mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
b5ae22fa1d
The proof accompanying each share built its response as NewScalar().Mul(challenge).Mul(share). NewScalar is the ZERO scalar, so that is 0·c·share = 0 and the response carried the nonce alone; the share never entered it. VerifyAndCombine gates every share on VerifyShare, so an entirely honest round ended as "invalid share from a to a". The package's four tests passed throughout because none of them called either function. Behind that sat a commitment that could not have been verified against in any case. createCommitment committed to the polynomial's EVALUATIONS at 1..t while evaluateCommitment read the same points back as COEFFICIENTS, and both halves of the intended Pedersen pair were taken on the base point, so the blinding polynomial added no hiding — a second generator was noted as missing and never supplied. polynomial.Exponent is that commitment, correct and already in this module: F(X) = [f(X)]·G, one point per coefficient, verified as F(x) == [f(x)]·G. Using it removes the hand-rolled commitment, the proof, and the challenge — 123 lines — and needs no proof at all, since the exponent check IS the verification. The tests now cover what the old ones stepped around: an honest share verifies, a share does not verify as another party's or against another dealer's commitment, and a full round completes.