From eda7812b8b426411a024608381c8dab732db61d2 Mon Sep 17 00:00:00 2001 From: John Driscoll Date: Wed, 11 Oct 2023 12:31:51 -0500 Subject: [PATCH] feat(sdk-lib-mpc): reject y not co-prime to N TICKET: WP-132 --- .../src/tss/ecdsa/paillierBlumProof.ts | 14 +- .../test/fixtures/mockPaillierBlumProof.json | 1956 ++++++++--------- 2 files changed, 985 insertions(+), 985 deletions(-) diff --git a/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts b/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts index 9ba74a5507..a17417b417 100644 --- a/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts +++ b/modules/sdk-lib-mpc/src/tss/ecdsa/paillierBlumProof.ts @@ -1,6 +1,6 @@ import { createHash } from 'crypto'; import { bitLength, randBits, isProbablyPrime } from 'bigint-crypto-utils'; -import { modInv, modPow } from 'bigint-mod-arith'; +import { gcd, modInv, modPow } from 'bigint-mod-arith'; import { bigIntFromBufferBE, bigIntToBufferBE } from '../../util'; import { DeserializedPaillierBlumProof } from './types'; @@ -33,7 +33,7 @@ function generateY(N, w): bigint[] { .update('$') .digest() ); - if (y > BigInt(0) && y < N) { + if (y > BigInt(0) && y < N && gcd(y, N) === BigInt(1)) { return y; } } @@ -110,14 +110,13 @@ export async function prove(p: bigint, q: bigint): Promise { // Select random a_i, b_i so that y_i' = (-1)^{a_i} * w^{b_i} * y is // quadratic residue of N using [HOC - Fact 2.137]. - let t; - while (true) { + let ab_i, t; + for (ab_i = 0; ab_i < 4; ab_i++) { t = y_i; - ab[i] = (await randBits(2))[0]; - if (ab[i] & 2) { + if (ab_i & 2) { t = -t; } - if (ab[i] & 1) { + if (ab_i & 1) { t *= w; } if ( @@ -127,6 +126,7 @@ export async function prove(p: bigint, q: bigint): Promise