. The
+ * channel is stateful (advances per-seed PRG counters) so many rounds compose into one amortized setup.
+ */
+export declare class OtChannel {
+    private readonly rng;
+    /** Optional post-quantum (or otherwise custom) base OT for the κ setup OTs; defaults to EC `baseOT`. */
+    private readonly baseOtFn?;
+    private ready;
+    private s;
+    private sBits;
+    private senderSeeds;
+    private senderBlk;
+    private recvSeed0;
+    private recvSeed1;
+    private recvBlk0;
+    private recvBlk1;
+    /** The base-OT transcript (available after setup) — exposed for inspection/tests. */
+    baseTranscript?: BaseOtTranscript;
+    /**
+     * TEST-ONLY injection modelling a MALICIOUS extension RECEIVER: if set, it is called with the honest
+     * `u` matrix (κ columns, each `mExt` bits) just before it goes "on the wire", and may mutate it (e.g.
+     * XOR a delta into one or more columns) to encode inconsistent choices. The KOS check is computed
+     * over the tampered `u` (what the sender sees) while the receiver's revealed `(x, t)` stay honest, so
+     * a non-trivial tamper is caught — the real malicious-receiver attack that KOS defeats.
+     */
+    tamperU?: (u: bigint[], round: number) => void;
+    private round;
+    /**
+     * `rng` defaults to the CSPRNG (`secureOtRandom`, `node:crypto`) — production randomness. Pass a
+     * deterministic `otRandom(splitMix64(seed))` ONLY to make a test bit-reproducible (docs §7.1 item c).
+     */
+    constructor(rng?: OtRandom, opts?: {
+        baseOtFn?: BaseOtFn;
+    });
+    private setup;
+    /** Selector s as a κ-bit bigint (sender-side secret; exposed only for tests). */
+    get selector(): bigint;
+    /**
+     * One MALICIOUS-secure extension round: `choiceBits[j] ∈ {0,1}` (receiver), `msg0[j]/msg1[j]`
+     * field-element messages (sender). Returns the receiver's chosen messages `msg_{choiceBits[j]}[j]`
+     * for the `m` real rows. The round transparently appends `κ + SSEC` random check-OT rows and runs the
+     * **KOS correlation check** over all `m + κ + SSEC` rows; a cheating receiver (tampered `u`) is caught
+     * there and the round throws `MalOtAbort`. `uMatrix` (the receiver→sender wire message, now
+     * `mExt`-bit) is returned for tests.
+     */
+    extend(choiceBits: number[], msg0: bigint[], msg1: bigint[]): {
+        received: bigint[];
+        uMatrix: bigint[];
+    };
+}