Distributed Key Generation

FROST, Gennaro, and 2-party Gennaro DKG — interactive protocols that produce a signing key no single participant ever holds.

DKG replaces the trusted dealer. Instead of one process splitting a key it already has, every participant samples its own contribution, publishes a verifiable commitment to it, and privately sends one share to each peer. The joint signing key is the sum of every contribution; each party ends up holding a Shamir share of that sum plus the joint public key. The key itself is never assembled — not during generation, and not during signing.

Three protocols live here, and they are not interchangeable.

FROST DKG — dkg/frost

Two rounds, implementing the DKG half of eprint 2020/852 (the citation is in the package doc comment). Each participant runs Feldman VSS on its own secret and attaches a Schnorr proof of knowledge of the constant coefficient, which is what stops a participant from biasing the joint key by choosing its contribution after seeing everyone else’s.

import (
	"github.com/sonr-io/crypto/core/curves"
	"github.com/sonr-io/crypto/dkg/frost"
	"github.com/sonr-io/crypto/sharing"
)

func twoPartyFrostDkg() error {
	curve := curves.ED25519()
	ctx := "1" // see the ctx warning below

	// Each participant knows its own id and the ids of all the others.
	p1, err := frost.NewDkgParticipant(1, 2, ctx, curve, 2)
	if err != nil {
		return err
	}
	p2, err := frost.NewDkgParticipant(2, 2, ctx, curve, 1)
	if err != nil {
		return err
	}

	// --- Round 1 --------------------------------------------------------
	bcast1, p2pSend1, err := p1.Round1(nil) // nil => sample a fresh secret
	if err != nil {
		return err
	}
	bcast2, p2pSend2, err := p2.Round1(nil)
	if err != nil {
		return err
	}

	// Broadcasts go to everyone, keyed by SENDER id, and include your own.
	bcast := map[uint32]*frost.Round1Bcast{1: bcast1, 2: bcast2}

	// P2P inputs are keyed by SENDER id too: p2p1[2] is what participant 2
	// sent to participant 1, i.e. p2pSend2[1].
	p2p1 := map[uint32]*sharing.ShamirShare{2: p2pSend2[1]}
	p2p2 := map[uint32]*sharing.ShamirShare{1: p2pSend1[2]}

	// --- Round 2 --------------------------------------------------------
	if _, err = p1.Round2(bcast, p2p1); err != nil {
		return err
	}
	if _, err = p2.Round2(bcast, p2p2); err != nil {
		return err
	}

	// p1.SkShare, p1.VkShare, p1.VerificationKey are now populated,
	// and p1.VerificationKey == p2.VerificationKey.
	_ = p1.SkShare
	return nil
}

Result fields

The SkShare values are ordinary Shamir shares of the joint key, so sharing.NewShamir(t, n, curve).Combine(...) over {Id, SkShare.Bytes()} pairs reconstructs it — which the package’s own test does to prove correctness, and which production code should never do.

Transport

Round1Result bundles the two halves of round 1 for one recipient:

result := &frost.Round1Result{Broadcast: bcast1, P2P: p2pSend1[2]}
wire, err := result.Encode() // gob
// ...
decoded := &frost.Round1Result{}
err = decoded.Decode(wire)

Encode uses encoding/gob and registers the concrete commitment point and Ci scalar types on each call. There is no matching helper for round 2 — serialise Round2Bcast yourself.

Gennaro DKG — dkg/gennaro

Four rounds, implementing the DKG of eprint 2020/540 (cited in the package doc). The extra rounds buy a two-phase VSS that FROST’s single Feldman pass does not provide.

import (
	"math/big"

	"github.com/btcsuite/btcd/btcec/v2"

	"github.com/sonr-io/crypto/core/curves"
	"github.com/sonr-io/crypto/dkg/gennaro"
)

func twoPartyGennaroDkg() error {
	// The blinding generator for Pedersen VSS. Must have unknown discrete log
	// w.r.t. the base point in real use — this fixed multiple is test-only.
	generator, err := curves.NewScalarBaseMult(btcec.S256(), big.NewInt(3333))
	if err != nil {
		return err
	}

	p1, err := gennaro.NewParticipant(1, 2, generator, curves.NewK256Scalar(), 2)
	if err != nil {
		return err
	}
	p2, err := gennaro.NewParticipant(2, 2, generator, curves.NewK256Scalar(), 1)
	if err != nil {
		return err
	}

	// Round 1
	bcast1, p2pSend1, err := p1.Round1(nil)
	if err != nil {
		return err
	}
	bcast2, p2pSend2, err := p2.Round1(nil)
	if err != nil {
		return err
	}
	bcast := map[uint32]gennaro.Round1Bcast{1: bcast1, 2: bcast2}
	p2p1 := map[uint32]*gennaro.Round1P2PSendPacket{2: p2pSend2[1]}
	p2p2 := map[uint32]*gennaro.Round1P2PSendPacket{1: p2pSend1[2]}

	// Round 2
	r2out1, err := p1.Round2(bcast, p2p1)
	if err != nil {
		return err
	}
	r2out2, err := p2.Round2(bcast, p2p2)
	if err != nil {
		return err
	}
	round3Input := map[uint32]gennaro.Round2Bcast{1: r2out1, 2: r2out2}

	// Round 3 — yields the joint public key and this party's secret share
	pubKey1, share1, err := p1.Round3(round3Input)
	if err != nil {
		return err
	}
	if _, _, err = p2.Round3(round3Input); err != nil {
		return err
	}

	// Round 4 — public shares for tECDSA signing (idempotent)
	publicShares1, err := p1.Round4()
	if err != nil {
		return err
	}
	_, _, _ = pubKey1, share1, publicShares1
	return nil
}

2-party Gennaro — dkg/gennaro2p

A façade over dkg/gennaro specialised for the 2-of-2 case. Its package doc states the simplification directly: no distinction between broadcast and peer messages, and only the counterparty’s message is used as round input because self-inputs are always ignored.

import (
	"github.com/btcsuite/btcd/btcec/v2"

	"github.com/sonr-io/crypto/core/curves"
	"github.com/sonr-io/crypto/dkg/gennaro2p"
)

func twoPartyDkg() (*gennaro2p.DkgResult, *gennaro2p.DkgResult, error) {
	curve := btcec.S256()
	scalar := curves.NewK256Scalar()

	// Passing nil blind makes the client generate a secure blinding generator.
	client, err := gennaro2p.NewParticipant(1, 2, nil, scalar, curve)
	if err != nil {
		return nil, nil, err
	}

	// Round 1 carries the blind, so the server can adopt the client's.
	clientR1, err := client.Round1(nil)
	if err != nil {
		return nil, nil, err
	}

	server, err := gennaro2p.NewParticipant(2, 1, clientR1.Blind, scalar, curve)
	if err != nil {
		return nil, nil, err
	}
	serverR1, err := server.Round1(nil)
	if err != nil {
		return nil, nil, err
	}

	// Round 2 consumes the *counterparty's* round 1 output.
	clientR2, err := client.Round2(serverR1)
	if err != nil {
		return nil, nil, err
	}
	serverR2, err := server.Round2(clientR1)
	if err != nil {
		return nil, nil, err
	}

	// Finalize consumes the counterparty's round 2 output.
	clientResult, err := client.Finalize(serverR2)
	if err != nil {
		return nil, nil, err
	}
	serverResult, err := server.Finalize(clientR2)
	if err != nil {
		return nil, nil, err
	}
	return clientResult, serverResult, nil
}

Caveats

Next