2018-10-23 02:49:19 -07:00
|
|
|
//! # Collaborative Threshold Signing
|
2018-07-02 03:09:06 -07:00
|
|
|
//!
|
2018-10-23 02:49:19 -07:00
|
|
|
//! The algorithm is instantiated with data to sign, and waits for the input (no data, just `()`),
|
|
|
|
//! then sends a signature share to the others. When at least _f + 1_ correct validators have done
|
|
|
|
//! so, each node outputs the same, valid signature of the data.
|
2018-07-02 03:09:06 -07:00
|
|
|
//!
|
2018-10-23 02:49:19 -07:00
|
|
|
//! In addition to signing, this can also be used as a source of pseudorandomness: The signature
|
|
|
|
//! cannot be known until more than _f_ validators have contributed their shares.
|
2018-07-02 03:09:06 -07:00
|
|
|
//!
|
|
|
|
//! ## How it works
|
|
|
|
//!
|
|
|
|
//! The algorithm uses a threshold signature scheme with the uniqueness property: For each public
|
2018-07-02 23:53:08 -07:00
|
|
|
//! key and message, there is exactly one valid signature. This group signature is produced using
|
2018-10-23 02:49:19 -07:00
|
|
|
//! signature shares from any combination of _f + 1_ secret key share holders.
|
2018-06-04 14:00:38 -07:00
|
|
|
|
2018-07-24 02:57:50 -07:00
|
|
|
use std::collections::BTreeMap;
|
2018-07-11 12:15:08 -07:00
|
|
|
use std::sync::Arc;
|
2018-06-04 14:00:38 -07:00
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
use crypto::{self, hash_g2, Signature, SignatureShare, G2};
|
2018-07-24 02:57:50 -07:00
|
|
|
use fault_log::{Fault, FaultKind};
|
2018-10-10 07:11:27 -07:00
|
|
|
use {DistAlgorithm, NetworkInfo, NodeIdT, Target};
|
2018-06-04 14:00:38 -07:00
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
/// A threshold signing error.
|
2018-07-25 14:38:33 -07:00
|
|
|
#[derive(Clone, Eq, PartialEq, Debug, Fail)]
|
|
|
|
pub enum Error {
|
|
|
|
#[fail(display = "CombineAndVerifySigCrypto error: {}", _0)]
|
2018-10-10 07:11:27 -07:00
|
|
|
CombineAndVerifySigCrypto(crypto::error::Error),
|
2018-07-25 14:38:33 -07:00
|
|
|
#[fail(display = "Unknown sender")]
|
|
|
|
UnknownSender,
|
|
|
|
#[fail(display = "Signature verification failed")]
|
|
|
|
VerificationFailed,
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
/// A threshold signing result.
|
2018-07-25 14:38:33 -07:00
|
|
|
pub type Result<T> = ::std::result::Result<T, Error>;
|
|
|
|
|
2018-07-05 09:20:53 -07:00
|
|
|
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Rand)]
|
2018-10-23 02:49:19 -07:00
|
|
|
pub struct Message(SignatureShare);
|
2018-06-04 14:00:38 -07:00
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
impl Message {
|
2018-07-17 06:54:12 -07:00
|
|
|
pub fn new(sig: SignatureShare) -> Self {
|
2018-10-23 02:49:19 -07:00
|
|
|
Message(sig)
|
2018-06-09 13:50:36 -07:00
|
|
|
}
|
|
|
|
|
2018-07-17 06:54:12 -07:00
|
|
|
pub fn to_sig(&self) -> &SignatureShare {
|
2018-06-09 13:50:36 -07:00
|
|
|
&self.0
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
/// A threshold signing algorithm instance. On input, broadcasts our threshold signature share. Upon
|
2018-06-08 11:43:27 -07:00
|
|
|
/// receiving at least `num_faulty + 1` shares, attempts to combine them into a signature. If that
|
|
|
|
/// signature is valid, the instance outputs it and terminates; otherwise the instance aborts.
|
2018-06-04 14:00:38 -07:00
|
|
|
#[derive(Debug)]
|
2018-10-23 02:49:19 -07:00
|
|
|
pub struct ThresholdSign<N> {
|
2018-08-02 14:27:55 -07:00
|
|
|
netinfo: Arc<NetworkInfo<N>>,
|
2018-10-23 02:49:19 -07:00
|
|
|
/// The hash of the data to be signed.
|
|
|
|
msg_hash: G2,
|
2018-06-08 11:43:27 -07:00
|
|
|
/// All received threshold signature shares.
|
2018-08-02 14:27:55 -07:00
|
|
|
received_shares: BTreeMap<N, SignatureShare>,
|
2018-10-23 02:49:19 -07:00
|
|
|
/// Whether we already sent our shares.
|
2018-06-10 03:36:13 -07:00
|
|
|
had_input: bool,
|
2018-06-08 11:43:27 -07:00
|
|
|
/// Termination flag.
|
|
|
|
terminated: bool,
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
pub type Step<N> = ::Step<ThresholdSign<N>>;
|
2018-07-09 04:35:26 -07:00
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
impl<N: NodeIdT> DistAlgorithm for ThresholdSign<N> {
|
2018-08-29 09:08:35 -07:00
|
|
|
type NodeId = N;
|
2018-06-04 14:00:38 -07:00
|
|
|
type Input = ();
|
2018-10-23 02:49:19 -07:00
|
|
|
type Output = Signature;
|
|
|
|
type Message = Message;
|
2018-06-04 14:00:38 -07:00
|
|
|
type Error = Error;
|
|
|
|
|
2018-06-08 11:43:27 -07:00
|
|
|
/// Sends our threshold signature share if not yet sent.
|
2018-10-23 06:38:42 -07:00
|
|
|
fn handle_input(&mut self, _input: ()) -> Result<Step<N>> {
|
|
|
|
self.sign()
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
|
2018-06-08 11:43:27 -07:00
|
|
|
/// Receives input from a remote node.
|
2018-10-23 06:38:42 -07:00
|
|
|
fn handle_message(&mut self, sender_id: &N, message: Message) -> Result<Step<N>> {
|
|
|
|
self.handle_message(sender_id, message)
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
/// Whether the algorithm has terminated.
|
|
|
|
fn terminated(&self) -> bool {
|
2018-06-08 11:43:27 -07:00
|
|
|
self.terminated
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
|
2018-08-29 09:08:35 -07:00
|
|
|
fn our_id(&self) -> &Self::NodeId {
|
|
|
|
self.netinfo.our_id()
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
impl<N: NodeIdT> ThresholdSign<N> {
|
2018-10-23 06:38:42 -07:00
|
|
|
/// Creates a new instance of `ThresholdSign`, with the goal to collaboratively sign `msg`.
|
2018-10-23 02:49:19 -07:00
|
|
|
pub fn new<M: AsRef<[u8]>>(netinfo: Arc<NetworkInfo<N>>, msg: M) -> Self {
|
|
|
|
ThresholdSign {
|
2018-06-14 02:05:05 -07:00
|
|
|
netinfo,
|
2018-10-23 02:49:19 -07:00
|
|
|
msg_hash: hash_g2(msg),
|
2018-06-08 11:43:27 -07:00
|
|
|
received_shares: BTreeMap::new(),
|
2018-06-10 03:36:13 -07:00
|
|
|
had_input: false,
|
2018-06-08 11:43:27 -07:00
|
|
|
terminated: false,
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|
|
|
|
}
|
2018-06-07 09:38:27 -07:00
|
|
|
|
2018-10-23 06:38:42 -07:00
|
|
|
/// Sends our signature shares, and if we have collected enough, returns the full signature.
|
|
|
|
pub fn sign(&mut self) -> Result<Step<N>> {
|
2018-10-23 02:49:19 -07:00
|
|
|
if self.had_input {
|
|
|
|
return Ok(Step::default());
|
|
|
|
}
|
|
|
|
self.had_input = true;
|
2018-06-29 08:20:54 -07:00
|
|
|
if !self.netinfo.is_validator() {
|
2018-07-24 02:57:50 -07:00
|
|
|
return self.try_output();
|
2018-06-25 12:09:45 -07:00
|
|
|
}
|
2018-10-23 06:38:42 -07:00
|
|
|
let msg = Message(self.netinfo.secret_key_share().sign_g2(self.msg_hash));
|
|
|
|
let mut step: Step<_> = Target::All.message(msg.clone()).into();
|
2018-10-25 05:44:28 -07:00
|
|
|
let id = self.our_id().clone();
|
2018-10-23 06:38:42 -07:00
|
|
|
step.extend(self.handle_message(&id, msg)?);
|
2018-07-24 02:57:50 -07:00
|
|
|
Ok(step)
|
2018-06-08 11:43:27 -07:00
|
|
|
}
|
|
|
|
|
2018-10-24 03:26:43 -07:00
|
|
|
/// Handles a message with a signature share received from `sender_id`.
|
|
|
|
///
|
|
|
|
/// This must be called with every message we receive from another node.
|
|
|
|
///
|
|
|
|
/// If we have collected enough, returns the full signature.
|
2018-10-23 06:38:42 -07:00
|
|
|
pub fn handle_message(&mut self, sender_id: &N, message: Message) -> Result<Step<N>> {
|
|
|
|
if self.terminated {
|
|
|
|
return Ok(Step::default());
|
|
|
|
}
|
|
|
|
let Message(share) = message;
|
2018-06-27 05:25:32 -07:00
|
|
|
if let Some(pk_i) = self.netinfo.public_key_share(sender_id) {
|
2018-10-23 02:49:19 -07:00
|
|
|
if !pk_i.verify_g2(&share, self.msg_hash) {
|
2018-07-08 09:41:50 -07:00
|
|
|
// Log the faulty node and ignore the invalid share.
|
|
|
|
let fault_kind = FaultKind::UnverifiedSignatureShareSender;
|
2018-07-24 02:57:50 -07:00
|
|
|
return Ok(Fault::new(sender_id.clone(), fault_kind).into());
|
2018-06-14 02:05:05 -07:00
|
|
|
}
|
|
|
|
self.received_shares.insert(sender_id.clone(), share);
|
2018-06-08 11:43:27 -07:00
|
|
|
} else {
|
2018-07-25 14:38:33 -07:00
|
|
|
return Err(Error::UnknownSender);
|
2018-06-25 12:09:45 -07:00
|
|
|
}
|
2018-07-24 02:57:50 -07:00
|
|
|
self.try_output()
|
2018-06-25 12:09:45 -07:00
|
|
|
}
|
|
|
|
|
2018-10-23 02:49:19 -07:00
|
|
|
fn try_output(&mut self) -> Result<Step<N>> {
|
2018-07-10 04:23:50 -07:00
|
|
|
debug!(
|
|
|
|
"{:?} received {} shares, had_input = {}",
|
2018-10-25 05:44:28 -07:00
|
|
|
self.our_id(),
|
2018-07-28 08:31:17 -07:00
|
|
|
self.received_shares.len(),
|
2018-07-10 04:23:50 -07:00
|
|
|
self.had_input
|
|
|
|
);
|
2018-07-28 08:31:17 -07:00
|
|
|
if self.had_input && self.received_shares.len() > self.netinfo.num_faulty() {
|
2018-06-25 12:09:45 -07:00
|
|
|
let sig = self.combine_and_verify_sig()?;
|
2018-10-25 05:44:28 -07:00
|
|
|
debug!("{:?} output {:?}", self.our_id(), sig);
|
2018-06-25 12:09:45 -07:00
|
|
|
self.terminated = true;
|
2018-08-29 08:28:02 -07:00
|
|
|
let step = self.handle_input(())?; // Before terminating, make sure we sent our share.
|
2018-10-23 02:49:19 -07:00
|
|
|
Ok(step.with_output(sig))
|
2018-07-24 02:57:50 -07:00
|
|
|
} else {
|
|
|
|
Ok(Step::default())
|
2018-06-08 11:43:27 -07:00
|
|
|
}
|
2018-06-07 09:38:27 -07:00
|
|
|
}
|
2018-06-14 04:28:38 -07:00
|
|
|
|
2018-06-21 08:31:15 -07:00
|
|
|
fn combine_and_verify_sig(&self) -> Result<Signature> {
|
2018-06-14 04:28:38 -07:00
|
|
|
// Pass the indices of sender nodes to `combine_signatures`.
|
2018-07-23 02:50:44 -07:00
|
|
|
let to_idx = |(id, share)| (self.netinfo.node_index(id).unwrap(), share);
|
|
|
|
let shares = self.received_shares.iter().map(to_idx);
|
2018-07-25 14:38:33 -07:00
|
|
|
let sig = self
|
|
|
|
.netinfo
|
|
|
|
.public_key_set()
|
|
|
|
.combine_signatures(shares)
|
|
|
|
.map_err(Error::CombineAndVerifySigCrypto)?;
|
2018-06-14 04:28:38 -07:00
|
|
|
if !self
|
|
|
|
.netinfo
|
|
|
|
.public_key_set()
|
|
|
|
.public_key()
|
2018-10-23 02:49:19 -07:00
|
|
|
.verify_g2(&sig, self.msg_hash)
|
2018-06-14 04:28:38 -07:00
|
|
|
{
|
|
|
|
// Abort
|
2018-10-25 05:44:28 -07:00
|
|
|
error!("{:?} main public key verification failed", self.our_id());
|
2018-07-25 14:38:33 -07:00
|
|
|
Err(Error::VerificationFailed)
|
2018-06-14 04:28:38 -07:00
|
|
|
} else {
|
|
|
|
Ok(sig)
|
|
|
|
}
|
|
|
|
}
|
2018-06-04 14:00:38 -07:00
|
|
|
}
|