Crate confium_tc_cmp20

Expand description

CMP20 threshold ECDSA over P-256 (Canetti, Makriyannis, Peled 2020, eprint 2020/496).

A newer, more efficient threshold ECDSA protocol than GG18. Key improvements exploited here:

Non-interactive key generation — DKG collapses to a single broadcast round (each party commits its public share; no per-peer share exchange is needed in the simplified path).
Three-round signing — down from GG18’s four. Round 1 commits nonces, round 2 reveals them and carries the MtA products, round 3 posts partial signatures and combines in the same round.
Identifiable abort — when a partial signature fails to verify the offending party is reported by index rather than failing opaquely.

§Example

use confium_tc_cmp20::inprocess;

// 2-of-3 DKG: produces 3 share blobs + a joint P-256 public key.
let kg = inprocess::keygen(2, 3)?;

// Sign with the first 2 shares (threshold met).
let sig = inprocess::sign(&kg.shares[..2], 2, b"hello, threshold world")?;
assert_eq!(sig.len(), 64); // (r, s) pair

Wired as a confium_tc::registry::TcScheme plugin with two scheme names registered through confium_tc::register_tc_scheme!:

DKG_SCHEME_NAME = "CMP20-ECDSA-P256" (non-interactive DKG) — produces per-party Cmp20Share + shared public key.
SIGN_SCHEME_NAME = "CMP20-ECDSA-P256-SIGN" — produces a standard 64-byte (r, s) ECDSA signature verifiable with the p256 crate.

See the module-level docs of keygen, sign, mta for what is implemented and what is omitted. In short: the Feldman VSS, Lagrange interpolation, and threshold-ECDSA combine are all real; the MtA sub-round is a simplified in-process stub (products computed in the clear) rather than a Paillier-based homomorphic MtA, matching the GG18 crate’s deferred-Paillier approach.

Re-exports§

pub use scheme::Cmp20EcdsaP256;
pub use scheme::Cmp20EcdsaP256Sign;
pub use share::Cmp20Share;

Modules§

e2e_signing: CMP20 end-to-end real signing.
error: Error helpers for the CMP20 scheme crate.
gg18_e2e: GG18 end-to-end threshold ECDSA signing.
gg18_mta: GG18 Paillier MtA integration.
inprocess: In-process synchronous driver for CMP20 DKG and signing.
keygen: CMP20 non-interactive distributed key generation over P-256.
lagrange: Lagrange interpolation in the P-256 scalar field.
mta: Multiplicative-to-Additive (MtA) sub-round.
mta_proofs: Zero-knowledge proofs for the MtA protocol — GG18/GG20 Appendix A (Gennaro & Goldfeder, eprint 2019/114 A.1/A.2), the construction spec 70-cmp20 requires on every MtA ciphertext.
paillier_mta: Paillier-based Multiplicative-to-Additive (MtA) share conversion.
recovery: Share backup + recovery for CMP20 threshold shares.
refresh: Proactive share refresh for P-256 threshold shares (Herzberg et al. 1995).
scheme: CMP20 scheme registration.
share: Per-party share material produced by CMP20 DKG and consumed by signing.
sign: CMP20 threshold ECDSA signing over P-256.
vss: Feldman verifiable secret sharing over P-256.

Constants§

DKG_SCHEME_NAME: Canonical scheme name for CMP20 DKG over P-256.
SIGN_SCHEME_NAME: Canonical scheme name for CMP20 signing over P-256.