Route blame between Processor and Coordinator (#427)

* Have processor report errors during the DKG to the coordinator

* Add RemoveParticipant, InvalidDkgShare to coordinator

* Route DKG blame around coordinator

* Allow public construction of AdditionalBlameMachine

Necessary for upcoming work on handling DKG blame in the processor and
coordinator.

Additionally fixes a publicly reachable panic when commitments parsed with one
ThresholdParams are used in a machine using another set of ThresholdParams.

Renames InvalidProofOfKnowledge to InvalidCommitments.

* Remove unused error from dleq

* Implement support for VerifyBlame in the processor

* Have coordinator send the processor share message relevant to Blame

* Remove desync between processors reporting InvalidShare and ones reporting GeneratedKeyPair

* Route blame on sign between processor and coordinator

Doesn't yet act on it in coordinator.

* Move txn usage as needed for stable Rust to build

* Correct InvalidDkgShare serialization

crypto/dkg/src/encryption.rs

@@ -341,7 +341,7 @@ pub(crate) enum DecryptionError {
 #[derive(Clone)]
 pub(crate) struct Encryption<C: Ciphersuite> {
   context: String,
-  i: Participant,
+  i: Option<Participant>,
   enc_key: Zeroizing<C::F>,
   enc_pub_key: C::G,
   enc_keys: HashMap<Participant, C::G>,
@@ -370,7 +370,11 @@ impl<C: Ciphersuite> Zeroize for Encryption<C> {
 }
 
 impl<C: Ciphersuite> Encryption<C> {
-  pub(crate) fn new<R: RngCore + CryptoRng>(context: String, i: Participant, rng: &mut R) -> Self {
+  pub(crate) fn new<R: RngCore + CryptoRng>(
+    context: String,
+    i: Option<Participant>,
+    rng: &mut R,
+  ) -> Self {
     let enc_key = Zeroizing::new(C::random_nonzero_F(rng));
     Self {
       context,
@@ -404,7 +408,7 @@ impl<C: Ciphersuite> Encryption<C> {
     participant: Participant,
     msg: Zeroizing<E>,
   ) -> EncryptedMessage<C, E> {
-    encrypt(rng, &self.context, self.i, self.enc_keys[&participant], msg)
+    encrypt(rng, &self.context, self.i.unwrap(), self.enc_keys[&participant], msg)
   }
 
   pub(crate) fn decrypt<R: RngCore + CryptoRng, I: Copy + Zeroize, E: Encryptable>(

crypto/dkg/src/frost.rs

@@ -133,7 +133,7 @@ impl<C: Ciphersuite> KeyGenMachine<C> {
     );
 
     // Additionally create an encryption mechanism to protect the secret shares
-    let encryption = Encryption::new(self.context.clone(), self.params.i, rng);
+    let encryption = Encryption::new(self.context.clone(), Some(self.params.i), rng);
 
     // Step 4: Broadcast
     let msg =
@@ -249,35 +249,38 @@ impl<C: Ciphersuite> SecretShareMachine<C> {
   fn verify_r1<R: RngCore + CryptoRng>(
     &mut self,
     rng: &mut R,
-    mut commitments: HashMap<Participant, EncryptionKeyMessage<C, Commitments<C>>>,
+    mut commitment_msgs: HashMap<Participant, EncryptionKeyMessage<C, Commitments<C>>>,
   ) -> Result<HashMap<Participant, Vec<C::G>>, FrostError<C>> {
     validate_map(
-      &commitments,
+      &commitment_msgs,
       &(1 ..= self.params.n()).map(Participant).collect::<Vec<_>>(),
       self.params.i(),
     )?;
 
-    let mut batch = BatchVerifier::<Participant, C::G>::new(commitments.len());
-    let mut commitments = commitments
-      .drain()
-      .map(|(l, msg)| {
-        let mut msg = self.encryption.register(l, msg);
+    let mut batch = BatchVerifier::<Participant, C::G>::new(commitment_msgs.len());
+    let mut commitments = HashMap::new();
+    for l in (1 ..= self.params.n()).map(Participant) {
+      let Some(msg) = commitment_msgs.remove(&l) else { continue };
+      let mut msg = self.encryption.register(l, msg);
 
-        // Step 5: Validate each proof of knowledge
-        // This is solely the prep step for the latter batch verification
-        msg.sig.batch_verify(
-          rng,
-          &mut batch,
-          l,
-          msg.commitments[0],
-          challenge::<C>(&self.context, l, msg.sig.R.to_bytes().as_ref(), &msg.cached_msg),
-        );
+      if msg.commitments.len() != self.params.t().into() {
+        Err(FrostError::InvalidCommitments(l))?;
+      }
 
-        (l, msg.commitments.drain(..).collect::<Vec<_>>())
-      })
-      .collect::<HashMap<_, _>>();
+      // Step 5: Validate each proof of knowledge
+      // This is solely the prep step for the latter batch verification
+      msg.sig.batch_verify(
+        rng,
+        &mut batch,
+        l,
+        msg.commitments[0],
+        challenge::<C>(&self.context, l, msg.sig.R.to_bytes().as_ref(), &msg.cached_msg),
+      );
 
-    batch.verify_vartime_with_vartime_blame().map_err(FrostError::InvalidProofOfKnowledge)?;
+      commitments.insert(l, msg.commitments.drain(..).collect::<Vec<_>>());
+    }
+
+    batch.verify_vartime_with_vartime_blame().map_err(FrostError::InvalidCommitments)?;
 
     commitments.insert(self.params.i, self.our_commitments.drain(..).collect());
     Ok(commitments)
@@ -470,12 +473,12 @@ impl<C: Ciphersuite> KeyMachine<C> {
     Ok(BlameMachine {
       commitments,
       encryption,
-      result: ThresholdCore {
+      result: Some(ThresholdCore {
         params,
         secret_share: secret,
         group_key: stripes[0],
         verification_shares,
-      },
+      }),
     })
   }
 }
@@ -484,7 +487,7 @@ impl<C: Ciphersuite> KeyMachine<C> {
 pub struct BlameMachine<C: Ciphersuite> {
   commitments: HashMap<Participant, Vec<C::G>>,
   encryption: Encryption<C>,
-  result: ThresholdCore<C>,
+  result: Option<ThresholdCore<C>>,
 }
 
 impl<C: Ciphersuite> fmt::Debug for BlameMachine<C> {
@@ -518,7 +521,7 @@ impl<C: Ciphersuite> BlameMachine<C> {
   /// tooling to do so. This function is solely intended to force users to acknowledge they're
   /// completing the protocol, not processing any blame.
   pub fn complete(self) -> ThresholdCore<C> {
-    self.result
+    self.result.unwrap()
   }
 
   fn blame_internal(
@@ -585,6 +588,32 @@ impl<C: Ciphersuite> BlameMachine<C> {
 #[derive(Debug, Zeroize)]
 pub struct AdditionalBlameMachine<C: Ciphersuite>(BlameMachine<C>);
 impl<C: Ciphersuite> AdditionalBlameMachine<C> {
+  /// Create an AdditionalBlameMachine capable of evaluating Blame regardless of if the caller was
+  /// a member in the DKG protocol.
+  ///
+  /// Takes in the parameters for the DKG protocol and all of the participant's commitment
+  /// messages.
+  ///
+  /// This constructor assumes the full validity of the commitment messages. They must be fully
+  /// authenticated as having come from the supposed party and verified as valid. Usage of invalid
+  /// commitments is considered undefined behavior, and may cause everything from inaccurate blame
+  /// to panics.
+  pub fn new<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    context: String,
+    n: u16,
+    mut commitment_msgs: HashMap<Participant, EncryptionKeyMessage<C, Commitments<C>>>,
+  ) -> Result<Self, FrostError<C>> {
+    let mut commitments = HashMap::new();
+    let mut encryption = Encryption::new(context, None, rng);
+    for i in 1 ..= n {
+      let i = Participant::new(i).unwrap();
+      let Some(msg) = commitment_msgs.remove(&i) else { Err(DkgError::MissingParticipant(i))? };
+      commitments.insert(i, encryption.register(i, msg).commitments);
+    }
+    Ok(AdditionalBlameMachine(BlameMachine { commitments, encryption, result: None }))
+  }
+
   /// Given an accusation of fault, determine the faulty party (either the sender, who sent an
   /// invalid secret share, or the receiver, who claimed a valid secret share was invalid).
   ///
@@ -596,7 +625,7 @@ impl<C: Ciphersuite> AdditionalBlameMachine<C> {
   /// the caller's job to ensure they're unique in order to prevent multiple instances of blame
   /// over a single incident.
   pub fn blame(
-    self,
+    &self,
     sender: Participant,
     recipient: Participant,
     msg: EncryptedMessage<C, SecretShare<C::F>>,

crypto/dkg/src/lib.rs

@@ -94,7 +94,7 @@ pub enum DkgError<B: Clone + PartialEq + Eq + Debug> {
 
   /// An invalid proof of knowledge was provided.
   #[cfg_attr(feature = "std", error("invalid proof of knowledge (participant {0})"))]
-  InvalidProofOfKnowledge(Participant),
+  InvalidCommitments(Participant),
   /// An invalid DKG share was provided.
   #[cfg_attr(feature = "std", error("invalid share (participant {participant}, blame {blame})"))]
   InvalidShare { participant: Participant, blame: Option<B> },

crypto/dkg/src/promote.rs

@@ -109,7 +109,7 @@ where
           &[C1::generator(), C2::generator()],
           &[original_shares[&i], proof.share],
         )
-        .map_err(|_| DkgError::InvalidProofOfKnowledge(i))?;
+        .map_err(|_| DkgError::InvalidCommitments(i))?;
       verification_shares.insert(i, proof.share);
     }
 

crypto/dkg/src/tests/frost.rs

@@ -6,7 +6,7 @@ use ciphersuite::Ciphersuite;
 
 use crate::{
   Participant, ThresholdParams, ThresholdCore,
-  frost::{KeyGenMachine, SecretShare, KeyMachine},
+  frost::{Commitments, KeyGenMachine, SecretShare, KeyMachine},
   encryption::{EncryptionKeyMessage, EncryptedMessage},
   tests::{THRESHOLD, PARTICIPANTS, clone_without},
 };
@@ -17,12 +17,13 @@ type FrostSecretShares<C> = HashMap<Participant, FrostEncryptedMessage<C>>;
 
 const CONTEXT: &str = "DKG Test Key Generation";
 
-// Commit, then return enc key and shares
+// Commit, then return commitment messages, enc keys, and shares
 #[allow(clippy::type_complexity)]
 fn commit_enc_keys_and_shares<R: RngCore + CryptoRng, C: Ciphersuite>(
   rng: &mut R,
 ) -> (
   HashMap<Participant, KeyMachine<C>>,
+  HashMap<Participant, EncryptionKeyMessage<C, Commitments<C>>>,
   HashMap<Participant, C::G>,
   HashMap<Participant, FrostSecretShares<C>>,
 ) {
@@ -68,7 +69,7 @@ fn commit_enc_keys_and_shares<R: RngCore + CryptoRng, C: Ciphersuite>(
     })
     .collect::<HashMap<_, _>>();
 
-  (machines, enc_keys, secret_shares)
+  (machines, commitments, enc_keys, secret_shares)
 }
 
 fn generate_secret_shares<C: Ciphersuite>(
@@ -89,7 +90,7 @@ fn generate_secret_shares<C: Ciphersuite>(
 pub fn frost_gen<R: RngCore + CryptoRng, C: Ciphersuite>(
   rng: &mut R,
 ) -> HashMap<Participant, ThresholdCore<C>> {
-  let (mut machines, _, secret_shares) = commit_enc_keys_and_shares::<_, C>(rng);
+  let (mut machines, _, _, secret_shares) = commit_enc_keys_and_shares::<_, C>(rng);
 
   let mut verification_shares = None;
   let mut group_key = None;
@@ -122,7 +123,11 @@ mod literal {
 
   use ciphersuite::Ristretto;
 
-  use crate::{DkgError, encryption::EncryptionKeyProof, frost::BlameMachine};
+  use crate::{
+    DkgError,
+    encryption::EncryptionKeyProof,
+    frost::{BlameMachine, AdditionalBlameMachine},
+  };
 
   use super::*;
 
@@ -130,6 +135,7 @@ mod literal {
   const TWO: Participant = Participant(2);
 
   fn test_blame(
+    commitment_msgs: HashMap<Participant, EncryptionKeyMessage<Ristretto, Commitments<Ristretto>>>,
     machines: Vec<BlameMachine<Ristretto>>,
     msg: FrostEncryptedMessage<Ristretto>,
     blame: Option<EncryptionKeyProof<Ristretto>>,
@@ -139,13 +145,26 @@ mod literal {
       assert_eq!(blamed, ONE);
       // Verify additional blame also works
       assert_eq!(additional.blame(ONE, TWO, msg.clone(), blame.clone()), ONE);
+
+      // Verify machines constructed with AdditionalBlameMachine::new work
+      assert_eq!(
+        AdditionalBlameMachine::new(
+          &mut OsRng,
+          CONTEXT.to_string(),
+          PARTICIPANTS,
+          commitment_msgs.clone()
+        )
+        .unwrap()
+        .blame(ONE, TWO, msg.clone(), blame.clone()),
+        ONE,
+      );
     }
   }
 
   // TODO: Write a macro which expands to the following
   #[test]
   fn invalid_encryption_pop_blame() {
-    let (mut machines, _, mut secret_shares) =
+    let (mut machines, commitment_msgs, _, mut secret_shares) =
       commit_enc_keys_and_shares::<_, Ristretto>(&mut OsRng);
 
     // Mutate the PoP of the encrypted message from 1 to 2
@@ -169,12 +188,12 @@ mod literal {
       })
       .collect::<Vec<_>>();
 
-    test_blame(machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
+    test_blame(commitment_msgs, machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
   }
 
   #[test]
   fn invalid_ecdh_blame() {
-    let (mut machines, _, mut secret_shares) =
+    let (mut machines, commitment_msgs, _, mut secret_shares) =
       commit_enc_keys_and_shares::<_, Ristretto>(&mut OsRng);
 
     // Mutate the share to trigger a blame event
@@ -209,13 +228,13 @@ mod literal {
       .collect::<Vec<_>>();
 
     blame.as_mut().unwrap().as_mut().unwrap().invalidate_key();
-    test_blame(machines, secret_shares[&TWO][&ONE].clone(), blame.unwrap());
+    test_blame(commitment_msgs, machines, secret_shares[&TWO][&ONE].clone(), blame.unwrap());
   }
 
   // This should be largely equivalent to the prior test
   #[test]
   fn invalid_dleq_blame() {
-    let (mut machines, _, mut secret_shares) =
+    let (mut machines, commitment_msgs, _, mut secret_shares) =
       commit_enc_keys_and_shares::<_, Ristretto>(&mut OsRng);
 
     secret_shares
@@ -244,12 +263,12 @@ mod literal {
       .collect::<Vec<_>>();
 
     blame.as_mut().unwrap().as_mut().unwrap().invalidate_dleq();
-    test_blame(machines, secret_shares[&TWO][&ONE].clone(), blame.unwrap());
+    test_blame(commitment_msgs, machines, secret_shares[&TWO][&ONE].clone(), blame.unwrap());
   }
 
   #[test]
   fn invalid_share_serialization_blame() {
-    let (mut machines, enc_keys, mut secret_shares) =
+    let (mut machines, commitment_msgs, enc_keys, mut secret_shares) =
       commit_enc_keys_and_shares::<_, Ristretto>(&mut OsRng);
 
     secret_shares.get_mut(&ONE).unwrap().get_mut(&TWO).unwrap().invalidate_share_serialization(
@@ -277,12 +296,12 @@ mod literal {
       })
       .collect::<Vec<_>>();
 
-    test_blame(machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
+    test_blame(commitment_msgs, machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
   }
 
   #[test]
   fn invalid_share_value_blame() {
-    let (mut machines, enc_keys, mut secret_shares) =
+    let (mut machines, commitment_msgs, enc_keys, mut secret_shares) =
       commit_enc_keys_and_shares::<_, Ristretto>(&mut OsRng);
 
     secret_shares.get_mut(&ONE).unwrap().get_mut(&TWO).unwrap().invalidate_share_value(
@@ -310,6 +329,6 @@ mod literal {
       })
       .collect::<Vec<_>>();
 
-    test_blame(machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
+    test_blame(commitment_msgs, machines, secret_shares[&ONE][&TWO].clone(), blame.unwrap());
   }
 }

crypto/dleq/src/cross_group/mod.rs

@@ -95,9 +95,6 @@ impl<G: PrimeGroup> Generators<G> {
 /// Error for cross-group DLEq proofs.
 #[derive(Error, PartialEq, Eq, Debug)]
 pub enum DLEqError {
-  /// Invalid proof of knowledge.
-  #[error("invalid proof of knowledge")]
-  InvalidProofOfKnowledge,
   /// Invalid proof length.
   #[error("invalid proof length")]
   InvalidProofLength,