confium_tc_frost_ed25519/
lib.rs

1//! FROST threshold signature scheme over ed25519 (draft-irtf-cfrg-frost).
2//!
3//! A real cryptographic implementation of FROST, registered with the
4//! [`confium_tc`] link-time scheme registry under two names:
5//!
6//! - [`sign::SCHEME_NAME`] = `"FROST-ed25519"` — threshold signing.
7//!   Produces a standard RFC-8032 ed25519 signature `(R, z)` verifiable
8//!   by any conformant verifier (e.g. `ed25519-dalek`).
9//!
10//! - [`dkg::SCHEME_NAME`] = `"FROST-ed25519-dkg"` — distributed key
11//!   generation via Pedersen / Feldman VSS. Produces a per-party share
12//!   plus the aggregate public key, encoded in the session's
13//!   [`confium_tc::Session::result`] as a length-prefixed blob
14//!   (`pubkey || share`). Pass that blob directly into a signing
15//!   session's [`confium_tc::SessionParams::local_share`].
16//!
17//! ## Protocol at a glance
18//!
19//! ### DKG (2 rounds)
20//!
21//! 1. Each party generates a degree-`T-1` VSS polynomial, broadcasts its
22//!    Feldman commitment list, and directs per-peer share fragments.
23//! 2. Each party verifies the fragments, aggregates them, and sums the
24//!    commitment-list constant terms to get the aggregate public key.
25//!
26//! ### Signing (3 rounds)
27//!
28//! 1. Each party broadcasts nonce commitments `(D_i, E_i)`.
29//! 2. Each party receives all commitments, derives binding factors, the
30//!    group commitment `R`, the challenge `c = SHA-512(R ‖ A ‖ M)`,
31//!    computes `z_i = d_i + ρ_i·e_i + λ_i·s_i·c`, and broadcasts it.
32//! 3. Each party aggregates `z = Σ z_i`, verifies `z·B == R + c·A`, and
33//!    emits `(R, z)`.
34//!
35//! ## Status / deviations
36//!
37//! See the module-level notes in [`dkg`] and [`sign`] for the full list
38//! of deviations from the textbook FROST protocol. The headline gaps:
39//!
40//! - **No DKG complaint round.** Byzantine VSS senders are silently
41//!   excluded; honest parties still converge on the same key.
42//! - **Nonce generation uses `OsRng`**, not the spec's deterministic
43//!   H3 derivation.
44//! - **Per-party share-response verification is partial.** The aggregate
45//!   signature is always verified; identifying which peer was byzantine
46//!   requires distributing per-party public shares during DKG, which is
47//!   future work.
48
49pub mod dkg;
50pub mod error;
51pub mod group;
52pub mod inprocess;
53pub mod polynomial;
54pub mod sign;
55pub mod transcript;
56
57// Re-export the scheme types and the DKG output parser for callers that
58// want to drive the scheme directly (the test harness does this).
59pub use dkg::FrostEd25519Dkg;
60pub use dkg::parse_output as parse_dkg_output;
61pub use sign::FrostEd25519;
62
63/// Convenience: the canonical name of the signing scheme, as a `&'static str`.
64pub const SIGN_SCHEME: &str = sign::SCHEME_NAME;
65
66/// Convenience: the canonical name of the DKG scheme, as a `&'static str`.
67pub const DKG_SCHEME: &str = dkg::SCHEME_NAME;
confium_tc_frost_ed25519/lib.rs

confium_tc_frost_ed25519/
lib.rs
