Helpers used by the AVID/AVSS PR: ecies, nodes, RS

Splits the support-module changes out of the batch_avss PR
(#954). No protocol changes here:

- Cargo.toml: drop serde-big-array (no longer used), add
  reed-solomon-erasure for the RS code.
- ecies_v1.rs: small additions used by the AVSS complaint flow,
  with a new test.
- nodes.rs: prune unused methods; nodes_tests.rs follows.
- reed_solomon.rs: extend the RS wrapper used by AVID dispersal,
  with doc comments on encode/decode.

Author: jonas-lj

fastcrypto-tbls/Cargo.toml

@@ -23,7 +23,7 @@ zeroize.workspace = true
 itertools = "0.10.5"
 hex = "0.4.3"
 tap = { version = "1.0.1", features = [] }
-serde-big-array = "0.5.1"
+reed-solomon-erasure = "6.0.0"
 
 [dev-dependencies]
 criterion = "0.5.1"

fastcrypto-tbls/src/ecies_v1.rs

@@ -8,6 +8,7 @@ use fastcrypto::error::{FastCryptoError, FastCryptoResult};
 use fastcrypto::groups::{FiatShamirChallenge, GroupElement, HashToGroupElement, Scalar};
 use fastcrypto::traits::{AllowedRng, ToFromBytes};
 use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use std::marker::PhantomData;
 use typenum::consts::{U16, U32};
 use typenum::Unsigned;
 use zeroize::{Zeroize, ZeroizeOnDrop};
@@ -45,10 +46,23 @@ pub const AES_KEY_LENGTH: usize = 32;
 pub struct MultiRecipientEncryption<G: GroupElement> {
     c: G,
     c_hat: G,
-    encs: Vec<Vec<u8>>,
+    pub(crate) encs: Vec<Vec<u8>>,
     proof: DdhTupleNizk<G>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SharedComponents<G: GroupElement> {
+    c: G,
+    c_hat: G,
+    proof: DdhTupleNizk<G>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EncryptedPart<G> {
+    enc: Vec<u8>,
+    g: PhantomData<G>,
+}
+
 impl<G: GroupElement + Serialize> MultiRecipientEncryption<G>
 where
     <G as GroupElement>::ScalarType: FiatShamirChallenge + Zeroize,
@@ -194,6 +208,24 @@ where
         &self.proof
     }
 
+    pub fn into_parts(self) -> (SharedComponents<G>, Vec<Vec<u8>>) {
+        let MultiRecipientEncryption {
+            c,
+            c_hat,
+            encs,
+            proof,
+        } = self;
+        (SharedComponents { c, c_hat, proof }, encs)
+    }
+
+    pub fn shared(&self) -> SharedComponents<G> {
+        SharedComponents {
+            c: self.c,
+            c_hat: self.c_hat,
+            proof: self.proof.clone(),
+        }
+    }
+
     fn encs_random_oracle(encryption_random_oracle: &RandomOracle) -> RandomOracle {
         encryption_random_oracle.extend("encs")
     }
@@ -229,6 +261,92 @@ fn sym_cipher(k: &[u8; 64]) -> Aes256Ctr {
     )
 }
 
+impl<G: GroupElement + Serialize> SharedComponents<G>
+where
+    <G as GroupElement>::ScalarType: FiatShamirChallenge + Zeroize,
+    G: HashToGroupElement,
+{
+    pub fn decrypt(
+        &self,
+        enc: &[u8],
+        sk: &PrivateKey<G>,
+        encryption_random_oracle: &RandomOracle,
+        receiver_index: usize,
+    ) -> Vec<u8> {
+        let enc_ro = MultiRecipientEncryption::<G>::encs_random_oracle(encryption_random_oracle);
+        let ephemeral_key = self.c * sk.0;
+        let k = enc_ro.evaluate(&(receiver_index, ephemeral_key));
+        let cipher = sym_cipher(&k);
+        cipher
+            .decrypt(&fixed_zero_nonce(), enc)
+            .expect("Decrypt should never fail for CTR mode")
+    }
+
+    pub fn ephemeral_key(&self) -> &G {
+        &self.c
+    }
+
+    pub fn verify(&self, encryption_random_oracle: &RandomOracle) -> FastCryptoResult<()> {
+        let g_hat = G::hash_to_group_element(
+            &MultiRecipientEncryption::<G>::g_hat_random_oracle(encryption_random_oracle)
+                .evaluate(&self.c),
+        );
+        self.proof.verify(
+            &g_hat,
+            &self.c,
+            &self.c_hat,
+            &MultiRecipientEncryption::<G>::zk_random_oracle(encryption_random_oracle),
+        )
+    }
+
+    pub fn create_recovery_package<R: AllowedRng>(
+        &self,
+        sk: &PrivateKey<G>,
+        recovery_random_oracle: &RandomOracle,
+        rng: &mut R,
+    ) -> RecoveryPackage<G> {
+        let pk = G::generator() * sk.0;
+        let ephemeral_key = self.c * sk.0;
+
+        let proof = DdhTupleNizk::<G>::create(
+            &sk.0,
+            &self.c,
+            &pk,
+            &ephemeral_key,
+            recovery_random_oracle,
+            rng,
+        );
+
+        RecoveryPackage {
+            ephemeral_key,
+            proof,
+        }
+    }
+
+    pub fn decrypt_with_recovery_package(
+        &self,
+        enc: &[u8],
+        pkg: &RecoveryPackage<G>,
+        recovery_random_oracle: &RandomOracle,
+        encryption_random_oracle: &RandomOracle,
+        receiver_pk: &PublicKey<G>,
+        receiver_index: usize,
+    ) -> FastCryptoResult<Vec<u8>> {
+        pkg.proof.verify(
+            &self.c,
+            &receiver_pk.0,
+            &pkg.ephemeral_key,
+            recovery_random_oracle,
+        )?;
+        let encs_ro = MultiRecipientEncryption::<G>::encs_random_oracle(encryption_random_oracle);
+        let k = encs_ro.evaluate(&(receiver_index, pkg.ephemeral_key));
+        let cipher = sym_cipher(&k);
+        Ok(cipher
+            .decrypt(&fixed_zero_nonce(), enc)
+            .expect("Decrypt should never fail for CTR mode"))
+    }
+}
+
 impl<G> PrivateKey<G>
 where
     G: GroupElement + Serialize,

fastcrypto-tbls/src/nodes.rs

@@ -6,6 +6,7 @@ use crate::types::ShareIndex;
 use fastcrypto::error::{FastCryptoError, FastCryptoResult};
 use fastcrypto::groups::GroupElement;
 use fastcrypto::hash::{Blake2b256, Digest, HashFunction};
+use itertools::Itertools;
 use serde::{Deserialize, Serialize};
 use tracing::debug;
 
@@ -157,6 +158,28 @@ impl<G: GroupElement + Serialize> Nodes<G> {
         hash.finalize()
     }
 
+    /// Given an iterator over a set of items, one per share index, this function groups them into
+    /// a vector of vectors, one per node, according to the share ids of the nodes.
+    /// Returns error if the number of items does not match the total weight.
+    pub fn collect_to_nodes<T>(
+        &self,
+        items: impl ExactSizeIterator<Item = T>,
+    ) -> FastCryptoResult<Vec<Vec<T>>> {
+        if items.len() != self.total_weight as usize {
+            return Err(FastCryptoError::InvalidInput);
+        }
+        let mut items = items;
+        Ok(self
+            .node_ids_iter()
+            .map(|id| {
+                items
+                    .by_ref()
+                    .take(self.weight_of(id).unwrap() as usize)
+                    .collect_vec()
+            })
+            .collect_vec())
+    }
+
     /// Create a new set of nodes. Nodes must have consecutive ids starting from 0.
     /// Reduces weights up to an allowed delta in the original total weight.
     /// Finds the largest d such that:
@@ -292,132 +315,9 @@ impl<G: GroupElement + Serialize> Nodes<G> {
             new_f,
         ))
     }
-
-    /// Create a new set of nodes. Nodes must have consecutive ids starting from 0.
-    /// Like [`Nodes::new_reduced_with_f`], but in addition to the integer divisor
-    /// sweep, fine-sweeps the unit interval above the first feasible integer at
-    /// granularity 0.01 to find a (possibly strictly larger) fractional divisor d.
-    /// Finds the largest d such that:
-    /// - The new threshold is ceil(t / d)
-    /// - The new threshold for Byzantine parties is ceil(f / d)
-    /// - The new weights are all divided by d (floor division)
-    /// - The precision loss, counted as the sum of remainders Σ_i (w_i mod d) plus the
-    ///   ceiling overheads (-t) mod d and (-f) mod d, is at most the allowed delta
-    ///
-    /// Operates on a 0.01-multiple grid for d (represented internally in u64
-    /// arithmetic via d_x100 = 100*d). The Stage-1 criterion is the natural
-    /// fractional-d extension of the one in `new_reduced_with_f`, with
-    /// (w mod d) := w - floor(w/d) * d ∈ [0, d) for any real d > 0; the
-    /// Safety, Liveness, and Byzantine-removal proofs go through verbatim.
-    /// Since prop_reduce considers a strict superset of `new_reduced_with_f`'s
-    /// candidates, its reduced total weight (and ceilings t', f') are always
-    /// ≤ those of `new_reduced_with_f`.
-    ///
-    /// In practice, allowed delta will be the extra liveness we would assume above 2f+1.
-    ///
-    /// total_weight_lower_bound allows limiting the level of reduction (e.g., in benchmarks). To
-    /// get the best results, set it to 1.
-    pub fn prop_reduce(
-        nodes_vec: Vec<Node<G>>,
-        t: u16,
-        f: u16,
-        allowed_delta: u16,
-        total_weight_lower_bound: u16,
-    ) -> FastCryptoResult<(Self, u16, u16)> {
-        let n = Self::new(nodes_vec)?; // checks the input, etc
-        assert!(total_weight_lower_bound <= n.total_weight && total_weight_lower_bound > 0);
-        let allowed_delta_x100 = (allowed_delta as u64) * 100;
-        let mut max_d_x100: u32 = 100; // d = 1, no reduction
-                                       // Sweep d downward from 40 to 2. Going down, the first feasible integer
-                                       // is the largest feasible integer divisor (the criterion is non-monotone
-                                       // in d, so an upward sweep cannot break early). After locking onto the
-                                       // first feasible integer d, fine-sweep (d, d+1) at 0.01 in decreasing
-                                       // order to find the largest feasible fractional divisor in that interval.
-        'outer: for d in (2u16..=40).rev() {
-            // Continue if we are below the lower bound. (Going down, W' grows as
-            // d shrinks, so once W' clears the lower bound it stays cleared.)
-            // U16 is safe here since total_weight is u16.
-            let new_total_weight = n.nodes.iter().map(|n| n.weight / d).sum::<u16>();
-            if new_total_weight < total_weight_lower_bound {
-                continue;
-            }
-            // Compute the precision loss at integer d.
-            // U16 is safe here since total_weight is u16.
-            let delta =
-                n.nodes.iter().map(|n| n.weight % d).sum::<u16>() + neg_mod(t, d) + neg_mod(f, d);
-            if delta > allowed_delta {
-                continue;
-            }
-            // Integer d is feasible; lock it as the fallback.
-            max_d_x100 = (d as u32) * 100;
-            // Fine-sweep (d, d+1) at 0.01, largest-first. The first hit is the
-            // largest feasible 0.01-multiple in that interval.
-            for k in (1..100u32).rev() {
-                let d_x100 = (d as u32) * 100 + k;
-                let new_w_total = n
-                    .nodes
-                    .iter()
-                    .map(|n| ((n.weight as u32) * 100) / d_x100)
-                    .sum::<u32>();
-                if (new_w_total as u16) < total_weight_lower_bound {
-                    continue;
-                }
-                // Σ_i (w_i mod d) * 100 = W*100 − W' * d_x100 (telescopes by floor).
-                let sum_mod_x100 =
-                    (n.total_weight as u64) * 100 - (new_w_total as u64) * (d_x100 as u64);
-                let delta_x100 = sum_mod_x100 + neg_mod_x100(t, d_x100) + neg_mod_x100(f, d_x100);
-                if delta_x100 <= allowed_delta_x100 {
-                    max_d_x100 = d_x100;
-                    break;
-                }
-            }
-            break 'outer;
-        }
-        debug!(
-            "Nodes::prop_reduce reducing from {} with max_d_x100 {}, allowed_delta {}, total_weight_lower_bound {}",
-            n.total_weight, max_d_x100, allowed_delta, total_weight_lower_bound
-        );
-
-        let nodes = n
-            .nodes
-            .iter()
-            .map(|n| Node {
-                id: n.id,
-                pk: n.pk.clone(),
-                weight: (((n.weight as u32) * 100) / max_d_x100) as u16,
-            })
-            .collect::<Vec<_>>();
-        let accumulated_weights = Self::get_accumulated_weights(&nodes);
-        let nodes_with_nonzero_weight = Self::filter_nonzero_weights(&nodes);
-        // U16 is safe here since the original total_weight is u16.
-        let total_weight = nodes.iter().map(|n| n.weight).sum::<u16>();
-        let new_t = ((t as u64) * 100).div_ceil(max_d_x100 as u64) as u16;
-        let new_f = ((f as u64) * 100).div_ceil(max_d_x100 as u64) as u16;
-        Ok((
-            Self {
-                nodes,
-                total_weight,
-                accumulated_weights,
-                nodes_with_nonzero_weight,
-            },
-            new_t,
-            new_f,
-        ))
-    }
 }
 
 /// Compute (-x) mod d = d * ceil(x/d) - x
 fn neg_mod(x: u16, d: u16) -> u16 {
     (-(x as i32)).rem_euclid(d as i32) as u16
 }
-
-/// Compute ((-w) mod d) * 100 for the possibly-fractional divisor d = d_x100 / 100.
-/// Equals (ceil(w/d) * d - w) * 100, a non-negative integer in [0, d_x100).
-fn neg_mod_x100(w: u16, d_x100: u32) -> u64 {
-    let r = ((w as u64) * 100) % (d_x100 as u64);
-    if r == 0 {
-        0
-    } else {
-        (d_x100 as u64) - r
-    }
-}

fastcrypto-tbls/src/tests/ecies_v1_tests.rs

@@ -59,6 +59,13 @@ mod point_tests {
             assert_eq!(msg.as_bytes(), &decrypted);
         }
 
+        let (common, parts) = mr_enc.clone().into_parts();
+        assert!(common.verify(&ro).is_ok());
+        for (i, (part, (sk, _, msg))) in parts.iter().zip(keys_and_msg.iter()).enumerate() {
+            // Using parts should work as well
+            assert_eq!(msg.as_bytes(), common.decrypt(part, sk, &ro, i));
+        }
+
         // test empty messages
         let mr_enc2 = MultiRecipientEncryption::encrypt(
             &keys_and_msg