A pairing-based threshold cryptosystem for collaborative decryption and signatures.
The blsttc crate provides cryptographic keys with methods for signing and encrypting messages, as well as key sets for threshold signatures and threshold encryption.
blsttc is an adaptation of the threshold_crypto crate using blast (blst) for signing and verification speed improvements.
The threshold signature scheme is described in Threshold Signatures, Multisignatures and Blind Signatures Based on the Gap-Diffie-Hellman-Group Signature Scheme by Alexandra Boldyreva. This paper extends Boneh-Lynn-Shacham signatures to the threshold setting. Message encryption uses the scheme by Baek and Zhang.
Our implementation is based on the pairing elliptic curve library.
In a network environment, messages are signed and encrypted, and key and signature shares are distributed to network participants. A message can be decrypted and authenticated only with cooperation from at least threshold + 1 nodes.
An official security audit has been completed on threshold_crypto by Jean-Philippe Aumasson. No exploitable security issues were found, and potential improvements have been addressed. Outdated dependencies mentioned in the audit were updated in commit 54026f5.
Note: This library makes no attempt at ensuring constant time operations and as such may leak information that could be used in a timing side-channel attack.
Cargo.toml:
[dependencies]
blsttc = "0.4.1"main.rs:
extern crate rand;
extern crate blsttc;
use blsttc::SecretKey;
/// Very basic secret key usage.
fn main() {
let sk0 = SecretKey::random();
let sk1 = SecretKey::random();
let pk0 = sk0.public_key();
let msg0 = b"Real news";
let msg1 = b"Fake news";
assert!(pk0.verify(&sk0.sign(msg0), msg0));
assert!(!pk0.verify(&sk1.sign(msg0), msg0)); // Wrong key.
assert!(!pk0.verify(&sk0.sign(msg1), msg0)); // Wrong message.
}Run tests with:
$ cargo test
Run examples from the examples directory using:
$ cargo run --example <example name>
Also see the distributed_key_generation test.
The basic usage outline is:
- choose a threshold value
t - create a key set
- distribute
Nsecret key shares among the participants - publish the public master key
A third party can now encrypt a message to the public master key
and any set of t + 1 participants (but no fewer!) can collaborate to
decrypt it. Also, any set of t + 1 participants can collaborate to sign a message,
producing a signature that is verifiable with the public master key.
In this system, a signature is unique and independent of
the set of participants that produced it. If S1 and S2 are
signatures for the same message, produced by two different sets of t + 1
secret key share holders, both signatures will be valid AND
equal. This is useful in some applications, for example a message signature can serve as a pseudorandom number unknown to anyone until t + 1 participants agree to reveal it.
In its simplest form, threshold_crypto requires a trusted dealer to produce and distribute the secret key shares. However, keys can be produced so that only the corresponding participant knows their secret in the end. This crate includes the basic tools to implement such a Distributed Key Generation scheme.
A major application for this library is within a distributed network that
must tolerate up to t adversarial (malicious or faulty) nodes. Because t + 1 nodes are required to sign or reveal information, messages can be trusted
by third-parties as representing the consensus of the network.
Benchmarking functionality is kept in the benches directory. You
can run the benchmarks with the following command:
$ RUSTFLAGS="-C target_cpu=native" cargo bench
We use the criterion benchmarking library.
Licensed under either of:
- Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
See the CONTRIBUTING document for contribution, testing and pull request protocol.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.