@atlasauth/pca-mpc 0.3.0 → 0.4.0

package/dist/spdz-runner.js

@@ -10,7 +10,11 @@
  * silent wrong answer. (Malicious-with-abort, dishonest-majority.)
  *
  * Offline phase (two interchangeable sources, same tiny interface):
- *   - DEFAULT: a trusted dealer produces the authenticated triples / input sharings and knows α.
+ *   - DEFAULT, labelled `'trusted-dealer'` in the result: a trusted dealer produces the authenticated
+ *     triples / input sharings and knows the MAC keys. A dealer that hands out a wrong triple (c ≠ a·b) is
+ *     now DETECTED: every delivered triple is certified by the sacrifice check with `SACRIFICE_PARTNERS`
+ *     independent partners (spdz.ts `sacrificeVerify`) and a bad one aborts. The dealer is still trusted for
+ *     PRIVACY (it knows every share and key).
  *   - NO-DEALER: pass `cfg.offline` (a `NoDealerOffline` from `mascot.ts`) and the triples, input
  *     sharings and the distributed MAC key all come from real oblivious transfer — no dealer, and α
  *     is never reconstructed. Either way the ONLINE phase here is the same maliciously-secure protocol.
@@ -19,9 +23,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.composeSecureMalicious = composeSecureMalicious;
 const field_1 = require("./field");
+const csprng_1 = require("./csprng");
 const spdz_1 = require("./spdz");
 const thermometer_1 = require("./thermometer");
 const party_1 = require("./party");
+const compose_1 = require("./compose");
 const T_M = 3;
 /**
  * Compose stakeholder decision vectors under MALICIOUS-secure MPC. Returns the composed decision only
@@ -33,7 +39,9 @@ function composeSecureMalicious(vectors, cfg = {}) {
     if (n === 0)
         throw new Error('composeSecureMalicious: no parties (fail closed)');
     const Q = cfg.Q ?? party_1.DEFAULT_Q;
-    const rng = new field_1.FieldRng(cfg.seed);
+    (0, compose_1.assertDecisionVectors)(vectors, Q);
+    // No seed => cryptographically secure randomness (see runner.ts); a seed is for reproducible tests only.
+    const rng = cfg.seed === undefined ? new csprng_1.SecureFieldRng() : new field_1.FieldRng(cfg.seed);
     // --- Offline: MAC key + authenticated input sharings + triples ---
     // Either a NO-DEALER provider (OT-based, mascot.ts) or the trusted dealer, behind one interface.
     const offline = cfg.offline;
@@ -43,7 +51,15 @@ function composeSecureMalicious(vectors, cfg = {}) {
     const ctx = offline ? offline.macContext : (0, spdz_1.setupMac)(n, rng);
     const engine = new spdz_1.SpdzEngine(ctx, cfg.deviations ?? []);
     let mults = 0;
-    const nextTriple = () => (offline ? offline.genAuthTriple() : (0, spdz_1.genAuthTriple)(ctx, rng));
+    const verify = cfg.dealer?.verifyTriples ?? true;
+    const nextTriple = () => {
+        if (offline)
+            return offline.genAuthTriple();
+        if (!verify)
+            return cfg.dealer?.fault ? (0, spdz_1.genTripleWithPartners)(ctx, rng, 1, cfg.dealer.fault).keep : (0, spdz_1.genAuthTriple)(ctx, rng);
+        const dealt = (0, spdz_1.genTripleWithPartners)(ctx, rng, cfg.dealer?.partners ?? spdz_1.SACRIFICE_PARTNERS, cfg.dealer?.fault);
+        return (0, spdz_1.sacrificeVerify)([dealt], ctx, rng)[0];
+    };
     const shareBit = (bit, owner) => offline ? offline.authInput(BigInt(bit), owner) : (0, spdz_1.authShare)(BigInt(bit), ctx, rng);
     // Secure AND over authenticated bits = product.
     const andBits = (bits) => {
@@ -98,6 +114,8 @@ function composeSecureMalicious(vectors, cfg = {}) {
         Q,
         opens: engine.openCount,
         multiplications: mults,
+        offlineMode: offline ? 'no-dealer' : 'trusted-dealer',
+        triplesVerified: offline ? true : verify,
         macChecked: true,
     };
 }

package/dist/spdz-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"spdz-runner.js","sourceRoot":"","sources":["../src/spdz-runner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAqDH,wDAmFC;AAtID,mCAAmC;AACnC,iCAYgB;AAEhB,+CAAqE;AACrE,mCAAyD;AA4BzD,MAAM,GAAG,GAAG,CAAC,CAAC;AAEd;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,OAAsC,EACtC,MAA0B,EAAE;IAE5B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,iBAAS,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,gBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnC,oEAAoE;IACpE,iGAAiG;IACjG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAe,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,eAAQ,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE,CACtD,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAErF,gDAAgD;IAChD,MAAM,OAAO,GAAG,CAAC,IAAc,EAAU,EAAE;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAA,mBAAY,EAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,GAAG,GAAG,IAAA,oBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,IAAc,EAAU,EAAE;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAA,mBAAY,EAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,IAAA,oBAAa,EAAC,IAAI,EAAE,IAAA,iBAAU,EAAC,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3F,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,IAAA,iBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,gGAAgG;IAChG,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,+BAAiB,EAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,+BAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,uFAAuF;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,oGAAoG;IACpG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAErB,iFAAiF;IACjF,MAAM,KAAK,GAAU,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAA,+BAAiB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAA,+BAAiB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE;QAC9B,OAAO,EAAE,CAAC;QACV,CAAC;QACD,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;AAClD,CAAC"}
+{"version":3,"file":"spdz-runner.js","sourceRoot":"","sources":["../src/spdz-runner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAmEH,wDA6FC;AA9JD,mCAAmC;AACnC,qCAA0C;AAC1C,iCAgBgB;AAEhB,+CAAqE;AACrE,mCAAyD;AACzD,uCAAyE;AAoCzE,MAAM,GAAG,GAAG,CAAC,CAAC;AAEd;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,OAAsC,EACtC,MAA0B,EAAE;IAE5B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,iBAAS,CAAC;IAC7B,IAAA,+BAAqB,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClC,yGAAyG;IACzG,MAAM,GAAG,GAAa,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,uBAAc,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE7F,oEAAoE;IACpE,iGAAiG;IACjG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAAe,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,eAAQ,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,iBAAU,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,GAAe,EAAE;QAClC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAA,4BAAqB,EAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,oBAAa,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5H,MAAM,KAAK,GAAG,IAAA,4BAAqB,EAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,IAAI,yBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7G,OAAO,IAAA,sBAAe,EAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAChD,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE,CACtD,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAErF,gDAAgD;IAChD,MAAM,OAAO,GAAG,CAAC,IAAc,EAAU,EAAE;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAA,mBAAY,EAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,GAAG,GAAG,IAAA,oBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,IAAc,EAAU,EAAE;QACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAA,mBAAY,EAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,IAAA,iBAAU,EAAC,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,IAAA,oBAAa,EAAC,IAAI,EAAE,IAAA,iBAAU,EAAC,IAAI,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3F,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,IAAA,iBAAU,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,gGAAgG;IAChG,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,+BAAiB,EAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,+BAAiB,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,uFAAuF;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAExE,oGAAoG;IACpG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAErB,iFAAiF;IACjF,MAAM,KAAK,GAAU,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAA,+BAAiB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAA,+BAAiB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE;QAC9B,OAAO,EAAE,CAAC;QACV,CAAC;QACD,KAAK,EAAE,MAAM,CAAC,SAAS;QACvB,eAAe,EAAE,KAAK;QACtB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB;QACrD,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxC,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAc,CAAC;AAClD,CAAC"}

package/dist/spdz.d.ts

@@ -19,11 +19,13 @@
  *
  * Security upgrade: semi-honest → **malicious-with-abort, dishonest-majority** (secure against up to
  * N−1 actively-corrupted parties; privacy and MAC-forgery-resistance both hold at the N−1 threshold).
- * The MAC is information-theoretic: forging a MAC on a wrong value succeeds with probability ≤ 2/p
- * (here ≈ 2^−60), independent of the adversary's computing power.
+ * The MAC is information-theoretic, independent of the adversary's computing power. ONE key over the 61-bit
+ * field is only ≈ 2^−60 sound, so every value carries `MAC_KEYS = 2` MACs under INDEPENDENT global keys, each
+ * with its own challenge vector, all checked in the same batched check: the forgery probability is
+ * ≤ (2/p)^2 ≈ 2^−120 (proof: docs/pca/security/pca-mpc-spdz-soundness.md; `macSoundnessBits`).
  *
  * OFFLINE-PHASE BOUNDARY (honest, see docs §7): the authenticated triples / input sharings below are
- * produced by a TRUSTED DEALER that honestly knows `α`. That keeps the *online* phase — openings,
+ * produced by a TRUSTED DEALER that honestly knows the MAC keys. That keeps the *online* phase — openings,
  * MAC updates, and the MAC-check — the real, maliciously-secure thing, with the dealer as the one
  * explicit trust assumption. A no-dealer offline phase (MASCOT/Overdrive: OT- or HE-based authenticated
  * triple generation, itself maliciously secure, with a distributed `α` nobody ever reconstructs) is
@@ -32,20 +34,30 @@
  * via `node:crypto`), modelling the commit-then-open round that defeats a rushing adversary.
  */
 import { FieldRng } from './field';
-/** The global SPDZ MAC key, additively shared. `alpha` is known to the DEALER only (and to tests). */
-export interface MacContext {
-    n: number;
-    /** α_i: party i's share of the MAC key. Σ α_i = α. No single party may learn α. */
+/** One global SPDZ MAC key, additively shared. */
+export interface MacKey {
+    /** α_i: party i's share of this key. Σ α_i = α. No single party may learn α. */
     alphaShares: bigint[];
-    /** The global MAC key α. For dealer preprocessing + test inspection ONLY; never held by one party. */
+    /** The key α. For dealer preprocessing + test inspection ONLY; never held by one party. */
     alpha: bigint;
 }
-/** An authenticated secret-shared value: value shares summing to x, MAC shares summing to α·x. */
+/**
+ * The global SPDZ MAC keys, additively shared. Key 0 is `alphaShares`/`alpha`; `extraKeys` are further
+ * INDEPENDENT keys (the statistical-security amplification: each is an independent 2/p test).
+ */
+export interface MacContext extends MacKey {
+    n: number;
+    /** Independent keys 1..k-1. Every authenticated value carries one MAC per key. */
+    extraKeys: MacKey[];
+}
+/** An authenticated secret-shared value: value shares summing to x, MAC shares summing to α·x (per key). */
 export interface AuthSV {
     /** value shares x_i (Σ = x). */
     value: bigint[];
-    /** MAC shares γ_i (Σ = α·x). */
+    /** MAC shares γ_i under key 0 (Σ = α·x). */
     mac: bigint[];
+    /** MAC shares under keys 1..k-1 (`extraMac[l-1]` sums to `extraKeys[l-1].alpha · x`). */
+    extraMac: bigint[][];
 }
 /** An authenticated Beaver triple: ⟦a⟧, ⟦b⟧, ⟦c⟧ with c = a·b, every component MAC'd. */
 export interface AuthTriple {
@@ -53,34 +65,80 @@ export interface AuthTriple {
     b: AuthSV;
     c: AuthSV;
 }
+/** Number of independent MAC keys the trusted-dealer / no-dealer setups create by default. */
+export declare const MAC_KEYS = 2;
+/** The statistical security the MAC-check must provide, in bits. `SpdzEngine` refuses a weaker context. */
+export declare const MIN_MAC_SOUNDNESS_BITS = 100;
+/** All keys of a context, key 0 first. */
+export declare function macKeys(ctx: MacContext): MacKey[];
+/**
+ * Soundness (as -log2 of the forgery probability) of the batched MAC-check over a field of `fieldBits`
+ * bits (default: this field) with `keys` independent keys: per key the failure probability is ≤ 2/p
+ * (1/p for guessing the key, 1/p for a random combination hitting a non-zero residual), and the keys and
+ * challenge vectors are independent, so the total is ≤ (2/p)^keys. Returns `keys · (log2 p − 1)`.
+ */
+export declare function macSoundnessBits(keys: number, p?: bigint): number;
 /** Raised when the SPDZ MAC-check detects an inconsistent opening/MAC: the protocol ABORTS, no output. */
 export declare class MacCheckAbort extends Error {
     constructor(message: string);
 }
-/** Dealer preprocessing: sample the global MAC key α and additively share it across n parties. */
-export declare function setupMac(n: number, rng: FieldRng): MacContext;
-/** Authenticated sharing of `secret` (dealer-side): value shares sum to x, MAC shares sum to α·x. */
+/** Dealer preprocessing: sample `keys` independent global MAC keys and additively share each across n parties. */
+export declare function setupMac(n: number, rng: FieldRng, keys?: number): MacContext;
+/** Authenticated sharing of `secret` (dealer-side): value shares sum to x, MAC shares sum to α·x per key. */
 export declare function authShare(secret: bigint, ctx: MacContext, rng: FieldRng): AuthSV;
 /** Authenticated sharing of a PUBLIC constant c: value = shareConstant(c), MAC = share of α·c (via α_i·c). */
 export declare function authConstant(c: bigint, ctx: MacContext): AuthSV;
-/** ⟦x⟧ + ⟦y⟧ (local; MAC shares add, preserving Σγ = α·(x+y)). */
+/** ⟦x⟧ + ⟦y⟧ (local; MAC shares add, preserving Σγ = α·(x+y) under every key). */
 export declare function addAuth(x: AuthSV, y: AuthSV): AuthSV;
 /** ⟦x⟧ − ⟦y⟧ (local). */
 export declare function subAuth(x: AuthSV, y: AuthSV): AuthSV;
 /** −⟦x⟧ (local). */
 export declare function negAuth(x: AuthSV): AuthSV;
-/** ⟦x⟧ · c for a PUBLIC scalar c (local): both value and MAC shares scale by c. */
+/** ⟦x⟧ · c for a PUBLIC scalar c (local): value and every MAC share scale by c. */
 export declare function scaleAuth(x: AuthSV, c: bigint): AuthSV;
 /**
  * ⟦x⟧ + c for a PUBLIC constant c (local). The SPDZ public-constant rule: add c to ONE party's value
- * share, and add α_i·c to EVERY party's MAC share (each party holds α_i), so Σγ becomes α·x + α·c =
- * α·(x+c). This is what lets affine gates stay authenticated without any interaction.
+ * share, and add α_i·c to EVERY party's MAC share under EVERY key (each party holds its α_i), so Σγ becomes
+ * α·x + α·c = α·(x+c). This is what lets affine gates stay authenticated without any interaction.
  */
 export declare function addPublicAuth(x: AuthSV, c: bigint, ctx: MacContext): AuthSV;
 /** Logical NOT of an authenticated bit b: ⟦1 − b⟧ (local). */
 export declare function notBitAuth(b: AuthSV, ctx: MacContext): AuthSV;
 /** Dealer preprocessing: one authenticated triple (a, b, c=a·b), every component MAC'd. */
 export declare function genAuthTriple(ctx: MacContext, rng: FieldRng): AuthTriple;
+/**
+ * Number of independent sacrifice partners per delivered triple. The sacrifice of one partner passes a
+ * triple with c ≠ a·b with probability ≤ 1/p (the random challenge must hit one value); `r` independent
+ * partners (each with its own challenge) give ≤ p^-r, so 2 partners ≈ 2^-122 > the 2^-100 floor.
+ */
+export declare const SACRIFICE_PARTNERS = 2;
+/** A triple to be delivered plus its sacrifice partners; every partner shares `keep.b` (same sharing). */
+export interface TripleWithPartners {
+    keep: AuthTriple;
+    partners: AuthTriple[];
+}
+/**
+ * TEST-ONLY fault of a LYING trusted dealer: the dealer authenticates a wrong product, so the triple is
+ * internally MAC-consistent (the MACs are computed on the wrong c) - exactly the lie MACs alone cannot
+ * detect. `keepCDelta` makes the delivered triple's c = a·b + delta; `partnerCDelta[r]` does the same to
+ * sacrifice partner r.
+ */
+export interface DealerFault {
+    keepCDelta?: bigint;
+    partnerCDelta?: Array<bigint | undefined>;
+}
+/** Trusted-dealer preprocessing of one triple together with its sacrifice partners (all sharing b). */
+export declare function genTripleWithPartners(ctx: MacContext, rng: FieldRng, partners?: number, fault?: DealerFault): TripleWithPartners;
+/**
+ * The MASCOT/SPDZ **sacrifice** check on a batch. For every kept triple (a,b,c) and each partner (â,b,ĉ)
+ * it draws a public random challenge e ≠ 0, opens ρ = e·a − â, forms ⟦τ⟧ = e·⟦c⟧ − ⟦ĉ⟧ − ρ·⟦b⟧ and opens
+ * it. If both triples are correct, τ = e·(c − ab) − (ĉ − âb) = 0; if c = ab + δ with δ ≠ 0, τ = e·δ − δ̂ is
+ * non-zero except for one value of e (prob 1/p), and independent partners multiply the failure
+ * probabilities. A lie in either opening is caught by the single batched MAC-check (all keys). Throws
+ * `MacCheckAbort` on any failure and emits NOTHING; otherwise returns the certified kept triples.
+ * The partners are consumed and must never be reused.
+ */
+export declare function sacrificeVerify(batch: ReadonlyArray<TripleWithPartners>, ctx: MacContext, rng: FieldRng, deviations?: Deviation[]): AuthTriple[];
 /** A party's broadcast deviation in the ONLINE phase — the knob that lets tests model an active cheater. */
 export interface Deviation {
     /** 0-based index of the `open()` call to corrupt. */
@@ -91,7 +149,23 @@ export interface Deviation {
     valueDelta?: bigint;
     /** delta added to that party's MAC share carried into the MAC-check for that open (a forged MAC). */
     macDelta?: bigint;
+    /** which MAC key `macDelta` applies to (0 = key 0, default). */
+    macKey?: number;
+}
+/** One partial opening as it reaches the MAC-check: the public value and the MAC shares per key per party. */
+export interface OpenedValue {
+    value: bigint;
+    /** macShares[key][party] */
+    macShares: bigint[][];
+    label: string;
 }
+/**
+ * The arithmetic core of the batched SPDZ MAC-check, over an ARBITRARY prime modulus `p` so the very same
+ * code can be exercised on a deliberately tiny field (the soundness experiment in the tests). For each key
+ * l, with its own challenge vector r^(l): a^(l) = Σ_j r_j^(l)·v_j, and party i's residual share is
+ * σ_i^(l) = Σ_j r_j^(l)·γ_ij^(l) − α_i^(l)·a^(l). Returns σ[key][party]; honest data gives Σ_i σ_i^(l) = 0 for every l.
+ */
+export declare function macResiduals(p: bigint, alphaShares: bigint[][], opened: ReadonlyArray<Pick<OpenedValue, 'value' | 'macShares'>>, challenges: bigint[][]): bigint[][];
 /**
  * The SPDZ online engine: performs partial openings (broadcast value shares, sum to the public value,
  * RETAIN the MAC shares for a single batched MAC-check at the end) and the MAC-check itself. A list of
@@ -114,11 +188,11 @@ export declare class SpdzEngine {
      */
     open(x: AuthSV, label?: string): bigint;
     /**
-     * SPDZ MAC-check over every partial-open so far. Draws public random coefficients r_j (a secure
-     * coin-flip in the real protocol; a seeded RNG here, documented), forms the public combination
-     * a = Σ r_j·a_j and each party's residual share σ_i = (Σ r_j·γ_i(a_j)) − α_i·a, then runs
-     * commit-then-open on the σ_i and checks Σ σ_i = 0. Honest runs give exactly 0; ANY inconsistent
-     * opened value or forged MAC makes it non-zero with probability ≥ 1 − 2/p, and we ABORT.
+     * SPDZ MAC-check over every partial-open so far. For EACH key draws an independent public challenge
+     * vector (a secure coin-flip in the real protocol; the supplied RNG here), forms the residual shares
+     * (`macResiduals`), then runs commit-then-open on every σ and checks Σ σ = 0 for every key. Honest runs
+     * give exactly 0; ANY inconsistent opened value or forged MAC makes some key's sum non-zero with
+     * probability ≥ 1 − (2/p)^k, and we ABORT.
      *
      * The commit-then-open (SHA-256 binding commitment) models the round that stops a *rushing*
      * adversary from choosing its σ_i after seeing the others — it must commit before any are revealed.