2022-04-21 21:36:18 -04:00
|
|
|
[package]
|
2022-06-19 05:21:22 -04:00
|
|
|
name = "modular-frost"
|
Smash the singular `Ciphersuite` trait into multiple
This helps identify where the various functionalities are used, or rather, not
used. The `Ciphersuite` trait present in `patches/ciphersuite`, facilitating
the entire FCMP++ tree, only requires the markers _and_ canonical point
decoding. I've opened a PR to upstream such a trait into `group`
(https://github.com/zkcrypto/group/pull/68).
`WrappedGroup` is still justified for as long as `Group::generator` exists.
Moving `::generator()` to its own trait, on an independent structure (upstream)
would be massively appreciated. @tarcieri also wanted to update from
`fn generator()` to `const GENERATOR`, which would encourage further discussion
on https://github.com/zkcrypto/group/issues/32 and
https://github.com/zkcrypto/group/issues/45, which have been stagnant.
The `Id` trait is occasionally used yet really should be first off the chopping
block.
Finally, `WithPreferredHash` is only actually used around a third of the time,
which more than justifies it being a separate trait.
---
Updates `dalek_ff_group::Scalar` to directly re-export
`curve25519_dalek::Scalar`, as without issue. `dalek_ff_group::RistrettoPoint`
also could be replaced with an export of `curve25519_dalek::RistrettoPoint`,
yet the coordinator relies on how we implemented `Hash` on it for the hell of
it so it isn't worth it at this time. `dalek_ff_group::EdwardsPoint` can't be
replaced for an re-export of `curve25519_dalek::SubgroupPoint` as it doesn't
implement `zeroize`, `subtle` traits within a released, non-yanked version.
Relevance to https://github.com/serai-dex/serai/issues/201 and
https://github.com/dalek-cryptography/curve25519-dalek/issues/811#issuecomment-3247732746.
Also updates the `Ristretto` ciphersuite to prefer `Blake2b-512` over
`SHA2-512`. In order to maintain compliance with FROST's IETF standard,
`modular-frost` defines its own ciphersuite for Ristretto which still uses
`SHA2-512`.
2025-09-03 12:25:37 -04:00
|
|
|
version = "0.11.0"
|
2022-06-19 05:21:22 -04:00
|
|
|
description = "Modular implementation of FROST over ff/group"
|
2022-04-21 21:36:18 -04:00
|
|
|
license = "MIT"
|
2022-10-15 23:46:22 -04:00
|
|
|
repository = "https://github.com/serai-dex/serai/tree/develop/crypto/frost"
|
2022-05-03 07:20:24 -04:00
|
|
|
authors = ["Luke Parker <lukeparker5132@gmail.com>"]
|
2022-06-19 05:21:22 -04:00
|
|
|
keywords = ["frost", "multisig", "threshold"]
|
2022-04-21 21:36:18 -04:00
|
|
|
edition = "2021"
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
rust-version = "1.85"
|
2022-04-21 21:36:18 -04:00
|
|
|
|
2022-09-28 07:44:49 -05:00
|
|
|
[package.metadata.docs.rs]
|
|
|
|
|
all-features = true
|
2022-09-29 04:47:55 -04:00
|
|
|
rustdoc-args = ["--cfg", "docsrs"]
|
2022-09-28 07:44:49 -05:00
|
|
|
|
2023-12-16 20:54:24 -05:00
|
|
|
[lints]
|
|
|
|
|
workspace = true
|
|
|
|
|
|
2022-04-21 21:36:18 -04:00
|
|
|
[dependencies]
|
2025-09-15 23:16:11 -04:00
|
|
|
std-shims = { version = "0.1", path = "../../common/std-shims", default-features = false, features = ["alloc"] }
|
2022-04-21 21:36:18 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
thiserror = { version = "2", default-features = false }
|
Utilize zeroize (#76)
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
2022-08-03 03:25:18 -05:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
rand_core = { version = "0.6", default-features = false, features = ["alloc"] }
|
|
|
|
|
rand_chacha = { version = "0.3", default-features = false }
|
Utilize zeroize (#76)
* Apply Zeroize to nonces used in Bulletproofs
Also makes bit decomposition constant time for a given amount of
outputs.
* Fix nonce reuse for single-signer CLSAG
* Attach Zeroize to most structures in Monero, and ZOnDrop to anything with private data
* Zeroize private keys and nonces
* Merge prepare_outputs and prepare_transactions
* Ensure CLSAG is constant time
* Pass by borrow where needed, bug fixes
The past few commitments have been one in-progress chunk which I've
broken up as best read.
* Add Zeroize to FROST structs
Still needs to zeroize internally, yet next step. Not quite as
aggressive as Monero, partially due to the limitations of HashMaps,
partially due to less concern about metadata, yet does still delete a
few smaller items of metadata (group key, context string...).
* Remove Zeroize from most Monero multisig structs
These structs largely didn't have private data, just fields with private
data, yet those fields implemented ZeroizeOnDrop making them already
covered. While there is still traces of the transaction left in RAM,
fully purging that was never the intent.
* Use Zeroize within dleq
bitvec doesn't offer Zeroize, so a manual zeroing has been implemented.
* Use Zeroize for random_nonce
It isn't perfect, due to the inability to zeroize the digest, and due to
kp256 requiring a few transformations. It does the best it can though.
Does move the per-curve random_nonce to a provided one, which is allowed
as of https://github.com/cfrg/draft-irtf-cfrg-frost/pull/231.
* Use Zeroize on FROST keygen/signing
* Zeroize constant time multiexp.
* Correct when FROST keygen zeroizes
* Move the FROST keys Arc into FrostKeys
Reduces amount of instances in memory.
* Manually implement Debug for FrostCore to not leak the secret share
* Misc bug fixes
* clippy + multiexp test bug fixes
* Correct FROST key gen share summation
It leaked our own share for ourself.
* Fix cross-group DLEq tests
2022-08-03 03:25:18 -05:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
zeroize = { version = "^1.5", default-features = false, features = ["alloc", "zeroize_derive"] }
|
|
|
|
|
subtle = { version = "^2.4", default-features = false }
|
2022-04-21 21:36:18 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
hex = { version = "0.4", default-features = false, features = ["alloc"], optional = true }
|
2022-06-06 02:18:25 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
transcript = { package = "flexible-transcript", path = "../transcript", version = "^0.3.2", default-features = false, features = ["recommended"] }
|
2022-06-05 16:08:51 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
dalek-ff-group = { path = "../dalek-ff-group", version = "0.5", default-features = false, features = ["alloc"], optional = true }
|
|
|
|
|
minimal-ed448 = { path = "../ed448", version = "0.4", default-features = false, features = ["alloc"], optional = true }
|
|
|
|
|
|
|
|
|
|
ciphersuite = { path = "../ciphersuite", version = "^0.4.1", default-features = false, features = ["alloc"] }
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
sha2 = { version = "0.10.0", default-features = false, optional = true }
|
|
|
|
|
elliptic-curve = { version = "0.13", default-features = false, features = ["hash2curve"], optional = true }
|
2025-09-15 23:16:11 -04:00
|
|
|
ciphersuite-kp256 = { path = "../ciphersuite/kp256", version = "0.4", default-features = false, features = ["alloc"], optional = true }
|
2023-03-07 03:46:16 -05:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
multiexp = { path = "../multiexp", version = "0.4", default-features = false, features = ["alloc", "batch"] }
|
2022-05-03 07:42:09 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
schnorr = { package = "schnorr-signatures", path = "../schnorr", version = "^0.5.1", default-features = false, features = ["alloc"] }
|
2022-07-12 01:28:01 -04:00
|
|
|
|
2025-09-15 23:16:11 -04:00
|
|
|
dkg = { path = "../dkg", version = "0.6.1", default-features = false }
|
|
|
|
|
dkg-recovery = { path = "../dkg/recovery", version = "0.6", default-features = false, optional = true }
|
|
|
|
|
dkg-dealer = { path = "../dkg/dealer", version = "0.6", default-features = false, optional = true }
|
2022-10-29 03:54:42 -05:00
|
|
|
|
2022-04-21 21:36:18 -04:00
|
|
|
[dev-dependencies]
|
2023-03-07 06:25:21 -05:00
|
|
|
hex = "0.4"
|
2023-11-13 05:31:47 -05:00
|
|
|
serde_json = { version = "1", default-features = false, features = ["std"] }
|
2022-06-05 16:08:51 -04:00
|
|
|
|
2025-08-18 01:54:52 -04:00
|
|
|
dkg = { path = "../dkg", default-features = false, features = ["std"] }
|
|
|
|
|
dkg-recovery = { path = "../dkg/recovery", default-features = false, features = ["std"] }
|
2025-08-18 02:13:12 -04:00
|
|
|
dkg-dealer = { path = "../dkg/dealer", default-features = false, features = ["std"] }
|
2022-11-14 19:20:56 -05:00
|
|
|
|
2022-06-05 16:08:51 -04:00
|
|
|
[features]
|
2025-09-15 23:16:11 -04:00
|
|
|
std = [
|
|
|
|
|
"std-shims/std",
|
|
|
|
|
|
|
|
|
|
"thiserror/std",
|
|
|
|
|
|
|
|
|
|
"rand_core/std",
|
|
|
|
|
"rand_chacha/std",
|
|
|
|
|
|
|
|
|
|
"zeroize/std",
|
|
|
|
|
"subtle/std",
|
|
|
|
|
|
|
|
|
|
"hex?/std",
|
|
|
|
|
|
|
|
|
|
"transcript/std",
|
|
|
|
|
|
|
|
|
|
"dalek-ff-group?/std",
|
|
|
|
|
"minimal-ed448?/std",
|
|
|
|
|
|
|
|
|
|
"ciphersuite/std",
|
|
|
|
|
"sha2?/std",
|
|
|
|
|
"elliptic-curve?/std",
|
|
|
|
|
"ciphersuite-kp256?/std",
|
|
|
|
|
|
|
|
|
|
"multiexp/std",
|
|
|
|
|
|
|
|
|
|
"schnorr/std",
|
|
|
|
|
|
|
|
|
|
"dkg/std",
|
|
|
|
|
"dkg-recovery?/std",
|
|
|
|
|
"dkg-dealer?/std",
|
|
|
|
|
]
|
|
|
|
|
|
2025-08-20 04:50:37 -04:00
|
|
|
ed25519 = ["dalek-ff-group"]
|
|
|
|
|
ristretto = ["dalek-ff-group"]
|
2022-08-29 02:32:59 -05:00
|
|
|
|
Replace `Ciphersuite::hash_to_F`
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a
DST, yet were not require to securely handle it. It was also biased towards the
requirements of `modular-frost` as `ciphersuite` was originally written all
those years ago, when `modular-frost` had needs exceeding what `ff`, `group`
satisfied.
Now, the hash is bound to produce an output which can be converted to a scalar
with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument
of the value to hash (removing the potential to insecurely handle the DST by
removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet
`FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines
a `FromUniformBytes` trait taking an array (then implemented for all satisfiers
of `ff::FromUniformBytes`). In order to get the array type from the
`GenericArray`, the output of the hash, `digest` is updated to the `0.11`
release candidate which moves to `flexible-array` which solves that problem.
The existing, specific `hash_to_F` functions have been moved to `modular-frost`
as necessary.
`flexible-array` itself is patched to a fork due to
https://github.com/RustCrypto/hybrid-array/issues/131.
2025-08-29 05:04:03 -04:00
|
|
|
secp256k1 = ["sha2", "elliptic-curve", "ciphersuite-kp256"]
|
|
|
|
|
p256 = ["sha2", "elliptic-curve", "ciphersuite-kp256"]
|
2022-08-29 02:32:59 -05:00
|
|
|
|
2025-08-20 04:50:37 -04:00
|
|
|
ed448 = ["minimal-ed448"]
|
2022-10-15 23:46:22 -04:00
|
|
|
|
2025-08-20 04:50:37 -04:00
|
|
|
tests = ["hex", "rand_core/getrandom", "dkg-dealer", "dkg-recovery"]
|
2025-09-15 23:16:11 -04:00
|
|
|
|
|
|
|
|
default = ["std"]
|