One Round DKG (#589)

* Upstream GBP, divisor, circuit abstraction, and EC gadgets from FCMP++ * Initial eVRF implementation Not quite done yet. It needs to communicate the resulting points and proofs to extract them from the Pedersen Commitments in order to return those, and then be tested. * Add the openings of the PCs to the eVRF as necessary * Add implementation of secq256k1 * Make DKG Encryption a bit more flexible No longer requires the use of an EncryptionKeyMessage, and allows pre-defined keys for encryption. * Make NUM_BITS an argument for the field macro * Have the eVRF take a Zeroizing private key * Initial eVRF-based DKG * Add embedwards25519 curve * Inline the eVRF into the DKG library Due to how we're handling share encryption, we'd either need two circuits or to dedicate this circuit to the DKG. The latter makes sense at this time. * Add documentation to the eVRF-based DKG * Add paragraph claiming robustness * Update to the new eVRF proof * Finish routing the eVRF functionality Still needs errors and serialization, along with a few other TODOs. * Add initial eVRF DKG test * Improve eVRF DKG Updates how we calculcate verification shares, improves performance when extracting multiple sets of keys, and adds more to the test for it. * Start using a proper error for the eVRF DKG * Resolve various TODOs Supports recovering multiple key shares from the eVRF DKG. Inlines two loops to save 2**16 iterations. Adds support for creating a constant time representation of scalars < NUM_BITS. * Ban zero ECDH keys, document non-zero requirements * Implement eVRF traits, all the way up to the DKG, for secp256k1/ed25519 * Add Ristretto eVRF trait impls * Support participating multiple times in the eVRF DKG * Only participate once per key, not once per key share * Rewrite processor key-gen around the eVRF DKG Still a WIP. * Finish routing the new key gen in the processor Doesn't touch the tests, coordinator, nor Substrate yet. `cargo +nightly fmt && cargo +nightly-2024-07-01 clippy --all-features -p serai-processor` does pass. * Deduplicate and better document in processor key_gen * Update serai-processor tests to the new key gen * Correct amount of yx coefficients, get processor key gen test to pass * Add embedded elliptic curve keys to Substrate * Update processor key gen tests to the eVRF DKG * Have set_keys take signature_participants, not removed_participants Now no one is removed from the DKG. Only `t` people publish the key however. Uses a BitVec for an efficient encoding of the participants. * Update the coordinator binary for the new DKG This does not yet update any tests. * Add sensible Debug to key_gen::[Processor, Coordinator]Message * Have the DKG explicitly declare how to interpolate its shares Removes the hack for MuSig where we multiply keys by the inverse of their lagrange interpolation factor. * Replace Interpolation::None with Interpolation::Constant Allows the MuSig DKG to keep the secret share as the original private key, enabling deriving FROST nonces consistently regardless of the MuSig context. * Get coordinator tests to pass * Update spec to the new DKG * Get clippy to pass across the repo * cargo machete * Add an extra sleep to ensure expected ordering of `Participation`s * Update orchestration * Remove bad panic in coordinator It expected ConfirmationShare to be n-of-n, not t-of-n. * Improve documentation on functions * Update TX size limit We now no longer have to support the ridiculous case of having 49 DKG participations within a 101-of-150 DKG. It does remain quite high due to needing to _sign_ so many times. It'd may be optimal for parties with multiple key shares to independently send their preprocesses/shares (despite the overhead that'll cause with signatures and the transaction structure). * Correct error in the Processor spec document * Update a few comments in the validator-sets pallet * Send/Recv Participation one at a time Sending all, then attempting to receive all in an expected order, wasn't working even with notable delays between sending messages. This points to the mempool not working as expected... * Correct ThresholdKeys serialization in modular-frost test * Updating existing TX size limit test for the new DKG parameters * Increase time allowed for the DKG on the GH CI * Correct construction of signature_participants in serai-client tests Fault identified by akil. * Further contextualize DkgConfirmer by ValidatorSet Caught by a safety check we wouldn't reuse preprocesses across messages. That raises the question of we were prior reusing preprocesses (reusing keys)? Except that'd have caused a variety of signing failures (suggesting we had some staggered timing avoiding it in practice but yes, this was possible in theory). * Add necessary calls to set_embedded_elliptic_curve_key in coordinator set rotation tests * Correct shimmed setting of a secq256k1 key * cargo fmt * Don't use `[0; 32]` for the embedded keys in the coordinator rotation test The key_gen function expects the random values already decided. * Big-endian secq256k1 scalars Also restores the prior, safer, Encryption::register function.
2025-12-10 05:09:22 +00:00 · 2024-08-16 11:26:07 -07:00
parent 669b2fef72
commit e4e4245ee3
121 changed files with 10388 additions and 2480 deletions
--- a/crypto/evrf/generalized-bulletproofs/src/lib.rs
+++ b/crypto/evrf/generalized-bulletproofs/src/lib.rs
@@ -0,0 +1,328 @@
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![doc = include_str!("../README.md")]
+#![deny(missing_docs)]
+#![allow(non_snake_case)]
+
+use core::fmt;
+use std::collections::HashSet;
+
+use zeroize::Zeroize;
+
+use multiexp::{multiexp, multiexp_vartime};
+use ciphersuite::{
+  group::{ff::Field, Group, GroupEncoding},
+  Ciphersuite,
+};
+
+mod scalar_vector;
+pub use scalar_vector::ScalarVector;
+mod point_vector;
+pub use point_vector::PointVector;
+
+/// The transcript formats.
+pub mod transcript;
+
+pub(crate) mod inner_product;
+
+pub(crate) mod lincomb;
+
+/// The arithmetic circuit proof.
+pub mod arithmetic_circuit_proof;
+
+/// Functionlity useful when testing.
+#[cfg(any(test, feature = "tests"))]
+pub mod tests;
+
+/// Calculate the nearest power of two greater than or equivalent to the argument.
+pub(crate) fn padded_pow_of_2(i: usize) -> usize {
+  let mut next_pow_of_2 = 1;
+  while next_pow_of_2 < i {
+    next_pow_of_2 <<= 1;
+  }
+  next_pow_of_2
+}
+
+/// An error from working with generators.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum GeneratorsError {
+  /// The provided list of generators for `g` (bold) was empty.
+  GBoldEmpty,
+  /// The provided list of generators for `h` (bold) did not match `g` (bold) in length.
+  DifferingGhBoldLengths,
+  /// The amount of provided generators were not a power of two.
+  NotPowerOfTwo,
+  /// A generator was used multiple times.
+  DuplicatedGenerator,
+}
+
+/// A full set of generators.
+#[derive(Clone)]
+pub struct Generators<C: Ciphersuite> {
+  g: C::G,
+  h: C::G,
+
+  g_bold: Vec<C::G>,
+  h_bold: Vec<C::G>,
+  h_sum: Vec<C::G>,
+}
+
+/// A batch verifier of proofs.
+#[must_use]
+#[derive(Clone)]
+pub struct BatchVerifier<C: Ciphersuite> {
+  g: C::F,
+  h: C::F,
+
+  g_bold: Vec<C::F>,
+  h_bold: Vec<C::F>,
+  h_sum: Vec<C::F>,
+
+  additional: Vec<(C::F, C::G)>,
+}
+
+impl<C: Ciphersuite> fmt::Debug for Generators<C> {
+  fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
+    let g = self.g.to_bytes();
+    let g: &[u8] = g.as_ref();
+
+    let h = self.h.to_bytes();
+    let h: &[u8] = h.as_ref();
+
+    fmt.debug_struct("Generators").field("g", &g).field("h", &h).finish_non_exhaustive()
+  }
+}
+
+/// The generators for a specific proof.
+///
+/// This potentially have been reduced in size from the original set of generators, as beneficial
+/// to performance.
+#[derive(Copy, Clone)]
+pub struct ProofGenerators<'a, C: Ciphersuite> {
+  g: &'a C::G,
+  h: &'a C::G,
+
+  g_bold: &'a [C::G],
+  h_bold: &'a [C::G],
+}
+
+impl<C: Ciphersuite> fmt::Debug for ProofGenerators<'_, C> {
+  fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
+    let g = self.g.to_bytes();
+    let g: &[u8] = g.as_ref();
+
+    let h = self.h.to_bytes();
+    let h: &[u8] = h.as_ref();
+
+    fmt.debug_struct("ProofGenerators").field("g", &g).field("h", &h).finish_non_exhaustive()
+  }
+}
+
+impl<C: Ciphersuite> Generators<C> {
+  /// Construct an instance of Generators for usage with Bulletproofs.
+  pub fn new(
+    g: C::G,
+    h: C::G,
+    g_bold: Vec<C::G>,
+    h_bold: Vec<C::G>,
+  ) -> Result<Self, GeneratorsError> {
+    if g_bold.is_empty() {
+      Err(GeneratorsError::GBoldEmpty)?;
+    }
+    if g_bold.len() != h_bold.len() {
+      Err(GeneratorsError::DifferingGhBoldLengths)?;
+    }
+    if padded_pow_of_2(g_bold.len()) != g_bold.len() {
+      Err(GeneratorsError::NotPowerOfTwo)?;
+    }
+
+    let mut set = HashSet::new();
+    let mut add_generator = |generator: &C::G| {
+      assert!(!bool::from(generator.is_identity()));
+      let bytes = generator.to_bytes();
+      !set.insert(bytes.as_ref().to_vec())
+    };
+
+    assert!(!add_generator(&g), "g was prior present in empty set");
+    if add_generator(&h) {
+      Err(GeneratorsError::DuplicatedGenerator)?;
+    }
+    for g in &g_bold {
+      if add_generator(g) {
+        Err(GeneratorsError::DuplicatedGenerator)?;
+      }
+    }
+    for h in &h_bold {
+      if add_generator(h) {
+        Err(GeneratorsError::DuplicatedGenerator)?;
+      }
+    }
+
+    let mut running_h_sum = C::G::identity();
+    let mut h_sum = vec![];
+    let mut next_pow_of_2 = 1;
+    for (i, h) in h_bold.iter().enumerate() {
+      running_h_sum += h;
+      if (i + 1) == next_pow_of_2 {
+        h_sum.push(running_h_sum);
+        next_pow_of_2 *= 2;
+      }
+    }
+
+    Ok(Generators { g, h, g_bold, h_bold, h_sum })
+  }
+
+  /// Create a BatchVerifier for proofs which use these generators.
+  pub fn batch_verifier(&self) -> BatchVerifier<C> {
+    BatchVerifier {
+      g: C::F::ZERO,
+      h: C::F::ZERO,
+
+      g_bold: vec![C::F::ZERO; self.g_bold.len()],
+      h_bold: vec![C::F::ZERO; self.h_bold.len()],
+      h_sum: vec![C::F::ZERO; self.h_sum.len()],
+
+      additional: Vec::with_capacity(128),
+    }
+  }
+
+  /// Verify all proofs queued for batch verification in this BatchVerifier.
+  #[must_use]
+  pub fn verify(&self, verifier: BatchVerifier<C>) -> bool {
+    multiexp_vartime(
+      &[(verifier.g, self.g), (verifier.h, self.h)]
+        .into_iter()
+        .chain(verifier.g_bold.into_iter().zip(self.g_bold.iter().cloned()))
+        .chain(verifier.h_bold.into_iter().zip(self.h_bold.iter().cloned()))
+        .chain(verifier.h_sum.into_iter().zip(self.h_sum.iter().cloned()))
+        .chain(verifier.additional)
+        .collect::<Vec<_>>(),
+    )
+    .is_identity()
+    .into()
+  }
+
+  /// The `g` generator.
+  pub fn g(&self) -> C::G {
+    self.g
+  }
+
+  /// The `h` generator.
+  pub fn h(&self) -> C::G {
+    self.h
+  }
+
+  /// A slice to view the `g` (bold) generators.
+  pub fn g_bold_slice(&self) -> &[C::G] {
+    &self.g_bold
+  }
+
+  /// A slice to view the `h` (bold) generators.
+  pub fn h_bold_slice(&self) -> &[C::G] {
+    &self.h_bold
+  }
+
+  /// Reduce a set of generators to the quantity necessary to support a certain amount of
+  /// in-circuit multiplications/terms in a Pedersen vector commitment.
+  ///
+  /// Returns None if reducing to 0 or if the generators reduced are insufficient to provide this
+  /// many generators.
+  pub fn reduce(&self, generators: usize) -> Option<ProofGenerators<'_, C>> {
+    if generators == 0 {
+      None?;
+    }
+
+    // Round to the nearest power of 2
+    let generators = padded_pow_of_2(generators);
+    if generators > self.g_bold.len() {
+      None?;
+    }
+
+    Some(ProofGenerators {
+      g: &self.g,
+      h: &self.h,
+
+      g_bold: &self.g_bold[.. generators],
+      h_bold: &self.h_bold[.. generators],
+    })
+  }
+}
+
+impl<'a, C: Ciphersuite> ProofGenerators<'a, C> {
+  pub(crate) fn len(&self) -> usize {
+    self.g_bold.len()
+  }
+
+  pub(crate) fn g(&self) -> C::G {
+    *self.g
+  }
+
+  pub(crate) fn h(&self) -> C::G {
+    *self.h
+  }
+
+  pub(crate) fn g_bold(&self, i: usize) -> C::G {
+    self.g_bold[i]
+  }
+
+  pub(crate) fn h_bold(&self, i: usize) -> C::G {
+    self.h_bold[i]
+  }
+
+  pub(crate) fn g_bold_slice(&self) -> &[C::G] {
+    self.g_bold
+  }
+
+  pub(crate) fn h_bold_slice(&self) -> &[C::G] {
+    self.h_bold
+  }
+}
+
+/// The opening of a Pedersen commitment.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub struct PedersenCommitment<C: Ciphersuite> {
+  /// The value committed to.
+  pub value: C::F,
+  /// The mask blinding the value committed to.
+  pub mask: C::F,
+}
+
+impl<C: Ciphersuite> PedersenCommitment<C> {
+  /// Commit to this value, yielding the Pedersen commitment.
+  pub fn commit(&self, g: C::G, h: C::G) -> C::G {
+    multiexp(&[(self.value, g), (self.mask, h)])
+  }
+}
+
+/// The opening of a Pedersen vector commitment.
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct PedersenVectorCommitment<C: Ciphersuite> {
+  /// The values committed to across the `g` (bold) generators.
+  pub g_values: ScalarVector<C::F>,
+  /// The values committed to across the `h` (bold) generators.
+  pub h_values: ScalarVector<C::F>,
+  /// The mask blinding the values committed to.
+  pub mask: C::F,
+}
+
+impl<C: Ciphersuite> PedersenVectorCommitment<C> {
+  /// Commit to the vectors of values.
+  ///
+  /// This function returns None if the amount of generators is less than the amount of values
+  /// within the relevant vector.
+  pub fn commit(&self, g_bold: &[C::G], h_bold: &[C::G], h: C::G) -> Option<C::G> {
+    if (g_bold.len() < self.g_values.len()) || (h_bold.len() < self.h_values.len()) {
+      None?;
+    };
+
+    let mut terms = vec![(self.mask, h)];
+    for pair in self.g_values.0.iter().cloned().zip(g_bold.iter().cloned()) {
+      terms.push(pair);
+    }
+    for pair in self.h_values.0.iter().cloned().zip(h_bold.iter().cloned()) {
+      terms.push(pair);
+    }
+    let res = multiexp(&terms);
+    terms.zeroize();
+    Some(res)
+  }
+}