Frost Module logic.

src/ctime_tests.c

@@ -53,6 +53,10 @@
 # pragma GCC diagnostic warning "-Wunused-function"
 #endif
 
+#ifdef ENABLE_MODULE_FROST
+#include "../include/secp256k1_frost.h"
+#endif
+
 static void run_tests(secp256k1_context *ctx, unsigned char *key);
 
 int main(void) {
@@ -361,6 +365,82 @@ static void run_tests(secp256k1_context *ctx, unsigned char *key) {
         CHECK(ret == 0);
     }
 #endif
+
+#ifdef ENABLE_MODULE_FROST
+    {
+        unsigned char thresh_seckey[32];
+        unsigned char secshares[2 * 32];
+        secp256k1_pubkey thresh_pk;
+        secp256k1_pubkey pubshares[2];
+        uint32_t frost_ids[2] = { 0, 1 };
+        secp256k1_frost_tweak_cache cache;
+        secp256k1_frost_secnonce secnonce[2];
+        secp256k1_frost_pubnonce pubnonce[2];
+        const secp256k1_frost_pubnonce *pubnonce_ptrs[2];
+        secp256k1_frost_aggnonce aggnonce;
+        secp256k1_frost_session session;
+        secp256k1_frost_partial_sig partial_sig[2];
+        const secp256k1_frost_partial_sig *partial_sig_ptrs[2];
+        unsigned char session_secrand[2][32];
+
+        pubnonce_ptrs[0] = &pubnonce[0];
+        pubnonce_ptrs[1] = &pubnonce[1];
+        partial_sig_ptrs[0] = &partial_sig[0];
+        partial_sig_ptrs[1] = &partial_sig[1];
+
+        /* All public inputs are derived from defined memory. key is reused as
+         * the base of the (secret) threshold key and session randomness. */
+        SECP256K1_CHECKMEM_DEFINE(key, 32);
+        memcpy(thresh_seckey, key, sizeof(thresh_seckey));
+        thresh_seckey[0] = thresh_seckey[0] + 1;
+        memcpy(session_secrand[0], key, 32);
+        session_secrand[0][0] = session_secrand[0][0] + 2;
+        memcpy(session_secrand[1], key, 32);
+        session_secrand[1][0] = session_secrand[1][0] + 3;
+
+        /* Test frost_trusted_dealer_keygen. The threshold secret key and the
+         * resulting secret shares are secret; the threshold public key and
+         * the public shares are public. */
+        SECP256K1_CHECKMEM_UNDEFINE(thresh_seckey, sizeof(thresh_seckey));
+        ret = secp256k1_frost_trusted_dealer_keygen(ctx, secshares, &thresh_pk, pubshares, 2, 2, thresh_seckey);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+        SECP256K1_CHECKMEM_DEFINE(&thresh_pk, sizeof(thresh_pk));
+        SECP256K1_CHECKMEM_DEFINE(pubshares, sizeof(pubshares));
+
+        /* The session setup uses only public inputs. */
+        CHECK(secp256k1_frost_tweak_cache_init(ctx, &cache, &thresh_pk) == 1);
+        /* Make sure that previous tests don't undefine msg. It's not used as a secret here. */
+        SECP256K1_CHECKMEM_DEFINE(msg, sizeof(msg));
+
+        /* Test frost_nonce_gen. The session randomness and the secret share
+         * are secret; the pubnonce is public. The secnonce stays secret. */
+        for (i = 0; i < 2; i++) {
+            SECP256K1_CHECKMEM_UNDEFINE(session_secrand[i], 32);
+            SECP256K1_CHECKMEM_UNDEFINE(&secshares[32 * i], 32);
+            ret = secp256k1_frost_nonce_gen(ctx, &secnonce[i], &pubnonce[i], session_secrand[i], &secshares[32 * i], &pubshares[i], NULL, msg, 32, NULL, 0);
+            SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+            CHECK(ret == 1);
+            SECP256K1_CHECKMEM_DEFINE(&pubnonce[i], sizeof(pubnonce[i]));
+        }
+
+        CHECK(secp256k1_frost_nonce_agg(ctx, &aggnonce, NULL, pubnonce_ptrs, 2) == 1);
+        CHECK(secp256k1_frost_session_init(ctx, &session, &aggnonce, frost_ids, pubshares, 2, 2, 2, &cache, msg, 32) == 1);
+
+        /* Test frost_sign. The secret share is secret (the secnonce is
+         * tainted through the tainted session randomness; its magic bytes
+         * must remain defined for the validity check). The partial signature
+         * is public. */
+        for (i = 0; i < 2; i++) {
+            SECP256K1_CHECKMEM_UNDEFINE(&secshares[32 * i], 32);
+            ret = secp256k1_frost_sign(ctx, &partial_sig[i], &secnonce[i], &secshares[32 * i], &session, frost_ids, pubshares, 2, frost_ids[i]);
+            SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+            CHECK(ret == 1);
+            SECP256K1_CHECKMEM_DEFINE(&partial_sig[i], sizeof(partial_sig[i]));
+        }
+        CHECK(secp256k1_frost_partial_sig_agg(ctx, sig, NULL, &session, partial_sig_ptrs, 2) == 1);
+    }
+#endif
 }
 
 #if defined(__GNUC__)