Repository navigation
Feature/dkg - #2
Merged
Merged
Conversation
verifySession compared decoded MAC bytes. base64url's spare low bits in the final character meant several spellings of one MAC verified. That isn't exploitable (the real MAC is still required), but a token should have exactly one valid form. Compare the canonical string instead. This surfaced as a flaky test: flipping 'A'<->'B' in the last character only touches padding bits. The test now tampers at fixed positions, including the last one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Validators now jointly generate the threshold key (Joint-Feldman DKG with complaints, Pedersen '91 / GJKR '99), so no party ever holds the group secret: - crypto/dkg.ts: each validator deals a random polynomial with Feldman commitments. Shares are encrypted to the recipient's transport key using the order cipher, with AAD binding session, dealer and recipient, so the routing coordinator never sees them. Recipients verify against the commitments and complain. Accused dealers must reveal publicly or be disqualified. QUAL, the group key and the verification keys are derived deterministically from the public transcript. The protocol aborts if |QUAL| < t. - validatorNetwork: the ValidatorNode interface gains the DKG rounds, and runDkg drives them, checking that all validators agree. Each simulated validator persists only its own share (data/validators/validator-<i>.json, mode 0600) plus a public transcript. Restarts reload the shares; the first start runs DKG. VALIDATOR_KEY_FILE becomes VALIDATOR_KEY_DIR. - The trusted dealer is gone from production code; it lives only in tests/fixtures for unit-testing the threshold math. - Commitment evaluation uses variable-time multiplication, which is safe because every input is public. This makes DKG about 4x faster. 10 new DKG tests: consistent keys across t-subsets, the coordinator never seeing a share, complaint resolved by an honest reveal, a lying dealer disqualified, abort on too few qualified dealers, misrouted and cross-session replayed shares, and equivocating commitments. The pipeline tests now run on DKG-generated keys. 41 backend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Explain the DKG rounds, map each DKG property to its test, and state its limitations (Joint-Feldman key bias, broadcast assumption). The 'simulated' caveat is now precise: there is no dealer, but validators sharing one process means one operator could still collect t shares until the validators run remotely. Contributor issue #1 becomes the GJKR unbiased-DKG upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces trusted-dealer keygen with Joint-Feldman DKG with complaints. No party ever holds the group secret. See docs/THRESHOLD_ENCRYPTION.md#key-generation-dkg. 41 backend tests pass