vss

package
v0.0.0-...-57993ae Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 23, 2019 License: MPL-2.0 Imports: 13 Imported by: 1

Documentation

Overview

Package vss implements the verifiable secret sharing scheme from "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing" by Torben Pryds Pedersen. https://link.springer.com/content/pdf/10.1007/3-540-46766-1_9.pdf

Index

Constants

View Source
const (
	// StatusComplaint is a constant value meaning that a verifier issues
	// a Complaint against its Dealer.
	StatusComplaint bool = false
	// StatusApproval is a constant value meaning that a verifier agrees with
	// the share it received.
	StatusApproval bool = true
)

Variables

View Source
var ErrNoDealBeforeResponse = errors.New("verfier: need to receive deal before response")

ErrNoDealBeforeResponse is an error returned if a verifier receives a deal before having received any responses. For the moment, the caller must be sure to have dispatched a deal before.

Functions

func MinimumT

func MinimumT(n int) int

MinimumT returns the minimum safe T that is proven to be secure with this protocol. It expects n, the total number of participants. WARNING: Setting a lower T could make the whole protocol insecure. Setting a higher T only makes it harder to reconstruct the secret.

func RecoverSecret

func RecoverSecret(suite Suite, deals []*Deal, n, t int) (kyber.Scalar, error)

RecoverSecret recovers the secret shared by a Dealer by gathering at least t Deals from the verifiers. It returns an error if there is not enough Deals or if all Deals don't have the same SessionID.

Types

type Deal

type Deal struct {
	// Unique session identifier for this protocol run
	SessionID []byte
	// Private share generated by the dealer
	SecShare *share.PriShare
	// Threshold used for this secret sharing run
	T uint32
	// Commitments are the coefficients used to verify the shares against
	Commitments []kyber.Point
}

Deal encapsulates the verifiable secret share and is sent by the dealer to a verifier.

func (*Deal) MarshalBinary

func (d *Deal) MarshalBinary() ([]byte, error)

MarshalBinary returns the binary representations of a Deal. The encryption of a deal operates on this binary representation.

func (*Deal) UnmarshalBinary

func (d *Deal) UnmarshalBinary(s Suite, buff []byte) error

UnmarshalBinary reads the Deal from the binary represenstation.

type Dealer

type Dealer struct {
	// contains filtered or unexported fields
}

Dealer encapsulates for creating and distributing the shares and for replying to any Responses.

func NewDealer

func NewDealer(suite Suite, longterm, secret kyber.Scalar, verifiers []kyber.Point, t int) (*Dealer, error)

NewDealer returns a Dealer capable of leading the secret sharing scheme. It does not have to be trusted by other Verifiers. The security parameter t is the number of shares required to reconstruct the secret. It is HIGHLY RECOMMENDED to use a threshold higher or equal than what the method MinimumT() returns, otherwise it breaks the security assumptions of the whole scheme. It returns an error if the t is less than or equal to 2.

func (*Dealer) Commits

func (d *Dealer) Commits() []kyber.Point

Commits returns the commitments of the coefficient of the secret polynomial the Dealer is sharing.

func (Dealer) DealCertified

func (a Dealer) DealCertified() bool

DealCertified returns true if there has been less than t complaints, all Justifications were correct and if EnoughApprovals() returns true.

func (*Dealer) EncryptedDeal

func (d *Dealer) EncryptedDeal(i int) (*EncryptedDeal, error)

EncryptedDeal returns the encryption of the deal that must be given to the verifier at index i. The dealer first generates a temporary Diffie Hellman key, signs it using its longterm key, and computes the shared key depending on its longterm and ephemeral key and the verifier's public key. This shared key is then fed into a HKDF whose output is the key to a AEAD (AES256-GCM) scheme to encrypt the deal.

func (*Dealer) EncryptedDeals

func (d *Dealer) EncryptedDeals() ([]*EncryptedDeal, error)

EncryptedDeals calls `EncryptedDeal` for each index of the verifier and returns the list of encrypted deals. Each index in the returned slice corresponds to the index in the list of verifiers.

func (Dealer) EnoughApprovals

func (a Dealer) EnoughApprovals() bool

EnoughApprovals returns true if enough verifiers have sent their approval for the deal they received.

func (*Dealer) Key

func (d *Dealer) Key() (secret kyber.Scalar, public kyber.Point)

Key returns the longterm key pair used by this Dealer.

func (*Dealer) PlaintextDeal

func (d *Dealer) PlaintextDeal(i int) (*Deal, error)

PlaintextDeal returns the plaintext version of the deal destined for peer i. Use this only for testing.

func (*Dealer) PrivatePoly

func (d *Dealer) PrivatePoly() *share.PriPoly

PrivatePoly returns the private polynomial used to generate the deal. This private polynomial can be saved and then later on used to generate new shares. This information SHOULD STAY PRIVATE and thus MUST never be given to any third party.

func (*Dealer) ProcessResponse

func (d *Dealer) ProcessResponse(r *Response) (*Justification, error)

ProcessResponse analyzes the given Response. If it's a valid complaint, then it returns a Justification. This Justification must be broadcasted to every participants. If it's an invalid complaint, it returns an error about the complaint. The verifiers will also ignore an invalid Complaint.

func (*Dealer) SecretCommit

func (d *Dealer) SecretCommit() kyber.Point

SecretCommit returns the commitment of the secret being shared by this dealer. This function is only to be called once the deal has enough approvals and is verified otherwise it returns nil.

func (*Dealer) SessionID

func (d *Dealer) SessionID() []byte

SessionID returns the current sessionID generated by this dealer for this protocol run.

func (*Dealer) SetTimeout

func (d *Dealer) SetTimeout()

SetTimeout marks the end of a round, invalidating any missing (or future) response for this DKG protocol round. The caller is expected to call this after a long timeout so each DKG node can still compute its share if enough Deals are valid.

func (Dealer) VerifyDeal

func (a Dealer) VerifyDeal(d *Deal, inclusion bool) error

VerifyDeal analyzes the deal and returns an error if it's incorrect. If inclusion is true, it also returns an error if it is the second time this struct analyzes a Deal.

type EncryptedDeal

type EncryptedDeal struct {
	// Ephemeral Diffie Hellman key
	DHKey []byte
	// Signature of the DH key by the longterm key of the dealer
	Signature []byte
	// Nonce used for the encryption
	Nonce []byte
	// AEAD encryption of the deal marshalled by protobuf
	Cipher []byte
}

EncryptedDeal contains the deal in a encrypted form only decipherable by the correct recipient. The encryption is performed in a similar manner as what is done in TLS. The dealer generates a temporary key pair, signs it with its longterm secret key.

type Justification

type Justification struct {
	// SessionID related to the current run of the protocol
	SessionID []byte
	// Index of the verifier who issued the Complaint,i.e. index of this Deal
	Index uint32
	// Deal in cleartext
	Deal *Deal
	// Signature over the whole packet
	Signature []byte
}

Justification is a message that is broadcasted by the Dealer in response to a Complaint. It contains the original Complaint as well as the shares distributed to the complainer.

func (*Justification) Hash

func (j *Justification) Hash(s Suite) []byte

Hash returns the hash of a Justification.

type Response

type Response struct {
	// SessionID related to this run of the protocol
	SessionID []byte
	// Index of the verifier issuing this Response
	Index uint32
	// false = NO APPROVAL == Complaint , true = APPROVAL
	Status bool
	// Signature over the whole packet
	Signature []byte
}

Response is sent by the verifiers to all participants and holds each individual validation or refusal of a Deal.

func (*Response) Hash

func (r *Response) Hash(s Suite) []byte

Hash returns the Hash representation of the Response

type Suite

Suite defines the capabilities required by the vss package.

type Verifier

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier receives a Deal from a Dealer, can reply with a Complaint, and can collaborate with other Verifiers to reconstruct a secret.

func NewVerifier

func NewVerifier(suite Suite, longterm kyber.Scalar, dealerKey kyber.Point,
	verifiers []kyber.Point) (*Verifier, error)

NewVerifier returns a Verifier out of:

  • its longterm secret key
  • the longterm dealer public key
  • the list of public key of verifiers. The list MUST include the public key of this Verifier also.

The security parameter t of the secret sharing scheme is automatically set to a default safe value. If a different t value is required, it is possible to set it with `verifier.SetT()`.

func (*Verifier) Deal

func (v *Verifier) Deal() *Deal

Deal returns the Deal that this verifier has received. It returns nil if the deal is not certified or there is not enough approvals.

func (Verifier) DealCertified

func (a Verifier) DealCertified() bool

DealCertified returns true if there has been less than t complaints, all Justifications were correct and if EnoughApprovals() returns true.

func (Verifier) EnoughApprovals

func (a Verifier) EnoughApprovals() bool

EnoughApprovals returns true if enough verifiers have sent their approval for the deal they received.

func (*Verifier) Index

func (v *Verifier) Index() int

Index returns the index of the verifier in the list of participants used during this run of the protocol.

func (*Verifier) Key

func (v *Verifier) Key() (kyber.Scalar, kyber.Point)

Key returns the longterm key pair this verifier is using during this protocol run.

func (*Verifier) ProcessEncryptedDeal

func (v *Verifier) ProcessEncryptedDeal(e *EncryptedDeal) (*Response, error)

ProcessEncryptedDeal decrypt the deal received from the Dealer. If the deal is valid, i.e. the verifier can verify its shares against the public coefficients and the signature is valid, an approval response is returned and must be broadcasted to every participants including the dealer. If the deal itself is invalid, it returns a complaint response that must be broadcasted to every other participants including the dealer. If the deal has already been received, or the signature generation of the response failed, it returns an error without any responses.

func (*Verifier) ProcessJustification

func (v *Verifier) ProcessJustification(dr *Justification) error

ProcessJustification takes a DealerResponse and returns an error if something went wrong during the verification. If it is the case, that probably means the Dealer is acting maliciously. In order to be sure, call `v.EnoughApprovals()` and if true, `v.DealCertified()`.

func (*Verifier) ProcessResponse

func (v *Verifier) ProcessResponse(resp *Response) error

ProcessResponse analyzes the given response. If it's a valid complaint, the verifier should expect to see a Justification from the Dealer. It returns an error if it's not a valid response. Call `v.DealCertified()` to check if the whole protocol is finished.

func (*Verifier) SessionID

func (v *Verifier) SessionID() []byte

SessionID returns the session id generated by the Dealer. It returns an nil slice if the verifier has not received the Deal yet.

func (*Verifier) SetTimeout

func (v *Verifier) SetTimeout()

SetTimeout marks the end of a round, invalidating any missing (or future) response for this DKG protocol round. The caller is expected to call this after a long timeout so each DKG node can still compute its share if enough Deals are valid.

func (*Verifier) UnsafeSetResponseDKG

func (v *Verifier) UnsafeSetResponseDKG(idx uint32, approval bool)

UnsafeSetResponseDKG is an UNSAFE bypass method to allow DKG to use VSS that works on basis of approval only.

func (Verifier) VerifyDeal

func (a Verifier) VerifyDeal(d *Deal, inclusion bool) error

VerifyDeal analyzes the deal and returns an error if it's incorrect. If inclusion is true, it also returns an error if it is the second time this struct analyzes a Deal.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL