mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zooqueen
b6ab5f46c1
pkg/reveal could open a secret; nothing could ask it to. This is the asking: an opcode the KMS client has always sent, a backend that fans the request out and waits for a quorum, and every node answering from its own share. Every node serves the answering half. A ring where only some answer is a ring with a smaller quorum than its threshold claims, and the shortfall would show up as a timeout rather than as the misconfiguration it is. A node that holds no share for the key publishes that fact. Silence and refusal look identical to a caller counting answers and they are not: one means wait longer, the other means never — so a failed opening says how many answered and names the nodes that would not. The wait ends at a quorum rather than at the deadline. This runs at boot, where a process that already has what it needs must not sit for twenty seconds proving it, and one that will never get it must say so rather than hang. Answers are counted per party under a lock. A redelivery or a duplicated subscription must not fill two seats — Open refuses such a set anyway, but the wait should be honest as well as the result. The two halves take a bus, a store and a name rather than reaching into the backend, so the whole path is exercised over a bus a test controls: the real Ed25519 keygen, each share in a store of its own, a root that travels the ring and comes back, and a quorum that never forms saying exactly why. The interface gained a method, so two test mocks did too. That is the compiler naming every implementation, which is the reason to put it there.