@atlasauth/pca-mpc 0.3.0 → 0.4.1

package/dist/net/faults.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * TEST-ONLY fault injection for the networked MPC.
+ *
+ * Two layers, deliberately separate:
+ *  - `tamperFor(spec)`: a MALICIOUS SENDER rewriting its own outgoing frames at the application layer
+ *    (duplicate, reorder, skipped sequence, garbage, truncation, wrong round/session, oversize length,
+ *    drop, silence). The bytes still travel inside valid TLS, so the receiver's framing checks decide.
+ *  - `FaultProxy`: a NETWORK adversary on the wire (TCP middlebox): drop / delay / truncate / bit-flip /
+ *    duplicate / reorder at the byte level. TLS 1.3 record authentication rejects tampering, so the
+ *    expected outcome is an attributable-to-the-link `disconnect`, never a silently corrupted value.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FaultProxy = void 0;
+exports.tamperFor = tamperFor;
+const net = __importStar(require("node:net"));
+const wire_1 = require("./wire");
+function tamperFor(spec) {
+    const stash = new Map();
+    let silent = false;
+    return (ev) => {
+        if (silent)
+            return [];
+        const hit = ev.frame.rd === spec.round && (spec.to === undefined || spec.to === ev.to);
+        if (spec.kind === 'reorder') {
+            const held = stash.get(ev.to);
+            if (held) {
+                stash.delete(ev.to);
+                return [ev.raw, held]; // later frame first, then the held-back one
+            }
+            if (hit) {
+                stash.set(ev.to, ev.raw);
+                return [];
+            }
+            return [ev.raw];
+        }
+        if (!hit)
+            return [ev.raw];
+        switch (spec.kind) {
+            case 'duplicate':
+                return [ev.raw, ev.raw];
+            case 'skip-seq':
+                return [(0, wire_1.encodeFrame)({ ...ev.frame, seq: ev.frame.seq + 1 })];
+            case 'garbage': {
+                const g = Buffer.alloc(ev.raw.length, 0x5a);
+                g.writeUInt32BE(ev.raw.length - 4, 0);
+                return [g];
+            }
+            case 'truncate':
+                return [ev.raw.subarray(0, Math.max(5, Math.floor(ev.raw.length / 2)))];
+            case 'bitflip': {
+                const b = Buffer.from(ev.raw);
+                const i = Math.floor(b.length * 0.6);
+                b[i] = b[i] ^ 0x04;
+                return [b];
+            }
+            case 'wrong-round':
+                return [(0, wire_1.encodeFrame)({ ...ev.frame, rd: 'zzz-' + ev.frame.rd })];
+            case 'wrong-session':
+                return [(0, wire_1.encodeFrame)({ ...ev.frame, sid: 'not-this-session' })];
+            case 'oversize': {
+                const h = Buffer.alloc(4);
+                h.writeUInt32BE(0x7fffffff, 0);
+                return [h];
+            }
+            case 'drop':
+                return [];
+            case 'silent-from':
+                silent = true;
+                return [];
+            case 'false-accuse':
+                return [
+                    (0, wire_1.encodeFrame)({ ...ev.frame, ty: 'abort', rd: 'abort', d: { kind: 'timeout', blamed: spec.accuse ?? 0, detail: 'forged accusation' } }),
+                ];
+            case 'extra-field':
+                return [(0, wire_1.encodeFrame)({ ...ev.frame, x: 1 })];
+        }
+    };
+}
+/** A transparent TCP proxy that misbehaves once, after `afterBytes` bytes, in one direction. */
+class FaultProxy {
+    listenPort;
+    target;
+    fault;
+    server;
+    log = [];
+    constructor(listenPort, target, fault) {
+        this.listenPort = listenPort;
+        this.target = target;
+        this.fault = fault;
+        this.server = net.createServer((c) => this.onClient(c));
+    }
+    listen() {
+        return new Promise((res, rej) => {
+            this.server.once('error', rej);
+            this.server.listen(this.listenPort, '127.0.0.1', () => res());
+        });
+    }
+    close() {
+        this.server.close();
+    }
+    onClient(c) {
+        const up = net.connect(this.target.port, this.target.host);
+        c.on('error', () => up.destroy());
+        up.on('error', () => c.destroy());
+        c.on('close', () => up.destroy());
+        up.on('close', () => c.destroy());
+        this.pipe(c, up, 'c2s');
+        this.pipe(up, c, 's2c');
+    }
+    pipe(from, to, dir) {
+        const f = this.fault;
+        const active = f.kind !== 'none' && f.dir === dir;
+        let seen = 0;
+        let fired = false;
+        let done = false;
+        let held = null;
+        let pending = 0; // delayed writes in flight: a half-close must not overtake them
+        let ended = false;
+        from.on('data', (chunk) => {
+            const before = seen;
+            seen += chunk.length;
+            if (!active || done || before + chunk.length <= f.afterBytes) {
+                if (active && f.kind === 'drop' && fired)
+                    return; // black hole stays black
+                to.write(chunk);
+                return;
+            }
+            if (!fired) {
+                fired = true;
+                this.log.push(`fault ${f.kind} ${dir} after ${f.afterBytes}B`);
+            }
+            switch (f.kind) {
+                case 'drop':
+                    return;
+                case 'delay':
+                    pending++;
+                    setTimeout(() => {
+                        if (!to.destroyed)
+                            to.write(chunk);
+                        pending--;
+                        if (pending === 0 && ended)
+                            to.end();
+                    }, f.ms ?? 1000);
+                    return;
+                case 'truncate':
+                    done = true;
+                    to.write(chunk.subarray(0, Math.floor(chunk.length / 2)));
+                    to.end();
+                    return;
+                case 'bitflip': {
+                    done = true;
+                    const b = Buffer.from(chunk);
+                    const i = Math.floor(b.length / 2);
+                    b[i] = b[i] ^ 0x01;
+                    to.write(b);
+                    return;
+                }
+                case 'duplicate':
+                    done = true;
+                    to.write(chunk);
+                    to.write(chunk);
+                    return;
+                case 'reorder':
+                    if (!held) {
+                        held = chunk;
+                    }
+                    else {
+                        done = true;
+                        to.write(chunk);
+                        to.write(held);
+                        held = null;
+                    }
+                    return;
+                default:
+                    to.write(chunk);
+            }
+        });
+        from.on('end', () => {
+            if (held)
+                to.write(held);
+            ended = true;
+            if (pending === 0)
+                to.end();
+        });
+    }
+}
+exports.FaultProxy = FaultProxy;
+//# sourceMappingURL=faults.js.map

package/dist/net/faults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"faults.js","sourceRoot":"","sources":["../../src/net/faults.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BH,8BA2DC;AAxFD,8CAAgC;AAChC,iCAAiD;AA4BjD,SAAgB,SAAS,CAAC,IAAgB;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,CAAC,EAAe,EAAY,EAAE;QACnC,IAAI,MAAM;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,4CAA4C;YACrE,CAAC;YACD,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW;gBACd,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAC1B,KAAK,UAAU;gBACb,OAAO,CAAC,IAAA,kBAAW,EAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;gBACpB,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;YACD,KAAK,aAAa;gBAChB,OAAO,CAAC,IAAA,kBAAW,EAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAClE,KAAK,eAAe;gBAClB,OAAO,CAAC,IAAA,kBAAW,EAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;YACjE,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;YACD,KAAK,MAAM;gBACT,OAAO,EAAE,CAAC;YACZ,KAAK,aAAa;gBAChB,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,EAAE,CAAC;YACZ,KAAK,cAAc;gBACjB,OAAO;oBACL,IAAA,kBAAW,EAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC;iBACtI,CAAC;YACJ,KAAK,aAAa;gBAChB,OAAO,CAAC,IAAA,kBAAW,EAAC,EAAE,GAAI,EAAE,CAAC,KAAe,EAAE,CAAC,EAAE,CAAC,EAAsB,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAgBD,gGAAgG;AAChG,MAAa,UAAU;IAKV;IACQ;IACA;IANX,MAAM,CAAa;IAClB,GAAG,GAAa,EAAE,CAAC;IAE5B,YACW,UAAkB,EACV,MAAsC,EACtC,KAAgB;QAFxB,eAAU,GAAV,UAAU,CAAQ;QACV,WAAM,GAAN,MAAM,CAAgC;QACtC,UAAK,GAAL,KAAK,CAAW;QAEjC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,QAAQ,CAAC,CAAa;QAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAEO,IAAI,CAAC,IAAgB,EAAE,EAAc,EAAE,GAAkB;QAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;QAClD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,gEAAgE;QACjF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7D,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK;oBAAE,OAAO,CAAC,yBAAyB;gBAC3E,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,OAAO;gBACT,KAAK,OAAO;oBACV,OAAO,EAAE,CAAC;oBACV,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC,EAAE,CAAC,SAAS;4BAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACnC,OAAO,EAAE,CAAC;wBACV,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK;4BAAE,EAAE,CAAC,GAAG,EAAE,CAAC;oBACvC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;oBACjB,OAAO;gBACT,KAAK,UAAU;oBACb,IAAI,GAAG,IAAI,CAAC;oBACZ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1D,EAAE,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO;gBACT,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACnC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC;oBACpB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,KAAK,WAAW;oBACd,IAAI,GAAG,IAAI,CAAC;oBACZ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAChB,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAChB,OAAO;gBACT,KAAK,SAAS;oBACZ,IAAI,CAAC,IAAI,EAAE,CAAC;wBACV,IAAI,GAAG,KAAK,CAAC;oBACf,CAAC;yBAAM,CAAC;wBACN,IAAI,GAAG,IAAI,CAAC;wBACZ,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAChB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBACf,IAAI,GAAG,IAAI,CAAC;oBACd,CAAC;oBACD,OAAO;gBACT;oBACE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,OAAO,KAAK,CAAC;gBAAE,EAAE,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAvGD,gCAuGC"}

package/dist/net/forensics.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Post-abort disclosure of the discarded triple's OT transcript (dealer-free mode), so a wrong operand in the offline
+ * triple products is ATTRIBUTED instead of only detected.
+ *
+ * When the triple sacrifice fails at triple `t`, that triple (its shares `a`, `a-hat_r`, `b` and the OT masks of its
+ * product items) is thrown away and the session is over. Every party then discloses, for the failed triple only:
+ * for each product slot (the product c and each partner product c-hat_r) its choice bits, its sender operand `y`
+ * (its share of `b`), the product share it claimed, the values it RECEIVED from each peer and the masks `rho` it OFFERED to
+ * each peer. Nothing disclosed is a MAC-key share, an input, or anything used in a completed computation, so naming costs
+ * no privacy.
+ *
+ * Each ordered pair (receiver i, sender j) must satisfy `recv_i[j][k] = rho_j[i][k] + bit_k * g_k * y_j` (mod p), and every
+ * party's claimed product share must equal `value*y + sum_p recv[p] - sum_p rho[p]` from its own disclosure. A party whose own
+ * disclosure fails the second test is certainly lying. A pair failing the first test has exactly one liar among the two (the
+ * honest endpoint's data are consistent with its own OT view); the honest endpoint therefore blames its counterpart, a third
+ * party can only name the pair. As elsewhere in this package an accusation is evidence for the accuser, not proof for a
+ * third party, and with two corrupt parties a corrupt receiver can frame an honest sender.
+ *
+ * COMMIT FIRST (R3-17). Disclosures are not sent in the clear first: every party first broadcasts a hiding, binding
+ * commitment to its disclosure (`forensic-c`), and only after it holds ALL commitments does it open (`forensic-o`). A
+ * rushing corrupt OT sender therefore cannot read the honest receivers' choice bits and received values and then solve
+ * for a `rho` / `y` that passes every pair and self check: it has to commit before it can see anything. A party whose
+ * opening does not match its commitment is blamed (`commitment`); one that never commits or opens within the shared
+ * deadline is blamed by timeout, and the deadline (also carried in the commitment message) is recorded on the abort.
+ * Both are first-hand observations of the blaming party, not transferable proof. What attribution still cannot do:
+ * with two corrupt parties a corrupt receiver can make an honest sender's pair fail, and a pair failure between two
+ * parties neither of which is the verifier names no one (`blamed = null` with a reason).
+ */
+export interface SlotDisclosure {
+    /** My OT choice bits for this product item (the encoding of my triple share). */
+    bits: number[];
+    /** My sender operand (my share of b). */
+    y: bigint;
+    /** The product share I claimed. */
+    z: bigint;
+    /** What I received as OT receiver, per peer. */
+    recv: Map<number, bigint[]>;
+    /** The masks rho I offered as OT sender, per peer. */
+    rho: Map<number, bigint[]>;
+}
+export type Disclosure = SlotDisclosure[];
+export declare const slotsFor: (partners: number) => number;
+export declare function wireDisclosure(d: Disclosure): unknown;
+/** Strict parse of a peer's disclosure; throws `Error` on any deviation from the expected shape. */
+export declare function parseDisclosure(raw: unknown, slots: number, rows: number, peers: readonly number[]): Disclosure;
+export interface AuditResult {
+    /** Parties whose own disclosure is internally inconsistent (their claimed product share does not follow from it). */
+    selfBad: Set<number>;
+    /** Ordered pairs `[receiver, sender]` whose OT transcripts disagree. */
+    pairBad: Array<[number, number]>;
+}
+/** Cross-check every party's disclosure for one failed triple. `gadget` is the public choice-bit gadget. */
+export declare function auditDisclosures(all: ReadonlyMap<number, Disclosure>, gadget: readonly bigint[]): AuditResult;
+/**
+ * The party the verifier `me` blames, or null if the evidence cannot name one: a party with an inconsistent own disclosure;
+ * else the counterpart of a failing pair `me` belongs to (the honest endpoint's data are consistent, so its counterpart
+ * lied); else null.
+ */
+export declare function blameFrom(me: number, r: AuditResult): number | null;
+/** Default time (ms) every party has to produce its forensic commitment and opening. Shared by all parties and carried in the commit message. */
+export declare const DEFAULT_FORENSIC_DEADLINE_MS = 30000;
+/** Binding commitment to a disclosure: session, party, failed-triple index, deadline, a 256-bit nonce and the canonical wire form. */
+export declare function disclosureCommit(sessionId: string, party: number, tripleIndex: number, deadlineMs: number, nonce: string, wire: unknown): string;
+export interface ForensicExchangeArgs {
+    sessionId: string;
+    id: number;
+    n: number;
+    tripleIndex: number;
+    mine: Disclosure;
+    slots: number;
+    rows: number;
+    deadlineMs: number;
+    /** One un-echoed all-to-all round whose receive deadline is `deadlineMs`. */
+    exchange: <T>(rd: string, mine: (peer: number) => unknown, parse: (p: number, raw: unknown) => T, timeoutMs: number) => Promise<Map<number, T>>;
+    bad: (p: number, what: string) => never;
+}
+/**
+ * Commit-first disclosure exchange. Returns every OTHER party's verified disclosure. Nobody opens before every commitment is
+ * in hand (the `forensic-c` exchange completes first), so no party's disclosure can depend on another's.
+ */
+export declare function exchangeDisclosures(a: ForensicExchangeArgs): Promise<Map<number, Disclosure>>;

package/dist/net/forensics.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * Post-abort disclosure of the discarded triple's OT transcript (dealer-free mode), so a wrong operand in the offline
+ * triple products is ATTRIBUTED instead of only detected.
+ *
+ * When the triple sacrifice fails at triple `t`, that triple (its shares `a`, `a-hat_r`, `b` and the OT masks of its
+ * product items) is thrown away and the session is over. Every party then discloses, for the failed triple only:
+ * for each product slot (the product c and each partner product c-hat_r) its choice bits, its sender operand `y`
+ * (its share of `b`), the product share it claimed, the values it RECEIVED from each peer and the masks `rho` it OFFERED to
+ * each peer. Nothing disclosed is a MAC-key share, an input, or anything used in a completed computation, so naming costs
+ * no privacy.
+ *
+ * Each ordered pair (receiver i, sender j) must satisfy `recv_i[j][k] = rho_j[i][k] + bit_k * g_k * y_j` (mod p), and every
+ * party's claimed product share must equal `value*y + sum_p recv[p] - sum_p rho[p]` from its own disclosure. A party whose own
+ * disclosure fails the second test is certainly lying. A pair failing the first test has exactly one liar among the two (the
+ * honest endpoint's data are consistent with its own OT view); the honest endpoint therefore blames its counterpart, a third
+ * party can only name the pair. As elsewhere in this package an accusation is evidence for the accuser, not proof for a
+ * third party, and with two corrupt parties a corrupt receiver can frame an honest sender.
+ *
+ * COMMIT FIRST (R3-17). Disclosures are not sent in the clear first: every party first broadcasts a hiding, binding
+ * commitment to its disclosure (`forensic-c`), and only after it holds ALL commitments does it open (`forensic-o`). A
+ * rushing corrupt OT sender therefore cannot read the honest receivers' choice bits and received values and then solve
+ * for a `rho` / `y` that passes every pair and self check: it has to commit before it can see anything. A party whose
+ * opening does not match its commitment is blamed (`commitment`); one that never commits or opens within the shared
+ * deadline is blamed by timeout, and the deadline (also carried in the commitment message) is recorded on the abort.
+ * Both are first-hand observations of the blaming party, not transferable proof. What attribution still cannot do:
+ * with two corrupt parties a corrupt receiver can make an honest sender's pair fail, and a pair failure between two
+ * parties neither of which is the verifier names no one (`blamed = null` with a reason).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_FORENSIC_DEADLINE_MS = exports.slotsFor = void 0;
+exports.wireDisclosure = wireDisclosure;
+exports.parseDisclosure = parseDisclosure;
+exports.auditDisclosures = auditDisclosures;
+exports.blameFrom = blameFrom;
+exports.disclosureCommit = disclosureCommit;
+exports.exchangeDisclosures = exchangeDisclosures;
+const node_crypto_1 = require("node:crypto");
+const field_1 = require("../field");
+const wire_1 = require("./wire");
+const wire_2 = require("./wire");
+const slotsFor = (partners) => 1 + partners;
+exports.slotsFor = slotsFor;
+function wireDisclosure(d) {
+    return d.map((s) => ({
+        bits: s.bits.join(''),
+        y: (0, wire_2.hx)(s.y),
+        z: (0, wire_2.hx)(s.z),
+        recv: Array.from(s.recv.entries()).map(([p, v]) => [p, v.map(wire_2.hx)]),
+        rho: Array.from(s.rho.entries()).map(([p, v]) => [p, v.map(wire_2.hx)]),
+    }));
+}
+/** Strict parse of a peer's disclosure; throws `Error` on any deviation from the expected shape. */
+function parseDisclosure(raw, slots, rows, peers) {
+    if (!Array.isArray(raw) || raw.length !== slots)
+        throw new Error('bad forensic disclosure');
+    const field = (s) => {
+        const v = (0, wire_2.unhx)(s);
+        if (v === null)
+            throw new Error('bad field element');
+        return v;
+    };
+    return raw.map((o) => {
+        const r = o;
+        if (typeof r?.bits !== 'string' || !new RegExp(`^[01]{${rows}}$`).test(r.bits))
+            throw new Error('bad choice bits');
+        const side = (x) => {
+            if (!Array.isArray(x) || x.length !== peers.length)
+                throw new Error('bad peer table');
+            const m = new Map();
+            for (const e of x) {
+                if (!Array.isArray(e) || e.length !== 2 || typeof e[0] !== 'number' || !peers.includes(e[0]) || m.has(e[0]))
+                    throw new Error('bad peer entry');
+                if (!Array.isArray(e[1]) || e[1].length !== rows)
+                    throw new Error('bad row table');
+                m.set(e[0], e[1].map(field));
+            }
+            return m;
+        };
+        return { bits: Array.from(r.bits, (c) => (c === '1' ? 1 : 0)), y: field(r.y), z: field(r.z), recv: side(r.recv), rho: side(r.rho) };
+    });
+}
+/** Cross-check every party's disclosure for one failed triple. `gadget` is the public choice-bit gadget. */
+function auditDisclosures(all, gadget) {
+    const selfBad = new Set();
+    const pairBad = [];
+    const parties = Array.from(all.keys()).sort((a, b) => a - b);
+    for (const i of parties) {
+        const di = all.get(i);
+        for (let s = 0; s < di.length; s++) {
+            const sd = di[s];
+            let value = 0n;
+            for (let k = 0; k < gadget.length; k++)
+                if (sd.bits[k] === 1)
+                    value += gadget[k];
+            let implied = (0, field_1.fmul)((0, field_1.mod)(value), sd.y);
+            for (const p of parties) {
+                if (p === i)
+                    continue;
+                for (const v of sd.recv.get(p))
+                    implied = (0, field_1.fadd)(implied, (0, field_1.mod)(v));
+                for (const v of sd.rho.get(p))
+                    implied = (0, field_1.fsub)(implied, v);
+            }
+            if (implied !== sd.z)
+                selfBad.add(i);
+            for (const p of parties) {
+                if (p === i)
+                    continue;
+                const sp = all.get(p)[s];
+                const rho = sp.rho.get(i);
+                const got = sd.recv.get(p);
+                const y = (0, field_1.mod)(sp.y);
+                let bad = false;
+                for (let k = 0; k < gadget.length && !bad; k++) {
+                    const want = (0, field_1.fadd)(rho[k], sd.bits[k] === 1 ? (0, field_1.fmul)(gadget[k], y) : 0n);
+                    if ((0, field_1.mod)(got[k]) !== want)
+                        bad = true;
+                }
+                if (bad)
+                    pairBad.push([i, p]);
+            }
+        }
+    }
+    void field_1.PRIME;
+    return { selfBad, pairBad };
+}
+/**
+ * The party the verifier `me` blames, or null if the evidence cannot name one: a party with an inconsistent own disclosure;
+ * else the counterpart of a failing pair `me` belongs to (the honest endpoint's data are consistent, so its counterpart
+ * lied); else null.
+ */
+function blameFrom(me, r) {
+    const own = Array.from(r.selfBad).filter((p) => p !== me).sort((a, b) => a - b);
+    if (own.length > 0)
+        return own[0];
+    for (const [recv, send] of r.pairBad) {
+        if (recv === me)
+            return send;
+        if (send === me)
+            return recv;
+    }
+    return null;
+}
+// ---- commit-first exchange (R3-17) ----
+/** Default time (ms) every party has to produce its forensic commitment and opening. Shared by all parties and carried in the commit message. */
+exports.DEFAULT_FORENSIC_DEADLINE_MS = 30_000;
+/** Binding commitment to a disclosure: session, party, failed-triple index, deadline, a 256-bit nonce and the canonical wire form. */
+function disclosureCommit(sessionId, party, tripleIndex, deadlineMs, nonce, wire) {
+    return (0, node_crypto_1.createHash)('sha256')
+        .update('atlas-pca-mpc/forensic-commit/v1\0')
+        .update(JSON.stringify([sessionId, party, tripleIndex, deadlineMs, nonce, wire]))
+        .digest('hex');
+}
+/**
+ * Commit-first disclosure exchange. Returns every OTHER party's verified disclosure. Nobody opens before every commitment is
+ * in hand (the `forensic-c` exchange completes first), so no party's disclosure can depend on another's.
+ */
+async function exchangeDisclosures(a) {
+    const wire = wireDisclosure(a.mine);
+    const nonce = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    const myCommit = disclosureCommit(a.sessionId, a.id, a.tripleIndex, a.deadlineMs, nonce, wire);
+    const commits = await a.exchange('forensic-c', () => ({ c: myCommit, d: a.deadlineMs }), (p, raw) => {
+        const o = raw;
+        if (typeof o?.c !== 'string' || !/^[0-9a-f]{64}$/.test(o.c))
+            return a.bad(p, 'bad forensic commitment');
+        if (o.d !== a.deadlineMs)
+            return a.bad(p, `forensic deadline ${String(o.d)} differs from the agreed ${a.deadlineMs}`);
+        return o.c;
+    }, a.deadlineMs);
+    return a.exchange('forensic-o', () => ({ w: wire, nonce }), (p, raw) => {
+        const o = raw;
+        if (typeof o?.nonce !== 'string' || !/^[0-9a-f]{64}$/.test(o.nonce))
+            return a.bad(p, 'bad forensic opening');
+        if (disclosureCommit(a.sessionId, p, a.tripleIndex, a.deadlineMs, o.nonce, o.w) !== commits.get(p)) {
+            throw new wire_1.NetAbort('commitment', p, a.id, `party ${p} opened a forensic disclosure that does not match its commitment`);
+        }
+        return parseDisclosure(o.w, a.slots, a.rows, Array.from({ length: a.n }, (_, q) => q).filter((q) => q !== p));
+    }, a.deadlineMs);
+}
+//# sourceMappingURL=forensics.js.map

package/dist/net/forensics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forensics.js","sourceRoot":"","sources":["../../src/net/forensics.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAuBH,wCAQC;AAGD,0CAsBC;AAUD,4CAkCC;AAOD,8BAQC;AASD,4CAKC;AAoBD,kDA4BC;AA/KD,6CAAsD;AACtD,oCAAwD;AACxD,iCAAkC;AAClC,iCAAkC;AAgB3B,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC;AAAtD,QAAA,QAAQ,YAA8C;AAEnE,SAAgB,cAAc,CAAC,CAAa;IAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,CAAC,EAAE,IAAA,SAAE,EAAC,CAAC,CAAC,CAAC,CAAC;QACV,CAAC,EAAE,IAAA,SAAE,EAAC,CAAC,CAAC,CAAC,CAAC;QACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAE,CAAC,CAAC,CAAC;QAClE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAE,CAAC,CAAC,CAAC;KACjE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,oGAAoG;AACpG,SAAgB,eAAe,CAAC,GAAY,EAAE,KAAa,EAAE,IAAY,EAAE,KAAwB;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE;QACnC,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnH,MAAM,IAAI,GAAG,CAAC,CAAU,EAAyB,EAAE;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtF,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC/I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnF,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtI,CAAC,CAAC,CAAC;AACL,CAAC;AASD,4GAA4G;AAC5G,SAAgB,gBAAgB,CAAC,GAAoC,EAAE,MAAyB;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;YAClB,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,KAAK,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC;YAClF,IAAI,OAAO,GAAG,IAAA,YAAI,EAAC,IAAA,WAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE;oBAAE,OAAO,GAAG,IAAA,YAAI,EAAC,OAAO,EAAE,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE;oBAAE,OAAO,GAAG,IAAA,YAAI,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACtB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,GAAG,GAAG,KAAK,CAAC;gBAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC/C,MAAM,IAAI,GAAG,IAAA,YAAI,EAAC,GAAG,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,YAAI,EAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACxE,IAAI,IAAA,WAAG,EAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,IAAI;wBAAE,GAAG,GAAG,IAAI,CAAC;gBACxC,CAAC;gBACD,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,aAAK,CAAC;IACX,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,EAAU,EAAE,CAAc;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,0CAA0C;AAE1C,iJAAiJ;AACpI,QAAA,4BAA4B,GAAG,MAAM,CAAC;AAEnD,sIAAsI;AACtI,SAAgB,gBAAgB,CAAC,SAAiB,EAAE,KAAa,EAAE,WAAmB,EAAE,UAAkB,EAAE,KAAa,EAAE,IAAa;IACtI,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,oCAAoC,CAAC;SAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAgBD;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CAAC,CAAuB;IAC/D,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,QAAQ,CAC9B,YAAY,EACZ,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,EACxC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,GAA0C,CAAC;QACrD,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACxG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,EACD,CAAC,CAAC,UAAU,CACb,CAAC;IACF,OAAO,CAAC,CAAC,QAAQ,CACf,YAAY,EACZ,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAC1B,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,GAA8C,CAAC;QACzD,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC7G,IAAI,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,eAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,kEAAkE,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC,EACD,CAAC,CAAC,UAAU,CACb,CAAC;AACJ,CAAC"}

package/dist/net/gadget.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Agreement on the joint choice-bit gadget seeds (R3-16): a signed commit-reveal with an echo round, so that ONE
+ * corrupt party cannot make the honest parties derive different gadgets and then blame each other.
+ *
+ * The plain commit-reveal (`gd-c` / `gd-o`) leaves each party's message to each peer unauthenticated beyond the TLS link,
+ * so a corrupt party can send a different commitment and seed to each honest peer. The honest parties then compute different
+ * gadgets, the triple sacrifice fails, and the forensic audit (which uses each verifier's OWN gadget) makes honest parties
+ * accuse each other while the corrupt one goes unnamed.
+ *
+ * Here every commitment and every opening is SIGNED by its sender with the sender's pinned TLS identity key. After the
+ * reveal each party echoes, to every peer, the signed values it received from each third party (`gd-e`). A receiver then
+ * checks each echoed statement against what it received directly:
+ *
+ *   - an echoed signature that does not verify is a forgery by the echoer: blame the echoer (first-hand: I can verify
+ *     the signature myself, and I need no one's word);
+ *   - an echoed statement that verifies but differs from the one I received directly from the same signer means the signer
+ *     signed two different values for the same round: blame the signer, with both signed statements as TRANSFERABLE evidence
+ *     (any third party can verify both against the signer's pinned certificate). An honest party signs one value per
+ *     round, so it can never be framed this way, and a corrupt echoer can only relay values the signer really signed.
+ *
+ * If every check passes, all honest parties hold identical seeds and so identical gadgets. A party that is silent, late
+ * or malformed is blamed by the existing receive deadline / schema checks (a local observation, see `NetAbort.deadlineMs`).
+ * With n = 2 there is no third party to equivocate towards, so the echo round is skipped.
+ */
+/** What the gadget agreement needs from the transport. */
+export interface GadgetNet {
+    selfId: number;
+    sessionId: string;
+    sign(data: Uint8Array): Uint8Array;
+    verify(peer: number, data: Uint8Array, sig: Uint8Array): boolean;
+}
+export interface GadgetIo {
+    /** One un-echoed all-to-all round; a throw inside `parse` aborts naming that peer. */
+    exchange: <T>(rd: string, mine: (peer: number) => unknown, parse: (p: number, raw: unknown) => T) => Promise<Map<number, T>>;
+    bad: (p: number, what: string) => never;
+}
+export declare const gadgetCommit: (sessionId: string, party: number, seed: Uint8Array) => string;
+/** The exact bytes a party signs: domain, session, round, signer and value, length-unambiguous via JSON. */
+export declare const gadgetStatement: (sessionId: string, round: "gd-c" | "gd-o", signer: number, value: string) => Uint8Array;
+/**
+ * Run the signed commit / reveal / echo and return every party's seed in party order (mine included).
+ * `mySeed` is injectable for tests; production passes nothing.
+ */
+export declare function agreeGadgetSeeds(net: GadgetNet, n: number, io: GadgetIo, mySeed?: Uint8Array): Promise<Uint8Array[]>;