@atlasauth/pca-mpc 0.3.0 → 0.4.1

package/dist/net/protocol.js

@@ -0,0 +1,655 @@
+"use strict";
+/**
+ * The DISTRIBUTED malicious-with-abort (SPDZ-style) composition protocol (research prototype).
+ *
+ * Same circuit and semantics as `composeSecureMalicious` (allow = AND, t = MAX, r = MAX via
+ * thermometers; authenticated Beaver multiplication; batched MAC-check before any output), but each
+ * party is its OWN process holding ONLY its own shares, and every opening is a real message over the
+ * TLS mesh (`mesh.ts`). Rounds (n parties, C = 1 + 3 + Q independent chains, k = MAC_KEYS global keys):
+ *
+ *   prep     dealer  -> party   : [TRUSTED-DEALER mode] key shares, sacrificed-triple material, input masks, pairwise tags
+ *            (or, in NO-DEALER mode, the OT-based offline phase of `offline-net.ts` runs here instead)
+ *   coin1-*  all-to-all         : commit/open of a random seed -> public challenges for the triple sacrifice
+ *   sac-rho  all-to-all         : value shares of rho = e*a - a-hat for every triple and sacrifice partner
+ *   sac-tau  all-to-all         : value shares of tau = e*c - c-hat - rho*b; every tau must be 0
+ *   inputs   all-to-all         : [dealer mode] owner broadcasts x - r  (r is the owner's dealer-given mask)
+ *   in-check all-to-all         : [no-dealer mode] opening of a masked random combination of the inputs
+ *   mul0..   all-to-all         : value shares of d = x-a, e = y-b for all C chains at once (n-1 rounds)
+ *   out      all-to-all         : value shares of the C output bits
+ *   <rd>.t   all-to-all         : [dealer mode] after every opening, the pairwise tags: each receiver verifies
+ *                                 the sender's opened shares IMMEDIATELY and blames the sender if one fails
+ *   coin-c/o all-to-all         : commit/open of a random seed -> public MAC-check challenges
+ *   sig-c/o  all-to-all         : commit/open of each party's MAC residual shares (one per key); sums must be 0
+ *   digest   all-to-all         : hash of the whole broadcast transcript; any disagreement aborts
+ *   blame    all-to-all         : [only after a failed MAC-check, dealer mode] every party opens its combined MAC
+ *                                 shares and key shares with their pairwise tags; each verifier checks them and
+ *                                 names the party whose data is inconsistent (or the dealer, if none is)
+ *
+ * No output is decoded until the MAC-check and the transcript echo pass. Everything else (timeouts,
+ * malformed/duplicate/out-of-order frames, disconnects, aborts) is handled by the mesh.
+ *
+ * OFFLINE MODES (the result names which one ran): `trusted-dealer` - a separate process that knows every
+ * share and key (it can break privacy and integrity if it colludes; but a dealer that gives a WRONG triple is
+ * detected by the sacrifice, and a dealer that deals inconsistent MACs is named by the blame round); and
+ * `no-dealer` - the parties derive the MAC keys, triples, authenticated inputs and pairwise tags themselves
+ * from OT.
+ *
+ * IDENTIFIABLE ABORT: in BOTH modes every share is pairwise-authenticated (`pa.ts`; dealt by the dealer, or
+ * generated by the parties from OT in `offline-net.ts`), so a party that lies about a share, a tag, a MAC share
+ * or a residual in the ONLINE phase is named by the honest verifiers with first-hand evidence. What stays
+ * unnamed: in no-dealer mode, a wrong OT operand in the offline triple products (the sacrifice detects the bad
+ * triple but its tags are consistent with it) - named only for n = 2, where the peer is the only possible
+ * culprit; and a verifier's accusation is evidence for the accuser only, never proof for a third party.
+ * Network-level misbehaviour (framing, commitments, timeouts) is attributed in both modes.
+ *
+ * HONEST LIMITS: there is no security proof for this implementation; the echo-broadcast is a hash exchange, not
+ * a Byzantine agreement protocol; the trusted dealer is trusted for privacy.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chainCount = exports.SilentParty = exports.T_M = void 0;
+exports.runDealer = runDealer;
+exports.runParty = runParty;
+const node_crypto_1 = require("node:crypto");
+const field_1 = require("../field");
+const csprng_1 = require("../csprng");
+const spdz_1 = require("../spdz");
+const thermometer_1 = require("../thermometer");
+const wire_1 = require("./wire");
+const forensics_1 = require("./forensics");
+const pa_1 = require("./pa");
+const prep_1 = require("./prep");
+exports.T_M = 3;
+/** Thrown by the test-only `silent` behaviour; the host process then idles with its sockets open. */
+class SilentParty extends Error {
+    constructor() {
+        super('silent');
+        this.name = 'SilentParty';
+    }
+}
+exports.SilentParty = SilentParty;
+const DEFAULT_Q = 100;
+/** Number of independent circuit chains (= output bits = input bits per owner). */
+const chainCount = (Q) => 1 + exports.T_M + Q;
+exports.chainCount = chainCount;
+/** Shared helper: canonical numbers per party in a dealer `prep` frame. */
+function prepLayout(n, C, keys, partners, tagged) {
+    const aw = (0, pa_1.awWidth)(n, keys, tagged);
+    const triples = (n - 1) * C;
+    const inputs = n * C;
+    const nums = (tagged ? 1 : 0) + keys * (0, pa_1.paWidth)(n, tagged) + triples * (0, prep_1.sharingsPerTriple)(partners) * aw + inputs * aw + C;
+    return { nums, triples, inputs };
+}
+/** Hex numbers per `prep` frame (keeps every frame far below the frame cap). */
+const PREP_CHUNK = 30_000;
+/**
+ * The TRUSTED DEALER role: samples the MAC keys, the verification keys, sacrifice-certified authenticated
+ * triples and authenticated input masks, and ships each party only its own slice. It never sees any party's
+ * input bit (inputs are masked by r and the masked value is broadcast only among parties), but it knows every
+ * key and share, so it can break privacy/integrity if it colludes with parties. That is the stated trust
+ * assumption of this mode. A dealer that deals a wrong triple is caught by the parties' sacrifice check.
+ */
+async function runDealer(cfg) {
+    const { n, mesh } = cfg;
+    const Q = cfg.Q ?? DEFAULT_Q;
+    const rng = cfg.seed !== undefined ? new field_1.FieldRng(cfg.seed) : new csprng_1.SecureFieldRng();
+    const C = (0, exports.chainCount)(Q);
+    const ctx = (0, spdz_1.setupMac)(n, rng, spdz_1.MAC_KEYS);
+    const keys = (0, spdz_1.macKeys)(ctx);
+    const deltas = Array.from({ length: n }, () => {
+        let d = rng.next();
+        while (d === 0n)
+            d = rng.next();
+        return d;
+    });
+    /** Deal the pairwise tags/keys for one sharing x_0..x_{n-1}: T_ij = K_ij + Δ_j·x_i. */
+    const dealPA = (x) => {
+        const K = x.map((_, i) => x.map((__, j) => (i === j ? 0n : rng.next())));
+        return x.map((xi, p) => ({
+            x: xi,
+            tag: x.map((_, j) => (j === p ? 0n : (0, field_1.fadd)(K[p][j], (0, field_1.fmul)(deltas[j], xi)))),
+            key: x.map((_, j) => (j === p ? 0n : K[j][p])),
+        }));
+    };
+    const dealAW = (sv) => {
+        const comps = [sv.value, sv.mac, ...sv.extraMac].map(dealPA);
+        return Array.from({ length: n }, (_, p) => ({ v: comps[0][p], m: comps.slice(1).map((c) => c[p]) }));
+    };
+    const perParty = Array.from({ length: n }, (_, p) => [deltas[p]]);
+    const alphaPA = keys.map((k) => dealPA(k.alphaShares));
+    for (let p = 0; p < n; p++)
+        for (const a of alphaPA)
+            perParty[p].push(...(0, pa_1.paFlat)(a[p], p, n, true));
+    const nTriples = (n - 1) * C;
+    for (let t = 0; t < nTriples; t++) {
+        const tr = (0, spdz_1.genTripleWithPartners)(ctx, rng, spdz_1.SACRIFICE_PARTNERS, cfg.fault);
+        const sharings = [tr.keep.a, tr.keep.b, tr.keep.c, ...tr.partners.flatMap((q) => [q.a, q.c])];
+        for (const sv of sharings) {
+            const aws = dealAW(sv);
+            for (let p = 0; p < n; p++)
+                perParty[p].push(...(0, pa_1.awFlat)(aws[p], p, n, true));
+        }
+    }
+    const masksByOwner = Array.from({ length: n }, () => []);
+    for (let q = 0; q < n * C; q++) {
+        const owner = Math.floor(q / C);
+        const r = rng.next();
+        masksByOwner[owner].push(r);
+        const sv = (0, spdz_1.authShare)(r, ctx, rng);
+        if (cfg.macFaultAtInput === q)
+            sv.mac[0] = (0, field_1.fadd)(sv.mac[0], 1n);
+        const aws = dealAW(sv);
+        for (let p = 0; p < n; p++)
+            perParty[p].push(...(0, pa_1.awFlat)(aws[p], p, n, true));
+    }
+    for (let p = 0; p < n; p++)
+        perParty[p].push(...masksByOwner[p]);
+    for (let p = 0; p < n; p++) {
+        const nums = perParty[p].map(wire_1.hx);
+        const chunks = Math.max(1, Math.ceil(nums.length / PREP_CHUNK));
+        mesh.send(p, 'prep', { total: nums.length, chunks, nums: nums.slice(0, PREP_CHUNK) });
+        for (let c = 1; c < chunks; c++)
+            mesh.send(p, `prep.${c}`, nums.slice(c * PREP_CHUNK, (c + 1) * PREP_CHUNK));
+    }
+    await mesh.finish();
+}
+const sha = (...parts) => {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const p of parts) {
+        h.update(typeof p === 'string' ? Buffer.from(p) : p);
+        h.update(Buffer.from([0]));
+    }
+    return h.digest();
+};
+/** Uniform non-zero field element `j` of the public challenge stream `label` derived from `seed` (rejection on p). */
+function challenge(seed, label, j) {
+    for (let ctr = 0;; ctr++) {
+        const h = sha('chal', seed, `${label}:${j}:${ctr}`);
+        const x = h.readBigUInt64BE(0) & ((1n << 61n) - 1n);
+        if (x < field_1.PRIME && x !== 0n)
+            return x;
+    }
+}
+async function runParty(cfg) {
+    const { id, n, mesh, sessionId } = cfg;
+    const Q = cfg.Q ?? DEFAULT_Q;
+    const dealerId = cfg.dealerId ?? n;
+    const offlineMode = cfg.offline ?? 'trusted-dealer';
+    const C = (0, exports.chainCount)(Q);
+    const K = spdz_1.MAC_KEYS;
+    const P = spdz_1.SACRIFICE_PARTNERS;
+    if (cfg.behavior && cfg.unsafeTestHooks !== true) {
+        throw new wire_1.NetAbort('local', null, id, 'the behavior test hook requires unsafeTestHooks: true (test-only)');
+    }
+    const beh = cfg.behavior;
+    const t0 = performance.now();
+    const rounds = [];
+    const transcript = (0, node_crypto_1.createHash)('sha256');
+    const others = [];
+    for (let i = 0; i < n; i++)
+        if (i !== id)
+            others.push(i);
+    if (!Number.isInteger(n) || n < 1)
+        throw new wire_1.NetAbort('local', null, id, 'n must be >= 1');
+    const v = cfg.input;
+    if (![0, 1].includes(v.allow) || ![1, 2, 3].includes(v.t) || !Number.isInteger(v.rQuant) || v.rQuant < 0 || v.rQuant > Q) {
+        throw new wire_1.NetAbort('local', null, id, 'invalid decision vector');
+    }
+    const totals = () => {
+        let o = 0;
+        let i = 0;
+        for (const s of mesh.stats()) {
+            o += s.appBytesOut;
+            i += s.appBytesIn;
+        }
+        return { out: o, in: i };
+    };
+    const crashIf = (rd) => {
+        if (beh?.kind === 'crash' && beh.round === rd)
+            process.exit(7);
+        if (beh?.kind === 'silent' && beh.round === rd)
+            throw new SilentParty();
+    };
+    /**
+     * One all-to-all round among the parties: send `mine(peer)` to each peer, collect + validate theirs.
+     * `hashed = false` keeps a round (the peer-specific pairwise tags) out of the echoed transcript.
+     */
+    async function exchange(rd, mine, parse, common, hashed = true, timeoutMs) {
+        crashIf(rd);
+        const a = totals();
+        const s = performance.now();
+        for (const p of others)
+            mesh.send(p, rd, mine(p));
+        const raw = await mesh.collect(rd, others, timeoutMs);
+        const parsed = new Map();
+        for (const p of others) {
+            try {
+                parsed.set(p, parse(p, raw.get(p)));
+            }
+            catch (e) {
+                if (e instanceof wire_1.NetAbort) {
+                    mesh.fail(e);
+                    throw e;
+                }
+                const ne = new wire_1.NetAbort('malformed', p, id, `round '${rd}': ${e.message}`);
+                mesh.fail(ne);
+                throw ne;
+            }
+        }
+        if (hashed) {
+            // transcript: party order, canonical JSON of what each party broadcast in this round
+            transcript.update(rd);
+            for (let p = 0; p < n; p++) {
+                transcript.update(`|${p}:`);
+                transcript.update(JSON.stringify(p === id ? common : raw.get(p)));
+            }
+        }
+        const b = totals();
+        rounds.push({ rd, ms: performance.now() - s, bytesOut: b.out - a.out, bytesIn: b.in - a.in });
+        return parsed;
+    }
+    const bad = (p, what) => {
+        throw new wire_1.NetAbort('malformed', p, id, what);
+    };
+    const arr = (p, raw, len) => (0, wire_1.unhxArray)(raw, len) ?? bad(p, `expected ${len} canonical field elements`);
+    const abort = (e) => {
+        mesh.fail(e);
+        throw e;
+    };
+    // ---- offline phase: prep from the trusted dealer, or the OT-based no-dealer phase ----
+    let prep;
+    crashIf('prep');
+    const prepStart = performance.now();
+    const before = totals();
+    if (offlineMode === 'trusted-dealer') {
+        prep = await receiveDealerPrep();
+    }
+    else {
+        const { runOfflineNet } = await Promise.resolve().then(() => __importStar(require('./offline-net')));
+        prep = await runOfflineNet({ mesh, id, n, C, keys: K, partners: P, sessionId, input: v, Q, behavior: beh, exchange: (rd, mine, parse) => exchange(rd, mine, parse, null, false), crashIf, bad, arr });
+    }
+    const afterPrep = totals();
+    rounds.push({ rd: 'prep', ms: performance.now() - prepStart, bytesOut: afterPrep.out - before.out, bytesIn: afterPrep.in - before.in });
+    async function receiveDealerPrep() {
+        const lay = prepLayout(n, C, K, P, true);
+        const first = (await mesh.recv(dealerId, 'prep'));
+        let nums = [];
+        try {
+            if (typeof first?.total !== 'number' || first.total !== lay.nums)
+                bad(dealerId, 'bad prep size');
+            if (typeof first?.chunks !== 'number' || first.chunks !== Math.max(1, Math.ceil(lay.nums / PREP_CHUNK)))
+                bad(dealerId, 'bad prep chunk count');
+            const take = (raw, len) => (0, wire_1.unhxArray)(raw, len) ?? bad(dealerId, 'bad prep numbers');
+            nums = take(first?.nums, Math.min(PREP_CHUNK, lay.nums));
+            for (let c = 1; c < first?.chunks; c++) {
+                const part = (await mesh.recv(dealerId, `prep.${c}`));
+                nums = nums.concat(take(part, Math.min(PREP_CHUNK, lay.nums - c * PREP_CHUNK)));
+            }
+        }
+        catch (e) {
+            const ne = e instanceof wire_1.NetAbort ? e : new wire_1.NetAbort('malformed', dealerId, id, e.message);
+            return abort(ne);
+        }
+        let o = 0;
+        const delta = nums[o++];
+        if (delta === 0n)
+            return abort(new wire_1.NetAbort('dealer', dealerId, id, 'the dealer gave me a zero verification key'));
+        const w = (0, pa_1.paWidth)(n, true);
+        const alpha = [];
+        for (let l = 0; l < K; l++) {
+            alpha.push((0, pa_1.paParse)(nums, o, id, n, true));
+            o += w;
+        }
+        const aw = (0, pa_1.awWidth)(n, K, true);
+        const triples = [];
+        for (let t = 0; t < lay.triples; t++) {
+            const sh = [];
+            for (let s = 0; s < (0, prep_1.sharingsPerTriple)(P); s++) {
+                sh.push((0, pa_1.awParse)(nums, o, id, n, K, true));
+                o += aw;
+            }
+            triples.push(sh);
+        }
+        const inputs = [];
+        for (let q = 0; q < lay.inputs; q++) {
+            inputs.push((0, pa_1.awParse)(nums, o, id, n, K, true));
+            o += aw;
+        }
+        const myPlain = nums.slice(o, o + C);
+        return { mode: 'trusted-dealer', tagged: true, delta, alpha, triples, inputs, myPlain };
+    }
+    const env = { id, n, delta: prep.delta, tagged: prep.tagged };
+    const addPub = (x, c) => (0, pa_1.wAddPublic)(env, x, c, prep.alpha);
+    const not = (x) => addPub((0, pa_1.wNeg)(x), 1n);
+    // ---- retained for the MAC-check / blame: every opened value, with my MAC shares at that opening ----
+    const opened = [];
+    /** Open authenticated values: broadcast value shares, verify pairwise tags (dealer mode), record for the MAC-check. */
+    async function openMany(rd, ws) {
+        let sendVals = ws.map((x) => x.v.x);
+        const macs = ws.map((x) => x.m);
+        if (beh?.round === rd) {
+            if (beh.kind === 'open-lie')
+                sendVals = sendVals.map((x, i) => (i === 0 ? (0, field_1.fadd)(x, 1n) : x));
+            if (beh.kind === 'mac-lie')
+                macs[0] = macs[0].map((pa, l) => (l === 0 ? { ...pa, x: (0, field_1.fadd)(pa.x, 1n) } : pa));
+        }
+        const common = sendVals.map(wire_1.hx);
+        const mineFn = (peer) => {
+            if (beh?.kind === 'equivocate' && beh.round === rd && peer === others[0]) {
+                return common.map((s, i) => (i === 0 ? (0, wire_1.hx)((0, field_1.fadd)(BigInt('0x' + s), 1n)) : s));
+            }
+            if (beh?.kind === 'short-array' && beh.round === rd)
+                return common.slice(1);
+            if (beh?.kind === 'noncanonical' && beh.round === rd)
+                return common.map((s, i) => (i === 0 ? (0, wire_1.hx)(field_1.PRIME) : s));
+            return common;
+        };
+        const got = await exchange(rd, mineFn, (p, raw) => arr(p, raw, ws.length), common);
+        if (prep.tagged) {
+            // pairwise tags: peer-specific, so a separate un-echoed round; each receiver verifies at once
+            const tagMsg = (peer) => ws.map((x, i) => (0, wire_1.hx)(beh?.kind === 'bad-tag' && beh.round === rd && i === 0 ? (0, field_1.fadd)(x.v.tag[peer], 1n) : x.v.tag[peer]));
+            const tags = await exchange(`${rd}.t`, tagMsg, (p, raw) => arr(p, raw, ws.length), null, false);
+            for (const p of others) {
+                for (let i = 0; i < ws.length; i++) {
+                    if (!(0, pa_1.paVerify)(env, ws[i].v, p, got.get(p)[i], tags.get(p)[i])) {
+                        return abort(new wire_1.NetAbort('mac-check', p, id, `pairwise MAC on party ${p}'s opened share failed in round '${rd}' (index ${i}): the share or its tag is not what the dealer issued`));
+                    }
+                }
+            }
+        }
+        const out = [];
+        for (let i = 0; i < ws.length; i++) {
+            let sum = sendVals[i];
+            for (const p of others)
+                sum = (0, field_1.fadd)(sum, got.get(p)[i]);
+            out.push(sum);
+            opened.push({ val: sum, mac: macs[i] });
+        }
+        return out;
+    }
+    // ---- coin flip (commit / open of a random seed) -> a joint public seed ----
+    async function coin(label, tamperOpen) {
+        const mySeed = (0, node_crypto_1.randomBytes)(32);
+        const seedCommit = sha('seed', sessionId, label, String(id), mySeed).toString('hex');
+        const seedCommits = await exchange(`${label}-c`, () => seedCommit, (p, raw) => (typeof raw === 'string' && /^[0-9a-f]{64}$/.test(raw) ? raw : bad(p, 'bad commitment')), seedCommit);
+        const openSeedMsg = () => (tamperOpen && beh?.kind === 'bad-coin-open' ? (0, node_crypto_1.randomBytes)(32).toString('hex') : mySeed.toString('hex'));
+        const seeds = await exchange(`${label}-o`, openSeedMsg, (p, raw) => {
+            if (typeof raw !== 'string' || !/^[0-9a-f]{64}$/.test(raw))
+                return bad(p, 'bad seed');
+            const sd = Buffer.from(raw, 'hex');
+            if (sha('seed', sessionId, label, String(p), sd).toString('hex') !== seedCommits.get(p)) {
+                throw new wire_1.NetAbort('commitment', p, id, `party ${p} opened a coin seed that does not match its commitment`);
+            }
+            return sd;
+        }, mySeed.toString('hex'));
+        return sha('joint', sessionId, label, ...Array.from({ length: n }, (_, p) => (p === id ? mySeed : seeds.get(p))));
+    }
+    // ---- sacrifice: certify every triple against its partners before it is used ----
+    const nT = prep.triples.length;
+    if (nT > 0) {
+        const joint1 = await coin('coin1', false);
+        const rhoW = [];
+        const idx = (t, r) => t * P + r;
+        for (let t = 0; t < nT; t++) {
+            const [a, , , ...parts] = prep.triples[t];
+            for (let r = 0; r < P; r++) {
+                const e = challenge(joint1, 'sac', idx(t, r));
+                rhoW.push((0, pa_1.wSub)((0, pa_1.wScale)(a, e), parts[2 * r]));
+            }
+        }
+        const rho = await openMany('sac-rho', rhoW);
+        const tauW = [];
+        for (let t = 0; t < nT; t++) {
+            const [, b, c, ...parts] = prep.triples[t];
+            for (let r = 0; r < P; r++) {
+                const e = challenge(joint1, 'sac', idx(t, r));
+                tauW.push((0, pa_1.wSub)((0, pa_1.wSub)((0, pa_1.wScale)(c, e), parts[2 * r + 1]), (0, pa_1.wScale)(b, rho[idx(t, r)])));
+            }
+        }
+        const tau = await openMany('sac-tau', tauW);
+        const badAt = tau.findIndex((x) => x !== 0n);
+        if (badAt >= 0) {
+            // Dealer-free mode: the triple is discarded, so its OT transcript can be disclosed and audited to name a party
+            // that fed a wrong operand into a triple product (forensics.ts). Every honest party reaches this point together.
+            let attributed = null;
+            let note = '';
+            const fx = prep.mode === 'no-dealer' ? prep.forensics : undefined;
+            if (fx) {
+                const bt = Math.floor(badAt / P);
+                const mine = fx.disclose(bt);
+                // R3-17: commit first, open only once every commitment is in hand (forensics.ts); a late or absent party times out at the shared deadline.
+                const got = await (0, forensics_1.exchangeDisclosures)({
+                    sessionId,
+                    id,
+                    n,
+                    tripleIndex: bt,
+                    mine,
+                    slots: fx.slots,
+                    rows: fx.rows,
+                    deadlineMs: cfg.forensicDeadlineMs ?? forensics_1.DEFAULT_FORENSIC_DEADLINE_MS,
+                    exchange: (rd, m, parse, t) => exchange(rd, m, parse, null, false, t),
+                    bad: (p, what) => bad(p, what),
+                });
+                const all = new Map([[id, mine]]);
+                for (const [p, d] of got)
+                    all.set(p, d);
+                const res = (0, forensics_1.auditDisclosures)(all, fx.gadget);
+                attributed = (0, forensics_1.blameFrom)(id, res);
+                note =
+                    attributed === null
+                        ? ` (OT transcript audit: ${res.pairBad.length} inconsistent pair(s), no party can be named from this view: a pair failure between two other parties is not evidence against either of them to me)`
+                        : ` (OT transcript audit names party ${attributed})`;
+            }
+            // every honest tag already verified, so the opened tau are the true ones: the dealt triple is wrong.
+            return abort(new wire_1.NetAbort(prep.mode === 'trusted-dealer' ? 'dealer' : 'mac-check', prep.mode === 'trusted-dealer' ? dealerId : (attributed ?? (n === 2 ? 1 - id : null)), id, `triple sacrifice FAILED at triple ${Math.floor(badAt / P)} (partner ${badAt % P}): c != a*b in the offline material; aborting with no output${note}`, undefined, undefined, { reason: 'the triple sacrifice failed in dealer-free mode and the OT transcript audit of this party\'s own view names no one (a failing pair that does not involve me is not evidence I can use, and an accusation is never accepted against a third party)' }));
+        }
+    }
+    // ---- inputs: bit k of owner o is the C-vector [allow, t-therm(3), r-therm(Q)] ----
+    const myBits = [v.allow, ...(0, thermometer_1.thermometerEncode)(v.t, exports.T_M), ...(0, thermometer_1.thermometerEncode)(v.rQuant, Q)];
+    let bitShare;
+    if (prep.mode === 'trusted-dealer') {
+        const masked = myBits.map((b, k) => (0, field_1.fsub)(BigInt(b), prep.myPlain[k]));
+        const maskedMsg = masked.map(wire_1.hx);
+        const gotMasked = await exchange('inputs', () => maskedMsg, (p, raw) => arr(p, raw, C), maskedMsg);
+        bitShare = (owner, k) => {
+            const pub = owner === id ? masked[k] : gotMasked.get(owner)[k];
+            return addPub(prep.inputs[owner * C + k], pub);
+        };
+    }
+    else {
+        // No-dealer: the inputs are already authenticated sharings of the bits. Run the MASCOT input-consistency
+        // check: open a random masked combination (the opening joins the batched MAC-check below).
+        bitShare = (owner, k) => prep.inputs[owner * C + k];
+        const jointIn = await coin('coin-in', false);
+        let w = prep.checkMask;
+        for (let q = 0; q < n * C; q++)
+            w = (0, pa_1.wAdd)(w, (0, pa_1.wScale)(prep.inputs[q], challenge(jointIn, 'in', q)));
+        await openMany('in-check', [w]);
+    }
+    // ---- chains: acc_c over owners; allow uses AND, others OR(=NOT AND NOT) ----
+    const isOr = (c) => c !== 0;
+    let acc = [];
+    for (let c = 0; c < C; c++) {
+        const b0 = bitShare(0, c);
+        acc.push(isOr(c) ? not(b0) : b0);
+    }
+    let mults = 0;
+    for (let s = 1; s < n; s++) {
+        const trs = Array.from({ length: C }, (_, c) => prep.triples[(s - 1) * C + c]);
+        const ys = Array.from({ length: C }, (_, c) => {
+            const b = bitShare(s, c);
+            return isOr(c) ? not(b) : b;
+        });
+        const ds = acc.map((x, c) => (0, pa_1.wSub)(x, trs[c][0]));
+        const es = ys.map((y, c) => (0, pa_1.wSub)(y, trs[c][1]));
+        const pub = await openMany(`mul${s - 1}`, [...ds, ...es]);
+        acc = acc.map((_, c) => {
+            const d = pub[c];
+            const e = pub[C + c];
+            const [ta, tb, tc] = trs[c];
+            let z = (0, pa_1.wAdd)(tc, (0, pa_1.wAdd)((0, pa_1.wScale)(tb, d), (0, pa_1.wScale)(ta, e)));
+            z = addPub(z, (0, field_1.fmul)(d, e));
+            return z;
+        });
+        mults += C;
+    }
+    // ---- outputs: allow as-is; or-chains are NOT of the product ----
+    const outShares = acc.map((x, c) => (isOr(c) ? not(x) : x));
+    const outVals = await openMany('out', outShares);
+    // ---- MAC-check: coin-flip for the challenges, one independent challenge vector per key ----
+    const joint = await coin('coin', true);
+    const chal = (l, j) => challenge(joint, `mac${l}`, j);
+    const aPub = [];
+    for (let l = 0; l < K; l++) {
+        let a = 0n;
+        opened.forEach((o, j) => {
+            a = (0, field_1.fadd)(a, (0, field_1.fmul)(chal(l, j), o.val));
+        });
+        aPub.push(a);
+    }
+    const gammaOf = (l) => {
+        let g = 0n;
+        opened.forEach((o, j) => {
+            g = (0, field_1.fadd)(g, (0, field_1.fmul)(chal(l, j), o.mac[l].x));
+        });
+        return g;
+    };
+    const Gamma = Array.from({ length: K }, (_, l) => gammaOf(l));
+    const sigma = Gamma.map((g, l) => (0, field_1.fsub)(g, (0, field_1.fmul)(prep.alpha[l].x, aPub[l])));
+    const sigNonce = (0, node_crypto_1.randomBytes)(32);
+    const sigCommit = (p, s, nonce) => sha('sigma', sessionId, String(p), s.map(wire_1.hx).join(','), nonce).toString('hex');
+    const sigmaSent = beh?.kind === 'sigma-lie' ? sigma.map((s, l) => (l === 0 ? (0, field_1.fadd)(s, 1n) : s)) : sigma;
+    const mySigCommit = sigCommit(id, sigmaSent, sigNonce);
+    const sigCommits = await exchange('sig-c', () => mySigCommit, (p, raw) => (typeof raw === 'string' && /^[0-9a-f]{64}$/.test(raw) ? raw : bad(p, 'bad commitment')), mySigCommit);
+    const mySigOpen = { s: sigmaSent.map(wire_1.hx), nonce: sigNonce.toString('hex') };
+    const sigOpens = await exchange('sig-o', () => (beh?.kind === 'bad-sigma-open' ? { s: sigmaSent.map((s, l) => (0, wire_1.hx)(l === 0 ? (0, field_1.fadd)(s, 1n) : s)), nonce: mySigOpen.nonce } : mySigOpen), (p, raw) => {
+        const o = raw;
+        const sv = (0, wire_1.unhxArray)(o?.s, K);
+        if (sv === null || typeof o?.nonce !== 'string' || !/^[0-9a-f]{64}$/.test(o.nonce))
+            return bad(p, 'bad sigma opening');
+        if (sigCommit(p, sv, Buffer.from(o.nonce, 'hex')) !== sigCommits.get(p)) {
+            throw new wire_1.NetAbort('commitment', p, id, `party ${p} opened a MAC residual that does not match its commitment`);
+        }
+        return sv;
+    }, mySigOpen);
+    const residual = Array.from({ length: K }, (_, l) => {
+        let r = sigmaSent[l];
+        for (const p of others)
+            r = (0, field_1.fadd)(r, sigOpens.get(p)[l]);
+        return r;
+    });
+    const macFailed = residual.some((r) => r !== 0n);
+    // ---- transcript echo: everyone must have seen the same broadcasts (also fixes the sigma data for the blame) ----
+    const digest = transcript.copy().digest('hex');
+    const digests = await exchange('digest', () => digest, (p, raw) => (typeof raw === 'string' && /^[0-9a-f]{64}$/.test(raw) ? raw : bad(p, 'bad digest')), digest);
+    for (const p of others) {
+        if (digests.get(p) !== digest) {
+            return abort(new wire_1.NetAbort('equivocation', p, id, `transcript digest of party ${p} differs from mine (a broadcast was inconsistent)`));
+        }
+    }
+    if (macFailed) {
+        const msg = 'MAC-check FAILED: an opened value or MAC share was inconsistent; aborting with no output';
+        if (!prep.tagged) {
+            // No pairwise tags in this mode: the evidence cannot name a party, except in the two-party case.
+            return abort(new wire_1.NetAbort('mac-check', n === 2 ? 1 - id : null, id, msg, undefined, undefined, { reason: 'this mode carries no pairwise tags, so a MAC-check failure cannot name a party (only possible with two parties)' }));
+        }
+        // ---- blame: every party opens its combined MAC shares with their pairwise tags; each verifier checks them ----
+        const combo = (l, pick) => {
+            let g = 0n;
+            opened.forEach((o, j) => {
+                g = (0, field_1.fadd)(g, (0, field_1.fmul)(chal(l, j), pick(o)));
+            });
+            return g;
+        };
+        const blameMsg = (peer) => ({
+            g: Gamma.map(wire_1.hx),
+            gt: Array.from({ length: K }, (_, l) => (0, wire_1.hx)(combo(l, (o) => o.mac[l].tag[peer]))),
+            a: prep.alpha.map((a) => (0, wire_1.hx)(a.x)),
+            at: prep.alpha.map((a) => (0, wire_1.hx)(a.tag[peer])),
+        });
+        const blames = await exchange('blame', blameMsg, (p, raw) => {
+            const o = raw;
+            return { g: arr(p, o?.g, K), gt: arr(p, o?.gt, K), a: arr(p, o?.a, K), at: arr(p, o?.at, K) };
+        }, null, false);
+        for (const p of others) {
+            const b = blames.get(p);
+            for (let l = 0; l < K; l++) {
+                const keyCombo = combo(l, (o) => o.mac[l].key[p]);
+                if ((0, field_1.fadd)(keyCombo, (0, field_1.fmul)(env.delta, b.g[l])) !== b.gt[l]) {
+                    return abort(new wire_1.NetAbort('mac-check', p, id, `${msg} - party ${p}'s MAC share (key ${l}) does not match its pairwise tag`));
+                }
+                if ((0, field_1.fadd)(prep.alpha[l].key[p], (0, field_1.fmul)(env.delta, b.a[l])) !== b.at[l]) {
+                    return abort(new wire_1.NetAbort('mac-check', p, id, `${msg} - party ${p}'s key share (key ${l}) does not match its pairwise tag`));
+                }
+                if ((0, field_1.fsub)(b.g[l], (0, field_1.fmul)(b.a[l], aPub[l])) !== sigOpens.get(p)[l]) {
+                    return abort(new wire_1.NetAbort('mac-check', p, id, `${msg} - party ${p}'s opened MAC residual (key ${l}) is not what its authenticated shares give`));
+                }
+            }
+        }
+        // Every other party's data is consistent with its pairwise tags; so is mine: the offline material disagrees.
+        if (prep.mode === 'trusted-dealer') {
+            return abort(new wire_1.NetAbort('dealer', dealerId, id, `${msg} - every party's shares verify, so the trusted dealer's MACs are inconsistent with its values`));
+        }
+        return abort(new wire_1.NetAbort('mac-check', n === 2 ? 1 - id : null, id, `${msg} - every party's shares verify under its pairwise tags, so the offline material is inconsistent (a wrong OT operand): not attributable`, undefined, undefined, { reason: 'every party\'s shares verify under its pairwise tags, so the failure is in the offline OT material and no party can be named' }));
+    }
+    // ---- only now decode ----
+    const bit = (x) => (x === 1n ? 1 : 0);
+    const allow = bit(outVals[0]);
+    const tBits = outVals.slice(1, 1 + exports.T_M).map(bit);
+    const rBits = outVals.slice(1 + exports.T_M).map(bit);
+    const composed = {
+        allow,
+        t: Math.min(3, Math.max(1, (0, thermometer_1.thermometerDecode)(tBits))),
+        rQuant: (0, thermometer_1.thermometerDecode)(rBits),
+    };
+    await mesh.finish();
+    return {
+        id,
+        n,
+        Q,
+        composed,
+        rounds,
+        transcriptDigest: digest,
+        wallMs: performance.now() - t0,
+        multiplications: mults,
+        opens: opened.length,
+        offlineMode: prep.mode,
+        macKeys: K,
+        sacrificedTriples: nT,
+        sacrificePartners: P,
+        identifiableAbort: prep.tagged,
+    };
+}
+//# sourceMappingURL=protocol.js.map