Restructure library #72

survived · 2024-01-30T11:34:39Z

CGGMP21 DKG has been proved to be UC-secure, and thus it can be safely reused with other UC-secure TSS implementations. To make it reusable, this PR moves DKG implementation into separate crate cggmp21-keygen, and key share definition into separate crate key-share

github-actions · 2024-01-30T11:35:00Z

Crate direct deps

Direct deps

cggmp21-keygen v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
digest v0.10.6
futures v0.3.24
generic-ec v0.1.3
generic-ec-zkp v0.1.1
hex v0.4.3
paillier-zk v0.1.0
rand_chacha v0.3.1
rand_core v0.6.4
round-based v0.2.0
serde v1.0.188
serde_with v2.3.3
sha2 v0.10.6
thiserror v1.0.48
udigest v0.1.0

Compared to base branch

Diff

--- direct-deps-base	2024-02-05 09:55:49.439333978 +0000
+++ direct-deps-pr	2024-02-05 09:55:49.775335204 +0000
@@ -0,0 +1 @@
+cggmp21-keygen v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
@@ -3 +4 @@
-generic-ec v0.1.2
+generic-ec v0.1.3

All deps

cargo tree

cggmp21 v0.2.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21)
├── cggmp21-keygen v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
│   ├── digest v0.10.6
│   │   ├── block-buffer v0.10.3
│   │   │   └── generic-array v0.14.6
│   │   │       ├── serde v1.0.188
│   │   │       │   └── serde_derive v1.0.188 (proc-macro)
│   │   │       │       ├── proc-macro2 v1.0.66
│   │   │       │       │   └── unicode-ident v1.0.4
│   │   │       │       ├── quote v1.0.33
│   │   │       │       │   └── proc-macro2 v1.0.66 (*)
│   │   │       │       └── syn v2.0.32
│   │   │       │           ├── proc-macro2 v1.0.66 (*)
│   │   │       │           ├── quote v1.0.33 (*)
│   │   │       │           └── unicode-ident v1.0.4
│   │   │       └── typenum v1.15.0
│   │   └── crypto-common v0.1.6
│   │       ├── generic-array v0.14.6 (*)
│   │       └── typenum v1.15.0
│   ├── futures v0.3.24
│   │   ├── futures-channel v0.3.24
│   │   │   ├── futures-core v0.3.24
│   │   │   └── futures-sink v0.3.24
│   │   ├── futures-core v0.3.24
│   │   ├── futures-executor v0.3.24
│   │   │   ├── futures-core v0.3.24
│   │   │   ├── futures-task v0.3.24
│   │   │   └── futures-util v0.3.24
│   │   │       ├── futures-channel v0.3.24 (*)
│   │   │       ├── futures-core v0.3.24
│   │   │       ├── futures-io v0.3.24
│   │   │       ├── futures-macro v0.3.24 (proc-macro)
│   │   │       │   ├── proc-macro2 v1.0.66 (*)
│   │   │       │   ├── quote v1.0.33 (*)
│   │   │       │   └── syn v1.0.101
│   │   │       │       ├── proc-macro2 v1.0.66 (*)
│   │   │       │       ├── quote v1.0.33 (*)
│   │   │       │       └── unicode-ident v1.0.4
│   │   │       ├── futures-sink v0.3.24
│   │   │       ├── futures-task v0.3.24
│   │   │       ├── memchr v2.5.0
│   │   │       ├── pin-project-lite v0.2.9
│   │   │       ├── pin-utils v0.1.0
│   │   │       └── slab v0.4.7
│   │   ├── futures-io v0.3.24
│   │   ├── futures-sink v0.3.24
│   │   ├── futures-task v0.3.24
│   │   └── futures-util v0.3.24 (*)
│   ├── generic-ec v0.1.3
│   │   ├── generic-ec-core v0.1.2
│   │   │   ├── generic-array v0.14.6 (*)
│   │   │   ├── rand_core v0.6.4
│   │   │   ├── serde v1.0.188 (*)
│   │   │   ├── subtle v2.4.1
│   │   │   └── zeroize v1.6.0
│   │   │       └── zeroize_derive v1.3.2 (proc-macro)
│   │   │           ├── proc-macro2 v1.0.66 (*)
│   │   │           ├── quote v1.0.33 (*)
│   │   │           ├── syn v1.0.101 (*)
│   │   │           └── synstructure v0.12.6
│   │   │               ├── proc-macro2 v1.0.66 (*)
│   │   │               ├── quote v1.0.33 (*)
│   │   │               ├── syn v1.0.101 (*)
│   │   │               └── unicode-xid v0.2.4
│   │   ├── getrandom v0.2.10
│   │   │   ├── cfg-if v1.0.0
│   │   │   └── libc v0.2.148
│   │   ├── hex v0.4.3
│   │   │   └── serde v1.0.188 (*)
│   │   ├── phantom-type v0.4.2
│   │   │   └── educe v0.4.19 (proc-macro)
│   │   │       ├── enum-ordinalize v3.1.11 (proc-macro)
│   │   │       │   ├── num-bigint v0.4.3
│   │   │       │   │   ├── num-integer v0.1.45
│   │   │       │   │   │   └── num-traits v0.2.15
│   │   │       │   │   └── num-traits v0.2.15
│   │   │       │   ├── num-traits v0.2.15
│   │   │       │   ├── proc-macro2 v1.0.66 (*)
│   │   │       │   ├── quote v1.0.33 (*)
│   │   │       │   └── syn v1.0.101 (*)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v1.0.101 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── serde v1.0.188 (*)
│   │   ├── serde_with v2.3.3
│   │   │   ├── serde v1.0.188 (*)
│   │   │   └── serde_with_macros v2.3.3 (proc-macro)
│   │   │       ├── darling v0.20.1
│   │   │       │   ├── darling_core v0.20.1
│   │   │       │   │   ├── fnv v1.0.7
│   │   │       │   │   ├── ident_case v1.0.1
│   │   │       │   │   ├── proc-macro2 v1.0.66 (*)
│   │   │       │   │   ├── quote v1.0.33 (*)
│   │   │       │   │   ├── strsim v0.10.0
│   │   │       │   │   └── syn v2.0.32 (*)
│   │   │       │   └── darling_macro v0.20.1 (proc-macro)
│   │   │       │       ├── darling_core v0.20.1 (*)
│   │   │       │       ├── quote v1.0.33 (*)
│   │   │       │       └── syn v2.0.32 (*)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v2.0.32 (*)
│   │   ├── subtle v2.4.1
│   │   ├── udigest v0.1.0
│   │   │   ├── digest v0.10.6 (*)
│   │   │   └── udigest-derive v0.1.0 (proc-macro)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v2.0.32 (*)
│   │   └── zeroize v1.6.0 (*)
│   ├── generic-ec-zkp v0.1.1
│   │   ├── generic-array v0.14.6 (*)
│   │   ├── generic-ec v0.1.3 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── serde v1.0.188 (*)
│   │   ├── subtle v2.4.1
│   │   └── udigest v0.1.0 (*)
│   ├── hex v0.4.3 (*)
│   ├── key-share v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)
│   │   ├── generic-ec v0.1.3 (*)
│   │   ├── generic-ec-zkp v0.1.1 (*)
│   │   ├── hex v0.4.3 (*)
│   │   ├── serde v1.0.188 (*)
│   │   ├── serde_with v2.3.3 (*)
│   │   └── thiserror v1.0.48
│   │       └── thiserror-impl v1.0.48 (proc-macro)
│   │           ├── proc-macro2 v1.0.66 (*)
│   │           ├── quote v1.0.33 (*)
│   │           └── syn v2.0.32 (*)
│   ├── rand_core v0.6.4
│   ├── round-based v0.2.0
│   │   ├── futures-util v0.3.24 (*)
│   │   ├── phantom-type v0.3.1
│   │   │   └── educe v0.4.19 (proc-macro) (*)
│   │   ├── round-based-derive v0.2.0 (proc-macro)
│   │   │   ├── proc-macro2 v1.0.66 (*)
│   │   │   ├── quote v1.0.33 (*)
│   │   │   └── syn v1.0.101 (*)
│   │   ├── thiserror v1.0.48 (*)
│   │   └── tracing v0.1.36
│   │       ├── cfg-if v1.0.0
│   │       ├── pin-project-lite v0.2.9
│   │       ├── tracing-attributes v0.1.22 (proc-macro)
│   │       │   ├── proc-macro2 v1.0.66 (*)
│   │       │   ├── quote v1.0.33 (*)
│   │       │   └── syn v1.0.101 (*)
│   │       └── tracing-core v0.1.29
│   │           └── once_cell v1.17.0
│   ├── serde v1.0.188 (*)
│   ├── serde_with v2.3.3 (*)
│   ├── sha2 v0.10.6
│   │   ├── cfg-if v1.0.0
│   │   ├── cpufeatures v0.2.5
│   │   └── digest v0.10.6 (*)
│   ├── thiserror v1.0.48 (*)
│   └── udigest v0.1.0 (*)
├── digest v0.10.6 (*)
├── futures v0.3.24 (*)
├── generic-ec v0.1.3 (*)
├── generic-ec-zkp v0.1.1 (*)
├── hex v0.4.3 (*)
├── paillier-zk v0.1.0
│   ├── digest v0.10.6 (*)
│   ├── fast-paillier v0.1.0
│   │   ├── bytemuck v1.13.1
│   │   │   └── bytemuck_derive v1.4.1 (proc-macro)
│   │   │       ├── proc-macro2 v1.0.66 (*)
│   │   │       ├── quote v1.0.33 (*)
│   │   │       └── syn v2.0.32 (*)
│   │   ├── rand_core v0.6.4
│   │   ├── rug v1.21.0
│   │   │   ├── az v1.2.1
│   │   │   ├── gmp-mpfr-sys v1.6.1
│   │   │   │   └── libc v0.2.148
│   │   │   ├── libc v0.2.148
│   │   │   └── serde v1.0.188 (*)
│   │   ├── serde v1.0.188 (*)
│   │   └── thiserror v1.0.48 (*)
│   ├── generic-ec v0.1.3 (*)
│   ├── rand_core v0.6.4
│   ├── rug v1.21.0 (*)
│   ├── serde v1.0.188 (*)
│   ├── serde_with v3.0.0
│   │   ├── serde v1.0.188 (*)
│   │   └── serde_with_macros v3.0.0 (proc-macro)
│   │       ├── darling v0.20.1 (*)
│   │       ├── proc-macro2 v1.0.66 (*)
│   │       ├── quote v1.0.33 (*)
│   │       └── syn v2.0.32 (*)
│   └── thiserror v1.0.48 (*)
├── rand_chacha v0.3.1
│   ├── ppv-lite86 v0.2.17
│   └── rand_core v0.6.4
├── rand_core v0.6.4
├── round-based v0.2.0 (*)
├── serde v1.0.188 (*)
├── serde_with v2.3.3 (*)
├── sha2 v0.10.6 (*)
├── thiserror v1.0.48 (*)
└── udigest v0.1.0 (*)

Compared to base branch

Diff

--- all-deps-base	2024-02-05 09:55:49.567334442 +0000
+++ all-deps-pr	2024-02-05 09:55:49.903335677 +0000
@@ -5,0 +6 @@
+cggmp21-keygen v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21-keygen)
@@ -26 +27 @@
-generic-ec v0.1.2
+generic-ec v0.1.3
@@ -32,0 +34 @@
+key-share v0.1.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/key-share)

github-actions · 2024-01-30T11:36:18Z

The spec was successfully compiled. PDF is available here.

github-actions · 2024-01-30T11:36:36Z

Benchmark Result

Benchmarks

RUST_TESTS_SEED=7271b1c80fd076cf867677aa8e2f59523790fac0052c593e7e9842beceaa1d39
n = 3

Non-threshold DKG
Protocol Performance:
  - Protocol took 428.32µs to complete
In particular:
  - Stage: 9.85µs
    - Setup networking: 9.68µs (98.3%)
    - Unstaged: 171.00ns (1.7%)
  - Round 1: 147.54µs
    - Compute execution id: 4.75µs (3.2%)
    - Sample x_i, rid_i, chain_code: 67.32µs (45.6%)
    - Sample schnorr commitment: 59.45µs (40.3%)
    - Commit to public data: 15.69µs (10.6%)
    - Unstaged: 339.00ns (0.2%)
  - Round 2: 1.11µs
    - Hash received msgs (reliability check): 911.00ns (81.9%)
    - Unstaged: 201.00ns (18.1%)
  - Round 3: 270.00ns
    - Assert other parties hashed messages (reliability check): 140.00ns (51.9%)
    - Unstaged: 130.00ns (48.1%)
  - Round 4: 31.33µs
    - Validate decommitments: 29.94µs (95.6%)
    - Calculate challege rid: 1.07µs (3.4%)
    - Prove knowledge of `x_i`: 180.00ns (0.6%)
    - Unstaged: 140.00ns (0.4%)
  - Round 5: 238.22µs
    - Validate schnorr proofs: 237.88µs (99.9%)
    - Unstaged: 340.00ns (0.1%)


Threshold DKG
Protocol Performance:
  - Protocol took 1.27ms to complete
In particular:
  - Stage: 1.72µs
    - Setup networking: 1.65µs (95.9%)
    - Unstaged: 70.00ns (4.1%)
  - Round 1: 230.98µs
    - Compute execution id: 872.00ns (0.4%)
    - Sample rid_i, schnorr commitment, polynomial, chain_code: 207.21µs (89.7%)
    - Commit to public data: 22.70µs (9.8%)
    - Unstaged: 200.00ns (0.1%)
  - Round 2: 1.01µs
    - Hash received msgs (reliability check): 831.00ns (82.2%)
    - Unstaged: 180.00ns (17.8%)
  - Round 3: 282.00ns
    - Assert other parties hashed messages (reliability check): 151.00ns (53.5%)
    - Unstaged: 131.00ns (46.5%)
  - Round 4: 773.59µs
    - Validate decommitments: 43.46µs (5.6%)
    - Validate data size: 300.00ns (0.0%)
    - Validate Feldmann VSS: 354.00µs (45.8%)
    - Compute rid: 340.00ns (0.0%)
    - Compute Ys: 360.23µs (46.6%)
    - Compute sigma: 321.00ns (0.0%)
    - Calculate challenge: 14.59µs (1.9%)
    - Prove knowledge of `sigma_i`: 180.00ns (0.0%)
    - Unstaged: 161.00ns (0.0%)
  - Round 5: 265.36µs
    - Validate schnorr proofs: 263.76µs (99.4%)
    - Derive resulting public key and other data: 1.33µs (0.5%)
    - Unstaged: 260.00ns (0.1%)


Auxiliary data generation protocol
Protocol Performance:
  - Protocol took 9.53s to complete
In particular:
  - Stage: 16.05µs
    - Retrieve auxiliary data: 381.00ns (2.4%)
    - Setup networking: 13.96µs (87.0%)
    - Precompute execution id and shared state: 1.58µs (9.9%)
    - Unstaged: 130.00ns (0.8%)
  - Round 1: 1.16s
    - Retrieve primes (p and q): 121.00ns (0.0%)
    - Compute paillier decryption key (N): 10.75µs (0.0%)
    - Generate auxiliary params r, λ, t, s: 9.23ms (0.8%)
    - Prove Πprm (ψˆ_i): 1.15s (99.2%)
    - Sample random bytes: 2.48µs (0.0%)
    - Compute hash commitment and sample decommitment: 301.65µs (0.0%)
    - Unstaged: 321.00ns (0.0%)
  - Round 2: 1.46µs
    - Hash received msgs (reliability check): 1.17µs (80.1%)
    - Unstaged: 291.00ns (19.9%)
  - Round 3: 301.00ns
    - Assert other parties hashed messages (reliability check): 181.00ns (60.1%)
    - Unstaged: 120.00ns (39.9%)
  - Round 4: 5.89s
    - Validate round 1 decommitments: 599.70µs (0.0%)
    - Validate П_prm (ψ_i): 2.29s (38.8%)
    - Add together shared random bytes: 1.75µs (0.0%)
    - Compute П_mod (ψ_i): 3.43s (58.3%)
    - Assemble security params for П_fac (ф_i): 7.62µs (0.0%)
    - Compute П_fac (ф_i^j): 171.46ms (2.9%)
    - Unstaged: 1.39µs (0.0%)
  - Round 5: 2.48s
    - Validate ψ_j (П_mod): 2.31s (93.1%)
    - Validate ф_j (П_fac): 172.26ms (6.9%)
    - Assemble auxiliary info: 148.02µs (0.0%)
    - Unstaged: 1.10µs (0.0%)


Signing protocol
Protocol Performance:
  - Protocol took 4.17s to complete
In particular:
  - Stage: 142.76µs
    - Map t-out-of-n protocol to t-out-of-t: 64.36µs (45.1%)
    - Retrieve auxiliary data: 73.59µs (51.5%)
    - Precompute execution id and security params: 972.00ns (0.7%)
    - Setup networking: 3.72µs (2.6%)
    - Unstaged: 120.00ns (0.1%)
  - Round 1: 188.62ms
    - Generate local ephemeral secrets (k_i, y_i, p_i, v_i): 49.45µs (0.0%)
    - Encrypt G_i and K_i: 107.53ms (57.0%)
    - Prove ψ0_j: 81.04ms (43.0%)
    - Unstaged: 1.82µs (0.0%)
  - Round 2: 15.74µs
    - Hash received msgs (reliability check): 15.43µs (98.0%)
    - Unstaged: 310.00ns (2.0%)
  - Round 3: 2.23s
    - Assert other parties hashed messages (reliability check): 1.29µs (0.0%)
    - Verify psi0 proofs: 268.49ms (12.0%)
    - Sample random r, hat_r, s, hat_s, beta, hat_beta: 45.24µs (0.0%)
    - Encrypt D_ji: 70.30ms (3.2%)
    - Encrypt F_ji: 35.77ms (1.6%)
    - Encrypt hat_D_ji: 559.40ms (25.1%)
    - Encrypt hat_F_ji: 35.80ms (1.6%)
    - Prove psi_ji: 794.81ms (35.6%)
    - Prove psiˆ_ji: 209.01ms (9.4%)
    - Prove psi_prime_ji : 257.50ms (11.5%)
    - Unstaged: 2.58µs (0.0%)
  - Round 4: 1.56s
    - Retrieve auxiliary data: 5.89µs (0.0%)
    - Validate psi: 164.95ms (10.6%)
    - Validate hat_psi: 164.86ms (10.6%)
    - Validate psi_prime: 934.69ms (59.9%)
    - Compute Gamma, Delta_i, delta_i, chi_i: 215.19ms (13.8%)
    - Prove psi_prime_prime: 81.32ms (5.2%)
    - Unstaged: 663.00ns (0.0%)
  - Presig output: 185.04ms
    - Validate psi_prime_prime: 184.90ms (99.9%)
    - Calculate presignature: 134.70µs (0.1%)
    - Unstaged: 1.21µs (0.0%)
  - Partial signing: 9.15µs
  - Signature reconstruction: 201.39µs

Cargo.toml

cggmp21-keygen/src/rng.rs

tests/tests/it/main.rs

cggmp21-keygen/src/lib.rs

cggmp21-keygen/src/non_threshold.rs

maurges · 2024-02-02T11:21:39Z

cggmp21-keygen/src/progress.rs

Symlink this one similarly to hex_or_bin?

Oh wait, it's gone from main protocol? Weren't we also using it to profile there?

We expose this module (we have to if we want someone to do profiling), so cggmp21::progress just re-exports cggmp21_keygen::progress.

It probably should be a dedicated crate actually, maybe we'll move it soon

maurges · 2024-02-02T11:34:23Z

Did you forget to remove keygen files from cggmp21/? It seems they are no longer part of the module tree

key-share/src/lib.rs

key-share/src/valid.rs

Separate key-share and cggmp21-keygen libs

100c0b5

survived force-pushed the restructure branch 2 times, most recently from 072a9fb to 266f41d Compare January 31, 2024 16:42

Separate key-share and cggmp21-keygen libs

28f4e37

survived force-pushed the restructure branch from 266f41d to 28f4e37 Compare February 1, 2024 09:31

survived commented Feb 1, 2024

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

survived commented Feb 1, 2024

View reviewed changes

cggmp21-keygen/src/rng.rs Outdated Show resolved Hide resolved

survived added 3 commits February 1, 2024 09:40

Reexport InvalidCoreShare in cggmp21::key_share

cdb7b42

Major version bump

f9029b6

Possibly make tests faster

2ca62e9

survived commented Feb 1, 2024

View reviewed changes

tests/tests/it/main.rs Outdated Show resolved Hide resolved

Fetch generic-ec from branch m

6a76e9f

survived requested a review from maurges February 1, 2024 10:21

survived marked this pull request as ready for review February 1, 2024 10:21

Fetch generic-ec from crates.io

1be0ee1