mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
e6c6417d52
Adds the Tier A formal-artifact cluster for protocols/cmp (Lux profile of CGGMP21 threshold ECDSA, CCS '21 / ePrint 2021/060). Mirrors luxfi/pulsar's Tier A structure adapted to CCS '21's 4-round keygen + 3-round presign + 1-round online sign decomposition. - proofs/easycrypt/CGGMP21_N1.ec — Class N1 byte-equality reduction - proofs/easycrypt/CGGMP21_N1_Refinement.ec — keygen/presign/sign refinement - proofs/easycrypt/CGGMP21_Paillier.ec — Paillier additive homomorphism - proofs/easycrypt/CGGMP21_ZK.ec — 17 ZK subprotocol cluster obligation - proofs/easycrypt/CGGMP21_N4.ec — refresh / proactive rotation - proofs/easycrypt/lemmas/CGGMP21_CT.ec — constant-time obligations - proofs/easycrypt/AXIOM-INVENTORY.md — honest enumeration - proofs/lean-easycrypt-bridge.md — Lean↔EC bridge map - jasmin/lib/ + jasmin/single-party/ + jasmin/presign/ + jasmin/threshold/ Admit budget: 1/1 (same one-line group-identity admit as FROST_N4). ZK cluster obligation surface honest: 17 subprotocols enumerated, mechanization is multi-year program documented in AXIOM-INVENTORY.md §closure roadmap.
35 lines
1.3 KiB
Plaintext
35 lines
1.3 KiB
Plaintext
// Single-party secp256k1 ECDSA Sign (RFC 6979 / SEC1).
|
|
//
|
|
// Algorithm (RFC 6979 §3.2 deterministic ECDSA):
|
|
// 1. m = SHA-256(message) // 32 bytes
|
|
// 2. k = RFC6979_derive_nonce(sk, m) // deterministic per RFC 6979
|
|
// 3. R = k*G // point on secp256k1
|
|
// 4. r = R.x mod n
|
|
// 5. s = k^{-1} * (m + r * sk) mod n
|
|
// 6. (If using Bitcoin canonical low-S form: if s > n/2, s = n - s)
|
|
// 7. Encode (r, s) per DER or fixed-length.
|
|
//
|
|
// CT obligation: time + memory access independent of (sk, k).
|
|
// Lux profile inherits CT from `cloudflare/circl` secp256k1.
|
|
|
|
require "../lib/cmp_params.jinc"
|
|
|
|
// sk: 32-byte secp256k1 secret scalar (SECRET)
|
|
// pk: 33-byte compressed public key (PUBLIC)
|
|
// msg_hash: 32-byte message hash (PUBLIC)
|
|
// sig: output 64-byte raw signature (r || s) (PUBLIC)
|
|
//
|
|
// CT obligation: time + memory access independent of (sk, k).
|
|
inline
|
|
fn secp256k1_ecdsa_sign(
|
|
reg ptr u8[CMP_SCALAR_BYTES] sk,
|
|
reg ptr u8[CMP_POINT_BYTES] pk,
|
|
reg ptr u8[CMP_MSG_HASH_BYTES] msg_hash,
|
|
reg ptr u8[CMP_SIG_RAW_BYTES] sig
|
|
) -> reg ptr u8[CMP_SIG_RAW_BYTES]
|
|
{
|
|
// TODO: jasmin implementation. Tracked in ../SUBMISSION-STATUS.md
|
|
// §3.7. Lux inherits CT from circl's CT secp256k1 implementation.
|
|
return sig;
|
|
}
|