feat(sdk-lib-mpc): reject y not co-prime to N

TICKET: WP-132
BitGo · Oct 11, 2023 · eda7812 · eda7812
1 parent 2f8c8cc
commit eda7812
Show file tree

Hide file tree

Showing 2 changed files with 985 additions and 985 deletions.
diff --git a/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts b/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts
@@ -1,6 +1,6 @@
 import { createHash } from 'crypto';
 import { bitLength, randBits, isProbablyPrime } from 'bigint-crypto-utils';
-import { modInv, modPow } from 'bigint-mod-arith';
+import { gcd, modInv, modPow } from 'bigint-mod-arith';
 import { bigIntFromBufferBE, bigIntToBufferBE } from '../../util';
 import { DeserializedPaillierBlumProof } from './types';
 
@@ -33,7 +33,7 @@ function generateY(N, w): bigint[] {
             .update('$')
             .digest()
         );
-        if (y > BigInt(0) && y < N) {
+        if (y > BigInt(0) && y < N && gcd(y, N) === BigInt(1)) {
           return y;
         }
       }
@@ -110,14 +110,13 @@ export async function prove(p: bigint, q: bigint): Promise<DeserializedPaillierB
     y.map(async (y_i, i) => {
       // Select random a_i, b_i so that y_i' = (-1)^{a_i} * w^{b_i} * y is
       // quadratic residue of N using [HOC - Fact 2.137].
-      let t;
-      while (true) {
+      let ab_i, t;
+      for (ab_i = 0; ab_i < 4; ab_i++) {
         t = y_i;
-        ab[i] = (await randBits(2))[0];
-        if (ab[i] & 2) {
+        if (ab_i & 2) {
           t = -t;
         }
-        if (ab[i] & 1) {
+        if (ab_i & 1) {
           t *= w;
         }
         if (
@@ -127,6 +126,7 @@ export async function prove(p: bigint, q: bigint): Promise<DeserializedPaillierB
           break;
         }
       }
+      ab[i] = ab_i;
       return modPow(t, e, N);
     })
   );