@atlasauth/pca-mpc 0.3.0 → 0.4.0

package/dist/net/prep.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The offline material one party holds when the online phase starts, whichever way it was produced:
+ * dealt by a TRUSTED DEALER over the mesh (`protocol.ts` `runDealer`) or generated by the parties themselves
+ * from oblivious transfer with NO dealer (`offline-net.ts`).
+ */
+import type { AW, PA } from './pa';
+import type { Disclosure } from './forensics';
+/** Number of sharings per delivered triple: a, b, c, then (a-hat, c-hat) for each sacrifice partner. */
+export declare const sharingsPerTriple: (partners: number) => number;
+export interface Prep {
+    /** Where this material came from. A `trusted-dealer` knows every share and key. */
+    mode: 'trusted-dealer' | 'no-dealer';
+    /** Whether the shares carry pairwise tags (identifiable abort). Only the trusted-dealer mode provides them. */
+    tagged: boolean;
+    /** My pairwise verification key Δ (0n when untagged). */
+    delta: bigint;
+    /** My share of each global MAC key, pairwise-authenticated. */
+    alpha: PA[];
+    /** Triples with their sacrifice partners: `triples[t] = [a, b, c, a-hat_1, c-hat_1, ...]` (partners share b). */
+    triples: AW[][];
+    /**
+     * trusted-dealer: the authenticated random MASKS r for each (owner, chain), `inputs[owner*C + c]`; the owner
+     * broadcasts x - r. no-dealer: the authenticated INPUT bits themselves, same indexing.
+     */
+    inputs: AW[];
+    /** My own plaintext side of `inputs`: the masks r (trusted-dealer) or my input bits (no-dealer), one per chain. */
+    myPlain: bigint[];
+    /** no-dealer only: an authenticated random mask for the input-consistency check. */
+    checkMask?: AW;
+    /** no-dealer only: the OT transcript of the triple products, for attributing a failed sacrifice (`forensics.ts`). */
+    forensics?: {
+        gadget: bigint[];
+        /** Choice bits per product item (the encoded width). */
+        rows: number;
+        /** Product slots per triple: the product and one per sacrifice partner. */
+        slots: number;
+        /** My disclosure for triple `t` (the triple is discarded when this is used). */
+        disclose: (t: number) => Disclosure;
+    };
+}

package/dist/net/prep.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * The offline material one party holds when the online phase starts, whichever way it was produced:
+ * dealt by a TRUSTED DEALER over the mesh (`protocol.ts` `runDealer`) or generated by the parties themselves
+ * from oblivious transfer with NO dealer (`offline-net.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sharingsPerTriple = void 0;
+/** Number of sharings per delivered triple: a, b, c, then (a-hat, c-hat) for each sacrifice partner. */
+const sharingsPerTriple = (partners) => 3 + 2 * partners;
+exports.sharingsPerTriple = sharingsPerTriple;
+//# sourceMappingURL=prep.js.map

package/dist/net/prep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prep.js","sourceRoot":"","sources":["../../src/net/prep.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAKH,wGAAwG;AACjG,MAAM,iBAAiB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;AAAnE,QAAA,iBAAiB,qBAAkD"}

package/dist/net/protocol.d.ts

@@ -0,0 +1,126 @@
+/**
+ * The DISTRIBUTED malicious-with-abort (SPDZ-style) composition protocol (research prototype).
+ *
+ * Same circuit and semantics as `composeSecureMalicious` (allow = AND, t = MAX, r = MAX via
+ * thermometers; authenticated Beaver multiplication; batched MAC-check before any output), but each
+ * party is its OWN process holding ONLY its own shares, and every opening is a real message over the
+ * TLS mesh (`mesh.ts`). Rounds (n parties, C = 1 + 3 + Q independent chains, k = MAC_KEYS global keys):
+ *
+ *   prep     dealer  -> party   : [TRUSTED-DEALER mode] key shares, sacrificed-triple material, input masks, pairwise tags
+ *            (or, in NO-DEALER mode, the OT-based offline phase of `offline-net.ts` runs here instead)
+ *   coin1-*  all-to-all         : commit/open of a random seed -> public challenges for the triple sacrifice
+ *   sac-rho  all-to-all         : value shares of rho = e*a - a-hat for every triple and sacrifice partner
+ *   sac-tau  all-to-all         : value shares of tau = e*c - c-hat - rho*b; every tau must be 0
+ *   inputs   all-to-all         : [dealer mode] owner broadcasts x - r  (r is the owner's dealer-given mask)
+ *   in-check all-to-all         : [no-dealer mode] opening of a masked random combination of the inputs
+ *   mul0..   all-to-all         : value shares of d = x-a, e = y-b for all C chains at once (n-1 rounds)
+ *   out      all-to-all         : value shares of the C output bits
+ *   <rd>.t   all-to-all         : [dealer mode] after every opening, the pairwise tags: each receiver verifies
+ *                                 the sender's opened shares IMMEDIATELY and blames the sender if one fails
+ *   coin-c/o all-to-all         : commit/open of a random seed -> public MAC-check challenges
+ *   sig-c/o  all-to-all         : commit/open of each party's MAC residual shares (one per key); sums must be 0
+ *   digest   all-to-all         : hash of the whole broadcast transcript; any disagreement aborts
+ *   blame    all-to-all         : [only after a failed MAC-check, dealer mode] every party opens its combined MAC
+ *                                 shares and key shares with their pairwise tags; each verifier checks them and
+ *                                 names the party whose data is inconsistent (or the dealer, if none is)
+ *
+ * No output is decoded until the MAC-check and the transcript echo pass. Everything else (timeouts,
+ * malformed/duplicate/out-of-order frames, disconnects, aborts) is handled by the mesh.
+ *
+ * OFFLINE MODES (the result names which one ran): `trusted-dealer` - a separate process that knows every
+ * share and key (it can break privacy and integrity if it colludes; but a dealer that gives a WRONG triple is
+ * detected by the sacrifice, and a dealer that deals inconsistent MACs is named by the blame round); and
+ * `no-dealer` - the parties derive the MAC keys, triples, authenticated inputs and pairwise tags themselves
+ * from OT.
+ *
+ * IDENTIFIABLE ABORT: in BOTH modes every share is pairwise-authenticated (`pa.ts`; dealt by the dealer, or
+ * generated by the parties from OT in `offline-net.ts`), so a party that lies about a share, a tag, a MAC share
+ * or a residual in the ONLINE phase is named by the honest verifiers with first-hand evidence. What stays
+ * unnamed: in no-dealer mode, a wrong OT operand in the offline triple products (the sacrifice detects the bad
+ * triple but its tags are consistent with it) - named only for n = 2, where the peer is the only possible
+ * culprit; and a verifier's accusation is evidence for the accuser only, never proof for a third party.
+ * Network-level misbehaviour (framing, commitments, timeouts) is attributed in both modes.
+ *
+ * HONEST LIMITS: there is no security proof for this implementation; the echo-broadcast is a hash exchange, not
+ * a Byzantine agreement protocol; the trusted dealer is trusted for privacy.
+ */
+import { type DealerFault } from '../spdz';
+import type { ComposedDecision } from '../compose';
+import type { DecisionVector } from '../party';
+import type { Mesh } from './mesh';
+export declare const T_M = 3;
+/** Thrown by the test-only `silent` behaviour; the host process then idles with its sockets open. */
+export declare class SilentParty extends Error {
+    constructor();
+}
+/** Number of independent circuit chains (= output bits = input bits per owner). */
+export declare const chainCount: (Q: number) => number;
+/** Test-only protocol-level misbehaviour for a (malicious) party. Never set in production. */
+export interface Behavior {
+    kind: 'open-lie' | 'mac-lie' | 'bad-tag' | 'sigma-lie' | 'offline-lie' | 'ot-u-lie' | 'ot-proof-lie' | 'equivocate' | 'bad-coin-open' | 'bad-sigma-open' | 'short-array' | 'noncanonical' | 'crash' | 'silent';
+    round?: string;
+}
+export interface RoundStat {
+    rd: string;
+    ms: number;
+    bytesOut: number;
+    bytesIn: number;
+}
+export interface PartyResult {
+    id: number;
+    n: number;
+    Q: number;
+    composed: ComposedDecision;
+    rounds: RoundStat[];
+    transcriptDigest: string;
+    wallMs: number;
+    multiplications: number;
+    opens: number;
+    /** Where the preprocessing came from. */
+    offlineMode: 'trusted-dealer' | 'no-dealer';
+    /** Independent global MAC keys checked (statistical soundness ~ (2/p)^keys). */
+    macKeys: number;
+    /** Triples certified by the sacrifice check (each with `sacrificePartners` independent partners). */
+    sacrificedTriples: number;
+    sacrificePartners: number;
+    /** Whether aborts in this run were identifiable by pairwise tags. */
+    identifiableAbort: boolean;
+}
+export interface DealerConfig {
+    n: number;
+    Q?: number;
+    mesh: Mesh;
+    /** Deterministic stream for reproducible tests; omit in real runs (CSPRNG). */
+    seed?: bigint;
+    /** TEST ONLY: a LYING dealer that authenticates a wrong product c = a*b + delta. */
+    fault?: DealerFault;
+    /** TEST ONLY: a dealer that deals party 0 a MAC share of input mask number `macFaultAtInput` that does not match its value. */
+    macFaultAtInput?: number;
+}
+/**
+ * The TRUSTED DEALER role: samples the MAC keys, the verification keys, sacrifice-certified authenticated
+ * triples and authenticated input masks, and ships each party only its own slice. It never sees any party's
+ * input bit (inputs are masked by r and the masked value is broadcast only among parties), but it knows every
+ * key and share, so it can break privacy/integrity if it colludes with parties. That is the stated trust
+ * assumption of this mode. A dealer that deals a wrong triple is caught by the parties' sacrifice check.
+ */
+export declare function runDealer(cfg: DealerConfig): Promise<void>;
+export interface PartyConfig {
+    id: number;
+    n: number;
+    Q?: number;
+    input: DecisionVector;
+    mesh: Mesh;
+    /** Node id of the dealer (default n). */
+    dealerId?: number;
+    /** Which offline phase to run (default `trusted-dealer`). */
+    offline?: 'trusted-dealer' | 'no-dealer';
+    /** TEST ONLY: refused unless `unsafeTestHooks` is `true`. */
+    behavior?: Behavior;
+    /** Explicit opt-in for `behavior`. Leave unset in production. */
+    unsafeTestHooks?: boolean;
+    sessionId: string;
+    /** Deadline (ms) every party has to commit to and open its forensic disclosure; shared by all parties (default 30 s). */
+    forensicDeadlineMs?: number;
+}
+export declare function runParty(cfg: PartyConfig): Promise<PartyResult>;