mirror of
https://github.com/luxfi/corona.git
synced 2026-09-24 00:25:54 +00:00
zeekay
725c3ee3b9
finishPedersenContribs derived the pairwise PRF seeds and MAC keys from
seedTranscript, whose inputs — a fixed tag, the noise seed, and bTilde — are all
published BootstrapTranscript fields. So the whole n×n authentication table was a
function of the public transcript: any observer recomputes it, mints the round-1
tag for any party, and Round2 accepts the forged commitment, because a peer's
round-1 D is authenticated by that symmetric pairwise MAC key alone. The comment
asserted the opposite ("protection comes from each party's SkShare"); it did not.
Each pair {i,j} now keys to the two Pedersen shares the VSS already sealed
between them — held by exactly the dealer and recipient, absent from the
transcript — and the diagonal to the party's own aggregate share. MAC keys stay
symmetric so honest MACs verify; seeds stay directional so the signing mask still
cancels across the committee sum. The transcript-only table is kept and
re-documented as the observer model the secrecy tests feed.
No signed message, wire, or consensus byte changes: the transcript, bTilde and
SkShare bytes are byte-identical (golden KAT passes) and the pairwise material
never appears on the wire.