Module mta 

Multiplicative-to-Additive (MtA) sub-round.

CMP20 signing needs to convert, for every pair (i, j), the product k_i * x_j into additive shares alpha_{ij} (held by i) and beta_{ji} (held by j) such that alpha_{ij} + beta_{ji} = k_i x_j.

The cryptographic way is Paillier homomorphic encryption (CMP20’s “key generation” already produces a Paillier keypair per party). This crate does not depend on a Paillier backend, so the MtA is computed in the clear inside the trusted test harness: alpha_{ij} = 0 and beta_{ji} = k_i x_j. The arithmetic outcome is identical to a real MtA; only the cryptographic hiding is lost. See the crate-level docs for what a production replacement requires.

CMP20 folds the MtA products into the nonce-reveal round (round 2), collapsing what would be two separate GG18 sub-rounds into one.

Structs

MtaInputs

Collected per-party inputs for one signing session’s MtA products.

Functions

party_mta_sum

Party i’s total MtA adjustment: delta_i = k_i x_i + sum_{j != i} (alphas[j][i] + betas[i][j]).