ZcashFoundation / frost

Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures) by the Zcash Foundation
https://frost.zfnd.org
Other
147 stars 58 forks source link

Split `dkg::part3()` #754

Open conradoplg opened 1 month ago

conradoplg commented 1 month ago

I think it would also be useful to split part3 function into several parts. For example, one part takes max_signers, identifier, round1_packages, round2_packages. This way, some independent party (like a smart contract) can find culprit, and other participants can locally calculate their secret shares.

Also, an independent party can probably compute PublicKeyPackage since it only requires an identifier and a commitment (VerifiableSecretSharingCommitment). It would be nice to have such an API.

Originally posted by @StackOverflowExcept1on in https://github.com/ZcashFoundation/frost/issues/728#issuecomment-2373229124

StackOverflowExcept1on commented 1 month ago

I'm not really sure if splitting the function is necessary. I'd like to have an API like this: https://github.com/StackOverflowExcept1on/roast/blob/dkg/roast-core/src/dkg.rs. The dealer collects round1 and can instantly reject them, the dealer also collects round2. Those who didn't send round1 and round2 can be blamed by the smart contract. Also, when all participants passed round1 and round2 and no one was blamed, there is another option - each participant can locally run part3 and get a list of culprits (not just Error on the first culprit), and then send it to the contract so that the contract can check the list of culprits and blame them for sending bad data on round2, and then restart DKG in case of this. Blaming also means that the deposit of bad participants will be reduced.

The current API is only convenient for use on centralized platforms, but it would be cool to do this in web3.