Ecosystem/serai
Ecosystem/serai
1
0
Fork 0
mirror of https://github.com/serai-dex/serai.git synced 2024-12-22 11:39:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Document H1's mismatch between the FROST preprint and IETF draft

Browse source
This commit is contained in:
Luke Parker 2023-09-15 14:16:15 -04:00
parent 8adef705c3
commit 9eaaa7d2e8
No known key found for this signature in database
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
crypto/frost/src/curve/mod.rs
View file

@ -68,6 +68,24 @@ pub trait Curve: Ciphersuite {
}
/// Hash the commitments and message to calculate the binding factor. H1 from the IETF draft.
//
// This may return 0, which is invalid according to the FROST preprint, as all binding factors
// are expected to be in the multiplicative subgroup. This isn't a practical issue, as there's a
// negligible probability of this returning 0.
//
// When raised in
// https://github.com/cfrg/draft-irtf-cfrg-frost/issues/451#issuecomment-1715985505,
// the negligible probbility was seen as sufficient reason not to edit the spec to be robust in
// this regard.
//
// While that decision may be disagreeable, this library cannot implement a robust scheme while
// following the specification. Following the specification is preferred to being robust against
// an impractical probability enabling a complex attack (made infeasible by the impractical
// probability required).
//
// We could still panic on the 0-hash, preferring correctness to liveliness. Finding the 0-hash
// is as computationally complex as simply calculating the group key's discrete log however,
// making it not worth having a panic (as this library is expected not to panic).
fn hash_binding_factor(binding: &[u8]) -> Self::F {
<Self as Curve>::hash_to_F(b"rho", binding)
}