vss

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 14, 2020 License: MPL-2.0 Imports: 13 Imported by: 1

Documentation

Overview

Package vss implements the verifiable secret sharing scheme from the paper "Provably Secure Distributed Schnorr Signatures and a (t, n) Threshold Scheme for Implicit Certificates". VSS enables a dealer to share a secret securely and verifiably among n participants out of which at least t are required for its reconstruction. The verifiability of the process prevents a malicious dealer from influencing the outcome to his advantage as each verifier can check the validity of the received share. The protocol has the following steps:

  1. The dealer send a Deal to every verifiers using `Deals()`. Each deal must be sent securely to one verifier whose public key is at the same index than the index of the Deal.

  2. Each verifier processes the Deal with `ProcessDeal`. This function returns a Response which can be twofold: - an approval, to confirm a correct deal - a complaint to announce an incorrect deal notifying others that the dealer might be malicious. All Responses must be broadcasted to every verifiers and the dealer.

  3. The dealer can respond to each complaint by a justification revealing the share he originally sent out to the accusing verifier. This is done by calling `ProcessResponse` on the `Dealer`.

  4. The verifiers refuse the shared secret and abort the protocol if there are at least t complaints OR if a Justification is wrong. The verifiers accept the shared secret if there are at least t approvals at which point any t out of n verifiers can reveal their shares to reconstruct the shared secret.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func MinimumT 

func MinimumT(n int) int

MinimumT returns the minimum safe T that is proven to be secure with this protocol. It expects n, the total number of participants. WARNING: Setting a lower T could make the whole protocol insecure. Setting a higher T only makes it harder to reconstruct the secret.

func RecoverSecret 

func RecoverSecret(suite Suite, deals []*Deal, n, t int) (kyber.Scalar, error)

RecoverSecret recovers the secret shared by a Dealer by gathering at least t Deals from the verifiers. It returns an error if there is not enough Deals or if all Deals don't have the same SessionID.

Types

type Deal 

type Deal struct {
	// Unique session identifier for this protocol run
	SessionID []byte
	// Private share generated by the dealer
	SecShare *share.PriShare
	// Random share generated by the dealer
	RndShare *share.PriShare
	// Threshold used for this secret sharing run
	T uint32
	// Commitments are the coefficients used to verify the shares against
	Commitments []kyber.Point
}

Deal encapsulates the verifiable secret share and is sent by the dealer to a verifier.

type Dealer 

type Dealer struct {
	// contains filtered or unexported fields
}

Dealer encapsulates for creating and distributing the shares and for replying to any Responses.

func NewDealer 

func NewDealer(suite Suite, longterm, secret kyber.Scalar, verifiers []kyber.Point, t int) (*Dealer, error)

NewDealer returns a Dealer capable of leading the secret sharing scheme. It does not have to be trusted by other Verifiers. The security parameter t is the number of shares required to reconstruct the secret. It is HIGHLY RECOMMENDED to use a threshold higher or equal than what the method MinimumT() returns, otherwise it breaks the security assumptions of the whole scheme. It returns an error if the t is inferior or equal to 2.

func (*Dealer) Commits 

func (d *Dealer) Commits() []kyber.Point

Commits returns the commitments of the coefficient of the secret polynomial the Dealer is sharing.

func (Dealer) DealCertified 

func (a Dealer) DealCertified() bool

DealCertified returns true if there has been less than t complaints, all Justifications were correct and if EnoughApprovals() returns true.

func (*Dealer) EncryptedDeal 

func (d *Dealer) EncryptedDeal(i int) (*EncryptedDeal, error)

EncryptedDeal returns the encryption of the deal that must be given to the verifier at index i. The dealer first generates a temporary Diffie Hellman key, signs it using its longterm key, and computes the shared key depending on its longterm and ephemeral key and the verifier's public key. This shared key is then fed into a HKDF whose output is the key to a AEAD (AES256-GCM) scheme to encrypt the deal.

func (*Dealer) EncryptedDeals 

func (d *Dealer) EncryptedDeals() ([]*EncryptedDeal, error)

EncryptedDeals calls `EncryptedDeal` for each index of the verifier and returns the list of encrypted deals. Each index in the returned slice corresponds to the index in the list of verifiers.

func (Dealer) EnoughApprovals 

func (a Dealer) EnoughApprovals() bool

EnoughApprovals returns true if enough verifiers have sent their approval for the deal they received.

func (*Dealer) Key 

func (d *Dealer) Key() (secret kyber.Scalar, public kyber.Point)

Key returns the longterm key pair used by this Dealer.

func (*Dealer) PlaintextDeal 

func (d *Dealer) PlaintextDeal(i int) (*Deal, error)

PlaintextDeal returns the plaintext version of the deal destined for peer i. Use this only for testing.

func (*Dealer) ProcessResponse 

func (d *Dealer) ProcessResponse(r *Response) (*Justification, error)

ProcessResponse analyzes the given Response. If it's a valid complaint, then it returns a Justification. This Justification must be broadcasted to every participants. If it's an invalid complaint, it returns an error about the complaint. The verifiers will also ignore an invalid Complaint.

func (*Dealer) SecretCommit 

func (d *Dealer) SecretCommit() kyber.Point

SecretCommit returns the commitment of the secret being shared by this dealer. This function is only to be called once the deal has enough approvals and is verified otherwise it returns nil.

func (*Dealer) SessionID 

func (d *Dealer) SessionID() []byte

SessionID returns the current sessionID generated by this dealer for this protocol run.

func (*Dealer) SetTimeout 

func (d *Dealer) SetTimeout()

SetTimeout tells this dealer to consider this moment the maximum time limit. it calls cleanVerifiers which will take care of all Verifiers who have not responded until now.

func (Dealer) UnsafeSetResponseDKG 

func (a Dealer) UnsafeSetResponseDKG(idx uint32, approval bool)

UnsafeSetResponseDKG is an UNSAFE bypass method to allow DKG to use VSS that works on basis of approval only.

func (Dealer) VerifyDeal 

func (a Dealer) VerifyDeal(d *Deal, inclusion bool) error

VerifyDeal analyzes the deal and returns an error if it's incorrect. If inclusion is true, it also returns an error if it the second time this struct analyzes a Deal.

type EncryptedDeal 

type EncryptedDeal struct {
	// Ephemeral Diffie Hellman key
	DHKey kyber.Point
	// Signature of the DH key by the longterm key of the dealer
	Signature []byte
	// Nonce used for the encryption
	Nonce []byte
	// AEAD encryption of the deal marshalled by protobuf
	Cipher []byte
}

EncryptedDeal contains the deal in a encrypted form only decipherable by the correct recipient. The encryption is performed in a similar manner as what is done in TLS. The dealer generates a temporary key pair, signs it with its longterm secret key.

type Justification 

type Justification struct {
	// SessionID related to the current run of the protocol
	SessionID []byte
	// Index of the verifier who issued the Complaint,i.e. index of this Deal
	Index uint32
	// Deal in cleartext
	Deal *Deal
	// Signature over the whole packet
	Signature []byte
}

Justification is a message that is broadcasted by the Dealer in response to a Complaint. It contains the original Complaint as well as the shares distributed to the complainer.

func (*Justification) Hash 

func (j *Justification) Hash(s Suite) []byte

Hash returns the hash of a Justification.

type Response 

type Response struct {
	// SessionID related to this run of the protocol
	SessionID []byte
	// Index of the verifier issuing this Response
	Index uint32
	// Approved is true if the Response is valid
	Approved bool
	// Signature over the whole packet
	Signature []byte
}

Response is sent by the verifiers to all participants and holds each individual validation or refusal of a Deal.

func (*Response) Hash 

func (r *Response) Hash(s Suite) []byte

Hash returns the Hash representation of the Response

type Suite 

type Suite interface {
	kyber.Group
	kyber.HashFactory
	kyber.XOFFactory
	kyber.Random
}

Suite defines the capabilities required by the vss package.

type Verifier 

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier receives a Deal from a Dealer, can reply with a Complaint, and can collaborate with other Verifiers to reconstruct a secret.

func NewVerifier 

func NewVerifier(suite Suite, longterm kyber.Scalar, dealerKey kyber.Point,
	verifiers []kyber.Point) (*Verifier, error)

NewVerifier returns a Verifier out of: - its longterm secret key - the longterm dealer public key - the list of public key of verifiers. The list MUST include the public key of this Verifier also. The security parameter t of the secret sharing scheme is automatically set to a default safe value. If a different t value is required, it is possible to set it with `verifier.SetT()`.

func (*Verifier) Deal 

func (v *Verifier) Deal() *Deal

Deal returns the Deal that this verifier has received. It returns nil if the deal is not certified or there is not enough approvals.

func (Verifier) DealCertified 

func (a Verifier) DealCertified() bool

DealCertified returns true if there has been less than t complaints, all Justifications were correct and if EnoughApprovals() returns true.

func (Verifier) EnoughApprovals 

func (a Verifier) EnoughApprovals() bool

EnoughApprovals returns true if enough verifiers have sent their approval for the deal they received.

func (*Verifier) Index 

func (v *Verifier) Index() int

Index returns the index of the verifier in the list of participants used during this run of the protocol.

func (*Verifier) Key 

func (v *Verifier) Key() (kyber.Scalar, kyber.Point)

Key returns the longterm key pair this verifier is using during this protocol run.

func (*Verifier) ProcessEncryptedDeal 

func (v *Verifier) ProcessEncryptedDeal(e *EncryptedDeal) (*Response, error)

ProcessEncryptedDeal decrypt the deal received from the Dealer. If the deal is valid, i.e. the verifier can verify its shares against the public coefficients and the signature is valid, an approval response is returned and must be broadcasted to every participants including the dealer. If the deal itself is invalid, it returns a complaint response that must be broadcasted to every other participants including the dealer. If the deal has already been received, or the signature generation of the response failed, it returns an error without any responses.

func (*Verifier) ProcessJustification 

func (v *Verifier) ProcessJustification(dr *Justification) error

ProcessJustification takes a DealerResponse and returns an error if something went wrong during the verification. If it is the case, that probably means the Dealer is acting maliciously. In order to be sure, call `v.EnoughApprovals()` and if true, `v.DealCertified()`.

func (*Verifier) ProcessResponse 

func (v *Verifier) ProcessResponse(resp *Response) error

ProcessResponse analyzes the given response. If it's a valid complaint, the verifier should expect to see a Justification from the Dealer. It returns an error if it's not a valid response. Call `v.DealCertified()` to check if the whole protocol is finished.

func (*Verifier) SessionID 

func (v *Verifier) SessionID() []byte

SessionID returns the session id generated by the Dealer. WARNING: it returns an nil slice if the verifier has not received the Deal yet !

func (*Verifier) SetTimeout 

func (v *Verifier) SetTimeout()

SetTimeout tells this verifier to consider this moment the maximum time limit. it calls cleanVerifiers which will take care of all Verifiers who have not responded until now.

func (Verifier) UnsafeSetResponseDKG 

func (a Verifier) UnsafeSetResponseDKG(idx uint32, approval bool)

UnsafeSetResponseDKG is an UNSAFE bypass method to allow DKG to use VSS that works on basis of approval only.

func (Verifier) VerifyDeal 

func (a Verifier) VerifyDeal(d *Deal, inclusion bool) error

VerifyDeal analyzes the deal and returns an error if it's incorrect. If inclusion is true, it also returns an error if it the second time this struct analyzes a Deal.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.