@atlasauth/pca-mpc 0.3.0 → 0.4.1

package/dist/ot.d.ts

@@ -47,7 +47,14 @@
  *     random weights `χ_j ∈ GF(2^κ)` (one per row, bound to `u` by a Fiat–Shamir hash here), the
  *     receiver reveals `x = Σ_j b_j·χ_j` and `t = Σ_j χ_j·t_j`, and the sender checks
  *     `Σ_j χ_j·q_j == t ⊕ x·s` in GF(2^κ). Honestly this always holds (`q_j = t_j ⊕ b_j·s`); a receiver
- *     who deviated in `u` satisfies it with probability ≤ `2^{-κ} = 2^{-128}`, so a deviation ABORTS.
+ *     who deviated in `u` is caught, so a deviation ABORTS. The honest statement of the bound is the KOS
+ *     STATISTICAL parameter `s = SSEC = 128`, NOT `2^{-κ}`: a receiver that deviates in a few columns passes by
+ *     guessing the matching bits of the selector `s`, and the 2015 proof (ePrint 2015/546) was additionally shown
+ *     to rest on an incorrect lemma (Roy, CRYPTO 2022). Roy's attacks give the receiver success
+ *     about `2^{-s}` with `s` extra rows, and the KOS proof is still open (Roy leaves a sound proof to future work), so
+ *     this module sets `s = SSEC = 128` extra rows (was 64): the best KNOWN attack then succeeds with probability about
+ *     `2^{-128}`. That is an argument from the attack analysis, NOT a proof; we did not implement SoftSpokenOT's own
+ *     (different, small-field VOLE) consistency check, whose parameters we could not verify from the paper.
  *     The check is run over `m + κ + SSEC` rows — the extra `κ + SSEC` random "sacrifice" OT rows mask
  *     the revealed combination (receiver privacy) and give statistical soundness. This makes the OT
  *     extension **malicious-secure**, not just semi-honest.
@@ -64,9 +71,12 @@ export declare const KAPPA = 128;
 /**
  * KOS statistical-security parameter: the number of EXTRA random check-OT rows (beyond the `κ` that
  * mask the revealed combination) appended to every extension round. Together `κ + SSEC` padding rows
- * give the correlation check its receiver-privacy and statistical soundness margin.
+ * give the correlation check its receiver-privacy and statistical soundness margin. Roy (CRYPTO 2022, ePrint
+ * 2022/192) shows the KOS proof is flawed and that the attacks succeed with probability about 2^-s for `s` extra
+ * rows; `s = 128` (raised from 64, a WIRE CHANGE: the matrix has 64 more rows per round) makes the best known attack
+ * about 2^-128. Not a proof.
  */
-export declare const SSEC = 64;
+export declare const SSEC = 128;
 /** Raised when the KOS correlation check fails: a cheating OT-extension receiver is detected → ABORT. */
 export declare class MalOtAbort extends Error {
     constructor(message: string);
@@ -82,6 +92,47 @@ export interface OtRandom {
 export declare function splitMix64(seed: bigint): () => bigint;
 /** Build an OtRandom from a SplitMix64-style 64-bit stream (deterministic; CSPRNG in production). */
 export declare function otRandom(next64: () => bigint): OtRandom;
+/**
+ * Session binding of one base OT: who runs it, in which session and round. It is folded into the sender's
+ * Schnorr challenge AND into every pad, so neither a proof nor a pad carries over to another session,
+ * party pair or round. `senderIndex` is the base-OT SENDER (the party that publishes S).
+ */
+export interface BaseOtBinding {
+    /** 8..64 bytes, unique per session (the network runner uses its session id). */
+    sessionId: Uint8Array;
+    senderIndex: number;
+    receiverIndex: number;
+    /** Non-empty label of the protocol round / use, at most 64 bytes. */
+    round: string;
+}
+/** Canonical, length-prefixed encoding of a binding (the Schnorr context and part of every KDF input). */
+export declare function bindingBytes(b: BaseOtBinding): Uint8Array;
+/** A fresh binding for an in-process OT (both roles simulated): random session id from `rng`. */
+export declare function randomBinding(rng: OtRandom, round: string, senderIndex?: number, receiverIndex?: number): BaseOtBinding;
+/**
+ * Hash of the WHOLE base-OT transcript: binding, the sender's S and every receiver point R_i, in order.
+ * Every pad is derived under this hash, so changing the session, S or ANY R_j changes EVERY key.
+ */
+export declare function baseOtTranscriptHash(binding: BaseOtBinding, S: Point, R: readonly Point[]): Uint8Array;
+/**
+ * Key derivation from a group point, Chou–Orlandi / Simplest-OT style but over the full transcript:
+ * `H("ot-kdf" ‖ H(transcript) ‖ index ‖ R_i ‖ P)` → SEED_BYTES bytes.
+ */
+export declare function baseOtKdf(transcriptHash: Uint8Array, index: number, Ri: Point, p: Point): Uint8Array;
+/**
+ * Derive the KOS row-weights χ_j ∈ GF(2^128) for one extension round (Fiat–Shamir). The sender and
+ * receiver both derive the SAME χ from the FULL `u` matrix on the wire, so a cheating receiver cannot
+ * pick `u` after seeing χ. In the real protocol χ comes from a secure coin-flip after the receiver
+ * commits to `u`; the transcript hash here models that round.
+ *
+ * The weights are the output of SHAKE256 (an extendable-output function, `node:crypto`) over
+ * `TAG ‖ channel binding ‖ round ‖ mExt ‖ every bit of every column of u`, 16 bytes per row — a vetted
+ * XOF seeded by the whole transcript, not a fast non-cryptographic stream. (An earlier version expanded a
+ * 128-bit digest with SplitMix64, and hashed only the low 128 bits of each column; both are gone.)
+ */
+export declare function kosChallenges(binding: Uint8Array, round: number, u: bigint[], mExt: number): bigint[];
+/** The same weights as little-endian u32 words (4 per row), the form the typed kernels consume. */
+export declare function kosChiWords(binding: Uint8Array, round: number, u: bigint[], mExt: number, colBytesList?: Uint8Array[]): Uint32Array;
 /** Raised when a base OT aborts: a cheating sender (bad proof / inconsistent ciphertext) is detected. */
 export declare class BaseOtAbort extends Error {
     constructor(message: string);
@@ -149,7 +200,36 @@ export interface MalRandomOtResult {
  * No messages are transferred — the pads ARE the random output. `tamper` injects malicious behaviour
  * for tests. Both parties are simulated in-process.
  */
-export declare function malBaseRandomOT(choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): MalRandomOtResult;
+export declare function malBaseRandomOT(choices: number[], rng?: OtRandom, tamper?: BaseOtTamper, binding?: BaseOtBinding): MalRandomOtResult;
+/** SENDER step 1: S = y·B, T = y·S, and a Schnorr proof of knowledge of y. `y`/`T` stay sender-local. */
+export declare function malBaseOtSenderSetup(rng: OtRandom, binding: BaseOtBinding): {
+    y: bigint;
+    T: Point;
+    S: Point;
+    proof: SchnorrProof;
+};
+/**
+ * RECEIVER step: validate the sender's point + proof BEFORE forming any R (malicious-sender guard), then
+ * choose x_i, form R_i = x_i·B (+ S if c_i=1) and derive recvPad_i = H(x_i·S). Throws `BaseOtAbort`/
+ * `PointValidationError` on a bad S or proof.
+ */
+export declare function malBaseOtReceiverRespond(S: Point, proof: SchnorrProof, choices: number[], rng: OtRandom, binding: BaseOtBinding): {
+    R: Point[];
+    recvPads: Uint8Array[];
+};
+/** SENDER step 2: validate every received R_i (malicious-receiver / small-subgroup guard), derive both pads. */
+export declare function malBaseOtSenderDerive(y: bigint, T: Point, R: Point[], S: Point, binding: BaseOtBinding): Array<[Uint8Array, Uint8Array]>;
+/** SENDER step 3 (chosen-message wrapper): one-time-pad each message under its pad and commit to it. */
+export declare function baseOtSenderEncrypt(messages: Array<[Uint8Array, Uint8Array]>, senderPads: Array<[Uint8Array, Uint8Array]>): {
+    ct: Array<[Uint8Array, Uint8Array]>;
+    com: Array<[Uint8Array, Uint8Array]>;
+};
+/**
+ * RECEIVER step 3: decrypt the chosen ciphertext with its pad, then CHECK the commitment it can open;
+ * `BaseOtAbort` on any inconsistency (a cheating sender). Every ciphertext/commitment must have the shape
+ * the receiver expects (equal-length byte strings of at most the pad width).
+ */
+export declare function baseOtReceiverDecrypt(choices: number[], recvPads: Uint8Array[], ct: Array<[Uint8Array, Uint8Array]>, com: Array<[Uint8Array, Uint8Array]>): Uint8Array[];
 /**
  * Run `count` MALICIOUS-secure base OTs in one batch (chosen-message, over the random OT above).
  * `messages[i] = [m0, m1]` (SEED_BYTES each), the sender's pair; `choices[i] ∈ {0,1}` the receiver's
@@ -157,25 +237,99 @@ export declare function malBaseRandomOT(choices: number[], rng?: OtRandom, tampe
  * the receiver recovers `m_{i,c_i}` and checks the commitment, aborting (`BaseOtAbort`) on any
  * inconsistency. Returns the receiver's recovered messages and the full transcript.
  */
-export declare function baseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: BaseOtTamper): BaseOtResult;
+export declare function baseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: BaseOtTamper, binding?: BaseOtBinding): BaseOtResult;
+/** One extension round's receiver -> sender message: the u matrix and the KOS-revealed (x, t) pair. */
+export interface ExtRoundMsg {
+    /** KAPPA columns of `mExt = m + KAPPA + SSEC` bits each. */
+    u: bigint[];
+    /** x = Σ_j b_j·χ_j in GF(2^128). */
+    x: bigint;
+    /** t = Σ_i x^i·(Σ_j t_i[j]·χ_j). */
+    tComb: bigint;
+}
+/** The receiver's private state between sending `ExtRoundMsg` and receiving the sender's ciphertexts. */
+export interface ExtPending {
+    m: number;
+    choiceBits: number[];
+    /** The receiver's `t` matrix: COLS columns of `W` u32 words, concatenated. */
+    t: Uint32Array;
+    W: number;
+    /** Channel-global index of this round's first row (R4-12 hash tweak). */
+    rowOffset: number;
+}
 /**
- * An IKNP OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs). The
- * κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap PRG+hash round. The
- * channel is stateful (advances per-seed PRG counters) so many rounds compose into one amortized setup.
+ * The OT-extension RECEIVER (holds the choice bits). In the base OT it is the SENDER: it draws κ seed pairs
+ * and offers them; after the base OT it expands them with the PRG.
+ */
+export declare class OtExtReceiver {
+    private readonly rng;
+    private readonly kosBinding;
+    private seed0;
+    private seed1;
+    private blk0;
+    private blk1;
+    private round;
+    /** Rows hashed in earlier rounds (R4-12 global tweak offset); advanced by m per round, in step with the sender. */
+    private rowsDone;
+    private readonly tweakDomain;
+    ready: boolean;
+    /**
+     * TEST-ONLY: called with the honest `u` matrix just before it goes on the wire; may mutate it (a malicious
+     * receiver encoding inconsistent choices). The KOS values are computed over the tampered `u`.
+     */
+    tamperU?: (u: bigint[], round: number) => void;
+    constructor(rng: OtRandom, kosBinding: Uint8Array);
+    /** Base-OT messages: the κ seed pairs this party offers as the base-OT sender. */
+    makeSeeds(): Array<[Uint8Array, Uint8Array]>;
+    /** Round start: form u and the KOS pair for `choiceBits` (the real rows); returns the wire message + pending state. */
+    begin(choiceBits: number[]): {
+        msg: ExtRoundMsg;
+        pending: ExtPending;
+    };
+    /** Round end: recover the chosen messages from the sender's ciphertexts. */
+    finish(pending: ExtPending, y0: bigint[], y1: bigint[]): bigint[];
+}
+/** The OT-extension SENDER (holds the message pairs). In the base OT it is the RECEIVER with selector `s`. */
+export declare class OtExtSender {
+    private readonly rng;
+    private readonly kosBinding;
+    private s;
+    private sBits;
+    private seeds;
+    private blk;
+    private round;
+    private rowsDone;
+    private readonly tweakDomain;
+    ready: boolean;
+    constructor(rng: OtRandom, kosBinding: Uint8Array);
+    /** Draw the secret selector s ∈ {0,1}^κ (the base-OT choice bits). */
+    makeSelector(): number[];
+    /** Install the κ seeds learned from the base OT. */
+    setSeeds(seeds: Uint8Array[]): void;
+    get selector(): bigint;
+    /**
+     * Verify the receiver's round message (structure + KOS correlation check) and return the ciphertexts for
+     * the `m` real rows. A cheating receiver is caught here: `MalOtAbort`.
+     */
+    respond(msg: ExtRoundMsg, msg0: bigint[], msg1: bigint[]): {
+        y0: bigint[];
+        y1: bigint[];
+    };
+}
+/**
+ * An IKNP/KOS OT-extension channel between a fixed RECEIVER (choice bits) and SENDER (message pairs), both
+ * simulated in-process. The κ base OTs run lazily on the first `extend`; each later `extend(m)` is a cheap
+ * PRG+hash round. The channel is stateful (advances per-seed PRG counters) so many rounds compose into one
+ * amortized setup. The two roles are the standalone `OtExtReceiver` / `OtExtSender` (used over the network).
  */
 export declare class OtChannel {
     private readonly rng;
     /** Optional post-quantum (or otherwise custom) base OT for the κ setup OTs; defaults to EC `baseOT`. */
     private readonly baseOtFn?;
+    private readonly bindingOpt?;
+    private recv?;
+    private send?;
     private ready;
-    private s;
-    private sBits;
-    private senderSeeds;
-    private senderBlk;
-    private recvSeed0;
-    private recvSeed1;
-    private recvBlk0;
-    private recvBlk1;
     /** The base-OT transcript (available after setup) — exposed for inspection/tests. */
     baseTranscript?: BaseOtTranscript;
     /**
@@ -186,13 +340,18 @@ export declare class OtChannel {
      * a non-trivial tamper is caught — the real malicious-receiver attack that KOS defeats.
      */
     tamperU?: (u: bigint[], round: number) => void;
-    private round;
     /**
      * `rng` defaults to the CSPRNG (`secureOtRandom`, `node:crypto`) — production randomness. Pass a
      * deterministic `otRandom(splitMix64(seed))` ONLY to make a test bit-reproducible (docs §7.1 item c).
      */
     constructor(rng?: OtRandom, opts?: {
         baseOtFn?: BaseOtFn;
+        /**
+         * Session binding of this channel (both parties must agree on it). `senderIndex` is the EXTENSION
+         * RECEIVER (it plays base-OT sender), `receiverIndex` the extension sender. Omitted for an in-process
+         * channel: a fresh random session id is drawn from `rng`.
+         */
+        binding?: Omit<BaseOtBinding, 'round'>;
     });
     private setup;
     /** Selector s as a κ-bit bigint (sender-side secret; exposed only for tests). */