Create a dedicated crate for the DKG (#141)

* Add dkg crate

* Remove F_len and G_len

They're generally no longer used.

* Replace hash_to_vec with a provided method around associated type H: Digest

Part of trying to minimize this trait so it can be moved elsewhere. Vec, 
which isn't std, may have been a blocker.

* Encrypt secret shares within the FROST library

Reduces requirements on callers in order to be correct.

* Update usage of Zeroize within FROST

* Inline functions in key_gen

There was no reason to have them separated as they were. sign probably 
has the same statement available, yet that isn't the focus right now.

* Add a ciphersuite package which provides hash_to_F

* Set the Ciphersuite version to something valid

* Have ed448 export Scalar/FieldElement/Point at the top level

* Move FROST over to Ciphersuite

* Correct usage of ff in ciphersuite

* Correct documentation handling

* Move Schnorr signatures to their own crate

* Remove unused feature from schnorr

* Fix Schnorr tests

* Split DKG into a separate crate

* Add serialize to Commitments and SecretShare

Helper for buf = vec![]; .write(buf).unwrap(); buf

* Move FROST over to the new dkg crate

* Update Monero lib to latest FROST

* Correct ethereum's usage of features

* Add serialize to GeneratorProof

* Add serialize helper function to FROST

* Rename AddendumSerialize to WriteAddendum

* Update processor

* Slight fix to processor

crypto/dkg/src/frost.rs

@@ -0,0 +1,458 @@
+use std::{
+  marker::PhantomData,
+  io::{self, Read, Write},
+  collections::HashMap,
+};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use digest::Digest;
+use hkdf::{Hkdf, hmac::SimpleHmac};
+use chacha20::{
+  cipher::{crypto_common::KeyIvInit, StreamCipher},
+  Key as Cc20Key, Nonce as Cc20Iv, ChaCha20,
+};
+
+use group::{
+  ff::{Field, PrimeField},
+  GroupEncoding,
+};
+
+use ciphersuite::Ciphersuite;
+
+use multiexp::{multiexp_vartime, BatchVerifier};
+
+use schnorr::SchnorrSignature;
+
+use crate::{DkgError, ThresholdParams, ThresholdCore, validate_map};
+
+#[allow(non_snake_case)]
+fn challenge<C: Ciphersuite>(context: &str, l: u16, R: &[u8], Am: &[u8]) -> C::F {
+  const DST: &[u8] = b"FROST Schnorr Proof of Knowledge";
+
+  // Hashes the context to get a fixed size value out of it
+  let mut transcript = C::H::digest(context.as_bytes()).as_ref().to_vec();
+  transcript.extend(l.to_be_bytes());
+  transcript.extend(R);
+  transcript.extend(Am);
+  C::hash_to_F(DST, &transcript)
+}
+
+/// Commitments message to be broadcast to all other parties.
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct Commitments<C: Ciphersuite> {
+  commitments: Vec<C::G>,
+  enc_key: C::G,
+  cached_msg: Vec<u8>,
+  sig: SchnorrSignature<C>,
+}
+impl<C: Ciphersuite> Drop for Commitments<C> {
+  fn drop(&mut self) {
+    self.zeroize();
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for Commitments<C> {}
+
+impl<C: Ciphersuite> Commitments<C> {
+  pub fn read<R: Read>(reader: &mut R, params: ThresholdParams) -> io::Result<Self> {
+    let mut commitments = Vec::with_capacity(params.t().into());
+    let mut cached_msg = vec![];
+
+    #[allow(non_snake_case)]
+    let mut read_G = || -> io::Result<C::G> {
+      let mut buf = <C::G as GroupEncoding>::Repr::default();
+      reader.read_exact(buf.as_mut())?;
+      let point = C::read_G(&mut buf.as_ref())?;
+      cached_msg.extend(buf.as_ref());
+      Ok(point)
+    };
+
+    for _ in 0 .. params.t() {
+      commitments.push(read_G()?);
+    }
+    let enc_key = read_G()?;
+
+    Ok(Commitments { commitments, enc_key, cached_msg, sig: SchnorrSignature::read(reader)? })
+  }
+
+  pub fn write<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(&self.cached_msg)?;
+    self.sig.write(writer)
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = vec![];
+    self.write(&mut buf).unwrap();
+    buf
+  }
+}
+
+/// State machine to begin the key generation protocol.
+pub struct KeyGenMachine<C: Ciphersuite> {
+  params: ThresholdParams,
+  context: String,
+  _curve: PhantomData<C>,
+}
+
+impl<C: Ciphersuite> KeyGenMachine<C> {
+  /// Creates a new machine to generate a key for the specified curve in the specified multisig.
+  // The context string should be unique among multisigs.
+  pub fn new(params: ThresholdParams, context: String) -> KeyGenMachine<C> {
+    KeyGenMachine { params, context, _curve: PhantomData }
+  }
+
+  /// Start generating a key according to the FROST DKG spec.
+  /// Returns a commitments message to be sent to all parties over an authenticated channel. If any
+  /// party submits multiple sets of commitments, they MUST be treated as malicious.
+  pub fn generate_coefficients<R: RngCore + CryptoRng>(
+    self,
+    rng: &mut R,
+  ) -> (SecretShareMachine<C>, Commitments<C>) {
+    let t = usize::from(self.params.t);
+    let mut coefficients = Vec::with_capacity(t);
+    let mut commitments = Vec::with_capacity(t);
+    let mut cached_msg = vec![];
+
+    for i in 0 .. t {
+      // Step 1: Generate t random values to form a polynomial with
+      coefficients.push(C::random_nonzero_F(&mut *rng));
+      // Step 3: Generate public commitments
+      commitments.push(C::generator() * coefficients[i]);
+      cached_msg.extend(commitments[i].to_bytes().as_ref());
+    }
+
+    // Generate an encryption key for transmitting the secret shares
+    // It would probably be perfectly fine to use one of our polynomial elements, yet doing so
+    // puts the integrity of FROST at risk. While there's almost no way it could, as it's used in
+    // an ECDH with validated group elemnents, better to avoid any questions on it
+    let enc_key = C::random_nonzero_F(&mut *rng);
+    let pub_enc_key = C::generator() * enc_key;
+    cached_msg.extend(pub_enc_key.to_bytes().as_ref());
+
+    // Step 2: Provide a proof of knowledge
+    let mut r = C::random_nonzero_F(rng);
+    let sig = SchnorrSignature::<C>::sign(
+      coefficients[0],
+      // This could be deterministic as the PoK is a singleton never opened up to cooperative
+      // discussion
+      // There's no reason to spend the time and effort to make this deterministic besides a
+      // general obsession with canonicity and determinism though
+      r,
+      challenge::<C>(
+        &self.context,
+        self.params.i(),
+        (C::generator() * r).to_bytes().as_ref(),
+        &cached_msg,
+      ),
+    );
+    r.zeroize();
+
+    // Step 4: Broadcast
+    (
+      SecretShareMachine {
+        params: self.params,
+        context: self.context,
+        coefficients,
+        our_commitments: commitments.clone(),
+        enc_key,
+      },
+      Commitments { commitments, enc_key: pub_enc_key, cached_msg, sig },
+    )
+  }
+}
+
+fn polynomial<F: PrimeField>(coefficients: &[F], l: u16) -> F {
+  let l = F::from(u64::from(l));
+  let mut share = F::zero();
+  for (idx, coefficient) in coefficients.iter().rev().enumerate() {
+    share += coefficient;
+    if idx != (coefficients.len() - 1) {
+      share *= l;
+    }
+  }
+  share
+}
+
+/// Secret share to be sent to the party it's intended for over an authenticated channel.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct SecretShare<F: PrimeField>(F::Repr);
+impl<F: PrimeField> Zeroize for SecretShare<F> {
+  fn zeroize(&mut self) {
+    self.0.as_mut().zeroize()
+  }
+}
+impl<F: PrimeField> Drop for SecretShare<F> {
+  fn drop(&mut self) {
+    self.zeroize();
+  }
+}
+impl<F: PrimeField> ZeroizeOnDrop for SecretShare<F> {}
+
+impl<F: PrimeField> SecretShare<F> {
+  pub fn read<R: Read>(reader: &mut R) -> io::Result<Self> {
+    let mut repr = F::Repr::default();
+    reader.read_exact(repr.as_mut())?;
+    Ok(SecretShare(repr))
+  }
+
+  pub fn write<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(self.0.as_ref())
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = vec![];
+    self.write(&mut buf).unwrap();
+    buf
+  }
+}
+
+fn create_ciphers<C: Ciphersuite>(
+  mut sender: <C::G as GroupEncoding>::Repr,
+  receiver: &mut <C::G as GroupEncoding>::Repr,
+  ecdh: &mut <C::G as GroupEncoding>::Repr,
+) -> (ChaCha20, ChaCha20) {
+  let directional = |sender: &mut <C::G as GroupEncoding>::Repr| {
+    let mut key = Cc20Key::default();
+    key.copy_from_slice(
+      &Hkdf::<C::H, SimpleHmac<C::H>>::extract(
+        Some(b"key"),
+        &[sender.as_ref(), ecdh.as_ref()].concat(),
+      )
+      .0
+      .as_ref()[.. 32],
+    );
+    let mut iv = Cc20Iv::default();
+    iv.copy_from_slice(
+      &Hkdf::<C::H, SimpleHmac<C::H>>::extract(
+        Some(b"iv"),
+        &[sender.as_ref(), ecdh.as_ref()].concat(),
+      )
+      .0
+      .as_ref()[.. 12],
+    );
+    sender.as_mut().zeroize();
+
+    let res = ChaCha20::new(&key, &iv);
+    <Cc20Key as AsMut<[u8]>>::as_mut(&mut key).zeroize();
+    <Cc20Iv as AsMut<[u8]>>::as_mut(&mut iv).zeroize();
+    res
+  };
+
+  let res = (directional(&mut sender), directional(receiver));
+  ecdh.as_mut().zeroize();
+  res
+}
+
+/// Advancement of the key generation state machine.
+#[derive(Zeroize)]
+pub struct SecretShareMachine<C: Ciphersuite> {
+  params: ThresholdParams,
+  context: String,
+  coefficients: Vec<C::F>,
+  our_commitments: Vec<C::G>,
+  enc_key: C::F,
+}
+impl<C: Ciphersuite> Drop for SecretShareMachine<C> {
+  fn drop(&mut self) {
+    self.zeroize()
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for SecretShareMachine<C> {}
+
+impl<C: Ciphersuite> SecretShareMachine<C> {
+  /// Verify the data from the previous round (canonicity, PoKs, message authenticity)
+  fn verify_r1<R: RngCore + CryptoRng>(
+    &mut self,
+    rng: &mut R,
+    mut commitments: HashMap<u16, Commitments<C>>,
+  ) -> Result<(HashMap<u16, Vec<C::G>>, HashMap<u16, C::G>), DkgError> {
+    validate_map(&commitments, &(1 ..= self.params.n()).collect::<Vec<_>>(), self.params.i())?;
+
+    let mut enc_keys = HashMap::new();
+    let mut batch = BatchVerifier::<u16, C::G>::new(commitments.len());
+    let mut commitments = commitments
+      .drain()
+      .map(|(l, mut msg)| {
+        enc_keys.insert(l, msg.enc_key);
+        msg.enc_key.zeroize();
+
+        // Step 5: Validate each proof of knowledge
+        // This is solely the prep step for the latter batch verification
+        msg.sig.batch_verify(
+          rng,
+          &mut batch,
+          l,
+          msg.commitments[0],
+          challenge::<C>(&self.context, l, msg.sig.R.to_bytes().as_ref(), &msg.cached_msg),
+        );
+
+        (l, msg.commitments.drain(..).collect::<Vec<_>>())
+      })
+      .collect::<HashMap<_, _>>();
+
+    batch.verify_with_vartime_blame().map_err(DkgError::InvalidProofOfKnowledge)?;
+
+    commitments.insert(self.params.i, self.our_commitments.drain(..).collect());
+    Ok((commitments, enc_keys))
+  }
+
+  /// Continue generating a key.
+  /// Takes in everyone else's commitments. Returns a HashMap of secret shares to be sent over
+  /// authenticated channels to their relevant counterparties.
+  pub fn generate_secret_shares<R: RngCore + CryptoRng>(
+    mut self,
+    rng: &mut R,
+    commitments: HashMap<u16, Commitments<C>>,
+  ) -> Result<(KeyMachine<C>, HashMap<u16, SecretShare<C::F>>), DkgError> {
+    let (commitments, mut enc_keys) = self.verify_r1(&mut *rng, commitments)?;
+
+    // Step 1: Generate secret shares for all other parties
+    let mut sender = (C::generator() * self.enc_key).to_bytes();
+    let mut ciphers = HashMap::new();
+    let mut res = HashMap::new();
+    for l in 1 ..= self.params.n() {
+      // Don't insert our own shares to the byte buffer which is meant to be sent around
+      // An app developer could accidentally send it. Best to keep this black boxed
+      if l == self.params.i() {
+        continue;
+      }
+
+      let (mut cipher_send, cipher_recv) = {
+        let receiver = enc_keys.get_mut(&l).unwrap();
+        let mut ecdh = (*receiver * self.enc_key).to_bytes();
+
+        create_ciphers::<C>(sender, &mut receiver.to_bytes(), &mut ecdh)
+      };
+
+      let mut share = polynomial(&self.coefficients, l);
+      let mut share_bytes = share.to_repr();
+      share.zeroize();
+
+      cipher_send.apply_keystream(share_bytes.as_mut());
+      drop(cipher_send);
+
+      ciphers.insert(l, cipher_recv);
+      res.insert(l, SecretShare::<C::F>(share_bytes));
+      share_bytes.as_mut().zeroize();
+    }
+    self.enc_key.zeroize();
+    sender.as_mut().zeroize();
+
+    // Calculate our own share
+    let share = polynomial(&self.coefficients, self.params.i());
+
+    self.coefficients.zeroize();
+
+    Ok((KeyMachine { params: self.params, secret: share, commitments, ciphers }, res))
+  }
+}
+
+/// Final step of the key generation protocol.
+pub struct KeyMachine<C: Ciphersuite> {
+  params: ThresholdParams,
+  secret: C::F,
+  ciphers: HashMap<u16, ChaCha20>,
+  commitments: HashMap<u16, Vec<C::G>>,
+}
+impl<C: Ciphersuite> Zeroize for KeyMachine<C> {
+  fn zeroize(&mut self) {
+    self.params.zeroize();
+    self.secret.zeroize();
+
+    // cipher implements ZeroizeOnDrop and zeroizes on drop, yet doesn't implement Zeroize
+    // The following is redundant, as Rust should automatically handle dropping it, yet it shows
+    // awareness of this quirk and at least attempts to be comprehensive
+    for (_, cipher) in self.ciphers.drain() {
+      drop(cipher);
+    }
+
+    for (_, commitments) in self.commitments.iter_mut() {
+      commitments.zeroize();
+    }
+  }
+}
+impl<C: Ciphersuite> Drop for KeyMachine<C> {
+  fn drop(&mut self) {
+    self.zeroize()
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for KeyMachine<C> {}
+
+impl<C: Ciphersuite> KeyMachine<C> {
+  /// Complete key generation.
+  /// Takes in everyone elses' shares submitted to us. Returns a ThresholdCore object representing
+  /// the generated keys. Successful protocol completion MUST be confirmed by all parties before
+  /// these keys may be safely used.
+  pub fn complete<R: RngCore + CryptoRng>(
+    mut self,
+    rng: &mut R,
+    mut shares: HashMap<u16, SecretShare<C::F>>,
+  ) -> Result<ThresholdCore<C>, DkgError> {
+    let mut secret_share = self.secret;
+    self.secret.zeroize();
+
+    validate_map(&shares, &(1 ..= self.params.n()).collect::<Vec<_>>(), self.params.i())?;
+
+    // Calculate the exponent for a given participant and apply it to a series of commitments
+    // Initially used with the actual commitments to verify the secret share, later used with
+    // stripes to generate the verification shares
+    let exponential = |i: u16, values: &[_]| {
+      let i = C::F::from(i.into());
+      let mut res = Vec::with_capacity(self.params.t().into());
+      (0 .. usize::from(self.params.t())).into_iter().fold(C::F::one(), |exp, l| {
+        res.push((exp, values[l]));
+        exp * i
+      });
+      res
+    };
+
+    let mut batch = BatchVerifier::new(shares.len());
+    for (l, mut share_bytes) in shares.drain() {
+      let mut cipher = self.ciphers.remove(&l).unwrap();
+      cipher.apply_keystream(share_bytes.0.as_mut());
+      drop(cipher);
+
+      let mut share: C::F =
+        Option::from(C::F::from_repr(share_bytes.0)).ok_or(DkgError::InvalidShare(l))?;
+      share_bytes.zeroize();
+      secret_share += share;
+
+      // This can be insecurely linearized from n * t to just n using the below sums for a given
+      // stripe. Doing so uses naive addition which is subject to malleability. The only way to
+      // ensure that malleability isn't present is to use this n * t algorithm, which runs
+      // per sender and not as an aggregate of all senders, which also enables blame
+      let mut values = exponential(self.params.i, &self.commitments[&l]);
+      values.push((-share, C::generator()));
+      share.zeroize();
+
+      batch.queue(rng, l, values);
+    }
+    batch.verify_with_vartime_blame().map_err(DkgError::InvalidShare)?;
+
+    // Stripe commitments per t and sum them in advance. Calculating verification shares relies on
+    // these sums so preprocessing them is a massive speedup
+    // If these weren't just sums, yet the tables used in multiexp, this would be further optimized
+    // As of right now, each multiexp will regenerate them
+    let mut stripes = Vec::with_capacity(usize::from(self.params.t()));
+    for t in 0 .. usize::from(self.params.t()) {
+      stripes.push(self.commitments.values().map(|commitments| commitments[t]).sum());
+    }
+
+    // Calculate each user's verification share
+    let mut verification_shares = HashMap::new();
+    for i in 1 ..= self.params.n() {
+      verification_shares.insert(i, multiexp_vartime(&exponential(i, &stripes)));
+    }
+    // Removing this check would enable optimizing the above from t + (n * t) to t + ((n - 1) * t)
+    debug_assert_eq!(C::generator() * secret_share, verification_shares[&self.params.i()]);
+
+    Ok(ThresholdCore {
+      params: self.params,
+      secret_share,
+      group_key: stripes[0],
+      verification_shares,
+    })
+  }
+}

crypto/dkg/src/lib.rs

@@ -0,0 +1,399 @@
+#![cfg_attr(docsrs, feature(doc_cfg))]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+
+//! A collection of implementations of various distributed key generation protocols.
+//! They all resolve into the provided Threshold types intended to enable their modularity.
+//! Additional utilities around them, such as promotion from one generator to another, are also
+//! provided.
+
+use core::fmt::Debug;
+use std::{io::Read, sync::Arc, collections::HashMap};
+
+use thiserror::Error;
+
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use group::{
+  ff::{Field, PrimeField},
+  GroupEncoding,
+};
+
+use ciphersuite::Ciphersuite;
+
+/// The distributed key generation protocol described in the
+/// [FROST paper](https://eprint.iacr.org/2020/852).
+pub mod frost;
+
+/// Promote keys between ciphersuites.
+pub mod promote;
+
+/// Tests for application-provided curves and algorithms.
+#[cfg(any(test, feature = "tests"))]
+pub mod tests;
+
+// Validate a map of values to have the expected included participants
+pub(crate) fn validate_map<T>(
+  map: &HashMap<u16, T>,
+  included: &[u16],
+  ours: u16,
+) -> Result<(), DkgError> {
+  if (map.len() + 1) != included.len() {
+    Err(DkgError::InvalidParticipantQuantity(included.len(), map.len() + 1))?;
+  }
+
+  for included in included {
+    if *included == ours {
+      if map.contains_key(included) {
+        Err(DkgError::DuplicatedIndex(*included))?;
+      }
+      continue;
+    }
+
+    if !map.contains_key(included) {
+      Err(DkgError::MissingParticipant(*included))?;
+    }
+  }
+
+  Ok(())
+}
+
+/// Parameters for a multisig.
+// These fields should not be made public as they should be static
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub struct ThresholdParams {
+  /// Participants needed to sign on behalf of the group.
+  t: u16,
+  /// Amount of participants.
+  n: u16,
+  /// Index of the participant being acted for.
+  i: u16,
+}
+
+impl ThresholdParams {
+  pub fn new(t: u16, n: u16, i: u16) -> Result<ThresholdParams, DkgError> {
+    if (t == 0) || (n == 0) {
+      Err(DkgError::ZeroParameter(t, n))?;
+    }
+
+    // When t == n, this shouldn't be used (MuSig2 and other variants of MuSig exist for a reason),
+    // but it's not invalid to do so
+    if t > n {
+      Err(DkgError::InvalidRequiredQuantity(t, n))?;
+    }
+    if (i == 0) || (i > n) {
+      Err(DkgError::InvalidParticipantIndex(n, i))?;
+    }
+
+    Ok(ThresholdParams { t, n, i })
+  }
+
+  pub fn t(&self) -> u16 {
+    self.t
+  }
+  pub fn n(&self) -> u16 {
+    self.n
+  }
+  pub fn i(&self) -> u16 {
+    self.i
+  }
+}
+
+/// Various errors possible during key generation/signing.
+#[derive(Copy, Clone, Error, Debug)]
+pub enum DkgError {
+  #[error("a parameter was 0 (required {0}, participants {1})")]
+  ZeroParameter(u16, u16),
+  #[error("invalid amount of required participants (max {1}, got {0})")]
+  InvalidRequiredQuantity(u16, u16),
+  #[error("invalid participant index (0 < index <= {0}, yet index is {1})")]
+  InvalidParticipantIndex(u16, u16),
+
+  #[error("invalid signing set")]
+  InvalidSigningSet,
+  #[error("invalid participant quantity (expected {0}, got {1})")]
+  InvalidParticipantQuantity(usize, usize),
+  #[error("duplicated participant index ({0})")]
+  DuplicatedIndex(u16),
+  #[error("missing participant {0}")]
+  MissingParticipant(u16),
+
+  #[error("invalid proof of knowledge (participant {0})")]
+  InvalidProofOfKnowledge(u16),
+  #[error("invalid share (participant {0})")]
+  InvalidShare(u16),
+
+  #[error("internal error ({0})")]
+  InternalError(&'static str),
+}
+
+/// Calculate the lagrange coefficient for a signing set.
+pub fn lagrange<F: PrimeField>(i: u16, included: &[u16]) -> F {
+  let mut num = F::one();
+  let mut denom = F::one();
+  for l in included {
+    if i == *l {
+      continue;
+    }
+
+    let share = F::from(u64::try_from(*l).unwrap());
+    num *= share;
+    denom *= share - F::from(u64::try_from(i).unwrap());
+  }
+
+  // Safe as this will only be 0 if we're part of the above loop
+  // (which we have an if case to avoid)
+  num * denom.invert().unwrap()
+}
+
+/// Keys and verification shares generated by a DKG.
+/// Called core as they're expected to be wrapped into an Arc before usage in various operations.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ThresholdCore<C: Ciphersuite> {
+  /// Threshold Parameters.
+  params: ThresholdParams,
+
+  /// Secret share key.
+  secret_share: C::F,
+  /// Group key.
+  group_key: C::G,
+  /// Verification shares.
+  verification_shares: HashMap<u16, C::G>,
+}
+
+impl<C: Ciphersuite> Zeroize for ThresholdCore<C> {
+  fn zeroize(&mut self) {
+    self.params.zeroize();
+    self.secret_share.zeroize();
+    self.group_key.zeroize();
+    for (_, share) in self.verification_shares.iter_mut() {
+      share.zeroize();
+    }
+  }
+}
+impl<C: Ciphersuite> Drop for ThresholdCore<C> {
+  fn drop(&mut self) {
+    self.zeroize()
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for ThresholdCore<C> {}
+
+impl<C: Ciphersuite> ThresholdCore<C> {
+  pub(crate) fn new(
+    params: ThresholdParams,
+    secret_share: C::F,
+    verification_shares: HashMap<u16, C::G>,
+  ) -> ThresholdCore<C> {
+    #[cfg(debug_assertions)]
+    validate_map(&verification_shares, &(0 ..= params.n).collect::<Vec<_>>(), 0).unwrap();
+
+    let t = (1 ..= params.t).collect::<Vec<_>>();
+    ThresholdCore {
+      params,
+      secret_share,
+      group_key: t.iter().map(|i| verification_shares[i] * lagrange::<C::F>(*i, &t)).sum(),
+      verification_shares,
+    }
+  }
+  pub fn params(&self) -> ThresholdParams {
+    self.params
+  }
+
+  pub fn secret_share(&self) -> C::F {
+    self.secret_share
+  }
+
+  pub fn group_key(&self) -> C::G {
+    self.group_key
+  }
+
+  pub(crate) fn verification_shares(&self) -> HashMap<u16, C::G> {
+    self.verification_shares.clone()
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    serialized.extend(u32::try_from(C::ID.len()).unwrap().to_be_bytes());
+    serialized.extend(C::ID);
+    serialized.extend(self.params.t.to_be_bytes());
+    serialized.extend(self.params.n.to_be_bytes());
+    serialized.extend(self.params.i.to_be_bytes());
+    serialized.extend(self.secret_share.to_repr().as_ref());
+    for l in 1 ..= self.params.n {
+      serialized.extend(self.verification_shares[&l].to_bytes().as_ref());
+    }
+    serialized
+  }
+
+  pub fn deserialize<R: Read>(reader: &mut R) -> Result<ThresholdCore<C>, DkgError> {
+    {
+      let missing = DkgError::InternalError("ThresholdCore serialization is missing its curve");
+      let different = DkgError::InternalError("deserializing ThresholdCore for another curve");
+
+      let mut id_len = [0; 4];
+      reader.read_exact(&mut id_len).map_err(|_| missing)?;
+      if u32::try_from(C::ID.len()).unwrap().to_be_bytes() != id_len {
+        Err(different)?;
+      }
+
+      let mut id = vec![0; C::ID.len()];
+      reader.read_exact(&mut id).map_err(|_| missing)?;
+      if id != C::ID {
+        Err(different)?;
+      }
+    }
+
+    let (t, n, i) = {
+      let mut read_u16 = || {
+        let mut value = [0; 2];
+        reader
+          .read_exact(&mut value)
+          .map_err(|_| DkgError::InternalError("missing participant quantities"))?;
+        Ok(u16::from_be_bytes(value))
+      };
+      (read_u16()?, read_u16()?, read_u16()?)
+    };
+
+    let secret_share =
+      C::read_F(reader).map_err(|_| DkgError::InternalError("invalid secret share"))?;
+
+    let mut verification_shares = HashMap::new();
+    for l in 1 ..= n {
+      verification_shares.insert(
+        l,
+        <C as Ciphersuite>::read_G(reader)
+          .map_err(|_| DkgError::InternalError("invalid verification share"))?,
+      );
+    }
+
+    Ok(ThresholdCore::new(
+      ThresholdParams::new(t, n, i).map_err(|_| DkgError::InternalError("invalid parameters"))?,
+      secret_share,
+      verification_shares,
+    ))
+  }
+}
+
+/// Threshold keys usable for signing.
+#[derive(Clone, Debug, Zeroize)]
+pub struct ThresholdKeys<C: Ciphersuite> {
+  /// Core keys.
+  #[zeroize(skip)]
+  core: Arc<ThresholdCore<C>>,
+
+  /// Offset applied to these keys.
+  pub(crate) offset: Option<C::F>,
+}
+
+// Manually implement Drop due to https://github.com/RustCrypto/utils/issues/786
+impl<C: Ciphersuite> Drop for ThresholdKeys<C> {
+  fn drop(&mut self) {
+    self.zeroize()
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for ThresholdKeys<C> {}
+
+/// View of keys passed to algorithm implementations.
+#[derive(Clone, Zeroize)]
+pub struct ThresholdView<C: Ciphersuite> {
+  group_key: C::G,
+  #[zeroize(skip)]
+  included: Vec<u16>,
+  secret_share: C::F,
+  #[zeroize(skip)]
+  verification_shares: HashMap<u16, C::G>,
+}
+
+impl<C: Ciphersuite> Drop for ThresholdView<C> {
+  fn drop(&mut self) {
+    self.zeroize()
+  }
+}
+impl<C: Ciphersuite> ZeroizeOnDrop for ThresholdView<C> {}
+
+impl<C: Ciphersuite> ThresholdKeys<C> {
+  pub fn new(core: ThresholdCore<C>) -> ThresholdKeys<C> {
+    ThresholdKeys { core: Arc::new(core), offset: None }
+  }
+
+  /// Offset the keys by a given scalar to allow for account and privacy schemes.
+  /// This offset is ephemeral and will not be included when these keys are serialized.
+  /// Keys offset multiple times will form a new offset of their sum.
+  pub fn offset(&self, offset: C::F) -> ThresholdKeys<C> {
+    let mut res = self.clone();
+    // Carry any existing offset
+    // Enables schemes like Monero's subaddresses which have a per-subaddress offset and then a
+    // one-time-key offset
+    res.offset = Some(offset + res.offset.unwrap_or_else(C::F::zero));
+    res
+  }
+
+  /// Returns the current offset in-use for these keys.
+  pub fn current_offset(&self) -> Option<C::F> {
+    self.offset
+  }
+
+  pub fn params(&self) -> ThresholdParams {
+    self.core.params
+  }
+
+  pub fn secret_share(&self) -> C::F {
+    self.core.secret_share
+  }
+
+  /// Returns the group key with any offset applied.
+  pub fn group_key(&self) -> C::G {
+    self.core.group_key + (C::generator() * self.offset.unwrap_or_else(C::F::zero))
+  }
+
+  /// Returns all participants' verification shares without any offsetting.
+  pub(crate) fn verification_shares(&self) -> HashMap<u16, C::G> {
+    self.core.verification_shares()
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    self.core.serialize()
+  }
+
+  pub fn view(&self, included: &[u16]) -> Result<ThresholdView<C>, DkgError> {
+    if (included.len() < self.params().t.into()) || (usize::from(self.params().n) < included.len())
+    {
+      Err(DkgError::InvalidSigningSet)?;
+    }
+
+    let offset_share = self.offset.unwrap_or_else(C::F::zero) *
+      C::F::from(included.len().try_into().unwrap()).invert().unwrap();
+    let offset_verification_share = C::generator() * offset_share;
+
+    Ok(ThresholdView {
+      group_key: self.group_key(),
+      secret_share: (self.secret_share() * lagrange::<C::F>(self.params().i, included)) +
+        offset_share,
+      verification_shares: self
+        .verification_shares()
+        .iter()
+        .map(|(l, share)| {
+          (*l, (*share * lagrange::<C::F>(*l, included)) + offset_verification_share)
+        })
+        .collect(),
+      included: included.to_vec(),
+    })
+  }
+}
+
+impl<C: Ciphersuite> ThresholdView<C> {
+  pub fn group_key(&self) -> C::G {
+    self.group_key
+  }
+
+  pub fn included(&self) -> Vec<u16> {
+    self.included.clone()
+  }
+
+  pub fn secret_share(&self) -> C::F {
+    self.secret_share
+  }
+
+  pub fn verification_share(&self, l: u16) -> C::G {
+    self.verification_shares[&l]
+  }
+}

crypto/dkg/src/promote.rs

@@ -0,0 +1,127 @@
+use std::{
+  marker::PhantomData,
+  io::{self, Read, Write},
+  sync::Arc,
+  collections::HashMap,
+};
+
+use rand_core::{RngCore, CryptoRng};
+
+use group::GroupEncoding;
+
+use ciphersuite::Ciphersuite;
+
+use transcript::{Transcript, RecommendedTranscript};
+use dleq::DLEqProof;
+
+use crate::{DkgError, ThresholdCore, ThresholdKeys, validate_map};
+
+/// Promote a set of keys to another Ciphersuite definition.
+pub trait CiphersuitePromote<C2: Ciphersuite> {
+  #[doc(hidden)]
+  #[allow(non_snake_case)]
+  fn _bound_C2(_c2: C2) {
+    panic!()
+  }
+
+  fn promote(self) -> ThresholdKeys<C2>;
+}
+
+fn transcript<G: GroupEncoding>(key: G, i: u16) -> RecommendedTranscript {
+  let mut transcript = RecommendedTranscript::new(b"FROST Generator Update");
+  transcript.append_message(b"group_key", key.to_bytes().as_ref());
+  transcript.append_message(b"participant", &i.to_be_bytes());
+  transcript
+}
+
+/// Proof of valid promotion to another generator.
+#[derive(Clone, Copy)]
+pub struct GeneratorProof<C: Ciphersuite> {
+  share: C::G,
+  proof: DLEqProof<C::G>,
+}
+
+impl<C: Ciphersuite> GeneratorProof<C> {
+  pub fn write<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(self.share.to_bytes().as_ref())?;
+    self.proof.serialize(writer)
+  }
+
+  pub fn read<R: Read>(reader: &mut R) -> io::Result<GeneratorProof<C>> {
+    Ok(GeneratorProof {
+      share: <C as Ciphersuite>::read_G(reader)?,
+      proof: DLEqProof::deserialize(reader)?,
+    })
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = vec![];
+    self.write(&mut buf).unwrap();
+    buf
+  }
+}
+
+/// Promote a set of keys from one curve to another, where the elliptic curve is the same.
+/// Since the Ciphersuite trait additionally specifies a generator, this provides an O(n) way to
+/// update the generator used with keys. The key generation protocol itself is exponential.
+pub struct GeneratorPromotion<C1: Ciphersuite, C2: Ciphersuite> {
+  base: ThresholdKeys<C1>,
+  proof: GeneratorProof<C1>,
+  _c2: PhantomData<C2>,
+}
+
+impl<C1: Ciphersuite, C2: Ciphersuite> GeneratorPromotion<C1, C2>
+where
+  C2: Ciphersuite<F = C1::F, G = C1::G>,
+{
+  /// Begin promoting keys from one curve to another. Returns a proof this share was properly
+  /// promoted.
+  pub fn promote<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    base: ThresholdKeys<C1>,
+  ) -> (GeneratorPromotion<C1, C2>, GeneratorProof<C1>) {
+    // Do a DLEqProof for the new generator
+    let proof = GeneratorProof {
+      share: C2::generator() * base.secret_share(),
+      proof: DLEqProof::prove(
+        rng,
+        &mut transcript(base.core.group_key(), base.params().i),
+        &[C1::generator(), C2::generator()],
+        base.secret_share(),
+      ),
+    };
+
+    (GeneratorPromotion { base, proof, _c2: PhantomData::<C2> }, proof)
+  }
+
+  /// Complete promotion by taking in the proofs from all other participants.
+  pub fn complete(
+    self,
+    proofs: &HashMap<u16, GeneratorProof<C1>>,
+  ) -> Result<ThresholdKeys<C2>, DkgError> {
+    let params = self.base.params();
+    validate_map(proofs, &(1 ..= params.n).collect::<Vec<_>>(), params.i)?;
+
+    let original_shares = self.base.verification_shares();
+
+    let mut verification_shares = HashMap::new();
+    verification_shares.insert(params.i, self.proof.share);
+    for (i, proof) in proofs {
+      let i = *i;
+      proof
+        .proof
+        .verify(
+          &mut transcript(self.base.core.group_key(), i),
+          &[C1::generator(), C2::generator()],
+          &[original_shares[&i], proof.share],
+        )
+        .map_err(|_| DkgError::InvalidProofOfKnowledge(i))?;
+      verification_shares.insert(i, proof.share);
+    }
+
+    Ok(ThresholdKeys {
+      core: Arc::new(ThresholdCore::new(params, self.base.secret_share(), verification_shares)),
+      offset: None,
+    })
+  }
+}

crypto/dkg/src/tests/frost.rs

@@ -0,0 +1,81 @@
+use std::collections::HashMap;
+
+use rand_core::{RngCore, CryptoRng};
+
+use crate::{
+  Ciphersuite, ThresholdParams, ThresholdCore,
+  frost::{SecretShare, Commitments, KeyGenMachine},
+  tests::{THRESHOLD, PARTICIPANTS, clone_without},
+};
+
+/// Fully perform the FROST key generation algorithm.
+pub fn frost_gen<R: RngCore + CryptoRng, C: Ciphersuite>(
+  rng: &mut R,
+) -> HashMap<u16, ThresholdCore<C>> {
+  let mut machines = HashMap::new();
+  let mut commitments = HashMap::new();
+  for i in 1 ..= PARTICIPANTS {
+    let machine = KeyGenMachine::<C>::new(
+      ThresholdParams::new(THRESHOLD, PARTICIPANTS, i).unwrap(),
+      "DKG Test Key Generation".to_string(),
+    );
+    let (machine, these_commitments) = machine.generate_coefficients(rng);
+    machines.insert(i, machine);
+
+    commitments.insert(
+      i,
+      Commitments::read::<&[u8]>(
+        &mut these_commitments.serialize().as_ref(),
+        ThresholdParams { t: THRESHOLD, n: PARTICIPANTS, i: 1 },
+      )
+      .unwrap(),
+    );
+  }
+
+  let mut secret_shares = HashMap::new();
+  let mut machines = machines
+    .drain()
+    .map(|(l, machine)| {
+      let (machine, mut shares) =
+        machine.generate_secret_shares(rng, clone_without(&commitments, &l)).unwrap();
+      let shares = shares
+        .drain()
+        .map(|(l, share)| {
+          (l, SecretShare::<C::F>::read::<&[u8]>(&mut share.serialize().as_ref()).unwrap())
+        })
+        .collect::<HashMap<_, _>>();
+      secret_shares.insert(l, shares);
+      (l, machine)
+    })
+    .collect::<HashMap<_, _>>();
+
+  let mut verification_shares = None;
+  let mut group_key = None;
+  machines
+    .drain()
+    .map(|(i, machine)| {
+      let mut our_secret_shares = HashMap::new();
+      for (l, shares) in &secret_shares {
+        if i == *l {
+          continue;
+        }
+        our_secret_shares.insert(*l, shares[&i].clone());
+      }
+      let these_keys = machine.complete(rng, our_secret_shares).unwrap();
+
+      // Verify the verification_shares are agreed upon
+      if verification_shares.is_none() {
+        verification_shares = Some(these_keys.verification_shares());
+      }
+      assert_eq!(verification_shares.as_ref().unwrap(), &these_keys.verification_shares());
+
+      // Verify the group keys are agreed upon
+      if group_key.is_none() {
+        group_key = Some(these_keys.group_key());
+      }
+      assert_eq!(group_key.unwrap(), these_keys.group_key());
+
+      (i, these_keys)
+    })
+    .collect::<HashMap<_, _>>()
+}

crypto/dkg/src/tests/mod.rs

@@ -0,0 +1,69 @@
+use std::collections::HashMap;
+
+use rand_core::{RngCore, CryptoRng};
+
+use group::ff::Field;
+
+use ciphersuite::Ciphersuite;
+
+use crate::{ThresholdCore, ThresholdKeys, lagrange};
+
+/// FROST generation test.
+pub mod frost;
+use frost::frost_gen;
+
+// Promotion test.
+mod promote;
+use promote::test_generator_promotion;
+
+/// Constant amount of participants to use when testing.
+pub const PARTICIPANTS: u16 = 5;
+/// Constant threshold of participants to use when signing.
+pub const THRESHOLD: u16 = ((PARTICIPANTS / 3) * 2) + 1;
+
+/// Clone a map without a specific value.
+pub fn clone_without<K: Clone + std::cmp::Eq + std::hash::Hash, V: Clone>(
+  map: &HashMap<K, V>,
+  without: &K,
+) -> HashMap<K, V> {
+  let mut res = map.clone();
+  res.remove(without).unwrap();
+  res
+}
+
+/// Recover the secret from a collection of keys.
+pub fn recover_key<C: Ciphersuite>(keys: &HashMap<u16, ThresholdKeys<C>>) -> C::F {
+  let first = keys.values().next().expect("no keys provided");
+  assert!(keys.len() >= first.params().t().into(), "not enough keys provided");
+  let included = keys.keys().cloned().collect::<Vec<_>>();
+
+  let group_private = keys.iter().fold(C::F::zero(), |accum, (i, keys)| {
+    accum + (keys.secret_share() * lagrange::<C::F>(*i, &included))
+  });
+  assert_eq!(C::generator() * group_private, first.group_key(), "failed to recover keys");
+  group_private
+}
+
+/// Generate threshold keys for tests.
+pub fn key_gen<R: RngCore + CryptoRng, C: Ciphersuite>(
+  rng: &mut R,
+) -> HashMap<u16, ThresholdKeys<C>> {
+  let res = frost_gen(rng)
+    .drain()
+    .map(|(i, core)| {
+      assert_eq!(
+        &ThresholdCore::<C>::deserialize::<&[u8]>(&mut core.serialize().as_ref()).unwrap(),
+        &core
+      );
+      (i, ThresholdKeys::new(core))
+    })
+    .collect();
+  assert_eq!(C::generator() * recover_key(&res), res[&1].group_key());
+  res
+}
+
+/// Run the test suite on a ciphersuite.
+pub fn test_ciphersuite<R: RngCore + CryptoRng, C: Ciphersuite>(rng: &mut R) {
+  key_gen::<_, C>(rng);
+  test_generator_promotion::<_, C>(rng);
+}

crypto/dkg/src/tests/promote.rs

@@ -0,0 +1,60 @@
+use std::{marker::PhantomData, collections::HashMap};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::Zeroize;
+
+use group::Group;
+
+use ciphersuite::Ciphersuite;
+
+use crate::{
+  promote::{GeneratorPromotion, GeneratorProof},
+  tests::{clone_without, key_gen, recover_key},
+};
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+struct AltGenerator<C: Ciphersuite> {
+  _curve: PhantomData<C>,
+}
+
+impl<C: Ciphersuite> Ciphersuite for AltGenerator<C> {
+  type F = C::F;
+  type G = C::G;
+  type H = C::H;
+
+  const ID: &'static [u8] = b"Alternate Ciphersuite";
+
+  fn generator() -> Self::G {
+    C::G::generator() * <C as Ciphersuite>::hash_to_F(b"DKG Promotion Test", b"generator")
+  }
+
+  fn hash_to_F(dst: &[u8], data: &[u8]) -> Self::F {
+    <C as Ciphersuite>::hash_to_F(dst, data)
+  }
+}
+
+// Test promotion of threshold keys to another generator
+pub(crate) fn test_generator_promotion<R: RngCore + CryptoRng, C: Ciphersuite>(rng: &mut R) {
+  let keys = key_gen::<_, C>(&mut *rng);
+
+  let mut promotions = HashMap::new();
+  let mut proofs = HashMap::new();
+  for (i, keys) in &keys {
+    let (promotion, proof) =
+      GeneratorPromotion::<_, AltGenerator<C>>::promote(&mut *rng, keys.clone());
+    promotions.insert(*i, promotion);
+    proofs.insert(*i, GeneratorProof::<C>::read::<&[u8]>(&mut proof.serialize().as_ref()).unwrap());
+  }
+
+  let new_group_key = AltGenerator::<C>::generator() * recover_key(&keys);
+  for (i, promoting) in promotions.drain() {
+    let promoted = promoting.complete(&clone_without(&proofs, &i)).unwrap();
+    assert_eq!(keys[&i].params(), promoted.params());
+    assert_eq!(keys[&i].secret_share(), promoted.secret_share());
+    assert_eq!(new_group_key, promoted.group_key());
+    for (l, verification_share) in promoted.verification_shares() {
+      assert_eq!(AltGenerator::<C>::generator() * keys[&l].secret_share(), verification_share);
+    }
+  }
+}