90bc364f9f
The prior-present `Ciphersuite::hash_to_F` was a sin. Implementations took a DST, yet were not require to securely handle it. It was also biased towards the requirements of `modular-frost` as `ciphersuite` was originally written all those years ago, when `modular-frost` had needs exceeding what `ff`, `group` satisfied. Now, the hash is bound to produce an output which can be converted to a scalar with `ff::FromUniformBytes`. A new `hash_to_F`, which accepts a single argument of the value to hash (removing the potential to insecurely handle the DST by removing the DST entirely). Due to `digest` yielding a `GenericArray`, yet `FromUniformBytes` taking a `const usize`, the `ciphersuite` crate now defines a `FromUniformBytes` trait taking an array (then implemented for all satisfiers of `ff::FromUniformBytes`). In order to get the array type from the `GenericArray`, the output of the hash, `digest` is updated to the `0.11` release candidate which moves to `flexible-array` which solves that problem. The existing, specific `hash_to_F` functions have been moved to `modular-frost` as necessary. `flexible-array` itself is patched to a fork due to https://github.com/RustCrypto/hybrid-array/issues/131.
Modular FROST
A modular implementation of FROST for any curve with a ff/group API. Additionally, custom algorithms may be specified so any signature reducible to Schnorr-like may be used with FROST.
A Schnorr algorithm is provided, of the form (R, s) where s = r + cx, which
allows specifying the challenge format. This is intended to easily allow
integrating with existing systems.
This library offers ciphersuites compatible with the IETF draft. Currently, version 15 is supported.
A variety of testing utilities are provided under the tests feature. These
are provided with no guarantees and may have completely arbitrary behavior,
including panicking for completely well-reasoned input.
This library was audited by Cypher Stack in March 2023, culminating in commit 669d2dbffc1dafb82a09d9419ea182667115df06. Any subsequent changes have not undergone auditing. While this audit included FROST's definition of Ed448, the underlying Ed448 ciphersuite (offered by the ciphersuite crate) was not audited, nor was the minimal-ed448 crate implementing the curve itself.