dkg_round1.go

//
// Copyright Coinbase, Inc. All Rights Reserved.
//
// SPDX-License-Identifier: Apache-2.0
//

package frost

import (
	"bytes"
	crand "crypto/rand"
	"encoding/gob"
	"fmt"
	"reflect"

	"github.com/pkg/errors"

	"github.com/coinbase/kryptology/internal"
	"github.com/coinbase/kryptology/pkg/core/curves"
	"github.com/coinbase/kryptology/pkg/sharing"
)

// Round1Bcast are values that are broadcast to all other participants
// after round1 completes
type Round1Bcast struct {
	Verifiers *sharing.FeldmanVerifier
	Wi, Ci    curves.Scalar
}

type Round1Result struct {
	Broadcast *Round1Bcast
	P2P       *sharing.ShamirShare
}

func (result *Round1Result) Encode() ([]byte, error) {
	gob.Register(result.Broadcast.Verifiers.Commitments[0]) // just the point for now
	gob.Register(result.Broadcast.Ci)
	buf := &bytes.Buffer{}
	enc := gob.NewEncoder(buf)
	if err := enc.Encode(result); err != nil {
		return nil, errors.Wrap(err, "couldn't encode round 1 broadcast")
	}
	return buf.Bytes(), nil
}

func (result *Round1Result) Decode(input []byte) error {
	buf := bytes.NewBuffer(input)
	dec := gob.NewDecoder(buf)
	if err := dec.Decode(result); err != nil {
		return errors.Wrap(err, "couldn't encode round 1 broadcast")
	}
	return nil
}

// Round1P2PSend are values that are P2PSend to all other participants
// after round1 completes
type Round1P2PSend = map[uint32]*sharing.ShamirShare

// Round1 implements dkg round 1 of FROST
func (dp *DkgParticipant) Round1(secret []byte) (*Round1Bcast, Round1P2PSend, error) {
	// Make sure dkg participant is not empty
	if dp == nil || dp.Curve == nil {
		return nil, nil, internal.ErrNilArguments
	}

	// Make sure round number is correct
	if dp.round != 1 {
		return nil, nil, internal.ErrInvalidRound
	}

	// Check number of participants
	if uint32(len(dp.participantShares)) > dp.feldman.Limit || uint32(len(dp.participantShares)) < dp.feldman.Threshold {
		return nil, nil, fmt.Errorf("length of dp.otherParticipantShares + 1 should be equal to feldman limit")
	}

	// If secret is nil, sample a new one
	// If not, check secret is valid
	var s curves.Scalar
	var err error
	if secret == nil {
		s = dp.Curve.Scalar.Random(crand.Reader)
	} else {
		s, err = dp.Curve.Scalar.SetBytes(secret)
		if err != nil {
			return nil, nil, err
		}
		if s.IsZero() {
			return nil, nil, internal.ErrZeroValue
		}
	}

	// Step 1 - (Aj0,...Ajt), (xi1,...,xin) <- FeldmanShare(s)
	// We should validate types of Feldman curve scalar and participant's curve scalar.
	if reflect.TypeOf(dp.feldman.Curve.Scalar) != reflect.TypeOf(dp.Curve.Scalar) {
		return nil, nil, fmt.Errorf("feldman scalar should have the same type as the dkg participant scalar")
	}
	ids := make([]uint32, len(dp.participantShares))
	cnt := 0
	for _, s := range dp.participantShares {
		ids[cnt] = s.Id
		cnt++
	}
	verifiers, shares, err := dp.feldman.SplitTo(s, crand.Reader, ids)
	if err != nil {
		return nil, nil, err
	}

	// Store Verifiers and shares
	dp.verifiers = verifiers
	dp.secretShares = shares

	// Step 2 - Sample ki <- Z_q
	ki := dp.Curve.Scalar.Random(crand.Reader)

	// Step 3 - Compute Ri = ki*G
	Ri := dp.Curve.ScalarBaseMult(ki)

	// Step 4 - Compute Ci = H(i, CTX, g^{a_(i,0)}, R_i), where CTX is fixed context string
	var msg []byte
	// Append participant id
	msg = append(msg, byte(dp.Id))
	// Append CTX
	msg = append(msg, dp.ctx)
	// Append a_{i,0}*G
	msg = append(msg, verifiers.Commitments[0].ToAffineCompressed()...)
	// Append Ri
	msg = append(msg, Ri.ToAffineCompressed()...)
	// Hash the message and get Ci
	ci := dp.Curve.Scalar.Hash(msg)

	// Step 5 - Compute Wi = ki+a_{i,0}*c_i mod q. Note that a_{i,0} is the secret.
	// Note: We have to compute scalar in the following way when using ed25519 curve, rather than scalar := dp.Scalar.Mul(s, Ci)
	// there is an invalid encoding error when we compute scalar as above.
	wi := s.MulAdd(ci, ki)

	// Step 6 - Broadcast (Ci, Wi, Ci) to other participants
	round1Bcast := &Round1Bcast{
		verifiers,
		wi,
		ci,
	}

	// Step 7 - P2PSend f_i(j) to each participant Pj and keep (i, f_j(i)) for himself
	amInCommittee := false
	for id, _ := range dp.participantShares {
		if dp.Id == id {
			amInCommittee = true
		}
	}
	p2pSendCnt := len(dp.participantShares)
	if !amInCommittee {
		p2pSendCnt = len(dp.participantShares) - 1
	}
	p2pSend := make(Round1P2PSend, p2pSendCnt)
	for _, share := range shares {
		if share.Id != dp.Id {
			p2pSend[share.Id] = share
		} else {
			ownShare := dp.Curve.Scalar.Zero().Clone()
			ownShare.SetBytes(share.Value)
			dp.SkShare = ownShare
		}
	}

	// Update internal state
	dp.round = 2

	// return
	return round1Bcast, p2pSend, nil
}

// SkipRound1 is used when the participant is the re-sharing share receiver only
func (dp *DkgParticipant) SkipRound1() error {
	// Make sure dkg participant is not empty
	if dp == nil || dp.Curve == nil {
		return internal.ErrNilArguments
	}

	// Make sure round number is correct
	if dp.round != 1 {
		return internal.ErrInvalidRound
	}

	// Update internal state
	dp.round = 2

	// return
	return nil
}