inv-tshare: Threshold (re-)sharing protocol

src/tshare/participant.rs

@@ -382,14 +382,22 @@ impl TshareParticipant {
             // Finish round 1 by generating messages for round 2
             let round_one_messages = run_only_once!(self.gen_round_two_msgs(rng, message.id()))?;
 
+            let mut outcomes = self
+                .fetch_messages(MessageType::Tshare(TshareMessageType::R2PrivateShare))?
+                .iter()
+                .map(|msg| self.handle_round_two_msg_private(msg))
+                .collect::<Result<Vec<_>>>()?;
+
             // Process any round 2 messages we may have received early
             let round_two_outcomes = self
                 .fetch_messages(MessageType::Tshare(TshareMessageType::R2Decommit))?
                 .iter()
                 .map(|msg| self.handle_round_two_msg(msg))
                 .collect::<Result<Vec<_>>>()?;
 
-            ProcessOutcome::collect_with_messages(round_two_outcomes, round_one_messages)
+            outcomes.extend(round_two_outcomes);
+
+            ProcessOutcome::collect_with_messages(outcomes, round_one_messages)
         } else {
             // Otherwise, wait for more round 1 messages
             Ok(ProcessOutcome::Incomplete)
@@ -429,7 +437,7 @@ impl TshareParticipant {
             MessageType::Tshare(TshareMessageType::R2Decommit),
             decom,
         )?;
-        messages.extend_from_slice(&more_messages);
+        //messages.extend_from_slice(&more_messages);
 
         let private_coeffs = self
             .local_storage
@@ -463,10 +471,41 @@ impl TshareParticipant {
                 })
                 .collect::<Result<Vec<Message>>>()?,
         );
+        messages.extend_from_slice(&more_messages);
 
         Ok(messages)
     }
 
+    /// Handle the protocol's round two private messages.
+    ///
+    /// Here we validate and store a private share from someone to us.
+    #[cfg_attr(feature = "flame_it", flame("tshare"))]
+    #[instrument(skip_all, err(Debug))]
+    fn handle_round_two_msg_private(
+        &mut self,
+        message: &Message,
+    ) -> Result<ProcessOutcome<<Self as ProtocolParticipant>::Output>> {
+        self.check_for_duplicate_msg::<storage::ValidPrivateEval>(message.from())?;
+
+        info!("Handling round two tshare private message.");
+
+        message.check_type(MessageType::Tshare(TshareMessageType::R2PrivateShare))?;
+        let encrypted_share: EvalEncrypted = deserialize!(&message.unverified_bytes)?;
+
+        // Get my private key from the AuxInfo protocol.
+        let my_dk = self.input.private_auxinfo().decryption_key();
+
+        // Decrypt the private share.
+        let private_share = encrypted_share.decrypt(my_dk)?;
+        // Write the private share to the storage
+        self.local_storage
+            .store_once::<storage::ValidPrivateEval>(message.from(), private_share)?;
+
+        Ok(self
+            .maybe_finish_round2()
+            .expect("Could not finish round 2"))
+    }
+
     /// Handle the protocol's round two messages.
     ///
     /// Here we check that the decommitments from each participant are valid.
@@ -496,34 +535,57 @@ impl TshareParticipant {
             .retrieve::<storage::Commit>(message.from())?;
         let decom = TshareDecommit::from_message(message, com)?;
         self.local_storage
-            .store_once::<storage::Decommit>(message.from(), decom)?;
+            .store_once::<storage::Decommit>(message.from(), decom.clone())?;
+        self.local_storage
+            .store::<storage::PublicCoeffs>(message.from(), decom.coeff_publics);
+
+        Ok(self
+            .maybe_finish_round2()
+            .expect("Could not finish round 2"))
+    }
+
+    fn maybe_finish_round2(
+        &mut self,
+    ) -> Result<ProcessOutcome<<Self as ProtocolParticipant>::Output>> {
+        let got_all_private_shares = self
+            .local_storage
+            .contains_for_all_ids::<storage::ValidPrivateEval>(self.other_ids());
 
         // Check if we've received all the decommits
-        let r2_done = self
+        let mut r2_done = self
             .local_storage
             .contains_for_all_ids::<storage::Decommit>(&self.all_participants());
 
+        r2_done &= got_all_private_shares;
+
         if r2_done {
+            // for each participant, read the private share and check if it matches the
+            // public share
+            for pid in self.other_ids() {
+                let decom = self.local_storage.retrieve::<storage::Decommit>(*pid)?;
+                let coeff_publics = decom.coeff_publics.clone();
+                let expected_public = Self::eval_public_share(coeff_publics.as_slice(), self.id())?;
+                let private_share = self
+                    .local_storage
+                    .retrieve::<storage::ValidPrivateEval>(*pid)?;
+                let implied_public = private_share.public_point();
+                if implied_public != expected_public {
+                    error!("the private share does not match the public share");
+                    return Err(InternalError::ProtocolError(Some(*pid)));
+                }
+            }
+
             // Generate messages for round 3...
             let round_three_messages = run_only_once!(self.gen_round_three_msgs())?;
 
-            let mut round_outcomes = self
-                .fetch_messages(MessageType::Tshare(TshareMessageType::R2PrivateShare))?
-                .iter()
-                .map(|msg| self.handle_round_two_msg_private(msg))
-                .collect::<Result<Vec<_>>>()?;
-
             // ...and handle any messages that other participants have sent for round 3.
             let round_three_outcomes = self
                 .fetch_messages(MessageType::Tshare(TshareMessageType::R3Proof))?
                 .iter()
                 .map(|msg| self.handle_round_three_msg(msg))
                 .collect::<Result<Vec<_>>>()?;
 
-            //round_three_outcomes.extend(outcomes_private);
-            round_outcomes.extend(round_three_outcomes);
-
-            ProcessOutcome::collect_with_messages(round_outcomes, round_three_messages)
+            ProcessOutcome::collect_with_messages(round_three_outcomes, round_three_messages)
         } else {
             // Otherwise, wait for more round 2 messages.
             Ok(ProcessOutcome::Incomplete)
@@ -576,37 +638,60 @@ impl TshareParticipant {
         if let Some(private) = self.input.share() {
             assert_eq!(my_contant_term, private.x);
         }
-        let public_share = EvalPublic::new(my_private_share.public_point());
 
-        // Generate proofs for each share.
-        let precom = self
+        // Have we got the private shares from everybody to us?
+        let got_all_private_shares = self
             .local_storage
-            .retrieve::<storage::SchnorrPrecom>(self.id())?;
+            .contains_for_all_ids::<storage::ValidPrivateEval>(self.other_ids());
 
-        let pk = &public_share;
-        let input = CommonInput::new(pk);
-        let sk = &my_private_share.x;
+        if got_all_private_shares {
+            // Compute the one's own private evaluation.
 
-        let proof = PiSchProof::prove_from_precommit(
-            &self.retrieve_context(),
-            precom,
-            &input,
-            &ProverSecret::new(&scalar_to_bn(sk)),
-            &transcript,
-        )?;
+            // Get a slice of EvalPrivate from other participants
+            let mut from_all_to_me_private = vec![];
+            for pid in self.other_ids() {
+                let private_share = self
+                    .local_storage
+                    .retrieve::<storage::ValidPrivateEval>(*pid)?;
+                from_all_to_me_private.push(private_share.clone());
+            }
 
-        self.local_storage
-            .store::<storage::ValidPrivateEval>(self.id(), my_private_share.clone());
-        self.local_storage
-            .store::<storage::ValidPublicShare>(self.id(), public_share.clone());
+            let other_private_shares = Self::aggregate_private_shares(&from_all_to_me_private);
+            let final_private_share = other_private_shares + &my_private_share;
+            let final_public_share = EvalPublic::new(final_private_share.public_point());
+
+            // Generate proofs for each share.
+            let precom = self
+                .local_storage
+                .retrieve::<storage::SchnorrPrecom>(self.id())?;
+
+            let pk = &final_public_share;
+            let input = CommonInput::new(pk);
+            let sk = &final_private_share.x;
+
+            let proof = PiSchProof::prove_from_precommit(
+                &self.retrieve_context(),
+                precom,
+                &input,
+                &ProverSecret::new(&scalar_to_bn(sk)),
+                &transcript,
+            )?;
 
-        // Send all proofs to everybody.
-        let messages = self.message_for_other_participants(
-            MessageType::Tshare(TshareMessageType::R3Proof),
-            proof,
-        )?;
+            self.local_storage
+                .store::<storage::ValidPrivateEval>(self.id(), final_private_share.clone());
+            self.local_storage
+                .store::<storage::ValidPublicShare>(self.id(), final_public_share.clone());
 
-        Ok(messages)
+            // Send all proofs to everybody.
+            let messages = self.message_for_other_participants(
+                MessageType::Tshare(TshareMessageType::R3Proof),
+                proof,
+            )?;
+
+            Ok(messages)
+        } else {
+            Err(InternalError::ProtocolError(None))
+        }
     }
 
     /// Assign a non-null x coordinate to each participant.
@@ -740,56 +825,6 @@ impl TshareParticipant {
         result
     }
 
-    /// Handle the protocol's round two private messages.
-    ///
-    /// Here we validate and store a private share from someone to us.
-    #[cfg_attr(feature = "flame_it", flame("tshare"))]
-    #[instrument(skip_all, err(Debug))]
-    fn handle_round_two_msg_private(
-        &mut self,
-        message: &Message,
-    ) -> Result<ProcessOutcome<<Self as ProtocolParticipant>::Output>> {
-        self.check_for_duplicate_msg::<storage::ValidPrivateEval>(message.from())?;
-
-        if !self.can_handle_round_three_msg() {
-            info!("Not yet ready to handle round three tshare private message.");
-            self.stash_message(message)?;
-            return Ok(ProcessOutcome::Incomplete);
-        }
-        info!("Handling round three tshare private message.");
-
-        message.check_type(MessageType::Tshare(TshareMessageType::R2PrivateShare))?;
-        let encrypted_share: EvalEncrypted = deserialize!(&message.unverified_bytes)?;
-
-        // Get my private key from the AuxInfo protocol.
-        let my_dk = self.input.private_auxinfo().decryption_key();
-
-        // Decrypt the private share.
-        let private_share = encrypted_share.decrypt(my_dk)?;
-
-        // Feldman validation
-        // Check that this private share matches our public share in TshareDecommit
-        // from this participant.
-        let decom = self
-            .local_storage
-            .retrieve::<storage::Decommit>(message.from())?;
-        let coeff_publics = decom.coeff_publics.clone();
-        let expected_public = Self::eval_public_share(coeff_publics.as_slice(), self.id())?;
-        let implied_public = private_share.public_point();
-        if implied_public != expected_public {
-            error!("the private share does not match the public share");
-            return Err(InternalError::ProtocolError(Some(message.from())));
-        }
-
-        self.local_storage
-            .store::<storage::ValidPrivateEval>(message.from(), private_share);
-
-        self.local_storage
-            .store::<storage::PublicCoeffs>(message.from(), coeff_publics);
-
-        self.maybe_finish()
-    }
-
     /// Handle round three messages only after our own `gen_round_three_msgs`.
     fn can_handle_round_three_msg(&self) -> bool {
         self.local_storage.contains::<storage::GlobalRid>(self.id())
@@ -821,38 +856,40 @@ impl TshareParticipant {
         let decom = self
             .local_storage
             .retrieve::<storage::Decommit>(message.from())?;
-        // calculate public share from the public coefficients
-        let public_share = Self::eval_public_share(&decom.coeff_publics, message.from())?;
-        let public_share = EvalPublic::new(public_share);
+
+        let mut final_public_share = CurvePoint::IDENTITY;
+        for pid in self.all_participants().iter() {
+            let coeff_publics = self.local_storage.retrieve::<storage::PublicCoeffs>(*pid)?;
+            let public_share = Self::eval_public_share(coeff_publics, message.from())?;
+            final_public_share = final_public_share + public_share;
+        }
 
         let mut transcript = schnorr_proof_transcript(self.sid(), &global_rid, message.from())?;
         proof.verify_with_precommit(
-            CommonInput::new(&public_share),
+            CommonInput::new(&final_public_share),
             &self.retrieve_context(),
             &mut transcript,
             &decom.precom,
         )?;
 
+        let final_public_share = EvalPublic::new(final_public_share);
         // Only if the proof verifies do we store the participant's shares.
         self.local_storage
-            .store_once::<storage::ValidPublicShare>(message.from(), public_share.clone())?;
+            .store_once::<storage::ValidPublicShare>(message.from(), final_public_share.clone())?;
 
-        self.maybe_finish()
+        self.maybe_finish_protocol()
     }
 
-    fn maybe_finish(&mut self) -> Result<ProcessOutcome<<Self as ProtocolParticipant>::Output>> {
+    fn maybe_finish_protocol(
+        &mut self,
+    ) -> Result<ProcessOutcome<<Self as ProtocolParticipant>::Output>> {
         // Have we validated and stored the public shares from everybody to everybody?
         let got_all_public_shares = self
             .local_storage
             .contains_for_all_ids::<storage::ValidPublicShare>(&self.all_participants());
 
-        // Have we got the private shares from everybody to us?
-        let got_all_private_shares = self
-            .local_storage
-            .contains_for_all_ids::<storage::ValidPrivateEval>(&self.all_participants());
-
         // If so, we completed the protocol! Return the outputs.
-        if got_all_public_shares && got_all_private_shares {
+        if got_all_public_shares {
             // Compute the public polynomial.
             let coeffs_from_all = self
                 .all_participants()
@@ -861,13 +898,11 @@ impl TshareParticipant {
                 .collect::<Result<Vec<_>>>()?;
             let all_public_coeffs = Self::aggregate_public_coeffs(&coeffs_from_all);
 
-            // Compute the one's own private evaluation.
-            let from_all_to_me_private = self
-                .all_participants()
-                .iter()
-                .map(|pid| self.local_storage.remove::<storage::ValidPrivateEval>(*pid))
-                .collect::<Result<Vec<_>>>()?;
-            let my_private_share = Self::aggregate_private_shares(&from_all_to_me_private);
+            // Read my_private_share from the storage, it was already aggregated in the end
+            // of round 2
+            let my_private_share = self
+                .local_storage
+                .retrieve::<storage::ValidPrivateEval>(self.id())?;
 
             // Double-check that the aggregated private share matches the aggregated public
             // coeffs.

src/tshare/share.rs

@@ -76,6 +76,15 @@ pub struct EvalPrivate {
     pub x: Scalar,
 }
 
+/// Implement addition operation for `EvalPrivate`.
+impl Add<&EvalPrivate> for EvalPrivate {
+    type Output = Self;
+
+    fn add(self, rhs: &EvalPrivate) -> Self::Output {
+        EvalPrivate { x: self.x + rhs.x }
+    }
+}
+
 impl EvalPrivate {
     pub fn new(x: Scalar) -> Self {
         EvalPrivate { x }