multisig-labs / multi-party-sig

Implementation of protocols for threshold signatures
Apache License 2.0
4 stars 2 forks source link

Missing proof in round 3 of key generation #9

Closed 0xJohnnyGault closed 2 years ago

0xJohnnyGault commented 2 years ago

Audit: KS-SBCF-F-02

Location: protocols/cmp/keygen/round3.go, Taurus specification.

Description:

According to Canetti et al. p.24, Figure 6, Round 3, Step 2 [2] the proof fac is performed. However, in the Taurus specification this proof is not created [1]. The fac proof or β€œno small factor proof” allows a party to prove that the Paillier modulus 𝑁 = 𝑝 β‹… π‘ž contains 𝑝, π‘ž > 2𝑙 . According to the paper section 6.4.1, the β€˜fac proof prevents then small values close to zero to have noticeably more weight than other values, modulo πœ™(𝑁̂) Also, if the other parties could recover her Paillier private key and all the shares of the affected party are sent to the broadcast channel, they could be decrypted by other parties, thus having access to one share of the secret. This would be equivalent to compromise the affected party and steal his share of the secret key.

Recommendation: We recommend to not deviate from protocol specifications.