modular_frost/curve/
mod.rs

1use core::ops::Deref;
2use std::io::{self, Read};
3
4use rand_core::{RngCore, CryptoRng};
5
6use zeroize::{Zeroize, Zeroizing};
7use subtle::ConstantTimeEq;
8
9use digest::{Digest, Output};
10
11pub use ciphersuite::{
12  group::{
13    ff::{Field, PrimeField},
14    Group,
15  },
16  Ciphersuite,
17};
18
19#[cfg(any(feature = "ristretto", feature = "ed25519"))]
20mod dalek;
21#[cfg(feature = "ristretto")]
22pub use dalek::{Ristretto, IetfRistrettoHram};
23#[cfg(feature = "ed25519")]
24pub use dalek::{Ed25519, IetfEd25519Hram};
25
26#[cfg(any(feature = "secp256k1", feature = "p256"))]
27mod kp256;
28#[cfg(feature = "secp256k1")]
29pub use kp256::{Secp256k1, IetfSecp256k1Hram};
30#[cfg(feature = "p256")]
31pub use kp256::{P256, IetfP256Hram};
32
33#[cfg(feature = "ed448")]
34mod ed448;
35#[cfg(feature = "ed448")]
36pub use ed448::{Ed448, IetfEd448Hram};
37#[cfg(all(test, feature = "ed448"))]
38pub(crate) use ed448::Ietf8032Ed448Hram;
39
40/// FROST Ciphersuite.
41///
42/// This exclude the signing algorithm specific H2, making this solely the curve, its associated
43/// hash function, and the functions derived from it.
44pub trait Curve: Ciphersuite {
45  /// Context string for this curve.
46  const CONTEXT: &'static [u8];
47
48  /// Hash the given dst and data to a byte vector. Used to instantiate H4 and H5.
49  fn hash(dst: &[u8], data: &[u8]) -> Output<Self::H> {
50    Self::H::digest([Self::CONTEXT, dst, data].concat())
51  }
52
53  /// Field element from hash. Used during key gen and by other crates under Serai as a general
54  /// utility. Used to instantiate H1 and H3.
55  #[allow(non_snake_case)]
56  fn hash_to_F(dst: &[u8], msg: &[u8]) -> Self::F {
57    <Self as Ciphersuite>::hash_to_F(&[Self::CONTEXT, dst].concat(), msg)
58  }
59
60  /// Hash the message for the binding factor. H4 from the IETF draft.
61  fn hash_msg(msg: &[u8]) -> Output<Self::H> {
62    Self::hash(b"msg", msg)
63  }
64
65  /// Hash the commitments for the binding factor. H5 from the IETF draft.
66  fn hash_commitments(commitments: &[u8]) -> Output<Self::H> {
67    Self::hash(b"com", commitments)
68  }
69
70  /// Hash the commitments and message to calculate the binding factor. H1 from the IETF draft.
71  //
72  // This may return 0, which is invalid according to the FROST preprint, as all binding factors
73  // are expected to be in the multiplicative subgroup. This isn't a practical issue, as there's a
74  // negligible probability of this returning 0.
75  //
76  // When raised in
77  // https://github.com/cfrg/draft-irtf-cfrg-frost/issues/451#issuecomment-1715985505,
78  // the negligible probbility was seen as sufficient reason not to edit the spec to be robust in
79  // this regard.
80  //
81  // While that decision may be disagreeable, this library cannot implement a robust scheme while
82  // following the specification. Following the specification is preferred to being robust against
83  // an impractical probability enabling a complex attack (made infeasible by the impractical
84  // probability required).
85  //
86  // We could still panic on the 0-hash, preferring correctness to liveliness. Finding the 0-hash
87  // is as computationally complex as simply calculating the group key's discrete log however,
88  // making it not worth having a panic (as this library is expected not to panic).
89  fn hash_binding_factor(binding: &[u8]) -> Self::F {
90    <Self as Curve>::hash_to_F(b"rho", binding)
91  }
92
93  /// Securely generate a random nonce. H3 from the IETF draft.
94  fn random_nonce<R: RngCore + CryptoRng>(
95    secret: &Zeroizing<Self::F>,
96    rng: &mut R,
97  ) -> Zeroizing<Self::F> {
98    let mut seed = Zeroizing::new(vec![0; 32]);
99    rng.fill_bytes(seed.as_mut());
100
101    let mut repr = secret.to_repr();
102
103    // Perform rejection sampling until we reach a non-zero nonce
104    // While the IETF spec doesn't explicitly require this, generating a zero nonce will produce
105    // commitments which will be rejected for being zero (and if they were used, leak the secret
106    // share)
107    // Rejection sampling here will prevent an honest participant from ever generating 'malicious'
108    // values and ensure safety
109    let mut res;
110    while {
111      seed.extend(repr.as_ref());
112      res = Zeroizing::new(<Self as Curve>::hash_to_F(b"nonce", seed.deref()));
113      res.ct_eq(&Self::F::ZERO).into()
114    } {
115      seed = Zeroizing::new(vec![0; 32]);
116      rng.fill_bytes(&mut seed);
117    }
118    repr.as_mut().zeroize();
119
120    res
121  }
122
123  /// Read a point from a reader, rejecting identity.
124  #[allow(non_snake_case)]
125  fn read_G<R: Read>(reader: &mut R) -> io::Result<Self::G> {
126    let res = <Self as Ciphersuite>::read_G(reader)?;
127    if res.is_identity().into() {
128      Err(io::Error::other("identity point"))?;
129    }
130    Ok(res)
131  }
132}
modular_frost/curve/mod.rs

modular_frost/curve/
mod.rs
