@idos-network/enclave 1.1.0

package/src/mpc/secretsharing/f256.ts

@@ -0,0 +1,122 @@
+import type { FiniteFieldElement } from "./finite-field-element";
+import { Polynomial } from "./polynomial";
+
+/** Represents an element in GF(2^8) using the reduction polynomial x^8+x^4+x^3+x+1. */
+export class F256 implements FiniteFieldElement<F256> {
+  readonly value: number;
+
+  private constructor(value: number) {
+    this.value = value;
+  }
+
+  /**
+   * The zero element.
+   */
+  static readonly ZERO: F256 = F256.createElement(0);
+
+  /**
+   * The one element.
+   */
+  static readonly ONE: F256 = F256.createElement(1);
+
+  /**
+   * Create a new field element with the given value.
+   * @param value the value
+   */
+  static createElement(value: number): F256 {
+    return new F256(value & 0xff);
+  }
+
+  /**
+   * Get the computation alphas for this field.
+   * @returns the computation alphas
+   */
+  static alphas(numNodes: number): readonly F256[] {
+    return Array.from({ length: numNodes }, (_value, key) => F256.createElement(key + 1));
+  }
+
+  /**
+   * Create a polynomial.
+   * @param coefficients the coefficients of the polynomial
+   */
+  static createPoly(coefficients: F256[]): Polynomial<F256> {
+    return Polynomial.create(coefficients, F256.ZERO);
+  }
+
+  /** @inheritDoc */
+  add(other: F256): F256 {
+    return Constants.elements[this.value ^ other.value];
+  }
+
+  /** @inheritDoc */
+  isEqualTo(other: F256): boolean {
+    return this.value === other.value;
+  }
+
+  /** @inheritDoc */
+  isOne(): boolean {
+    return this.value === 1;
+  }
+
+  /** @inheritDoc */
+  isZero(): boolean {
+    return this.value === 0;
+  }
+
+  /** @inheritDoc */
+  modInverse(): F256 {
+    return Constants.elements[Constants.multiplicativeInverse[this.value]];
+  }
+
+  /** @inheritDoc */
+  multiply(other: F256): F256 {
+    let a = this.value;
+    let b = other.value;
+    let m;
+    let p = 0;
+    for (let i = 0; i < 8; i++) {
+      p = (p ^ (-(b & 1) & a)) & 0xff;
+      m = -((a >> 7) & 1) & 0xff;
+      a = ((a << 1) ^ (0b100011011 & m)) & 0xff;
+      b = b >> 1;
+    }
+    return Constants.elements[p];
+  }
+
+  /** @inheritDoc */
+  negate(): F256 {
+    return this;
+  }
+
+  /** @inheritDoc */
+  squareRoot(): F256 {
+    throw new Error("Not implemented");
+  }
+
+  /** @inheritDoc */
+  subtract(other: F256): F256 {
+    return this.add(other);
+  }
+}
+
+const Constants = {
+  elements: Array.from({ length: 256 }, (_value, key) => F256.createElement(key)),
+  multiplicativeInverse: [
+    0x00, 0x01, 0x8d, 0xf6, 0xcb, 0x52, 0x7b, 0xd1, 0xe8, 0x4f, 0x29, 0xc0, 0xb0, 0xe1, 0xe5, 0xc7,
+    0x74, 0xb4, 0xaa, 0x4b, 0x99, 0x2b, 0x60, 0x5f, 0x58, 0x3f, 0xfd, 0xcc, 0xff, 0x40, 0xee, 0xb2,
+    0x3a, 0x6e, 0x5a, 0xf1, 0x55, 0x4d, 0xa8, 0xc9, 0xc1, 0x0a, 0x98, 0x15, 0x30, 0x44, 0xa2, 0xc2,
+    0x2c, 0x45, 0x92, 0x6c, 0xf3, 0x39, 0x66, 0x42, 0xf2, 0x35, 0x20, 0x6f, 0x77, 0xbb, 0x59, 0x19,
+    0x1d, 0xfe, 0x37, 0x67, 0x2d, 0x31, 0xf5, 0x69, 0xa7, 0x64, 0xab, 0x13, 0x54, 0x25, 0xe9, 0x09,
+    0xed, 0x5c, 0x05, 0xca, 0x4c, 0x24, 0x87, 0xbf, 0x18, 0x3e, 0x22, 0xf0, 0x51, 0xec, 0x61, 0x17,
+    0x16, 0x5e, 0xaf, 0xd3, 0x49, 0xa6, 0x36, 0x43, 0xf4, 0x47, 0x91, 0xdf, 0x33, 0x93, 0x21, 0x3b,
+    0x79, 0xb7, 0x97, 0x85, 0x10, 0xb5, 0xba, 0x3c, 0xb6, 0x70, 0xd0, 0x06, 0xa1, 0xfa, 0x81, 0x82,
+    0x83, 0x7e, 0x7f, 0x80, 0x96, 0x73, 0xbe, 0x56, 0x9b, 0x9e, 0x95, 0xd9, 0xf7, 0x02, 0xb9, 0xa4,
+    0xde, 0x6a, 0x32, 0x6d, 0xd8, 0x8a, 0x84, 0x72, 0x2a, 0x14, 0x9f, 0x88, 0xf9, 0xdc, 0x89, 0x9a,
+    0xfb, 0x7c, 0x2e, 0xc3, 0x8f, 0xb8, 0x65, 0x48, 0x26, 0xc8, 0x12, 0x4a, 0xce, 0xe7, 0xd2, 0x62,
+    0x0c, 0xe0, 0x1f, 0xef, 0x11, 0x75, 0x78, 0x71, 0xa5, 0x8e, 0x76, 0x3d, 0xbd, 0xbc, 0x86, 0x57,
+    0x0b, 0x28, 0x2f, 0xa3, 0xda, 0xd4, 0xe4, 0x0f, 0xa9, 0x27, 0x53, 0x04, 0x1b, 0xfc, 0xac, 0xe6,
+    0x7a, 0x07, 0xae, 0x63, 0xc5, 0xdb, 0xe2, 0xea, 0x94, 0x8b, 0xc4, 0xd5, 0x9d, 0xf8, 0x90, 0x6b,
+    0xb1, 0x0d, 0xd6, 0xeb, 0xc6, 0x0e, 0xcf, 0xad, 0x08, 0x4e, 0xd7, 0xe3, 0x5d, 0x50, 0x1e, 0xb3,
+    0x5b, 0x23, 0x38, 0x34, 0x68, 0x46, 0x03, 0x8c, 0xdd, 0x9c, 0x7d, 0xa0, 0xcd, 0x1a, 0x41, 0x1c,
+  ],
+} as const;

package/src/mpc/secretsharing/finite-field-element.ts

@@ -0,0 +1,50 @@
+/**
+ * A finite field element.
+ *
+ * <p>Copied from <a href="https://gitlab.com/partisiablockchain/language/abi/zk-client"> zk-client</a>.
+ */
+export interface FiniteFieldElement<T> {
+  /**
+   * Field element addition.
+   * @param other the right-hand side
+   */
+  readonly add: (other: T) => T;
+  /**
+   * Field element subtraction.
+   * @param other the right-hand side
+   */
+  readonly subtract: (other: T) => T;
+  /**
+   * Field element multiplication.
+   * @param other the right-hand side
+   */
+  readonly multiply: (other: T) => T;
+  /**
+   * Negate this element.
+   */
+  readonly negate: () => T;
+  /**
+   * Return the multiplicative inverse of this element.
+   */
+  readonly modInverse: () => T;
+  /**
+   * Get the square root of the element.
+   */
+  readonly squareRoot: () => T;
+  /**
+   * Whether this element is zero.
+   * @returns true if zero
+   */
+  readonly isZero: () => boolean;
+  /**
+   * Whether this element is one.
+   * @returns true if one
+   */
+  readonly isOne: () => boolean;
+  /**
+   * Whether this element is equal to the specified element.
+   * @param other the element to check
+   * @returns the equality
+   */
+  readonly isEqualTo: (other: T) => boolean;
+}

package/src/mpc/secretsharing/lagrange.ts

@@ -0,0 +1,163 @@
+import type { FiniteFieldElement } from "./finite-field-element";
+import { Polynomial } from "./polynomial";
+
+// File copied from <a href="https://gitlab.com/partisiablockchain/language/abi/zk-client"> zk-client</a>.
+
+/**
+ * Try to interpolate a polynomial that passes through the supplied points.
+ *
+ * @param xs x-coordinates in the points
+ * @param ys y-coordinates in the points
+ * @param zero 0 element in the Finite Field.
+ * @param one 1 element in the Finite Field.
+ *
+ * @returns the interpolated polynomial or null if unable to interpolate
+ */
+function interpolate<T extends FiniteFieldElement<T>>(
+  xs: readonly T[],
+  ys: T[],
+  zero: T,
+  one: T,
+): Polynomial<T> {
+  if (xs.length !== ys.length) {
+    throw new Error("xs and ys must be of same size");
+  }
+
+  if (xs.length === 0) {
+    throw new Error("xs and ys must have at least one element");
+  }
+
+  const n = xs.length;
+  const c: T[] = Array(n).fill(one);
+  c[0] = one;
+
+  for (let i = 0; i < n; i++) {
+    for (let j = i; j > 0; j--) {
+      c[j] = c[j - 1].subtract(c[j].multiply(xs[i]));
+    }
+    c[0] = c[0].multiply(xs[i].negate());
+  }
+
+  const coefficients: T[] = Array(n).fill(zero);
+  // Stryker disable next-line ArrayDeclaration
+  const tc: T[] = Array(n).fill(zero);
+  tc[n - 1] = one;
+  for (let i = 0; i < n; i++) {
+    let denominator = one;
+    for (let j = 0; j < n; j++) {
+      if (i !== j) {
+        denominator = denominator.multiply(xs[i].subtract(xs[j]));
+      }
+    }
+
+    const t: T = ys[i].multiply(denominator.modInverse());
+    coefficients[n - 1] = coefficients[n - 1].add(t.multiply(tc[n - 1]));
+
+    for (let j = n - 2; j >= 0; j--) {
+      tc[j] = c[j + 1].add(tc[j + 1].multiply(xs[i]));
+      coefficients[j] = coefficients[j].add(t.multiply(tc[j]));
+    }
+  }
+
+  return Polynomial.create(coefficients, zero);
+}
+
+/**
+ * Interpolate the minimal polynomial that passes through all the supplied points. And verify that
+ * the polynomial has a degree less that maximalDegree.
+ *
+ * @param xs x-coordinates in the points
+ * @param ys y-coordinates in the points
+ * @param zero 0 element in the Finite Field.
+ * @param one 1 element in the Finite Field.
+ * @param maximalDegree the expected maximal degree
+ * @return the interpolated polynomial
+ */
+function interpolateCheckDegree<T extends FiniteFieldElement<T>>(
+  xs: readonly T[],
+  ys: T[],
+  maximalDegree: number,
+  zero: T,
+  one: T,
+): Polynomial<T> {
+  const poly = interpolate(xs, ys, zero, one);
+  if (poly.degree() > maximalDegree) {
+    throw new Error(
+      `Interpolated polynomial has too high degree. Expected maximal=${maximalDegree}, actual=${poly.degree()}`,
+    );
+  }
+  return poly;
+}
+
+/**
+ * Try to interpolate a polynomial that passes through at least <code>2 &sdot; maximalDegree + 1
+ * </code> of the supplied points.
+ *
+ * <p>Element lists ({@code xs} and {@code ys}) must have same size.
+ *
+ * @param xs x-coordinates in the points
+ * @param ys y-coordinates in the points
+ * @param maximalDegree the expected maximal degree
+ * @param zero 0 element in the Finite Field.
+ * @param one 1 element in the Finite Field.
+ *
+ * @returns the interpolated polynomial or undefined if unable to interpolate
+ */
+function interpolateIfPossible<T extends FiniteFieldElement<T>>(
+  xs: readonly T[],
+  ys: T[],
+  maximalDegree: number,
+  zero: T,
+  one: T,
+): Polynomial<T> | undefined {
+  if (xs.length !== ys.length) {
+    throw new Error("xs and ys must be of same size");
+  }
+  return interpolateIfPossibleInner(xs, ys, maximalDegree, zero, one);
+}
+
+function interpolateIfPossibleInner<T extends FiniteFieldElement<T>>(
+  xs: readonly T[],
+  ys: T[],
+  maximalDegree: number,
+  zero: T,
+  one: T,
+): Polynomial<T> | undefined {
+  if (xs.length <= 2 * maximalDegree + 1) {
+    const interpolated = interpolate(xs, ys, zero, one);
+    if (interpolated.degree() > maximalDegree) {
+      return undefined;
+    }
+    return interpolated;
+  }
+  for (let removeIndex = 0; removeIndex < xs.length; removeIndex++) {
+    const interpolated = interpolateIfPossibleInner(
+      withoutIndex(xs, removeIndex),
+      withoutIndex(ys, removeIndex),
+      maximalDegree,
+      zero,
+      one,
+    );
+    if (interpolated !== undefined) {
+      return interpolated;
+    }
+  }
+  return undefined;
+}
+
+function withoutIndex<T>(values: readonly T[], removeIndex: number): T[] {
+  return values.filter((_value, index, _array) => index != removeIndex);
+}
+
+/**
+ * Utility for lagrange interpolation.
+ */
+export const Lagrange: {
+  interpolate: typeof interpolate;
+  interpolateCheckDegree: typeof interpolateCheckDegree;
+  interpolateIfPossible: typeof interpolateIfPossible;
+} = {
+  interpolate,
+  interpolateCheckDegree,
+  interpolateIfPossible,
+};

package/src/mpc/secretsharing/polynomial.ts

@@ -0,0 +1,84 @@
+import type { FiniteFieldElement } from "./finite-field-element";
+
+/**
+ *  Polynomials with coefficients in a finite field.
+ *
+ * <p>Copied from <a href="https://gitlab.com/partisiablockchain/language/abi/zk-client"> zk-client</a>.
+ */
+export class Polynomial<T extends FiniteFieldElement<T>> {
+  private readonly coefficients: T[];
+
+  private constructor(coefficients: T[]) {
+    this.coefficients = coefficients;
+  }
+
+  /**
+   * Construct a polynomial from a set of coefficients. The degree of the resultant polynomial is
+   * assumed to be equal to the number of coefficients minus 1. The constant term of the polynomial
+   * is assumed to be stored in the first position of the coefficients.
+   *
+   * @param coefficients the coefficients of the polynomial
+   * @param zero zero element of the field
+   * @return the constructed polynomial
+   */
+  static create<T extends FiniteFieldElement<T>>(coefficients: T[], zero: T): Polynomial<T> {
+    return new Polynomial<T>(Polynomial.filterHighZeroes(coefficients, zero));
+  }
+
+  private static filterHighZeroes<T extends FiniteFieldElement<T>>(
+    coefficients: T[],
+    zero: T,
+  ): T[] {
+    for (let i = coefficients.length - 1; i >= 0; i--) {
+      if (!coefficients[i].isZero()) {
+        return coefficients.slice(0, i + 1);
+      }
+    }
+    return [zero];
+  }
+
+  /**
+   * Returns the coefficients of the polynomial.
+   *
+   * @return the coefficients of the polynomial
+   */
+  getCoefficients(): T[] {
+    return this.coefficients.slice();
+  }
+
+  /**
+   * Returns the degree of this polynomial.
+   *
+   * @return the degree of the polynomial
+   */
+  degree(): number {
+    return this.coefficients.length - 1;
+  }
+
+  /**
+   * Returns the constant term of the polynomial.
+   *
+   * @return the term stored on position 0 of the coefficients of this polynomial
+   */
+  getConstantTerm(): T {
+    return this.coefficients[0];
+  }
+
+  /**
+   * Evaluates this polynomial on a point. That is, if F is the polynomial and x a value, then this
+   * method returns F(x).
+   *
+   * @param point the point to evaluate this polynomial on
+   * @return F(point) where F is this polynomial
+   */
+  evaluate(point: T): T {
+    const degree = this.degree();
+
+    let result = this.coefficients[degree];
+    for (let i = degree - 1; i >= 0; --i) {
+      const current = this.coefficients[i];
+      result = current.add(point.multiply(result));
+    }
+    return result;
+  }
+}

package/src/mpc/secretsharing/secret-share-factory.ts

@@ -0,0 +1,30 @@
+import type { SecretShares } from "./secret-shares";
+
+/**
+ * Factory object for create {@link SecretShares}.
+ *
+ * <p>Based on the java implementation of the secret-sharing client.
+ *
+ * @param <ShareT> Type of {@link SecretShares} create by the factory object.
+ */
+export interface SecretShareFactory<ShareT extends SecretShares> {
+  /**
+   * Create a new {@link SecretShares} from the given plaintext for the given amount of recipient
+   * nodes.
+   *
+   * <p>The factory is allowed to fail if it doesn't support the given amount of recipient nodes.
+   *
+   * @param numNodes Number of nodes to spread secret-shares across.
+   * @param plainText The plain text to be secret-shared. Not nullable.
+   * @returns Newly created {@link SecretShares}. Not nullable.
+   */
+  fromPlainText(numNodes: number, plainText: Buffer): ShareT;
+
+  /**
+   * Create a new {@link SecretShares} from the given shares.
+   *
+   * @param shares Shares to create from.
+   * @return Newly created {@link SecretShares}. Not nullable.
+   */
+  fromSharesBytes(shares: Array<Buffer | undefined>): ShareT;
+}

package/src/mpc/secretsharing/secret-shares.ts

@@ -0,0 +1,20 @@
+/**
+ * All shares of a specific secure secret-sharing scheme.
+ *
+ * <p>Constructed either from a plain-text or from all shares of the plain-text. Can be converted
+ * into the individual shares, or into the plain-text.
+ *
+ * <p>Based on the java implementation of the secret-sharing client.
+ *
+ * @see <a href="https://en.wikipedia.org/wiki/Secret_sharing">Secret sharing, Wikipedia</a>
+ */
+export interface SecretShares {
+  /** Get number of shares that this {@link SecretShares} have been split over. */
+  numShares(): number;
+
+  /** Get the secret-share for the given node index. */
+  getShareBytes(nodeIndex: number): Buffer;
+
+  /** Reconstruct plaintext from all the shares of the {@link SecretShares} object. */
+  reconstructPlainText(): Buffer;
+}

package/src/mpc/secretsharing/shamir-secret-shares.ts

@@ -0,0 +1,164 @@
+import { randomBytes } from "crypto";
+import { F256 } from "./f256";
+import { Lagrange } from "./lagrange";
+import type { SecretShareFactory } from "./secret-share-factory";
+import type { SecretShares } from "./secret-shares";
+
+/**
+ * Configuration for creating and reconstructing shamir secret shares.
+ *
+ * <p>The <code>numToReconstruct</code> value must be at least <code>numMalicious + 1</code> to be able
+ * to reconstruct.
+ *
+ * <p>If <code>numToReconstruct</code> is less than <code>2 * numMalicious + 1</code> then there must be
+ * some other way to guarantee that the shares are correct, e.g. through commitments on-chain.
+ */
+export interface ShamirConfig {
+  /** Maximum number of malicious nodes. Depends on the threat model. */
+  numMalicious: number;
+  /** Total number of nodes to receive a share. */
+  numNodes: number;
+  /** Minimum number of shares needed to reconstruct a secret. */
+  numToReconstruct: number;
+}
+
+/** Factory for creating elements of {@link ShamirSecretShares}. */
+export class ShamirFactory implements SecretShareFactory<ShamirSecretShares> {
+  private readonly shamirConfig: ShamirConfig;
+
+  /**
+   * Create the {@link ShamirFactory}.
+   *
+   * @param shamirConfig configuration for creating and reconstructing shamir secret shares.
+   */
+  constructor(shamirConfig: ShamirConfig) {
+    this.shamirConfig = shamirConfig;
+  }
+
+  fromPlainText(numNodes: number, plainText: Buffer): ShamirSecretShares {
+    if (numNodes != this.shamirConfig.numNodes) {
+      throw new Error(
+        `This shamir factory expects there to be ${this.shamirConfig.numNodes} nodes, but there was ${numNodes}.`,
+      );
+    }
+    const randomElements = randomBytes(plainText.length * this.shamirConfig.numMalicious);
+    const alphas = F256.alphas(this.shamirConfig.numNodes);
+    const shares: F256[][] = Array.from({ length: this.shamirConfig.numNodes }, () => []);
+    for (let i = 0; i < plainText.length; i++) {
+      const coefficients = [F256.createElement(plainText[i])];
+      for (let j = 0; j < this.shamirConfig.numMalicious; j++) {
+        coefficients.push(
+          F256.createElement(randomElements[this.shamirConfig.numMalicious * i + j]),
+        );
+      }
+      const poly = F256.createPoly(coefficients);
+      for (let j = 0; j < this.shamirConfig.numNodes; j++) {
+        shares[j].push(poly.evaluate(alphas[j]));
+      }
+    }
+
+    return new ShamirSecretShares(this.shamirConfig, shares);
+  }
+
+  fromSharesBytes(shares: Array<Buffer | undefined>): ShamirSecretShares {
+    const elementShares = shares.map((bytes) => {
+      if (bytes == undefined) {
+        return undefined;
+      }
+      const elements = [];
+      for (let i = 0; i < bytes.length; i++) {
+        elements.push(F256.createElement(bytes[i]));
+      }
+      return elements;
+    });
+    return new ShamirSecretShares(this.shamirConfig, elementShares);
+  }
+}
+
+/**
+ * Secure secret-sharing scheme based on shamir-secret sharing.
+ *
+ * <p>Supported number of shares ({@code N}): {@code 4}
+ *
+ * <p>Based on the java implementation of the secret-sharing client.
+ *
+ * @see <a href="https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing">Shamir's secret sharing,
+ *     Wikipedia</a>
+ */
+export class ShamirSecretShares implements SecretShares {
+  private readonly shares: Array<F256[] | undefined>;
+  private readonly shamirConfig: ShamirConfig;
+
+  constructor(shamirConfig: ShamirConfig, shares: Array<F256[] | undefined>) {
+    if (shares.length != shamirConfig.numNodes) {
+      throw new Error(`There must be ${shamirConfig.numNodes} nodes`);
+    }
+    const numReceivedShares = shares.filter((s) => s != undefined).length;
+    if (numReceivedShares < shamirConfig.numToReconstruct) {
+      throw new Error(
+        `Must have received at least ${shamirConfig.numToReconstruct} shares to reconstruct. Received ${numReceivedShares}.`,
+      );
+    }
+    this.shamirConfig = shamirConfig;
+    this.shares = shares;
+  }
+
+  getShareBytes(nodeIndex: number): Buffer {
+    const share = this.shares[nodeIndex];
+    if (share == undefined) {
+      throw new Error("Expected share to be defined");
+    }
+    return Buffer.from(share.map((field) => field.value));
+  }
+
+  numShares(): number {
+    return this.shamirConfig.numNodes;
+  }
+
+  reconstructPlainText(): Buffer {
+    const alphas = F256.alphas(this.shamirConfig.numNodes);
+    const definedAlphas: F256[] = [];
+    const definedShares: F256[][] = [];
+    for (let i = 0; i < this.shares.length; i++) {
+      const share = this.shares[i];
+      if (share != undefined) {
+        definedAlphas.push(alphas[i]);
+        definedShares.push(share);
+      }
+    }
+
+    const reconstructedElements = [];
+    const numElements = definedShares[0].length;
+    for (let i = 0; i < numElements; i++) {
+      const sharesOfIthElement = [];
+      for (let j = 0; j < definedShares.length; j++) {
+        sharesOfIthElement.push(definedShares[j][i]);
+      }
+      const interpolated = Lagrange.interpolateIfPossible(
+        definedAlphas,
+        sharesOfIthElement,
+        this.shamirConfig.numMalicious,
+        F256.ZERO,
+        F256.ONE,
+      );
+      if (interpolated === undefined) {
+        throw new Error("Unable to reconstruct secret");
+      }
+      reconstructedElements.push(interpolated.getConstantTerm().value);
+    }
+    return Buffer.from(reconstructedElements);
+  }
+
+  public static readonly FACTORY: SecretShareFactory<ShamirSecretShares> = new ShamirFactory({
+    numMalicious: 1,
+    numNodes: 4,
+    numToReconstruct: 2,
+  });
+}
+
+export function getRandomBytes(length: number): Buffer {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+
+  return Buffer.from(array);
+}

package/src/mpc/secretsharing/xor-secret-shares.ts

@@ -0,0 +1,68 @@
+import { randomBytes } from "crypto";
+import type { SecretShareFactory } from "./secret-share-factory";
+import type { SecretShares } from "./secret-shares";
+
+/**
+ * Secure secret-sharing scheme based on XOR.
+ *
+ * <p>Supported number of shares (<code>N</code>): <code>2+</code>
+ *
+ * <p>Threshold for reconstruction: <code>N</code>
+ *
+ * <p>Based on the java implementation of the secret-sharing client.
+ *
+ * @see <a href="https://en.wikipedia.org/wiki/Secret_sharing">Secret sharing, Wikipedia</a>
+ */
+export class XorSecretShares implements SecretShares {
+  private readonly shares: Buffer[];
+
+  /** The least number of shares supported by the secret sharing. */
+  public static readonly MIN_SHARES = 2;
+
+  constructor(shares: Buffer[]) {
+    if (shares.length < XorSecretShares.MIN_SHARES) {
+      throw new Error(
+        `XorSecretShares requires at least ${XorSecretShares.MIN_SHARES} shares, but specified only ${shares.length}`,
+      );
+    }
+    this.shares = shares;
+  }
+
+  getShareBytes(nodeIndex: number): Buffer {
+    return this.shares[nodeIndex];
+  }
+
+  numShares(): number {
+    return this.shares.length;
+  }
+
+  reconstructPlainText(): Buffer {
+    return xorByteArrays(this.shares[0].length, this.shares);
+  }
+
+  public static readonly FACTORY: SecretShareFactory<XorSecretShares> = {
+    fromPlainText(numNodes: number, plainText: Buffer): XorSecretShares {
+      const shares: Buffer[] = [];
+      for (let i = 0; i < numNodes - 1; i++) {
+        shares.push(randomBytes(plainText.length));
+      }
+      const finalShare = xorByteArrays(plainText.length, [...shares, plainText]);
+      shares.push(finalShare);
+      return new XorSecretShares(shares);
+    },
+    fromSharesBytes(shares: Array<Buffer | undefined>): XorSecretShares {
+      if (shares.filter((b) => b == undefined).length != 0) {
+        throw new Error("XorSecretShares must receive elements from all nodes");
+      }
+      return new XorSecretShares(shares as Buffer[]);
+    },
+  };
+}
+
+function xorByteArrays(length: number, manyBytes: Buffer[]) {
+  return Buffer.from(
+    manyBytes.reduce((previousValue, currentValue, _currentIndex, _array) => {
+      return Buffer.from(previousValue.map((value, index, _array) => value ^ currentValue[index]));
+    }, Buffer.alloc(length)),
+  );
+}