search

dfns / cggmp21

State-of-art threshold ECDSA in Rust
Apache License 2.0
43 stars 6 forks source link

Use Polynomial from `generic-ec` #49

Closed survived closed 1 year ago

survived commented 1 year ago

Blocked by https://github.com/dfns-labs/generic-ec/pull/3

github-actions[bot] commented 1 year ago

Crate direct deps

Direct deps ```text digest v0.10.6 futures v0.3.24 generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) hex v0.4.3 paillier-zk v0.1.0 (https://github.com/dfns-labs/paillier-zk?branch=m#a2639222) rand_chacha v0.3.1 rand_core v0.6.4 round-based v0.2.0 (https://github.com/Zengo-X/round-based-protocol?branch=round-based2#16bb42a4) serde v1.0.160 serde_json v1.0.89 serde_with v2.0.1 sha2 v0.10.6 thiserror v1.0.37 ```

Compared to base branch

Diff ```text --- direct-deps-base 2023-07-03 13:41:58.049926522 +0000 +++ direct-deps-pr 2023-07-03 13:41:58.561929342 +0000 @@ -3,2 +3,2 @@ -generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#c418c93b) -generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#c418c93b) +generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) +generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) ```

All deps

cargo tree ```text cggmp21 v0.0.0 (/home/runner/work/cggmp21/cggmp21/pr_branch/cggmp21) ├── digest v0.10.6 │ ├── block-buffer v0.10.3 │ │ └── generic-array v0.14.6 │ │ ├── serde v1.0.160 │ │ │ └── serde_derive v1.0.160 (proc-macro) │ │ │ ├── proc-macro2 v1.0.56 │ │ │ │ └── unicode-ident v1.0.4 │ │ │ ├── quote v1.0.26 │ │ │ │ └── proc-macro2 v1.0.56 (*) │ │ │ └── syn v2.0.15 │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── unicode-ident v1.0.4 │ │ └── typenum v1.15.0 │ └── crypto-common v0.1.6 │ ├── generic-array v0.14.6 (*) │ └── typenum v1.15.0 ├── futures v0.3.24 │ ├── futures-channel v0.3.24 │ │ ├── futures-core v0.3.24 │ │ └── futures-sink v0.3.24 │ ├── futures-core v0.3.24 │ ├── futures-executor v0.3.24 │ │ ├── futures-core v0.3.24 │ │ ├── futures-task v0.3.24 │ │ └── futures-util v0.3.24 │ │ ├── futures-channel v0.3.24 (*) │ │ ├── futures-core v0.3.24 │ │ ├── futures-io v0.3.24 │ │ ├── futures-macro v0.3.24 (proc-macro) │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── syn v1.0.101 │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── unicode-ident v1.0.4 │ │ ├── futures-sink v0.3.24 │ │ ├── futures-task v0.3.24 │ │ ├── memchr v2.5.0 │ │ ├── pin-project-lite v0.2.9 │ │ ├── pin-utils v0.1.0 │ │ └── slab v0.4.7 │ ├── futures-io v0.3.24 │ ├── futures-sink v0.3.24 │ ├── futures-task v0.3.24 │ └── futures-util v0.3.24 (*) ├── generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) │ ├── generic-ec-core v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) │ │ ├── generic-array v0.14.6 (*) │ │ ├── rand_core v0.6.4 │ │ │ └── getrandom v0.2.8 │ │ │ ├── cfg-if v1.0.0 │ │ │ └── libc v0.2.134 │ │ ├── serde v1.0.160 (*) │ │ ├── subtle v2.4.1 │ │ └── zeroize v1.5.7 │ │ └── zeroize_derive v1.3.2 (proc-macro) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ ├── syn v1.0.101 (*) │ │ └── synstructure v0.12.6 │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ ├── syn v1.0.101 (*) │ │ └── unicode-xid v0.2.4 │ ├── hex v0.4.3 │ │ └── serde v1.0.160 (*) │ ├── phantom-type v0.4.2 │ │ └── educe v0.4.19 (proc-macro) │ │ ├── enum-ordinalize v3.1.11 (proc-macro) │ │ │ ├── num-bigint v0.4.3 │ │ │ │ ├── num-integer v0.1.45 │ │ │ │ │ └── num-traits v0.2.15 │ │ │ │ └── num-traits v0.2.15 │ │ │ ├── num-traits v0.2.15 │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── syn v1.0.101 (*) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v1.0.101 (*) │ ├── rand_core v0.6.4 (*) │ ├── serde v1.0.160 (*) │ ├── serde_with v2.0.1 │ │ ├── serde v1.0.160 (*) │ │ └── serde_with_macros v2.0.1 (proc-macro) │ │ ├── darling v0.14.1 │ │ │ ├── darling_core v0.14.1 │ │ │ │ ├── fnv v1.0.7 │ │ │ │ ├── ident_case v1.0.1 │ │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ │ ├── quote v1.0.26 (*) │ │ │ │ ├── strsim v0.10.0 │ │ │ │ └── syn v1.0.101 (*) │ │ │ └── darling_macro v0.14.1 (proc-macro) │ │ │ ├── darling_core v0.14.1 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── syn v1.0.101 (*) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v1.0.101 (*) │ ├── subtle v2.4.1 │ └── zeroize v1.5.7 (*) ├── generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) │ ├── digest v0.10.6 (*) │ ├── generic-array v0.14.6 (*) │ ├── generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) (*) │ ├── rand_core v0.6.4 (*) │ ├── serde v1.0.160 (*) │ └── subtle v2.4.1 ├── hex v0.4.3 (*) ├── paillier-zk v0.1.0 (https://github.com/dfns-labs/paillier-zk?branch=m#a2639222) │ ├── generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) (*) │ ├── libpaillier v0.5.0 │ │ ├── digest v0.10.6 (*) │ │ ├── serde v1.0.160 (*) │ │ ├── serde_bare v0.5.0 │ │ │ └── serde v1.0.160 (*) │ │ ├── unknown_order v0.6.0 │ │ │ ├── digest v0.9.0 │ │ │ │ └── generic-array v0.14.6 (*) │ │ │ ├── hex v0.4.3 (*) │ │ │ ├── num-traits v0.2.15 │ │ │ ├── rand v0.8.5 │ │ │ │ ├── libc v0.2.134 │ │ │ │ ├── rand_chacha v0.3.1 │ │ │ │ │ ├── ppv-lite86 v0.2.17 │ │ │ │ │ └── rand_core v0.6.4 (*) │ │ │ │ └── rand_core v0.6.4 (*) │ │ │ ├── rug v1.18.0 │ │ │ │ ├── az v1.2.1 │ │ │ │ ├── gmp-mpfr-sys v1.4.12 │ │ │ │ │ └── libc v0.2.134 │ │ │ │ ├── libc v0.2.134 │ │ │ │ ├── num-integer v0.1.45 (*) │ │ │ │ └── num-traits v0.2.15 │ │ │ ├── serde v1.0.160 (*) │ │ │ ├── subtle v2.4.1 │ │ │ └── zeroize v1.5.7 (*) │ │ └── zeroize v1.5.7 (*) │ ├── rand_chacha v0.3.1 (*) │ ├── rand_core v0.6.4 (*) │ ├── serde v1.0.160 (*) │ ├── serde_with v3.0.0 │ │ ├── serde v1.0.160 (*) │ │ └── serde_with_macros v3.0.0 (proc-macro) │ │ ├── darling v0.20.1 │ │ │ ├── darling_core v0.20.1 │ │ │ │ ├── fnv v1.0.7 │ │ │ │ ├── ident_case v1.0.1 │ │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ │ ├── quote v1.0.26 (*) │ │ │ │ ├── strsim v0.10.0 │ │ │ │ └── syn v2.0.15 (*) │ │ │ └── darling_macro v0.20.1 (proc-macro) │ │ │ ├── darling_core v0.20.1 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── syn v2.0.15 (*) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v2.0.15 (*) │ ├── sha2 v0.10.6 │ │ ├── cfg-if v1.0.0 │ │ ├── cpufeatures v0.2.5 │ │ └── digest v0.10.6 (*) │ ├── subtle v2.4.1 │ ├── thiserror v1.0.37 │ │ └── thiserror-impl v1.0.37 (proc-macro) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v1.0.101 (*) │ └── zeroize v1.5.7 (*) ├── rand_chacha v0.3.1 (*) ├── rand_core v0.6.4 (*) ├── round-based v0.2.0 (https://github.com/Zengo-X/round-based-protocol?branch=round-based2#16bb42a4) │ ├── async-stream v0.3.3 │ │ ├── async-stream-impl v0.3.3 (proc-macro) │ │ │ ├── proc-macro2 v1.0.56 (*) │ │ │ ├── quote v1.0.26 (*) │ │ │ └── syn v1.0.101 (*) │ │ └── futures-core v0.3.24 │ ├── bincode v1.3.3 │ │ └── serde v1.0.160 (*) │ ├── futures v0.3.24 (*) │ ├── never v0.1.0 │ ├── phantom-type v0.3.1 │ │ └── educe v0.4.19 (proc-macro) (*) │ ├── round-based-derive v0.1.0 (proc-macro) (https://github.com/Zengo-X/round-based-protocol?branch=round-based2#16bb42a4) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v1.0.101 (*) │ ├── serde v1.0.160 (*) │ ├── thiserror v1.0.37 (*) │ ├── tokio v1.21.2 │ │ └── pin-project-lite v0.2.9 │ ├── tokio-stream v0.1.10 │ │ ├── futures-core v0.3.24 │ │ ├── pin-project-lite v0.2.9 │ │ ├── tokio v1.21.2 (*) │ │ └── tokio-util v0.7.4 │ │ ├── bytes v1.2.1 │ │ ├── futures-core v0.3.24 │ │ ├── futures-sink v0.3.24 │ │ ├── pin-project-lite v0.2.9 │ │ └── tokio v1.21.2 (*) │ └── tracing v0.1.36 │ ├── cfg-if v1.0.0 │ ├── pin-project-lite v0.2.9 │ ├── tracing-attributes v0.1.22 (proc-macro) │ │ ├── proc-macro2 v1.0.56 (*) │ │ ├── quote v1.0.26 (*) │ │ └── syn v1.0.101 (*) │ └── tracing-core v0.1.29 │ └── once_cell v1.17.0 ├── serde v1.0.160 (*) ├── serde_json v1.0.89 │ ├── itoa v1.0.4 │ ├── ryu v1.0.11 │ └── serde v1.0.160 (*) ├── serde_with v2.0.1 (*) ├── sha2 v0.10.6 (*) └── thiserror v1.0.37 (*) ```

Compared to base branch

Diff ```text --- all-deps-base 2023-07-03 13:41:58.289927843 +0000 +++ all-deps-pr 2023-07-03 13:41:58.801930664 +0000 @@ -31,3 +31,3 @@ -generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#c418c93b) -generic-ec-core v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#c418c93b) -generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#c418c93b) +generic-ec v0.0.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) +generic-ec-core v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) +generic-ec-zkp v0.1.0 (https://github.com/dfns-labs/generic-ec?branch=m#448b0789) ```
github-actions[bot] commented 1 year ago

Benchmark Result

Benchmarks ```text RUST_TESTS_SEED=d02bc28f3cab3c5edc90f95be22f3740daa38184dc8fc97d3510e9a736411503 n = 3 Non-threshold DKG Protocol Performance: - Protocol took 678.82µs to complete In particular: - Setup: 4.00µs - Setup networking: 3.90µs (97.5%) - Unstaged: 100.00ns (2.5%) - Round 1: 172.81µs - Compute execution id: 400.00ns (0.2%) - Sample x_i, rid_i: 75.60µs (43.8%) - Sample schnorr commitment: 68.30µs (39.5%) - Commit to public data: 28.10µs (16.3%) - Unstaged: 400.00ns (0.2%) - Round 2: 4.30µs - Hash received msgs (reliability check): 4.10µs (95.3%) - Unstaged: 200.00ns (4.7%) - Round 3: 300.00ns - Assert other parties hashed messages (reliability check): 200.00ns (66.7%) - Unstaged: 100.00ns (33.3%) - Round 4: 74.60µs - Validate decommitments: 69.50µs (93.2%) - Calculate challege rid: 4.70µs (6.3%) - Prove knowledge of `x_i`: 200.00ns (0.3%) - Unstaged: 200.00ns (0.3%) - Round 5: 422.82µs - Validate schnorr proofs: 422.32µs (99.9%) - Unstaged: 500.00ns (0.1%) Threshold DKG Protocol Performance: - Protocol took 1.48ms to complete In particular: - Setup: 2.60µs - Setup networking: 2.60µs (100.0%) - Unstaged: 0.00ns (0.0%) - Round 1: 242.71µs - Compute execution id: 200.00ns (0.1%) - Sample rid_i, schnorr commitment, polynomial: 207.41µs (85.5%) - Commit to public data: 34.80µs (14.3%) - Unstaged: 300.00ns (0.1%) - Round 2: 4.40µs - Hash received msgs (reliability check): 4.20µs (95.5%) - Unstaged: 200.00ns (4.5%) - Round 3: 300.00ns - Assert other parties hashed messages (reliability check): 100.00ns (33.3%) - Unstaged: 200.00ns (66.7%) - Round 4: 915.43µs - Validate decommitments: 67.80µs (7.4%) - Validate data size: 300.00ns (0.0%) - Validate Feldmann VSS: 410.12µs (44.8%) - Compute rid: 800.00ns (0.1%) - Compute Ys: 413.52µs (45.2%) - Compute sigma: 400.00ns (0.0%) - Calculate challenge: 22.00µs (2.4%) - Prove knowledge of `sigma_i`: 200.00ns (0.0%) - Unstaged: 300.00ns (0.0%) - Round 5: 319.41µs - Validate schnorr proofs: 317.41µs (99.4%) - Derive resulting public key and other data: 1.60µs (0.5%) - Unstaged: 400.00ns (0.1%) Key refresh protocol Protocol Performance: - Protocol took 3.54s to complete In particular: - Setup: 12.60µs - Retrieve auxiliary data: 700.00ns (5.6%) - Setup networking: 10.00µs (79.4%) - Precompute execution id and shared state: 1.80µs (14.3%) - Unstaged: 100.00ns (0.8%) - Round 1: 391.17ms - Retrieve primes (p and q): 300.00ns (0.0%) - Compute paillier decryption key (N): 22.30ms (5.7%) - Generate secret x_i and public X_i: 212.81µs (0.1%) - Generate auxiliary params r, λ, t, s: 5.67ms (1.4%) - Prove Πprm (ψˆ_i): 362.30ms (92.6%) - Compute schnorr commitment τ_j: 211.01µs (0.1%) - Sample random bytes: 200.00ns (0.0%) - Compute hash commitment and sample decommitment: 467.02µs (0.1%) - Unstaged: 400.00ns (0.0%) - Round 2: 5.00µs - Hash received msgs (reliability check): 4.60µs (92.0%) - Unstaged: 400.00ns (8.0%) - Round 3: 700.00ns - Assert other parties hashed messages (reliability check): 400.00ns (57.1%) - Unstaged: 300.00ns (42.9%) - Round 4: 2.17s - Validate round 1 decommitments: 923.61µs (0.0%) - Validate data sizes: 400.00ns (0.0%) - Validate П_prm (ψ_i): 725.77ms (33.5%) - Validate X_i: 8.10µs (0.0%) - Compute paillier encryption keys: 11.50µs (0.0%) - Add together shared random bytes: 2.10µs (0.0%) - Compute П_mod (ψ_i): 1.23s (56.9%) - Assemble security params for П_fac (ф_i): 1.92ms (0.1%) - Compute schnorr proof ψ_i^j: 8.80µs (0.0%) - Prepare auxiliary params and security level for proofs: 500.00ns (0.0%) - Paillier encryption of x_i^j: 50.42ms (2.3%) - Compute П_fac (ф_i^j): 155.11ms (7.2%) - Unstaged: 1.10µs (0.0%) - Round 5: 981.73ms - Paillier decrypt x_j^i from C_j^i: 46.13ms (4.7%) - Validate shares: 140.37µs (0.0%) - Validate schnorr proofs п_j and ψ_j^k: 827.61µs (0.1%) - Validate ψ_j (П_mod): 774.01ms (78.8%) - Validate ф_j (П_fac): 160.60ms (16.4%) - Calculate new x_i: 900.00ns (0.0%) - Calculate new X_i: 7.30µs (0.0%) - Assemble new core share: 600.00ns (0.0%) - Assemble auxiliary info: 3.00µs (0.0%) - Unstaged: 900.00ns (0.0%) Signing protocol Protocol Performance: - Protocol took 2.41s to complete In particular: - Setup: 28.34ms - Map t-out-of-n protocol to t-out-of-t: 5.60µs (0.0%) - Retrieve auxiliary data: 28.32ms (100.0%) - Precompute execution id and security params: 1.90µs (0.0%) - Setup networking: 5.30µs (0.0%) - Unstaged: 200.00ns (0.0%) - Round 1: 176.02ms - Generate local ephemeral secrets (k_i, y_i, p_i, v_i): 48.00µs (0.0%) - Encrypt G_i and K_i: 50.09ms (28.5%) - Prove ψ0_j: 125.87ms (71.5%) - Unstaged: 10.20µs (0.0%) - Round 2: 59.80µs - Hash received msgs (reliability check): 59.30µs (99.2%) - Unstaged: 500.00ns (0.8%) - Round 3: 1.21s - Assert other parties hashed messages (reliability check): 800.00ns (0.0%) - Verify psi0 proofs: 119.21ms (9.9%) - Sample random r, hat_r, s, hat_s, beta, hat_beta: 78.40µs (0.0%) - Encrypt D_ji: 83.15ms (6.9%) - Encrypt F_ji: 77.33ms (6.4%) - Encrypt hat_D_ji: 94.15ms (7.8%) - Encrypt hat_F_ji: 88.37ms (7.3%) - Prove psi_ji: 298.53ms (24.8%) - Prove psiˆ_ji: 311.36ms (25.8%) - Prove psi_prime_ji : 133.02ms (11.0%) - Unstaged: 1.60µs (0.0%) - Round 4: 885.43ms - Retrieve auxiliary data: 6.90µs (0.0%) - Validate psi: 269.99ms (30.5%) - Validate hat_psi: 281.74ms (31.8%) - Validate psi_prime: 114.14ms (12.9%) - Compute Gamma, Delta_i, delta_i, chi_i: 88.75ms (10.0%) - Prove psi_prime_prime: 130.80ms (14.8%) - Unstaged: 700.00ns (0.0%) - Presig output: 118.85ms - Validate psi_prime_prime: 118.69ms (99.9%) - Calculate presignature: 159.40µs (0.1%) - Unstaged: 1.10µs (0.0%) - Partial signing: 13.40µs - Signature reconstruction: 248.00µs ```