Module dkg 

Distributed key generation for FROST-ed25519.

Implements a Pedersen / Feldman VSS-based DKG that produces:

• a per-party secret share s_i (32-byte scalar, little-endian),
• the aggregate public key A = (sum of constant terms) · B (32-byte compressed point),

such that any T of the N shares can produce FROST signatures that verify against A under standard ed25519.

Protocol

Two rounds:

• Round 1 — each party generates a fresh random degree-T-1 polynomial f_i(X), broadcasts its Feldman commitment list C_{i,k} = a_{i,k} · B, and sends each peer j the directed share f_i(j).

• Round 2 — each party verifies every received share against its sender’s commitment list (rejecting byzantine parties with a proof), sums all valid shares into its aggregate share s_i, and computes the aggregate public key as the sum of all parties’ C_{i,0}.

Output shape

The DKG session’s result() returns a length-prefixed blob of the form

  pubkey_len:u32 BE | pubkey[32] | share_len:u32 BE | share[32]

The framework’s confium_tc::Session::dkg_public_key only surfaces the first 32 bytes (the public key); this crate’s parse_output helper parses the full blob for callers that need the share as well (e.g. feeding it into a subsequent FROST signing session).

Deviations from the textbook protocol

• No complaint round. A party whose VSS share fails verification is silently excluded from this party’s aggregate; that party’s commitment list is also excluded from the public-key sum. This means all honest parties still converge on the same key as long as they observe the same broadcasts. A future revision should add an explicit complaint / expose-the-liar round as the spec requires.
• No secure channel abstraction. The directed share f_i(j) is transported in the clear inside a confium_tc::Message addressed to party j. In production this requires an authenticated, private transport; the framework provides message routing but not confidentiality. This matches the framework’s “transport is a separate concern” stance (see TODO.roadmap/05).

Structs

FrostEd25519Dkg

FROST-ed25519 distributed key generation scheme.

Constants

SCHEME_NAME

Canonical scheme name advertised through the registry.

Functions

parse_output

Parse a DKG output blob into (public_key_bytes, share_bytes).