Repository navigation
Conversation
CI runs clippy on the latest stable with -D warnings, and that version rejects uninlined format args, so every pull request fails before its own changes are even checked. Inlines the four format! calls it flags, in the tokio example, the FFI memory hardening test and the protocol tests.
A wallet service hands out a new address for every customer or payment, and today each one needs every party to run derive_child. The group key plus the chain code make a BIP-32 xpub, so a server can derive addresses on its own, and they match the ones the parties later sign for. Adds chain_code() to the key share handle, in Rust, the C API (tss_handle_chain_code) and every binding. DKLs23 returns the chain code made at DKG; FROST Taproot returns the value derive.rs already uses, through one shared helper. Other suites return ProtocolMismatch. Tests check child keys against a separate BIP-32 implementation, and the FFI tests get a shared DKG and signing driver.
Parties lose shares: a disk dies, a server is replaced, a backup is bad. Today the only fix is a new DKG, which means a new key, new addresses and moving every coin on chain. Repair brings the lost party back under the same key. Each helper sends the lost party one masked term; the masks cancel, so the party learns its own share and nothing about the helpers'. It checks the sum against its verifying share and stops on a mismatch. The rebuilt share has no OT state, so signing refuses it until a complete refresh across all parties gives every share new randomness and new OT state. secp256k1 only for now, with C API and Go bindings, and tests in Rust, the FFI and Go.
Repair and the complete refresh add new functions and a new kind of key share, a rebuilt one that can't sign yet, so readers of the spec need to know how they fit with the rest of the API. Updates the API design, FFI and key management pages: the repair flow, the hollow share and when it can sign again, the complete refresh, and the three new C functions.
Lightning derives a fresh key for every channel state by adding a number to its base key, or multiplying it. If the node is backed by a threshold key, every party has to apply the same tweak to its own share, and apps reach DKLs23 through libtss. Adds tweak_add and tweak_mul for DKLs23 shares in Rust, the C API (tss_tweak_add, tss_tweak_mul) and every binding. The math is DKLs23's Party and PublicKeyPackage tweak API; libtss parses the 32-byte scalar, picks the address function and wraps the result in a new handle. Tests cover DKG, tweak, sign and verify under the tweaked key at the Rust, FFI, Go, Node and Python layers.
The tweak commit calls Party::tweak_add and friends, which only exist on the DKLs23 pull request that adds them, so this branch can't build against DKLs23 main yet. Points the two dkls23 crates at that pull request's branch on our fork, and moves sha3 to rc.9, which the keccak version DKLs23 now pulls in needs. Revert this commit once the DKLs23 change is on main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Lightning derives a fresh key for every channel state by adding a number to its base key, or by multiplying it (see 0xCarbon/DKLs23#97). If a Lightning node is backed by a threshold key, every party has to apply the same tweak to its own share. Apps reach DKLs23 through libtss, so libtss needs to expose it.
What
tweak_addandtweak_mulfor DKLs23 shares, in Rust, the C API (tss_tweak_add,tss_tweak_mul) and every binding.InvalidConfig. A zero factor or an identity result isTweakError. Any other suite isProtocolMismatch.Depends on
main. Until then Cargo points at our DKLs23 branch, and the last commit gets reverted.