FS-DKR: One Round Distributed Key Rotation

Related tags

cryptography
Overview

FS-DKR: One Round Distributed Key Rotation

Intro

In this note we aim to re-purpose the Fouque-Stern Distributed Key Generation (DKG) to support a secure Distributed Key Refresh (DKR). As we claim, FS-DKR is well suited for rotation of threshold ECDSA keys.

Background

The FS-DKG protocol is a one round DKG based on Publicly Verifiable Secret Sharing (PVSS) and the Paillier cryptosystem. There are two major security shortcomings to FS-DKG:

  1. It introduces a factoring assumptions (DCRA)
  2. it is insecure against rushing adversary

Rushing adversary is a common assumption in Multiparty Computation (MPC). In FS-DKG, an adversary waiting to receive messages from all other parties will be able to decide on the final public key. In the worst case it can lead to a rouge-key attack, giving full control of the secret key to the attacker. This is the main reason, in our opinion, why FS-DKG, altough with prominent features, was over-looked for the past 20 years. in this write-up we show how by adjusting FS-DKG to key rotation for threshold ecdsa the above shortcomings are avoided.

Our Model

We use standard proactive security assumptions. The protocol will be run by $n$ parties. We assume honest majority, that is, number of corruptions is $t<n/2$. The adversary is malicious, and rushing. For communication, the parties have access to a broadcast channel (can be implemented via a bulletin board). For threshold ECDSA, we focus on GG20 protocol, currently considered state of the art and most widely deployed threshold ecdsa scheme (e.g. multi-party-ecdsa, tss-lib).

High-level Description of FS-DKG

Here we give a short description of the FS-DKG protocol. FS-DKG works in one round. This round includes a single broadcast message from each party $P_j$. For Setup, we assume every party in the system has a public/private key pair for Paillier encryption scheme. At first, $P_j$ picks a random secret $s$ and secret shares it. $P_j$ publishes one set of size $t$ of commitment points $\textbf{A}$ corresponding to the polynomial coefficients: $A_i = a_iG$, and one set of $n$ commitment points $\textbf{S}$ corresponding to $n$ points on the polynomial: $S_i = \sigma_i G$. The points on the polynomial are also encrypted using the paillier keys of the receiving parties: $Enc_{pk_i}(\sigma_i)$. Finally, $P_j$ computes zero knowledge proofs $\pi_i$ to show that the paillier encryption for $P_i$ encrypts the same value commited in $S_i$. The ZK proof is a sigma protocol (can be made non-interactive using Fiat-Shamir) given in the original FS paper under the name proof of fairness. We implemented it under the same name.

Verification proceeds as follows. Each party $P_j$ verifies:

  1. all broadcasted proofs of fairness
  2. all secret sharing schemes - computing the polynomial points "at the exponent"

The parties define the set $\mathcal{Q}$ to be the set of the first $t+1$ parties for which all checks passed. we now show a simple optimization on how each party computes its local secret key: Each party maps its encrypted shares from ${t,n}$ to ${\mathcal{Q},\mathcal{Q}}$. It then homomorphically adds all the paillier ciphertext (which is an additive homomorphic scheme) and decrypts to get the local secret key.

Adjusting FS-DKG to DKR and threshold ECDSA

We will now highlight the adjustments required for FS-DKR. In a key refresh protocol the parties start with their inputs equal to the outputs of a DKG done in the past or the output of previous DKR. Meaning, as opposed to FS-DKG protocol in which the inputs are pseudorandom such that the attacker can bias the output, for example in a rushing adversary attack, FS-DKR avoids this potential attack on FS-DKG because of the added restriction over the inputs of the attacker. Concretely, in the case the parties must reshare their DKG/DKR output secret share, all other parties already know a public commitment to the attacker secret share and can check for it. Recall that FS-DKG is secure assuming Paillier is secure (what we called DCRA assumption). Moreover, we assumed a setup phase in which all parties generate paillier keys and share them. This fits well with threshold ECDSA: First, GG20 already requires us to assume Paillier security, therefore in this particular case, no new assumption is needed. The setup phase actually happens as part of GG20 DKG. We will use this to our advantage, running the FS-DKR using the GG20-DKG paillier keys. Obviously because we need to refresh the paillier keys as well we will also add a step to FS-DKR to generate new paillier keys and prove they were generated correctly. This is a standard proof, that can be made non-interactive. See the zk-paillier lib for an implementation.

Adding/Removing parties: There is a clear distinction between parties with secret shares (”Senders”) and new parties (”Receivers”). The FS-DKR protocol therefore supports adding and removing parties in a natural way: Define $\mathcal{J}>t+1$ the subset of parties participating in the protocol. To remove an existing party $P_i$, other parties exclude it from the subset $\mathcal{J}$. To add a new party, we assume the parties in $\mathcal{J}$ are aware of the new party' paillier key. In that case, the parties in $\mathcal{J}$ assign an index $i$ to the new party and broadcast the PVSS messages to it. Removal of a party is simply done by not broadcasting the encrypted messages to it. If enough parties decide on that for a party index, they will not be able to reconstruct a rotated key.

Identifiable Abort: A nice property of FS-DKR is that if a party misbehaves all honest parties learn about it. This is due to the nature of PVSS used in the protocol. As GG20, our reference threshold ECDSA protocol, also have this property, it is important that identifiable abort can be guaranteed throughout the DKR as well.

For completeness, Below is the FS-DKR protocol, written as FS-DKG with changes in red for DKR. The protocol is implemented in the ZenGo-X/fs-dkr repo (warning, the code is not audited yet).

Related Work

Our main requirement from FS-DKR is minimal round-count. In FS-DKR the parties can pre-process all the data they need to send. Our main bottleneck is $\mathcal{O}(n^2)$ communication, which seems a standard cost in our context: It is the same asymptotic complexity as we have in GG20-DKG and GG20-Signing.

In this section we focus on alternative protocols for DKR. Three recent results come to mind. The first one, CGGMP20, is another threshold ECDSA protocol with a companion refresh protocol, see figure 6 in the paper. Their protocol has the most resemblance to FS-DKR, with few notable differences. First, while FS-DKR is publicly verifiable, CGGMP20-DKR current version suffers from a technichal issue with its Identifiable Abort (acknowledged by the authors). Second, the paillier keys used in the CGGMP20-DKR are the new ones, while in FS-DKR, we use the old ones, already known to all, which helps us save a round of communication. Finally, CGMMP20-DKR key refresh is done by adding shares of zero while in FS-DKR we re-share existing shares. Overall we treat the similarities between the protocols as a positive signal of validation for FS-DKR. A second protocol, by Gurkan et. al., uses gossip for aggregating transcripts from the parties. However, their DKG is generating group elements secret shares and we need field elements secret shares for our threshold ECDSA. The third relevant work is Jens Groth' Non interactive DKG and DKR. There, instead of paillier encryption, they use El-Gamal based encryption scheme that offers forward security. Their DKR makes the assumption that the El-Gamal decryption keys are long-term and not rotated. This assumption seems crucial for the Groth-DKG construction. In our context it means that we need to let the parties generate, store and use a new set of keypair,in addition to the Paillier keypair, and that this new keypair poses a security risk against the classical mobile adversary, which our model does not allow. As opposed to Groth-DKR, FS-DKR is reusing the existing paillier keypair and rotate it as well. In terms of efficiency - there is no complexity analysis given in the paper, however, from inspection we estimate the asymptotic complexity is comparable to FS-DKR (quadratic in the number of parties).

Acknowledgments

We thank Claudio Orlandi, Kobi Gurkan and Nikolaos Makriyannis for reviewing the note

Issues
  • handle deletion of old local key

    handle deletion of old local key

    once the protocol finishes - the old key must be deleted / zeroized

    opened by omershlo 1
  • zeroize the old key

    zeroize the old key

    For the zeroization we need to make the old key mutable and to zeroize linear key.

    opened by tudorcebere 1
  • add zeroize where necessary in fairness_proof

    add zeroize where necessary in fairness_proof

    secrets must be zeroized immediately after use example

    opened by omershlo 0
  • add new paillier keys to DKR

    add new paillier keys to DKR

    https://github.com/ZenGo-X/fs-dkr/blob/main/src/lib.rs#L71

    As part of thee DKR we need each party to generate a new paillier keypair and broadcast it together with a proof of correctness (proof can be taken from: https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/correct_key_ni.rs)

    opened by omershlo 0
  • Err sanity checks

    Err sanity checks

    Added error handling and a few sanity checks.

    opened by tudorcebere 0
  • write a test with multiple refresh cycles

    write a test with multiple refresh cycles

    refresh is repeating operation - write a test with few consecutive refreshes. Make sure that each time the same joint public key is outputted not secret shares are not the same

    opened by omershlo 0
  • Add new Paillier ek + proof to RefreshMessage.

    Add new Paillier ek + proof to RefreshMessage.

    Create new Paillier ek/dk pair + Add ek + proof of correctness to RefreshMessage.

    opened by tudorcebere 0
  • Quickstart for the CI

    Quickstart for the CI

    null

    opened by tudorcebere 0
  • Several changes

    Several changes

    • Derives RefreshMessage from De/Serialize traits
    • Exposes DecryptionKey from paillier
    opened by rimbi 0
  • implementing removal/addition of parties

    implementing removal/addition of parties

    null

    opened by tudorcebere 0
  • [WIP] Add parties

    [WIP] Add parties

    null

    opened by tudorcebere 3
  • replace proof of fairness with PDLwSlack

    replace proof of fairness with PDLwSlack

    PDLwSlack can be found here: https://github.com/ZenGo-X/multi-party-ecdsa/tree/master/src/utilities/zk_pdl_with_slack

    opened by omershlo 0
  • typo

    typo

    rogue-key attack

    opened by 3for 1
  • Let parties which do not have a valid LocalKey participate in key resharing process

    Let parties which do not have a valid LocalKey participate in key resharing process

    A sample scenario:

    • We start 300 validator nodes
    • Only 100 of them becomes valid validators in the first coming session
    • These 100 nodes participate in key generation and has valid LocalKeys
    • The rest did not participate and thus do not have LocalKeys
    • There comes a new session and in 50 of the valid validators leaves the session while 50 new one joins
    • How will those new 50 nodes without LocalKey participate key resharing process?
    opened by rimbi 0
  • handle different adversarial settings

    handle different adversarial settings

    The code currently assumes:

    1. all n refresh message arrive
    2. If 1 out of n messages fails the test the protocol fails. Therefore in the protocol we simply take the first t+1 refresh messages after we checked all n messages are valid. In practice we need to take the first t+1 messages of parties that passed all checks (doesn't have to be indices 1...t+1)

    We need to add support for the case where some parties are malicious, meaning that we have some k honest parties ,t<k<n, and that the malicious parties can attack any party (adversary is not necessarily control indices k+1...n for example)

    opened by omershlo 0
  • benchmarks & optimizations

    benchmarks & optimizations

    Add a benchmark for the computation time and bandwidth required to run the refresh (per party). See if there are ways to optimize the code from an engineering point of view (e.g. removing loops / running loops in parallel etc..)

    opened by omershlo 0
Owner
[ZenGo X]
Threshold cryptography for blockchains. Projects with "city" in name are work in progress.
[ZenGo X]
A Rust library for generating cryptocurrency wallets

Table of Contents 1. Overview 2. Build Guide 2.1 Install Rust 2.2a Build from Homebrew 2.2b Build from Crates.io 2.2c Build from Source Code 3. Usage

Aleo 399 Sep 9, 2021
A fast and secure multi protocol honeypot.

Medusa A fast and secure multi protocol honeypot that can mimic realistic devices running ssh, telnet, http, https or any other tcp and udp servers. W

Simone Margaritelli 192 Sep 12, 2021
A prototype implementation of the Host Identity Protocol v2 for bare-metal systems, written in pure-rust.

Host Identity Protocol for bare-metal systems, using Rust I've been evaluating TLS replacements in constrained environments for a while now. Embedded

null 20 Aug 27, 2021
Drop-in Access Control via NFT Ownership

niftygate - Signature-Based Authenticating Proxy What is it? niftygate is a proxy for HTTP services, that validates signatures, providing an AuthN lay

Chris Olstrom 31 Sep 14, 2021
A modern TLS library in Rust

Rustls is a modern TLS library written in Rust. It's pronounced 'rustles'. It uses ring for cryptography and libwebpki for certificate verification. S

ctz 2.9k Sep 15, 2021
Secure storage for cryptographic secrets in Rust

secrets secrets is a library to help Rust programmers safely held cryptographic secrets in memory. It is mostly an ergonomic wrapper around the memory

Stephen Touset 125 Aug 21, 2021
Byzantine-fault-tolerant time synchronization

Byztime Byztime is a Byzantine-fault-tolerant protocol for synchronizing time among a group of peers, without reliance on any external time authority.

Akamai Unofficial 36 Sep 15, 2021
The Mullvad VPN client app for desktop and mobile

Mullvad VPN desktop and mobile app Welcome to the Mullvad VPN client app. This repository contains all the source code for the desktop and mobile vers

Mullvad VPN 1.7k Sep 18, 2021
🔐 Encrypts all the Serialize.

serde-encrypt ?? Encrypts all the Serialize. Alice Bob +-----------------------------------+

Sho Nakatani 152 Aug 14, 2021
Manage secret values in-repo via public key cryptography

amber Manage secret values in-repo via public key cryptography. See the announcement blog post for more motivation. Amber provides the ability to secu

FP Complete 54 Sep 6, 2021
A distributed, cryptographically-verifiable blog / social network

FeoBlog FeoBlog is a distributed blogging platform. It takes a lot of its inspiration from Mastodon and Scuttlebutt. It aims to solve a couple of prob

Cody Casterline 66 Aug 14, 2021
shavee is a Program to automatically decrypt and mount ZFS datasets using Yubikey HMAC as 2FA or any USB drive with support for PAM to auto mount home directories.

shavee is a simple program to decrypt and mount encrypted ZFS user home directories at login using Yubikey HMAC or a Simple USB drive as 2FA written in rust.

Ashutosh Verma 11 Sep 16, 2021
Keyhouse is a skeleton of general-purpose Key Management System written in Rust.

Keyhouse Keyhouse is a skeleton of general-purpose Key Management System. Keyhouse is not an off-the-shelf system, and it's not ready for production.

Bytedance Inc. 23 Sep 9, 2021
rabe is an Attribute Based Encryption library, written in Rust

Rabe rabe is a rust library implementing several Attribute Based Encryption (ABE) schemes using a modified version of the bn library of zcash (type-3

Fraunhofer AISEC 40 Jul 18, 2021
X25519 elliptic curve Diffie-Hellman key exchange in pure-Rust, using curve25519-dalek.

x25519-dalek A pure-Rust implementation of x25519 elliptic curve Diffie-Hellman key exchange, with curve operations provided by curve25519-dalek. This

dalek cryptography 197 Aug 31, 2021
HD wallet BIP-32 related key derivation utilities.

HDWallet Docs HD wallet(BIP-32) key derivation utilities. This crate is build upon secp256k1 crate, this crate only provides BIP-32 related features,

jjy 16 Jul 21, 2021
An implementation of the OPAQUE password-authenticated key exchange protocol

The OPAQUE key exchange protocol OPAQUE is an asymmetric password-authenticated key exchange protocol. It allows a client to authenticate to a server

Novi 79 Sep 13, 2021
Prototype: ORAM and related for Intel SGX enclaves

mc-oblivious Traits and implementations for Oblivious RAM inside of Intel SGX enclaves. The scope of this repository is: Traits for fast constant-time

MobileCoin 26 Aug 25, 2021
Experimental binary transparency for pacman with sigstore and rekor

pacman-bintrans This is an experimental implementation of binary transparency for pacman, the Arch Linux package manager. This project was originally

null 52 Sep 9, 2021