@atlasauth/pca-mpc 0.2.0 → 0.4.0

package/dist/ot.js

@@ -48,7 +48,14 @@
  *     random weights `χ_j ∈ GF(2^κ)` (one per row, bound to `u` by a Fiat–Shamir hash here), the
  *     receiver reveals `x = Σ_j b_j·χ_j` and `t = Σ_j χ_j·t_j`, and the sender checks
  *     `Σ_j χ_j·q_j == t ⊕ x·s` in GF(2^κ). Honestly this always holds (`q_j = t_j ⊕ b_j·s`); a receiver
- *     who deviated in `u` satisfies it with probability ≤ `2^{-κ} = 2^{-128}`, so a deviation ABORTS.
+ *     who deviated in `u` is caught, so a deviation ABORTS. The honest statement of the bound is the KOS
+ *     STATISTICAL parameter `s = SSEC = 128`, NOT `2^{-κ}`: a receiver that deviates in a few columns passes by
+ *     guessing the matching bits of the selector `s`, and the 2015 proof (ePrint 2015/546) was additionally shown
+ *     to rest on an incorrect lemma (Roy, CRYPTO 2022). Roy's attacks give the receiver success
+ *     about `2^{-s}` with `s` extra rows, and the KOS proof is still open (Roy leaves a sound proof to future work), so
+ *     this module sets `s = SSEC = 128` extra rows (was 64): the best KNOWN attack then succeeds with probability about
+ *     `2^{-128}`. That is an argument from the attack analysis, NOT a proof; we did not implement SoftSpokenOT's own
+ *     (different, small-field VOLE) consistency check, whose parameters we could not verify from the paper.
  *     The check is run over `m + κ + SSEC` rows — the extra `κ + SSEC` random "sacrifice" OT rows mask
  *     the revealed combination (receiver privacy) and give statistical soundness. This makes the OT
  *     extension **malicious-secure**, not just semi-honest.
@@ -60,23 +67,38 @@
  * `u`. See docs §7.1 for the remaining boundary (real async transport, constant-time, CSPRNG).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OtChannel = exports.BaseOtAbort = exports.MalOtAbort = exports.SSEC = exports.KAPPA = void 0;
+exports.OtChannel = exports.OtExtSender = exports.OtExtReceiver = exports.BaseOtAbort = exports.MalOtAbort = exports.SSEC = exports.KAPPA = void 0;
 exports.splitMix64 = splitMix64;
 exports.otRandom = otRandom;
+exports.bindingBytes = bindingBytes;
+exports.randomBinding = randomBinding;
+exports.baseOtTranscriptHash = baseOtTranscriptHash;
+exports.baseOtKdf = baseOtKdf;
+exports.kosChallenges = kosChallenges;
+exports.kosChiWords = kosChiWords;
 exports.malBaseRandomOT = malBaseRandomOT;
+exports.malBaseOtSenderSetup = malBaseOtSenderSetup;
+exports.malBaseOtReceiverRespond = malBaseOtReceiverRespond;
+exports.malBaseOtSenderDerive = malBaseOtSenderDerive;
+exports.baseOtSenderEncrypt = baseOtSenderEncrypt;
+exports.baseOtReceiverDecrypt = baseOtReceiverDecrypt;
 exports.baseOT = baseOT;
 const node_crypto_1 = require("node:crypto");
 const ec_1 = require("./ec");
 const gf128_1 = require("./gf128");
+const otx_1 = require("./otx");
 const csprng_1 = require("./csprng");
 /** IKNP security parameter (number of base OTs / width of the selector s). */
 exports.KAPPA = 128;
 /**
  * KOS statistical-security parameter: the number of EXTRA random check-OT rows (beyond the `κ` that
  * mask the revealed combination) appended to every extension round. Together `κ + SSEC` padding rows
- * give the correlation check its receiver-privacy and statistical soundness margin.
+ * give the correlation check its receiver-privacy and statistical soundness margin. Roy (CRYPTO 2022, ePrint
+ * 2022/192) shows the KOS proof is flawed and that the attacks succeed with probability about 2^-s for `s` extra
+ * rows; `s = 128` (raised from 64, a WIRE CHANGE: the matrix has 64 more rows per round) makes the best known attack
+ * about 2^-128. Not a proof.
  */
-exports.SSEC = 64;
+exports.SSEC = 128;
 /** Raised when the KOS correlation check fails: a cheating OT-extension receiver is detected → ABORT. */
 class MalOtAbort extends Error {
     constructor(message) {
@@ -104,8 +126,9 @@ function splitMix64(seed) {
 function otRandom(next64) {
     return {
         scalar() {
-            // Assemble 256 bits then reduce mod L; reject 0.
-            for (;;) {
+            // Assemble 256 bits then reduce mod L; reject 0. Bounded: a healthy source yields 0 with probability
+            // ~2^-252, so a handful of consecutive zeros means a stuck-at-zero stream - fail closed, never spin.
+            for (let attempt = 0; attempt < 8; attempt++) {
                 let acc = 0n;
                 for (let i = 0; i < 4; i++)
                     acc = (acc << 64n) | next64();
@@ -113,6 +136,7 @@ function otRandom(next64) {
                 if (s !== 0n)
                     return s;
             }
+            throw new Error('otRandom: entropy stream returned zero scalars repeatedly (RNG failure)');
         },
         bytes(n) {
             const out = new Uint8Array(n);
@@ -146,66 +170,100 @@ function u32(x) {
     b[3] = x & 0xff;
     return b;
 }
-/** Key-derivation from a group point: H("ot-kdf" ‖ index ‖ encode(P)) → SEED_BYTES bytes. */
-function kdfPoint(index, p) {
-    return sha256(TAG_KDF, u32(index), (0, ec_1.encodePoint)(p)).slice(0, SEED_BYTES);
+const TAG_BINDING = new TextEncoder().encode('atlas-pca-mpc/base-ot-binding');
+const TAG_TRANSCRIPT = new TextEncoder().encode('atlas-pca-mpc/base-ot-transcript');
+/** Canonical, length-prefixed encoding of a binding (the Schnorr context and part of every KDF input). */
+function bindingBytes(b) {
+    if (!(b.sessionId instanceof Uint8Array) || b.sessionId.length < 8 || b.sessionId.length > 64) {
+        throw new RangeError('base-OT binding: sessionId must be 8..64 bytes');
+    }
+    for (const [k, v] of [['senderIndex', b.senderIndex], ['receiverIndex', b.receiverIndex]]) {
+        if (!Number.isInteger(v) || v < 0 || v > 0xffffffff)
+            throw new RangeError(`base-OT binding: ${k} must be a uint32`);
+    }
+    if (b.senderIndex === b.receiverIndex)
+        throw new RangeError('base-OT binding: sender and receiver must be different parties');
+    const round = new TextEncoder().encode(b.round);
+    if (round.length === 0 || round.length > 64)
+        throw new RangeError('base-OT binding: round label must be 1..64 bytes');
+    const parts = [TAG_BINDING, u32(b.sessionId.length), b.sessionId, u32(b.senderIndex), u32(b.receiverIndex), u32(round.length), round];
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+/** A fresh binding for an in-process OT (both roles simulated): random session id from `rng`. */
+function randomBinding(rng, round, senderIndex = 0, receiverIndex = 1) {
+    return { sessionId: rng.bytes(16), senderIndex, receiverIndex, round };
+}
+/**
+ * Hash of the WHOLE base-OT transcript: binding, the sender's S and every receiver point R_i, in order.
+ * Every pad is derived under this hash, so changing the session, S or ANY R_j changes EVERY key.
+ */
+function baseOtTranscriptHash(binding, S, R) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    h.update(TAG_TRANSCRIPT);
+    h.update(bindingBytes(binding));
+    h.update((0, ec_1.encodePoint)(S));
+    h.update(u32(R.length));
+    for (const r of R)
+        h.update((0, ec_1.encodePoint)(r));
+    return new Uint8Array(h.digest());
+}
+/**
+ * Key derivation from a group point, Chou–Orlandi / Simplest-OT style but over the full transcript:
+ * `H("ot-kdf" ‖ H(transcript) ‖ index ‖ R_i ‖ P)` → SEED_BYTES bytes.
+ */
+function baseOtKdf(transcriptHash, index, Ri, p) {
+    return sha256(TAG_KDF, transcriptHash, u32(index), (0, ec_1.encodePoint)(Ri), (0, ec_1.encodePoint)(p)).slice(0, SEED_BYTES);
 }
 const TAG_KDF = new TextEncoder().encode('atlas-pca-mpc/ot-kdf');
-const TAG_PRG = new TextEncoder().encode('atlas-pca-mpc/ot-prg');
-const TAG_CRH = new TextEncoder().encode('atlas-pca-mpc/ot-crh');
 const TAG_KOS = new TextEncoder().encode('atlas-pca-mpc/ot-kos');
 const TAG_COMMIT = new TextEncoder().encode('atlas-pca-mpc/ot-msg-commit');
+/** Little-endian fixed-width serialization of a non-negative bigint (callers have range-checked it). */
+const leBytes = otx_1.bigToBytes;
 /**
- * Derive the KOS row-weights χ_j ∈ GF(2^128) for one extension round, bound to the committed `u`
- * matrix (Fiat–Shamir). The sender and receiver both derive the SAME χ from the `u` on the wire, so a
- * cheating receiver cannot pick `u` after seeing χ. In the real protocol χ comes from a secure
- * coin-flip after the receiver commits to `u`; the transcript-hash here models that round and keeps the
- * check deterministic for tests. The seed expands through a fast (non-crypto) stream — fine because χ
- * only needs to be unpredictable-before-commit and uniform, which the hash seed provides.
+ * Derive the KOS row-weights χ_j ∈ GF(2^128) for one extension round (Fiat–Shamir). The sender and
+ * receiver both derive the SAME χ from the FULL `u` matrix on the wire, so a cheating receiver cannot
+ * pick `u` after seeing χ. In the real protocol χ comes from a secure coin-flip after the receiver
+ * commits to `u`; the transcript hash here models that round.
+ *
+ * The weights are the output of SHAKE256 (an extendable-output function, `node:crypto`) over
+ * `TAG ‖ channel binding ‖ round ‖ mExt ‖ every bit of every column of u`, 16 bytes per row — a vetted
+ * XOF seeded by the whole transcript, not a fast non-cryptographic stream. (An earlier version expanded a
+ * 128-bit digest with SplitMix64, and hashed only the low 128 bits of each column; both are gone.)
  */
-function kosChallenges(u, mExt) {
-    const h = (0, node_crypto_1.createHash)('sha256');
-    h.update(TAG_KOS);
-    h.update(u32(u.length));
-    const buf = new Uint8Array(SEED_BYTES);
-    for (const col of u) {
-        let v = col;
-        for (let i = 0; i < SEED_BYTES; i++) {
-            buf[i] = Number(v & 0xffn);
-            v >>= 8n;
-        }
-        h.update(buf);
-    }
-    const digest = new Uint8Array(h.digest());
-    let lo = 0n;
-    for (let i = 0; i < 8; i++)
-        lo |= BigInt(digest[i]) << BigInt(8 * i);
-    let hi = 0n;
-    for (let i = 8; i < 16; i++)
-        hi |= BigInt(digest[i]) << BigInt(8 * (i - 8));
-    const s0 = splitMix64(lo === 0n ? 1n : lo);
-    const s1 = splitMix64(hi === 0n ? 0x9e3779b97f4a7c15n : hi);
+function kosChallenges(binding, round, u, mExt) {
+    const w = kosChiWords(binding, round, u, mExt);
     const chi = new Array(mExt);
     for (let j = 0; j < mExt; j++)
-        chi[j] = (s0() << 64n) | s1();
+        chi[j] = (0, otx_1.gfToBig)(w.subarray(4 * j, 4 * j + 4));
     return chi;
 }
-/** XOR into `acc` the χ_j for every SET bit `j` of the (≤ mExt-bit) column `col`, fast via 32-bit words. */
-function accumSetBits(col, chi, acc) {
-    let v = col;
-    let base = 0;
-    while (v > 0n) {
-        let w = Number(v & 0xffffffffn) >>> 0;
-        v >>= 32n;
-        while (w !== 0) {
-            const b = w & -w; // lowest set bit
-            const j = base + (31 - Math.clz32(b));
-            acc = (0, gf128_1.gf128Add)(acc, chi[j]);
-            w ^= b;
-        }
-        base += 32;
-    }
-    return acc;
+/** The same weights as little-endian u32 words (4 per row), the form the typed kernels consume. */
+function kosChiWords(binding, round, u, mExt, colBytesList) {
+    const colBytes = Math.ceil(mExt / 8);
+    const xof = (0, node_crypto_1.createHash)('shake256', { outputLength: mExt * 16 });
+    xof.update(TAG_KOS);
+    xof.update(u32(binding.length));
+    xof.update(binding);
+    xof.update(u32(round));
+    xof.update(u32(mExt));
+    xof.update(u32(u.length));
+    if (colBytesList)
+        for (const cb of colBytesList)
+            xof.update(cb);
+    else
+        for (const col of u)
+            xof.update(leBytes(col, colBytes));
+    const out = xof.digest();
+    const words = new Uint32Array(mExt * 4);
+    for (let i = 0; i < words.length; i++)
+        words[i] = out.readUInt32LE(i * 4);
+    return words;
 }
 /** XOR two equal-length byte arrays. */
 function xorBytes(a, b) {
@@ -214,35 +272,6 @@ function xorBytes(a, b) {
         out[i] = a[i] ^ b[i];
     return out;
 }
-/** PRG: expand a seed to `nbits` bits as a bigint, from block offset `startBlock` (counter mode). */
-function prgBits(seed, startBlock, nbits) {
-    const nBlocks = Math.ceil(nbits / 256);
-    let acc = 0n;
-    let produced = 0;
-    for (let t = 0; t < nBlocks; t++) {
-        const block = sha256(TAG_PRG, seed, u32(startBlock + t));
-        for (let i = 0; i < 32 && produced < nbits; i++) {
-            acc |= BigInt(block[i]) << BigInt(produced);
-            produced += 8;
-        }
-    }
-    // Mask to exactly nbits.
-    return acc & ((1n << BigInt(nbits)) - 1n);
-}
-/** Correlation-robust hash H(j, row) → a 64-bit mask (field messages are < 2^61). */
-function crh(j, row) {
-    const rowBytes = new Uint8Array(SEED_BYTES);
-    let v = row;
-    for (let i = 0; i < SEED_BYTES; i++) {
-        rowBytes[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    const d = sha256(TAG_CRH, u32(j), rowBytes);
-    let acc = 0n;
-    for (let i = 0; i < 8; i++)
-        acc |= BigInt(d[i]) << BigInt(8 * i);
-    return acc;
-}
 // --------------------------------------------------------------------------------------------------
 // Base OT — MALICIOUSLY-secure Chou–Orlandi, batched (docs §7.1 item a).
 //
@@ -280,42 +309,107 @@ function ctEqual(a, b) {
  * No messages are transferred — the pads ARE the random output. `tamper` injects malicious behaviour
  * for tests. Both parties are simulated in-process.
  */
-function malBaseRandomOT(choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
-    const count = choices.length;
-    // --- Sender setup: S = y·B, T = y·S, and a Schnorr proof of knowledge of y. ---
-    const y = rng.scalar();
-    const S0 = (0, ec_1.mulBase)(y);
-    const Tpt = (0, ec_1.mul)(y, S0); // T = y·S = y²·B
-    const proof0 = (0, ec_1.schnorrProve)(y, S0, () => rng.scalar());
+function malBaseRandomOT(choices, rng = (0, csprng_1.secureOtRandom)(), tamper, binding = randomBinding(rng, 'base-ot')) {
+    const setup = malBaseOtSenderSetup(rng, binding);
     // What actually goes on the wire (a malicious sender may tamper either).
-    const S = tamper?.tamperS ? tamper.tamperS(S0) : S0;
-    const proof = tamper?.tamperProof ? tamper.tamperProof(proof0) : proof0;
-    // --- Receiver: validate the sender's point + proof BEFORE forming any R (malicious-sender guard). ---
+    const S = tamper?.tamperS ? tamper.tamperS(setup.S) : setup.S;
+    const proof = tamper?.tamperProof ? tamper.tamperProof(setup.proof) : setup.proof;
+    const { R, recvPads } = malBaseOtReceiverRespond(S, proof, choices, rng, binding);
+    // A malicious receiver may tamper the R it sends on the wire (test-injected).
+    if (tamper?.tamperR)
+        tamper.tamperR(R);
+    const senderPads = malBaseOtSenderDerive(setup.y, setup.T, R, S, binding);
+    return { S, proof, R, senderPads, recvPads };
+}
+// --- The same protocol as explicit per-party steps, so it can run over a real network (`net/ot-net.ts`). ---
+/** SENDER step 1: S = y·B, T = y·S, and a Schnorr proof of knowledge of y. `y`/`T` stay sender-local. */
+function malBaseOtSenderSetup(rng, binding) {
+    const ctx = bindingBytes(binding);
+    const y = rng.scalar();
+    const S = (0, ec_1.mulBase)(y);
+    const T = (0, ec_1.mul)(y, S); // T = y·S = y²·B
+    const proof = (0, ec_1.schnorrProve)(y, S, () => rng.scalar(), ctx);
+    return { y, T, S, proof };
+}
+/**
+ * RECEIVER step: validate the sender's point + proof BEFORE forming any R (malicious-sender guard), then
+ * choose x_i, form R_i = x_i·B (+ S if c_i=1) and derive recvPad_i = H(x_i·S). Throws `BaseOtAbort`/
+ * `PointValidationError` on a bad S or proof.
+ */
+function malBaseOtReceiverRespond(S, proof, choices, rng, binding) {
+    const ctx = bindingBytes(binding);
     (0, ec_1.assertInSubgroup)(S, 'base-OT S (received by receiver)');
-    if (!(0, ec_1.schnorrVerify)(S, proof)) {
+    if (!(0, ec_1.schnorrVerify)(S, proof, ctx)) {
         throw new BaseOtAbort('base OT: sender Schnorr proof-of-knowledge of S=y·B failed; aborting');
     }
-    // --- Receiver: choose x_i, form R_i = x_i·B (+ S if c_i=1), derive recvPad_i = H(x_i·S). ---
     const R = [];
-    const recvPads = [];
-    for (let i = 0; i < count; i++) {
+    const xs = [];
+    for (let i = 0; i < choices.length; i++) {
         const x = rng.scalar();
         const ci = choices[i] & 1;
-        const Ri = ci === 1 ? (0, ec_1.add)((0, ec_1.mulBase)(x), S) : (0, ec_1.mulBase)(x);
-        R.push(Ri);
-        recvPads.push(kdfPoint(i, (0, ec_1.mul)(x, S)));
+        R.push(ci === 1 ? (0, ec_1.add)((0, ec_1.mulBase)(x), S) : (0, ec_1.mulBase)(x));
+        xs.push(x);
     }
-    // A malicious receiver may tamper the R it sends on the wire (test-injected).
-    if (tamper?.tamperR)
-        tamper.tamperR(R);
-    // --- Sender: validate every received R_i (malicious-receiver / small-subgroup guard), then derive pads. ---
+    // Keys are derived under the hash of the WHOLE transcript (binding, S, every R_i).
+    const th = baseOtTranscriptHash(binding, S, R);
+    const recvPads = xs.map((x, i) => baseOtKdf(th, i, R[i], (0, ec_1.mul)(x, S)));
+    return { R, recvPads };
+}
+/** SENDER step 2: validate every received R_i (malicious-receiver / small-subgroup guard), derive both pads. */
+function malBaseOtSenderDerive(y, T, R, S, binding) {
     const senderPads = [];
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < R.length; i++)
         (0, ec_1.assertInSubgroup)(R[i], `base-OT R_${i} (received by sender)`);
+    const th = baseOtTranscriptHash(binding, S, R);
+    for (let i = 0; i < R.length; i++) {
         const yR = (0, ec_1.mul)(y, R[i]);
-        senderPads.push([kdfPoint(i, yR), kdfPoint(i, (0, ec_1.sub)(yR, Tpt))]);
+        senderPads.push([baseOtKdf(th, i, R[i], yR), baseOtKdf(th, i, R[i], (0, ec_1.sub)(yR, T))]);
     }
-    return { S, proof, R, senderPads, recvPads };
+    return senderPads;
+}
+/** SENDER step 3 (chosen-message wrapper): one-time-pad each message under its pad and commit to it. */
+function baseOtSenderEncrypt(messages, senderPads) {
+    if (messages.length !== senderPads.length)
+        throw new Error('baseOT: messages/pads length mismatch');
+    for (const [i, [m0, m1]] of messages.entries()) {
+        if (m0.length > SEED_BYTES || m1.length > SEED_BYTES || m0.length !== m1.length) {
+            throw new RangeError(`baseOT: message pair ${i} must be equal length and at most ${SEED_BYTES} bytes (pad width)`);
+        }
+    }
+    const ct = [];
+    const com = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [p0, p1] = senderPads[i];
+        ct.push([xorBytes(messages[i][0], p0), xorBytes(messages[i][1], p1)]);
+        com.push([otCommit(i, 0, messages[i][0], p0), otCommit(i, 1, messages[i][1], p1)]);
+    }
+    return { ct, com };
+}
+/**
+ * RECEIVER step 3: decrypt the chosen ciphertext with its pad, then CHECK the commitment it can open;
+ * `BaseOtAbort` on any inconsistency (a cheating sender). Every ciphertext/commitment must have the shape
+ * the receiver expects (equal-length byte strings of at most the pad width).
+ */
+function baseOtReceiverDecrypt(choices, recvPads, ct, com) {
+    if (ct.length !== choices.length || com.length !== choices.length || recvPads.length !== choices.length) {
+        throw new BaseOtAbort('base OT: ciphertext/commitment count does not match the number of choices; aborting');
+    }
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const ci = choices[i] & 1;
+        const c0 = ct[i][0];
+        const c1 = ct[i][1];
+        if (c0.length !== c1.length || c0.length > SEED_BYTES) {
+            throw new BaseOtAbort(`base OT (index ${i}): malformed ciphertext shape; aborting`);
+        }
+        const m = xorBytes(ct[i][ci], recvPads[i]);
+        const check = otCommit(i, ci, m, recvPads[i]);
+        if (!ctEqual(check, com[i][ci])) {
+            throw new BaseOtAbort(`base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+        }
+        received.push(m);
+    }
+    return received;
 }
 /**
  * Run `count` MALICIOUS-secure base OTs in one batch (chosen-message, over the random OT above).
@@ -324,58 +418,275 @@ function malBaseRandomOT(choices, rng = (0, csprng_1.secureOtRandom)(), tamper)
  * the receiver recovers `m_{i,c_i}` and checks the commitment, aborting (`BaseOtAbort`) on any
  * inconsistency. Returns the receiver's recovered messages and the full transcript.
  */
-function baseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+function baseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper, binding = randomBinding(rng, 'base-ot')) {
     if (messages.length !== choices.length)
         throw new Error('baseOT: messages/choices length mismatch');
-    const count = messages.length;
-    const ro = malBaseRandomOT(choices, rng, tamper);
-    // Sender: E_{i,b} = m_{i,b} ⊕ pad_{i,b}, and commit com_{i,b} = H(i ‖ b ‖ m_{i,b} ‖ pad_{i,b}).
-    const ct = [];
-    const com = [];
-    for (let i = 0; i < count; i++) {
-        const [p0, p1] = ro.senderPads[i];
-        ct.push([xorBytes(messages[i][0], p0), xorBytes(messages[i][1], p1)]);
-        com.push([otCommit(i, 0, messages[i][0], p0), otCommit(i, 1, messages[i][1], p1)]);
-    }
+    // The one-time pads are SEED_BYTES wide: a longer message would have its tail sent in the clear.
+    const ro = malBaseRandomOT(choices, rng, tamper, binding);
+    const { ct, com } = baseOtSenderEncrypt(messages, ro.senderPads);
     // A malicious sender may corrupt the ciphertexts on the wire (inconsistent with the commitment).
     if (tamper?.tamperCiphertext)
         tamper.tamperCiphertext(ct);
-    // Receiver: decrypt the chosen ciphertext with its pad, then CHECK the commitment it can open.
-    const received = [];
-    for (let i = 0; i < count; i++) {
-        const ci = choices[i] & 1;
-        const m = xorBytes(ct[i][ci], ro.recvPads[i]);
-        const check = otCommit(i, ci, m, ro.recvPads[i]);
-        if (!ctEqual(check, com[i][ci])) {
-            throw new BaseOtAbort(`base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+    const received = baseOtReceiverDecrypt(choices, ro.recvPads, ct, com);
+    return { received, transcript: { S: ro.S, proof: ro.proof, R: ro.R, ct, com } };
+}
+function checkExtInputs(choiceBits, msg0, msg1) {
+    const m = choiceBits.length;
+    const MSG_LIMIT = 1n << 64n;
+    for (let j = 0; j < m; j++) {
+        const c = choiceBits[j];
+        if (c !== 0 && c !== 1)
+            throw new RangeError(`OtChannel.extend: choice bit ${j} must be 0 or 1`);
+    }
+    if (msg0 && msg1) {
+        for (let j = 0; j < m; j++) {
+            const a = msg0[j];
+            const b = msg1[j];
+            if (typeof a !== 'bigint' || typeof b !== 'bigint' || a < 0n || b < 0n || a >= MSG_LIMIT || b >= MSG_LIMIT) {
+                throw new RangeError(`OtChannel.extend: message ${j} must be a bigint in [0, 2^64) (the pad is 64 bits wide)`);
+            }
         }
-        received.push(m);
     }
-    return { received, transcript: { S: ro.S, proof: ro.proof, R: ro.R, ct, com } };
 }
-// --------------------------------------------------------------------------------------------------
-// OT extension — IKNP (semi-honest), as a stateful in-process channel for one (receiver, sender) pair.
-// --------------------------------------------------------------------------------------------------
 /**
- * An IKNP OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs). The
- * κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap PRG+hash round. The
- * channel is stateful (advances per-seed PRG counters) so many rounds compose into one amortized setup.
+ * The OT-extension RECEIVER (holds the choice bits). In the base OT it is the SENDER: it draws κ seed pairs
+ * and offers them; after the base OT it expands them with the PRG.
+ */
+class OtExtReceiver {
+    rng;
+    kosBinding;
+    seed0 = [];
+    seed1 = [];
+    blk0 = [];
+    blk1 = [];
+    round = 0;
+    /** Rows hashed in earlier rounds (R4-12 global tweak offset); advanced by m per round, in step with the sender. */
+    rowsDone = 0;
+    tweakDomain;
+    ready = false;
+    /**
+     * TEST-ONLY: called with the honest `u` matrix just before it goes on the wire; may mutate it (a malicious
+     * receiver encoding inconsistent choices). The KOS values are computed over the tampered `u`.
+     */
+    tamperU;
+    constructor(rng, kosBinding) {
+        this.rng = rng;
+        this.kosBinding = kosBinding;
+        this.tweakDomain = (0, otx_1.otTweakDomain)(kosBinding);
+    }
+    /** Base-OT messages: the κ seed pairs this party offers as the base-OT sender. */
+    makeSeeds() {
+        const messages = [];
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const k0 = this.rng.bytes(SEED_BYTES);
+            const k1 = this.rng.bytes(SEED_BYTES);
+            this.seed0.push(k0);
+            this.seed1.push(k1);
+            this.blk0.push(0);
+            this.blk1.push(0);
+            messages.push([k0, k1]);
+        }
+        this.ready = true;
+        return messages;
+    }
+    /** Round start: form u and the KOS pair for `choiceBits` (the real rows); returns the wire message + pending state. */
+    begin(choiceBits) {
+        if (!this.ready)
+            throw new Error('OtExtReceiver: base OT not done');
+        checkExtInputs(choiceBits, undefined, undefined);
+        const m = choiceBits.length;
+        const roundIdx = this.round++;
+        const rowOffset = this.rowsDone;
+        this.rowsDone += m;
+        const pad = exports.KAPPA + exports.SSEC;
+        const mExt = m + pad;
+        const W = (mExt + 31) >>> 5;
+        const colBytes = Math.ceil(mExt / 8);
+        const bvec = new Uint32Array(W);
+        for (let j = 0; j < m; j++)
+            if (choiceBits[j] & 1)
+                bvec[j >>> 5] = (bvec[j >>> 5] | (1 << (j & 31))) >>> 0;
+        const padBytes = this.rng.bytes(pad);
+        for (let p = 0; p < pad; p++) {
+            if (padBytes[p] & 1) {
+                const j = m + p;
+                bvec[j >>> 5] = (bvec[j >>> 5] | (1 << (j & 31))) >>> 0;
+            }
+        }
+        const blocks = Math.ceil(W / 4); // 16-byte AES blocks consumed per column
+        const t = new Uint32Array(otx_1.COLS * W);
+        const u = new Array(otx_1.COLS);
+        const uw = new Uint32Array(W);
+        const ubytes = new Array(otx_1.COLS);
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const ti = (0, otx_1.prgColumn)(this.seed0[i], this.blk0[i], W);
+            const gi = (0, otx_1.prgColumn)(this.seed1[i], this.blk1[i], W);
+            this.blk0[i] += blocks;
+            this.blk1[i] += blocks;
+            (0, otx_1.maskTail)(ti, mExt);
+            (0, otx_1.maskTail)(gi, mExt);
+            t.set(ti, i * W);
+            for (let w = 0; w < W; w++)
+                uw[w] = (gi[w] ^ ti[w] ^ bvec[w]) >>> 0;
+            ubytes[i] = new Uint8Array(uw.buffer.slice(0, colBytes));
+            u[i] = (0, otx_1.bytesToBig)(ubytes[i]);
+        }
+        if (this.tamperU)
+            this.tamperU(u, roundIdx);
+        const pending = { m, choiceBits: choiceBits.slice(), t, W, rowOffset };
+        // A (test-injected) malformed matrix cannot be hashed; send it as is with a zero pair - the sender's
+        // structural check aborts on it before any arithmetic.
+        const limit = 1n << BigInt(mExt);
+        if (u.some((c) => typeof c !== 'bigint' || c < 0n || c >= limit)) {
+            return { msg: { u, x: 0n, tComb: 0n }, pending };
+        }
+        const chi = kosChiWords(this.kosBinding, roundIdx, u, mExt, this.tamperU ? undefined : ubytes);
+        const x = new Uint32Array(4);
+        (0, otx_1.accumColumn)(bvec, chi, x);
+        const tComb = (0, otx_1.kosCombine)(t, W, chi);
+        return { msg: { u, x: (0, otx_1.gfToBig)(x), tComb: (0, otx_1.gfToBig)(tComb) }, pending };
+    }
+    /** Round end: recover the chosen messages from the sender's ciphertexts. */
+    finish(pending, y0, y1) {
+        const { m, choiceBits, t, W, rowOffset } = pending;
+        if (y0.length !== m || y1.length !== m)
+            throw new MalOtAbort('OT extension: ciphertext count does not match the number of rows; aborting');
+        const rows = (0, otx_1.transposeCols)(t, W, m);
+        const h = (0, otx_1.tmmoCrh)(rows, m, { offset: rowOffset, domain: this.tweakDomain });
+        const received = new Array(m);
+        for (let j = 0; j < m; j++)
+            received[j] = (choiceBits[j] === 1 ? y1[j] : y0[j]) ^ (0, otx_1.word64)(h, j);
+        return received;
+    }
+}
+exports.OtExtReceiver = OtExtReceiver;
+/** The OT-extension SENDER (holds the message pairs). In the base OT it is the RECEIVER with selector `s`. */
+class OtExtSender {
+    rng;
+    kosBinding;
+    s = [];
+    sBits = 0n;
+    seeds = [];
+    blk = [];
+    round = 0;
+    rowsDone = 0;
+    tweakDomain;
+    ready = false;
+    constructor(rng, kosBinding) {
+        this.rng = rng;
+        this.kosBinding = kosBinding;
+        this.tweakDomain = (0, otx_1.otTweakDomain)(kosBinding);
+    }
+    /** Draw the secret selector s ∈ {0,1}^κ (the base-OT choice bits). */
+    makeSelector() {
+        this.s = Array.from({ length: exports.KAPPA }, () => this.rng.bytes(1)[0] & 1);
+        return this.s.slice();
+    }
+    /** Install the κ seeds learned from the base OT. */
+    setSeeds(seeds) {
+        if (seeds.length !== exports.KAPPA || this.s.length !== exports.KAPPA)
+            throw new Error('OtExtSender: wrong base-OT output size');
+        this.seeds = seeds;
+        this.blk = new Array(exports.KAPPA).fill(0);
+        let acc = 0n;
+        for (let i = 0; i < exports.KAPPA; i++)
+            acc |= BigInt(this.s[i]) << BigInt(i);
+        this.sBits = acc;
+        this.ready = true;
+    }
+    get selector() {
+        return this.sBits;
+    }
+    /**
+     * Verify the receiver's round message (structure + KOS correlation check) and return the ciphertexts for
+     * the `m` real rows. A cheating receiver is caught here: `MalOtAbort`.
+     */
+    respond(msg, msg0, msg1) {
+        if (!this.ready)
+            throw new Error('OtExtSender: base OT not done');
+        const m = msg0.length;
+        if (msg1.length !== m)
+            throw new Error('OtChannel.extend: length mismatch');
+        checkExtInputs(new Array(m).fill(0), msg0, msg1);
+        const roundIdx = this.round++;
+        const rowOffset = this.rowsDone;
+        this.rowsDone += m;
+        const mExt = m + exports.KAPPA + exports.SSEC;
+        const u = msg.u;
+        if (!Array.isArray(u) || u.length !== exports.KAPPA) {
+            throw new MalOtAbort(`KOS check (round ${roundIdx}): wrong number of u columns; a cheating OT-extension receiver was detected; aborting`);
+        }
+        // Structural check on what arrived: every column must be an mExt-bit non-negative integer. Bits beyond
+        // mExt have no challenge weight, and would otherwise crash the correlation check with an untyped error.
+        const colLimit = 1n << BigInt(mExt);
+        for (let i = 0; i < exports.KAPPA; i++) {
+            const ui = u[i];
+            if (typeof ui !== 'bigint' || ui < 0n || ui >= colLimit) {
+                throw new MalOtAbort(`KOS check (round ${roundIdx}): malformed u column ${i}; a cheating OT-extension receiver was detected; aborting`);
+            }
+        }
+        const lim128 = 1n << 128n;
+        if (typeof msg.x !== 'bigint' || typeof msg.tComb !== 'bigint' || msg.x < 0n || msg.x >= lim128 || msg.tComb < 0n || msg.tComb >= lim128) {
+            throw new MalOtAbort(`KOS check (round ${roundIdx}): malformed (x, t); a cheating OT-extension receiver was detected; aborting`);
+        }
+        const W = (mExt + 31) >>> 5;
+        const colBytes = Math.ceil(mExt / 8);
+        const blocks = Math.ceil(W / 4);
+        // q_i = (s_i ? u_i : 0) ⊕ PRG(k_i^{s_i})  =>  q_i = t_i ⊕ (s_i · bvec) if the receiver is honest.
+        const q = new Uint32Array(otx_1.COLS * W);
+        const ubytes = new Array(otx_1.COLS);
+        for (let i = 0; i < exports.KAPPA; i++) {
+            ubytes[i] = (0, otx_1.bigToBytes)(u[i], colBytes);
+            const ks = (0, otx_1.prgColumn)(this.seeds[i], this.blk[i], W);
+            this.blk[i] += blocks;
+            (0, otx_1.maskTail)(ks, mExt);
+            if (this.s[i] === 1) {
+                const ub = new Uint8Array(4 * W);
+                ub.set(ubytes[i]);
+                const uw = new Uint32Array(ub.buffer, 0, W);
+                for (let w = 0; w < W; w++)
+                    ks[w] = (ks[w] ^ uw[w]) >>> 0;
+            }
+            q.set(ks, i * W);
+        }
+        // KOS correlation check (GF(2^128)): Σ χ_j·q_j == t ⊕ x·s with χ bound to the whole u on the wire.
+        const chi = kosChiWords(this.kosBinding, roundIdx, u, mExt, ubytes);
+        const qComb = (0, otx_1.gfToBig)((0, otx_1.kosCombine)(q, W, chi));
+        const expected = msg.tComb ^ (0, gf128_1.gf128Mul)(msg.x, this.sBits);
+        if (qComb !== expected) {
+            throw new MalOtAbort(`KOS correlation check FAILED (round ${roundIdx}): a cheating OT-extension receiver was detected; aborting`);
+        }
+        const rows = (0, otx_1.transposeCols)(q, W, m);
+        const tweak = { offset: rowOffset, domain: this.tweakDomain };
+        const h0 = (0, otx_1.tmmoCrh)(rows, m, tweak);
+        const sw = (0, otx_1.gfFromBig)(this.sBits);
+        for (let j = 0; j < m; j++)
+            (0, otx_1.gfXorInto)(rows.subarray(4 * j, 4 * j + 4), sw, 0);
+        const h1 = (0, otx_1.tmmoCrh)(rows, m, tweak);
+        const y0 = new Array(m);
+        const y1 = new Array(m);
+        for (let j = 0; j < m; j++) {
+            y0[j] = msg0[j] ^ (0, otx_1.word64)(h0, j);
+            y1[j] = msg1[j] ^ (0, otx_1.word64)(h1, j);
+        }
+        return { y0, y1 };
+    }
+}
+exports.OtExtSender = OtExtSender;
+/**
+ * An IKNP/KOS OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs), both
+ * simulated in-process. The κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap
+ * PRG+hash round. The channel is stateful (advances per-seed PRG counters) so many rounds compose into one
+ * amortized setup. The two roles are the standalone `OtExtReceiver` / `OtExtSender` (used over the network).
  */
 class OtChannel {
     rng;
     /** Optional post-quantum (or otherwise custom) base OT for the κ setup OTs; defaults to EC `baseOT`. */
     baseOtFn;
+    bindingOpt;
+    recv;
+    send;
     ready = false;
-    // Extension-sender state: selector s (κ bits) and the κ seeds it learned (k_i^{s_i}).
-    s = [];
-    sBits = 0n; // s packed as a κ-bit bigint (cached)
-    senderSeeds = [];
-    senderBlk = [];
-    // Extension-receiver state: κ seed pairs.
-    recvSeed0 = [];
-    recvSeed1 = [];
-    recvBlk0 = [];
-    recvBlk1 = [];
     /** The base-OT transcript (available after setup) — exposed for inspection/tests. */
     baseTranscript;
     /**
@@ -386,7 +697,6 @@ class OtChannel {
      * a non-trivial tamper is caught — the real malicious-receiver attack that KOS defeats.
      */
     tamperU;
-    round = 0;
     /**
      * `rng` defaults to the CSPRNG (`secureOtRandom`, `node:crypto`) — production randomness. Pass a
      * deterministic `otRandom(splitMix64(seed))` ONLY to make a test bit-reproducible (docs §7.1 item c).
@@ -394,46 +704,37 @@ class OtChannel {
     constructor(rng = (0, csprng_1.secureOtRandom)(), opts) {
         this.rng = rng;
         this.baseOtFn = opts?.baseOtFn;
+        this.bindingOpt = opts?.binding;
     }
     setup() {
-        // Extension-RECEIVER is the base-SENDER: it generates κ seed pairs.
-        const messages = [];
-        for (let i = 0; i < exports.KAPPA; i++) {
-            const k0 = this.rng.bytes(SEED_BYTES);
-            const k1 = this.rng.bytes(SEED_BYTES);
-            this.recvSeed0.push(k0);
-            this.recvSeed1.push(k1);
-            this.recvBlk0.push(0);
-            this.recvBlk1.push(0);
-            messages.push([k0, k1]);
-        }
-        // Extension-SENDER is the base-RECEIVER with selector s: it learns k_i^{s_i}.
-        this.s = Array.from({ length: exports.KAPPA }, () => {
-            const b = this.rng.bytes(1);
-            return b[0] & 1;
-        });
+        const base = this.bindingOpt ?? randomBinding(this.rng, 'x');
+        const binding = { sessionId: base.sessionId, senderIndex: base.senderIndex, receiverIndex: base.receiverIndex };
+        const kos = bindingBytes({ ...binding, round: 'iknp-kos' });
+        const recv = new OtExtReceiver(this.rng, kos);
+        const send = new OtExtSender(this.rng, kos);
+        // Extension-RECEIVER is the base-SENDER: it generates κ seed pairs; the extension-SENDER is the
+        // base-RECEIVER with selector s: it learns k_i^{s_i}.
+        const messages = recv.makeSeeds();
+        const s = send.makeSelector();
         if (this.baseOtFn) {
             // Custom (e.g. post-quantum ML-KEM) base OT: its transcript shape differs, so leave the
             // EC-typed `baseTranscript` unset.
-            this.senderSeeds = this.baseOtFn(messages, this.s, this.rng).received;
+            send.setSeeds(this.baseOtFn(messages, s, this.rng).received);
         }
         else {
-            const base = baseOT(messages, this.s, this.rng);
-            this.senderSeeds = base.received;
-            this.baseTranscript = base.transcript;
+            const baseRes = baseOT(messages, s, this.rng, undefined, { ...binding, round: 'iknp-kappa-setup' });
+            send.setSeeds(baseRes.received);
+            this.baseTranscript = baseRes.transcript;
         }
-        this.senderBlk = new Array(exports.KAPPA).fill(0);
-        let acc = 0n;
-        for (let i = 0; i < exports.KAPPA; i++)
-            acc |= BigInt(this.s[i]) << BigInt(i);
-        this.sBits = acc;
+        this.recv = recv;
+        this.send = send;
         this.ready = true;
     }
     /** Selector s as a κ-bit bigint (sender-side secret; exposed only for tests). */
     get selector() {
         if (!this.ready)
             this.setup();
-        return this.sBits;
+        return this.send.selector;
     }
     /**
      * One MALICIOUS-secure extension round: `choiceBits[j] ∈ {0,1}` (receiver), `msg0[j]/msg1[j]`
@@ -451,85 +752,11 @@ class OtChannel {
             throw new Error('OtChannel.extend: length mismatch');
         if (m === 0)
             return { received: [], uMatrix: [] };
-        const roundIdx = this.round++;
-        // --- KOS padding: append κ+SSEC random check-OT rows (no messages are transferred for them). ---
-        const pad = exports.KAPPA + exports.SSEC;
-        const mExt = m + pad;
-        const padChoice = new Array(pad);
-        for (let p = 0; p < pad; p++)
-            padChoice[p] = this.rng.bytes(1)[0] & 1;
-        // Full choice vector (real ‖ padding) as an mExt-bit bigint, and a per-row accessor for the check.
-        let bvec = 0n;
-        for (let j = 0; j < m; j++)
-            if (choiceBits[j] & 1)
-                bvec |= 1n << BigInt(j);
-        for (let p = 0; p < pad; p++)
-            if (padChoice[p] & 1)
-                bvec |= 1n << BigInt(m + p);
-        const blocks = Math.ceil(mExt / 256);
-        // Receiver forms t_i, u_i = PRG(k1) ⊕ t_i ⊕ bvec  (over all mExt rows).
-        const t = new Array(exports.KAPPA);
-        const u = new Array(exports.KAPPA);
-        for (let i = 0; i < exports.KAPPA; i++) {
-            const ti = prgBits(this.recvSeed0[i], this.recvBlk0[i], mExt);
-            const gi = prgBits(this.recvSeed1[i], this.recvBlk1[i], mExt);
-            this.recvBlk0[i] += blocks;
-            this.recvBlk1[i] += blocks;
-            t[i] = ti;
-            u[i] = gi ^ ti ^ bvec;
-        }
-        // A malicious receiver may tamper the u it sends on the wire (test-injected).
-        if (this.tamperU)
-            this.tamperU(u, roundIdx);
-        // Sender computes q_i = (s_i ? u_i : 0) ⊕ PRG(k_i^{s_i}).  => q_i = t_i ⊕ (s_i · bvec) if honest.
-        const q = new Array(exports.KAPPA);
-        for (let i = 0; i < exports.KAPPA; i++) {
-            const ks = prgBits(this.senderSeeds[i], this.senderBlk[i], mExt);
-            this.senderBlk[i] += blocks;
-            q[i] = (this.s[i] === 1 ? u[i] : 0n) ^ ks;
-        }
-        const sBits = this.sBits;
-        // --- KOS correlation check (GF(2^128), column-domain fold over all mExt rows). ---
-        // χ_j bound to the (possibly tampered) u on the wire. Receiver reveals x = Σ b_j·χ_j and
-        // t_comb = Σ χ_j·t_j; sender checks Σ χ_j·q_j == t_comb ⊕ x·s. Honestly q_j = t_j ⊕ b_j·s so it
-        // holds; a receiver who tampered u passes with prob ≤ 2^{-128}, else ABORT.
-        const chi = kosChallenges(u, mExt);
-        // x = Σ_{j: b_j=1} χ_j  (receiver side; over real + padding choices, so real choices stay masked).
-        let x = 0n;
-        x = accumSetBits(bvec, chi, x);
-        // t_comb = Σ_i (Σ_{j: t_i has bit j} χ_j)·x^i ;  q_comb likewise from q_i.
-        let tComb = 0n;
-        let qComb = 0n;
-        for (let i = 0; i < exports.KAPPA; i++) {
-            const at = accumSetBits(t[i], chi, 0n);
-            const aq = accumSetBits(q[i], chi, 0n);
-            tComb = (0, gf128_1.gf128Add)(tComb, (0, gf128_1.gf128MulByXi)(at, i));
-            qComb = (0, gf128_1.gf128Add)(qComb, (0, gf128_1.gf128MulByXi)(aq, i));
-        }
-        const expected = (0, gf128_1.gf128Add)(tComb, (0, gf128_1.gf128Mul)(x, sBits));
-        if (qComb !== expected) {
-            throw new MalOtAbort(`KOS correlation check FAILED (round ${roundIdx}): a cheating OT-extension receiver was detected; aborting`);
-        }
-        // --- Only the m real rows carry messages. Sender: y0_j = msg0_j ⊕ H(j,qrow_j), y1 ⊕ H(j,qrow⊕s). ---
-        const y0 = new Array(m);
-        const y1 = new Array(m);
-        for (let j = 0; j < m; j++) {
-            let qrow = 0n;
-            for (let i = 0; i < exports.KAPPA; i++)
-                qrow |= ((q[i] >> BigInt(j)) & 1n) << BigInt(i);
-            y0[j] = msg0[j] ^ crh(j, qrow);
-            y1[j] = msg1[j] ^ crh(j, qrow ^ sBits);
-        }
-        // Receiver: recovered_j = y_{b_j}[j] ⊕ H(j, trow_j).
-        const received = new Array(m);
-        for (let j = 0; j < m; j++) {
-            let trow = 0n;
-            for (let i = 0; i < exports.KAPPA; i++)
-                trow |= ((t[i] >> BigInt(j)) & 1n) << BigInt(i);
-            const bj = choiceBits[j] & 1;
-            received[j] = (bj === 1 ? y1[j] : y0[j]) ^ crh(j, trow);
-        }
-        return { received, uMatrix: u };
+        checkExtInputs(choiceBits, msg0, msg1);
+        this.recv.tamperU = this.tamperU;
+        const { msg, pending } = this.recv.begin(choiceBits);
+        const { y0, y1 } = this.send.respond(msg, msg0, msg1);
+        return { received: this.recv.finish(pending, y0, y1), uMatrix: msg.u };
     }
 }
 exports.OtChannel = OtChannel;