mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
4be24bf983
Ported changes from taurusgroup/multi-party-sig upstream:
1. Security fix: Increased ZKModIterations from 12 to 128
- Improves security of Paillier-Blum modulus validation
- Aligns with theoretical statistical security parameter requirements
2. Extended OT monochrome check improvement (based on paper revision)
- Added doubleFieldElement type for proper GF(2^k) multiplication
- New helper functions: randFe, pluckColumnToFieldElement,
pluckBitsToFieldElements, transposeToFieldSizeElements, adjustBatchSize
- Improved constant-time equality check
- Better batch size padding for security
3. Comment/typo fixes from upstream
Adapted to local naming conventions (Delta vs _Delta, _KDelta vs _K_Delta)
while preserving the security improvements from the upstream implementation.
Reference: https://eprint.iacr.org/2015/546
34 lines
1.1 KiB
Go
34 lines
1.1 KiB
Go
package params
|
||
|
||
const (
|
||
SecParam = 256
|
||
SecBytes = SecParam / 8
|
||
OTParam = 128
|
||
OTBytes = OTParam / 8
|
||
StatParam = 80
|
||
|
||
// ZKModIterations is the number of iterations that are performed to prove the validity of
|
||
// a Paillier-Blum modulus N.
|
||
// Theoretically, the number of iterations corresponds to the statistical security parameter,
|
||
// and would be 80.
|
||
// The way it is used in the refresh protocol ensures that the prover cannot guess in advance the secret ρ
|
||
// used to instantiate the hash function.
|
||
// Since sampling primes is expensive, we argue that the security can be reduced.
|
||
ZKModIterations = 128
|
||
|
||
L = 1 * SecParam // = 256
|
||
LPrime = 5 * SecParam // = 1280
|
||
Epsilon = 2 * SecParam // = 512
|
||
LPlusEpsilon = L + Epsilon // = 768
|
||
LPrimePlusEpsilon = LPrime + Epsilon // 1792
|
||
|
||
BitsIntModN = 8 * SecParam // = 2048
|
||
BytesIntModN = BitsIntModN / 8 // = 256
|
||
|
||
BitsBlumPrime = 4 * SecParam // = 1024
|
||
BitsPaillier = 2 * BitsBlumPrime // = 2048
|
||
|
||
BytesPaillier = BitsPaillier / 8 // = 256
|
||
BytesCiphertext = 2 * BytesPaillier // = 512
|
||
)
|