mirror of
https://github.com/sonr-io/sonr.git
synced 2026-08-03 01:41:44 +00:00
feature/1220 origin handle exists method (#1241)
* feat: add docs and CI workflow for publishing to onsonr.dev * (refactor): Move hway,motr executables to their own repos * feat: simplify devnet and testnet configurations * refactor: update import path for didcrypto package * docs(networks): Add README with project overview, architecture, and community links * refactor: Move network configurations to deploy directory * build: update golang version to 1.23 * refactor: move logger interface to appropriate package * refactor: Move devnet configuration to networks/devnet * chore: improve release process with date variable * (chore): Move Crypto Library * refactor: improve code structure and readability in DID module * feat: integrate Trunk CI checks * ci: optimize CI workflow by removing redundant build jobs --------- Co-authored-by: Darp Alakun <i@prad.nu>
This commit is contained in:
Prad Nukala
Executable
+177
@@ -0,0 +1,177 @@
|
||||
//
|
||||
// Copyright Coinbase, Inc. All Rights Reserved.
|
||||
//
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
//
|
||||
|
||||
// This file implements the key refresh protocol of [DKLs18](https://eprint.iacr.org/2018/499.pdf).
|
||||
// The key refresh protocol is defined as follows:
|
||||
// 1. Key Share:
|
||||
// 1.1. alice generates k_A <-- F_q; writes it to merlin transcript. sends it to bob.
|
||||
// 1.2. bob receives k_A and writes it to merlin transcript. generates k_B <-- F_q and writes it to merlin transcript. reads k out of merlin transcript. overwrites sk_B *= k. sends k_B to Alice.
|
||||
// 1.3. alice writes k_B to merlin transcript. reads k from it. overwrites sk_A *= k^{-1}.
|
||||
// 2. OT: Redo OT (as it is done in the DKG)
|
||||
package refresh
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
|
||||
"github.com/gtank/merlin"
|
||||
"github.com/pkg/errors"
|
||||
|
||||
"github.com/onsonr/sonr/crypto/core/curves"
|
||||
"github.com/onsonr/sonr/crypto/ot/base/simplest"
|
||||
"github.com/onsonr/sonr/crypto/ot/extension/kos"
|
||||
"github.com/onsonr/sonr/crypto/tecdsa/dklsv1/dkg"
|
||||
"github.com/onsonr/sonr/crypto/zkp/schnorr"
|
||||
)
|
||||
|
||||
// Alice struct encoding Alice's state during one execution of the overall signing algorithm.
|
||||
// At the end of the joint computation, Alice will NOT obtain the signature.
|
||||
type Alice struct {
|
||||
// receiver is the base OT receiver.
|
||||
receiver *simplest.Receiver
|
||||
|
||||
// secretKeyShare is Alice's secret key for the joint public key.
|
||||
secretKeyShare curves.Scalar
|
||||
|
||||
// publicKey is the joint public key of Alice and Bob.
|
||||
publicKey curves.Point
|
||||
|
||||
curve *curves.Curve
|
||||
|
||||
transcript *merlin.Transcript
|
||||
}
|
||||
|
||||
// Bob struct encoding Bob's state during one execution of the overall signing algorithm.
|
||||
// At the end of the joint computation, Bob will obtain the signature.
|
||||
type Bob struct {
|
||||
// sender is the base OT sender.
|
||||
sender *simplest.Sender
|
||||
|
||||
// secretKeyShare is Bob's secret key for the joint public key.
|
||||
secretKeyShare curves.Scalar
|
||||
|
||||
// publicKey is the joint public key of Alice and Bob.
|
||||
publicKey curves.Point
|
||||
|
||||
curve *curves.Curve
|
||||
|
||||
transcript *merlin.Transcript
|
||||
}
|
||||
|
||||
type RefreshRound2Output struct {
|
||||
SeedOTRound1Output *schnorr.Proof
|
||||
BobMultiplier curves.Scalar
|
||||
}
|
||||
|
||||
// NewAliceRefresh creates a party that can participate in 2-of-2 key refresh.
|
||||
func NewAlice(curve *curves.Curve, dkgOutput *dkg.AliceOutput) *Alice {
|
||||
return &Alice{
|
||||
curve: curve,
|
||||
secretKeyShare: dkgOutput.SecretKeyShare,
|
||||
publicKey: dkgOutput.PublicKey,
|
||||
transcript: merlin.NewTranscript("Coinbase_DKLs_Refresh"),
|
||||
}
|
||||
}
|
||||
|
||||
// NewBobRefresh creates a party that can participate in 2-of-2 key refresh.
|
||||
func NewBob(curve *curves.Curve, dkgOutput *dkg.BobOutput) *Bob {
|
||||
return &Bob{
|
||||
curve: curve,
|
||||
secretKeyShare: dkgOutput.SecretKeyShare,
|
||||
publicKey: dkgOutput.PublicKey,
|
||||
transcript: merlin.NewTranscript("Coinbase_DKLs_Refresh"),
|
||||
}
|
||||
}
|
||||
|
||||
func (alice *Alice) Round1RefreshGenerateSeed() curves.Scalar {
|
||||
refreshSeed := alice.curve.Scalar.Random(rand.Reader)
|
||||
alice.transcript.AppendMessage([]byte("alice refresh seed"), refreshSeed.Bytes())
|
||||
return refreshSeed
|
||||
}
|
||||
|
||||
func (bob *Bob) Round2RefreshProduceSeedAndMultiplyAndStartOT(aliceSeed curves.Scalar) (*RefreshRound2Output, error) {
|
||||
bob.transcript.AppendMessage([]byte("alice refresh seed"), aliceSeed.Bytes())
|
||||
bobSeed := bob.curve.Scalar.Random(rand.Reader)
|
||||
bob.transcript.AppendMessage([]byte("bob refresh seed"), bobSeed.Bytes())
|
||||
k, err := bob.curve.NewScalar().SetBytes(
|
||||
bob.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
|
||||
}
|
||||
bob.secretKeyShare = bob.secretKeyShare.Mul(k)
|
||||
|
||||
uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
|
||||
copy(uniqueSessionId[:], bob.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
|
||||
bob.sender, err = simplest.NewSender(bob.curve, kos.Kappa, uniqueSessionId)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "bob constructing new OT sender in refresh round 2")
|
||||
}
|
||||
seedOTRound1Output, err := bob.sender.Round1ComputeAndZkpToPublicKey()
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "bob computing round 1 of seed OT within refresh round 2")
|
||||
}
|
||||
|
||||
return &RefreshRound2Output{
|
||||
SeedOTRound1Output: seedOTRound1Output,
|
||||
BobMultiplier: bobSeed,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (alice *Alice) Round3RefreshMultiplyRound2Ot(input *RefreshRound2Output) ([]simplest.ReceiversMaskedChoices, error) {
|
||||
alice.transcript.AppendMessage([]byte("bob refresh seed"), input.BobMultiplier.Bytes())
|
||||
k, err := alice.curve.NewScalar().SetBytes(
|
||||
alice.transcript.ExtractBytes([]byte("secret key share multiplier"), simplest.DigestSize),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "couldn't produce bob's secret key share multiplier")
|
||||
}
|
||||
kInverse, err := k.Invert()
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "couldn't produce k inverse (alice's secret key share)")
|
||||
}
|
||||
alice.secretKeyShare = alice.secretKeyShare.Mul(kInverse)
|
||||
|
||||
uniqueSessionId := [simplest.DigestSize]byte{} // note: will use and re-use this below for sub-session IDs.
|
||||
copy(uniqueSessionId[:], alice.transcript.ExtractBytes([]byte("salt for simplest OT"), simplest.DigestSize))
|
||||
alice.receiver, err = simplest.NewReceiver(alice.curve, kos.Kappa, uniqueSessionId)
|
||||
if err != nil {
|
||||
return nil, errors.Wrap(err, "couldn't construct OT receiver")
|
||||
}
|
||||
|
||||
return alice.receiver.Round2VerifySchnorrAndPadTransfer(input.SeedOTRound1Output)
|
||||
}
|
||||
|
||||
func (bob *Bob) Round4RefreshRound3Ot(compressedReceiversMaskedChoice []simplest.ReceiversMaskedChoices) ([]simplest.OtChallenge, error) {
|
||||
return bob.sender.Round3PadTransfer(compressedReceiversMaskedChoice)
|
||||
}
|
||||
|
||||
func (alice *Alice) Round5RefreshRound4Ot(challenge []simplest.OtChallenge) ([]simplest.OtChallengeResponse, error) {
|
||||
return alice.receiver.Round4RespondToChallenge(challenge)
|
||||
}
|
||||
|
||||
func (bob *Bob) Round6RefreshRound5Ot(challengeResponses []simplest.OtChallengeResponse) ([]simplest.ChallengeOpening, error) {
|
||||
return bob.sender.Round5Verify(challengeResponses)
|
||||
}
|
||||
|
||||
func (alice *Alice) Round7DkgRound6Ot(challengeOpenings []simplest.ChallengeOpening) error {
|
||||
return alice.receiver.Round6Verify(challengeOpenings)
|
||||
}
|
||||
|
||||
func (alice *Alice) Output() *dkg.AliceOutput {
|
||||
return &dkg.AliceOutput{
|
||||
PublicKey: alice.publicKey,
|
||||
SecretKeyShare: alice.secretKeyShare,
|
||||
SeedOtResult: alice.receiver.Output,
|
||||
}
|
||||
}
|
||||
|
||||
func (bob *Bob) Output() *dkg.BobOutput {
|
||||
return &dkg.BobOutput{
|
||||
PublicKey: bob.publicKey,
|
||||
SecretKeyShare: bob.secretKeyShare,
|
||||
SeedOtResult: bob.sender.Output,
|
||||
}
|
||||
}
|
||||
Executable
+186
@@ -0,0 +1,186 @@
|
||||
//
|
||||
// Copyright Coinbase, Inc. All Rights Reserved.
|
||||
//
|
||||
// SPDX-License-Identifier: Apache-2.0
|
||||
//
|
||||
|
||||
package refresh_test
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
"golang.org/x/crypto/sha3"
|
||||
|
||||
"github.com/onsonr/sonr/crypto/core/curves"
|
||||
"github.com/onsonr/sonr/crypto/ot/extension/kos"
|
||||
"github.com/onsonr/sonr/crypto/tecdsa/dklsv1/dkg"
|
||||
"github.com/onsonr/sonr/crypto/tecdsa/dklsv1/refresh"
|
||||
"github.com/onsonr/sonr/crypto/tecdsa/dklsv1/sign"
|
||||
)
|
||||
|
||||
func performDKG(t *testing.T, curve *curves.Curve) (*dkg.Alice, *dkg.Bob) {
|
||||
t.Helper()
|
||||
|
||||
alice := dkg.NewAlice(curve)
|
||||
bob := dkg.NewBob(curve)
|
||||
|
||||
seed, err := bob.Round1GenerateRandomSeed()
|
||||
require.NoError(t, err)
|
||||
round3Output, err := alice.Round2CommitToProof(seed)
|
||||
require.NoError(t, err)
|
||||
proof, err := bob.Round3SchnorrProve(round3Output)
|
||||
require.NoError(t, err)
|
||||
proof, err = alice.Round4VerifyAndReveal(proof)
|
||||
require.NoError(t, err)
|
||||
proof, err = bob.Round5DecommitmentAndStartOt(proof)
|
||||
require.NoError(t, err)
|
||||
compressedReceiversMaskedChoice, err := alice.Round6DkgRound2Ot(proof)
|
||||
require.NoError(t, err)
|
||||
challenge, err := bob.Round7DkgRound3Ot(compressedReceiversMaskedChoice)
|
||||
require.NoError(t, err)
|
||||
challengeResponse, err := alice.Round8DkgRound4Ot(challenge)
|
||||
require.NoError(t, err)
|
||||
challengeOpenings, err := bob.Round9DkgRound5Ot(challengeResponse)
|
||||
require.NoError(t, err)
|
||||
err = alice.Round10DkgRound6Ot(challengeOpenings)
|
||||
require.NoError(t, err)
|
||||
|
||||
return alice, bob
|
||||
}
|
||||
|
||||
func performRefresh(t *testing.T, curve *curves.Curve, aliceSecretKeyShare, bobSecretKeyShare curves.Scalar) (*refresh.Alice, *refresh.Bob) {
|
||||
t.Helper()
|
||||
alice := refresh.NewAlice(curve, &dkg.AliceOutput{SecretKeyShare: aliceSecretKeyShare})
|
||||
bob := refresh.NewBob(curve, &dkg.BobOutput{SecretKeyShare: bobSecretKeyShare})
|
||||
|
||||
round1Output := alice.Round1RefreshGenerateSeed()
|
||||
require.False(t, round1Output.IsZero())
|
||||
round2Output, err := bob.Round2RefreshProduceSeedAndMultiplyAndStartOT(round1Output)
|
||||
require.NoError(t, err)
|
||||
round3Output, err := alice.Round3RefreshMultiplyRound2Ot(round2Output)
|
||||
require.NoError(t, err)
|
||||
round4Output, err := bob.Round4RefreshRound3Ot(round3Output)
|
||||
require.NoError(t, err)
|
||||
round5Output, err := alice.Round5RefreshRound4Ot(round4Output)
|
||||
require.NoError(t, err)
|
||||
round6Output, err := bob.Round6RefreshRound5Ot(round5Output)
|
||||
require.NoError(t, err)
|
||||
err = alice.Round7DkgRound6Ot(round6Output)
|
||||
require.NoError(t, err)
|
||||
return alice, bob
|
||||
}
|
||||
|
||||
func Test_RefreshLeadsToTheSamePublicKeyButDifferentPrivateMaterial(t *testing.T) {
|
||||
t.Parallel()
|
||||
curveInstances := []*curves.Curve{
|
||||
curves.K256(),
|
||||
curves.P256(),
|
||||
}
|
||||
for _, curve := range curveInstances {
|
||||
boundCurve := curve
|
||||
t.Run(fmt.Sprintf("testing refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
|
||||
tt.Parallel()
|
||||
alice, bob := performDKG(tt, boundCurve)
|
||||
|
||||
publicKey := alice.Output().PublicKey
|
||||
require.True(tt, publicKey.Equal(bob.Output().PublicKey))
|
||||
|
||||
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)
|
||||
|
||||
require.NotEqual(tt, aliceRefreshed.Output().SecretKeyShare, alice.Output().SecretKeyShare)
|
||||
require.NotEqual(tt, bobRefreshed.Output().SeedOtResult, bob.Output().SecretKeyShare)
|
||||
require.NotEqualValues(
|
||||
tt,
|
||||
aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey,
|
||||
alice.Output().SeedOtResult.OneTimePadDecryptionKey,
|
||||
)
|
||||
require.NotEqualValues(
|
||||
tt,
|
||||
aliceRefreshed.Output().SeedOtResult.PackedRandomChoiceBits,
|
||||
alice.Output().SeedOtResult.PackedRandomChoiceBits,
|
||||
)
|
||||
require.NotEqualValues(
|
||||
tt,
|
||||
aliceRefreshed.Output().SeedOtResult.RandomChoiceBits,
|
||||
alice.Output().SeedOtResult.RandomChoiceBits,
|
||||
)
|
||||
require.NotEqualValues(
|
||||
tt,
|
||||
bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys,
|
||||
bob.Output().SeedOtResult.OneTimePadEncryptionKeys,
|
||||
)
|
||||
|
||||
pkA := boundCurve.ScalarBaseMult(aliceRefreshed.Output().SecretKeyShare)
|
||||
computedPublicKeyA := pkA.Mul(bobRefreshed.Output().SecretKeyShare)
|
||||
require.True(tt, computedPublicKeyA.Equal(publicKey))
|
||||
|
||||
pkB := boundCurve.ScalarBaseMult(bobRefreshed.Output().SecretKeyShare)
|
||||
computedPublicKeyB := pkB.Mul(aliceRefreshed.Output().SecretKeyShare)
|
||||
require.True(tt, computedPublicKeyB.Equal(publicKey))
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_RefreshOTIsCorrect(t *testing.T) {
|
||||
t.Parallel()
|
||||
curveInstances := []*curves.Curve{
|
||||
curves.K256(),
|
||||
curves.P256(),
|
||||
}
|
||||
for _, curve := range curveInstances {
|
||||
boundCurve := curve
|
||||
t.Run(fmt.Sprintf("testing OT correctness of key refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
|
||||
tt.Parallel()
|
||||
alice, bob := performDKG(tt, boundCurve)
|
||||
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, alice.Output().SecretKeyShare, bob.Output().SecretKeyShare)
|
||||
for i := 0; i < kos.Kappa; i++ {
|
||||
if aliceRefreshed.Output().SeedOtResult.OneTimePadDecryptionKey[i] != bobRefreshed.Output().SeedOtResult.OneTimePadEncryptionKeys[i][aliceRefreshed.Output().SeedOtResult.RandomChoiceBits[i]] {
|
||||
tt.Errorf("oblivious transfer is incorrect at index i=%v", i)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func Test_CanSignAfterRefresh(t *testing.T) {
|
||||
t.Parallel()
|
||||
curveInstances := []*curves.Curve{
|
||||
curves.K256(),
|
||||
curves.P256(),
|
||||
}
|
||||
for _, curve := range curveInstances {
|
||||
boundCurve := curve
|
||||
t.Run(fmt.Sprintf("testing sign after refresh for curve %s", boundCurve.Name), func(tt *testing.T) {
|
||||
tt.Parallel()
|
||||
aliceDKG, bobDKG := performDKG(tt, boundCurve)
|
||||
|
||||
publicKey := aliceDKG.Output().PublicKey
|
||||
require.True(tt, publicKey.Equal(bobDKG.Output().PublicKey))
|
||||
|
||||
aliceRefreshed, bobRefreshed := performRefresh(tt, boundCurve, aliceDKG.Output().SecretKeyShare, bobDKG.Output().SecretKeyShare)
|
||||
|
||||
alice := sign.NewAlice(boundCurve, sha3.New256(), &dkg.AliceOutput{
|
||||
SeedOtResult: aliceRefreshed.Output().SeedOtResult,
|
||||
SecretKeyShare: aliceRefreshed.Output().SecretKeyShare,
|
||||
PublicKey: publicKey,
|
||||
})
|
||||
bob := sign.NewBob(boundCurve, sha3.New256(), &dkg.BobOutput{
|
||||
SeedOtResult: bobRefreshed.Output().SeedOtResult,
|
||||
SecretKeyShare: bobRefreshed.Output().SecretKeyShare,
|
||||
PublicKey: publicKey,
|
||||
})
|
||||
|
||||
message := []byte("A message.")
|
||||
seed, err := alice.Round1GenerateRandomSeed()
|
||||
require.NoError(tt, err)
|
||||
round3Output, err := bob.Round2Initialize(seed)
|
||||
require.NoError(tt, err)
|
||||
round4Output, err := alice.Round3Sign(message, round3Output)
|
||||
require.NoError(tt, err)
|
||||
err = bob.Round4Final(message, round4Output)
|
||||
require.NoError(tt, err, "curve: %s", boundCurve.Name)
|
||||
})
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user