zkdkg

README

zk-dkg

A zero knowledge library for Neo X's Anti-MEV key generation in Geth node.

This library is only designed and implemented for Neo X's Anti-MEV, using this in any other use case may import potential security risks. E.g. the code doesn't compute a GCM tag for message authorization, because related check is ensure at smart contract level. So please evaluate carefully before referring to this library.

Provided Methods

zkdkg.circuit provides:

• Transform key shares to different type formats and encrypt them: PrepareEncryptedKeyShares;
• Circuits AES256, ECIES and BatchEncryption;
• Compute witness for key share encryption: ComputeSingleKeyShareEncryptionAssignment;
• Compute witness for a batch of key share encryption: ComputeMultipleKeyShareEncryptionAssignment.

zkdkg.ecies provides:

• ECIES encryption: ECIESEncrypt;
• ECIES decryption: ECIESDecrypt.

zkdkg.helper provides:

• Proof generation: ComputeProof;
• Export Solidity contracts: ExportContract;
• Export contracts inputs: GetOutputData;
• MPC parameter reader: GetInitParamsFromExistedMPCSetUp.

For easy of use, zkdkg provides:

• Compute a zk proof and witness for single DKG key share encryption: ProveSingleKeyShareEncryption;
• Compute a zk proof and witness for a batch of DKG key share encryption: ProveMultipleKeyShareEncryption.

Examples

• Single proof: TestECIESCircuit and TestECIESWithMPC;
• Batch proof: TestBatchEncryptionCircuit and TestBatchEncryptionWithMPC.

MPC usage process

Stage 1:

1. go run mpccmd.go phase1 init --output <phase1 file path>, this command is used to generate the phase1 initial file;
2. go run mpccmd.go phase1 contribute --phase1file <prev phase1 file path> --output <curr phase1 file path>, this command is used by participants in this round to calculate phase1 data;
3. go run mpccmd.go phase1 verify --phase1file <prev phase1 file path> --output <curr phase1 file path>, this command is used by other participants to verify phase1 data.

Repeat steps 2-3 in a loop until all participants complete the calculation and verification work of phase1.

Stage 1.5:

• go run mpccmd.go phase1 seal --phase1file <filepath> --beacon <string> --output <filepath>, this command is used to output SRS parameters for Stage 2 initialization.

Stage 2:

1. go run mpccmd.go phase2 init --srsfile <filepath> --output <phase2 file path> --batch <batch size>, this command is used to generate the phase2 initial file;
2. go run mpccmd.go phase2 contribute --phase2file <prev phase2 file path> --output <curr phase2 file path>, this command is used by participants in this round to calculate phase2 data;
3. go run mpccmd.go phase2 verify --phase2file <prev phase2 file path> --output <curr phase2 file path>, this command is used by other participants to verify phase2 data.

Repeat steps 2-3 in a loop until all participants complete the calculation and verification work of phase2.

Export contract:

• go run mpccmd.go seal --batch <size> --srsfile <filepath> --phase2file <filepath> --beacon <string> --contract <filepath> --provingkey <filepath> --verifyingkey <filepath> --r1cs <filepath>, this command is used to export verification contracts after mpc has completed.

Note: The beacon challenge used in MPC sealing should only be evaluated after the final contribution, for its detail, please ref gnark comment and https://a16zcrypto.com/posts/article/public-randomness-and-randomness-beacons/. Some external-and-unpredictable variable before time t is preferred, e.g. the block hash of some Bitcoin/Ethereum after time t, so that the value can work as an entropy.

Documentation

Index

• func ProveMultipleKeyShareEncryption(css constraint.ConstraintSystem, provingKey *groth16.ProvingKey, ...) (*groth16.Proof, witness.Witness, error)
• func ProveSingleKeyShareEncryption(css constraint.ConstraintSystem, provingKey *groth16.ProvingKey, ...) (*groth16.Proof, witness.Witness, error)

Functions

func ProveMultipleKeyShareEncryption

func ProveMultipleKeyShareEncryption(css constraint.ConstraintSystem, provingKey *groth16.ProvingKey, sender [20]byte, pubKey []*ecies.PublicKey, rs []*big.Int, fisInts []*big.Int, encryptedFis [][]byte, nonces [][]byte) (*groth16.Proof, witness.Witness, error)

*

• Function: ProveMultipleKeyShareEncryption
• @Description: generate a zk proof of a key share batch generating process
• @param css: compiled circuit constraint system
• @param provingKey: proving key used for proof encryption
• @param sender: the sender address as identifier
• @param pubKey: a set of public keys used for key share encryption
• @param rs: a set of the integer format of random numbers
• @param fisBytes: a set of the serialization format of the keys
• @param fisInts: a set of the integer format of the keys
• @param encryptedFis: a set of encrypted key shares
• @param nonces: a set of salt
• @return proof: zk proof
• @return witness: witness of zk proof
• @return err:

func ProveSingleKeyShareEncryption

func ProveSingleKeyShareEncryption(css constraint.ConstraintSystem, provingKey *groth16.ProvingKey, sender [20]byte, pubKey *ecies.PublicKey, r *big.Int, fiInt *big.Int, encryptedFi []byte, nonce []byte) (*groth16.Proof, witness.Witness, error)

*

• Function: ProveSingleKeyShareEncryption
• @Description: generate a zk proof of a key share generating process
• @param css: compiled circuit constraint system
• @param provingKey: proving key used for proof encryption
• @param sender: the sender address as identifier
• @param pubKey: public key used for key share encryption
• @param r: the integer format of random number
• @param fiBytes: the key share in a byte array
• @param fiInt: the integer format of the key share
• @param encryptedFi: the encrypted key share
• @param nonce: salt
• @return proof: zk proof
• @return witness: witness of zk proof
• @return err: