merge queue: embarking main (7c8a872) and [#493 + #496] together

frost-core/src/frost/round1.rs

@@ -207,6 +207,12 @@ pub struct SigningNonces<C: Ciphersuite> {
     pub(crate) hiding: Nonce<C>,
     /// The binding [`Nonce`].
     pub(crate) binding: Nonce<C>,
+    /// The commitments to the nonces. This is precomputed to improve
+    /// sign() performance, since it needs to check if the commitments
+    /// to the participant's nonces are included in the commitments sent
+    /// by the Coordinator, and this prevents having to recompute them.
+    #[zeroize(skip)]
+    pub(crate) commitments: SigningCommitments<C>,
 }
 
 impl<C> SigningNonces<C>
@@ -221,12 +227,26 @@ where
     where
         R: CryptoRng + RngCore,
     {
-        // The values of 'hiding' and 'binding' must be non-zero so that commitments are
-        // not the identity.
         let hiding = Nonce::<C>::new(secret, rng);
         let binding = Nonce::<C>::new(secret, rng);
 
-        Self { hiding, binding }
+        Self::from_nonces(hiding, binding)
+    }
+
+    /// Generates a new [`SigningNonces`] from a pair of [`Nonce`]. This is
+    /// useful internally since [`SigningNonces`] precompute the respective
+    /// commitments.
+    #[cfg_attr(test, visibility::make(pub))]
+    pub(crate) fn from_nonces(hiding: Nonce<C>, binding: Nonce<C>) -> Self {
+        let hiding_commitment = (&hiding).into();
+        let binding_commitment = (&binding).into();
+        let commitments = SigningCommitments::new(hiding_commitment, binding_commitment);
+
+        Self {
+            hiding,
+            binding,
+            commitments,
+        }
     }
 
     /// Gets the hiding [`Nonce`]
@@ -295,11 +315,7 @@ where
     C: Ciphersuite,
 {
     fn from(nonces: &SigningNonces<C>) -> Self {
-        Self {
-            hiding: nonces.hiding.clone().into(),
-            binding: nonces.binding.clone().into(),
-            ciphersuite: (),
-        }
+        nonces.commitments
     }
 }
 

frost-core/src/frost/round2.rs

@@ -11,8 +11,6 @@ use crate::{
 #[cfg(feature = "serde")]
 use crate::ScalarSerialization;
 
-use super::round1::SigningCommitments;
-
 // Used to help encoding a SignatureShare. Since it has a Scalar<C> it can't
 // be directly encoded with serde, so we use this struct to wrap the scalar.
 #[cfg(feature = "serde")]
@@ -195,10 +193,8 @@ pub fn sign<C: Ciphersuite>(
         .get(&key_package.identifier)
         .ok_or(Error::MissingCommitment)?;
 
-    let signing_commitments = SigningCommitments::from(signer_nonces);
-
     // Validate if the signer's commitment exists
-    if &signing_commitments != commitment {
+    if &signer_nonces.commitments != commitment {
         return Err(Error::IncorrectCommitment);
     }
 

frost-core/src/signing_key.rs

@@ -28,9 +28,14 @@ where
     pub fn deserialize(
         bytes: <<C::Group as Group>::Field as Field>::Serialization,
     ) -> Result<SigningKey<C>, Error<C>> {
-        <<C::Group as Group>::Field as Field>::deserialize(&bytes)
-            .map(|scalar| SigningKey { scalar })
-            .map_err(|e| e.into())
+        let scalar =
+            <<C::Group as Group>::Field as Field>::deserialize(&bytes).map_err(Error::from)?;
+
+        if scalar == <<C::Group as Group>::Field as Field>::zero() {
+            return Err(Error::MalformedSigningKey);
+        }
+
+        Ok(Self { scalar })
     }
 
     /// Serialize `SigningKey` to bytes

frost-core/src/tests/ciphersuite_generic.rs

@@ -6,12 +6,20 @@ use std::{
 
 use crate::{
     frost::{self, Identifier},
-    Error, Field, Group, Signature, VerifyingKey,
+    Error, Field, Group, Signature, SigningKey, VerifyingKey,
 };
 use rand_core::{CryptoRng, RngCore};
 
 use crate::Ciphersuite;
 
+/// Test if creating a zero SigningKey fails
+pub fn check_zero_key_fails<C: Ciphersuite>() {
+    let zero = <<<C as Ciphersuite>::Group as Group>::Field>::zero();
+    let encoded_zero = <<<C as Ciphersuite>::Group as Group>::Field>::serialize(&zero);
+    let r = SigningKey::<C>::deserialize(encoded_zero);
+    assert_eq!(r, Err(Error::MalformedSigningKey));
+}
+
 /// Test share generation with a Ciphersuite
 pub fn check_share_generation<C: Ciphersuite, R: RngCore + CryptoRng>(mut rng: R) {
     let secret = crate::SigningKey::<C>::new(&mut rng);

frost-core/src/tests/vectors.rs

@@ -96,10 +96,10 @@ pub fn parse_test_vectors<C: Ciphersuite>(json_vectors: &Value) -> TestVectors<C
             hex::decode(signer["binding_nonce_randomness"].as_str().unwrap()).unwrap();
         binding_nonces_randomness.insert(identifier, binding_nonce_randomness);
 
-        let signing_nonces = SigningNonces::<C> {
-            hiding: Nonce::<C>::from_hex(signer["hiding_nonce"].as_str().unwrap()).unwrap(),
-            binding: Nonce::<C>::from_hex(signer["binding_nonce"].as_str().unwrap()).unwrap(),
-        };
+        let signing_nonces = SigningNonces::<C>::from_nonces(
+            Nonce::<C>::from_hex(signer["hiding_nonce"].as_str().unwrap()).unwrap(),
+            Nonce::<C>::from_hex(signer["binding_nonce"].as_str().unwrap()).unwrap(),
+        );
 
         signer_nonces.insert(identifier, signing_nonces);
 

frost-ed25519/tests/integration_tests.rs

@@ -3,6 +3,11 @@ use lazy_static::lazy_static;
 use rand::thread_rng;
 use serde_json::Value;
 
+#[test]
+fn check_zero_key_fails() {
+    frost_core::tests::ciphersuite_generic::check_zero_key_fails::<Ed25519Sha512>();
+}
+
 #[test]
 fn check_sign_with_dkg() {
     let rng = thread_rng();

frost-ed448/tests/integration_tests.rs

@@ -3,6 +3,11 @@ use lazy_static::lazy_static;
 use rand::thread_rng;
 use serde_json::Value;
 
+#[test]
+fn check_zero_key_fails() {
+    frost_core::tests::ciphersuite_generic::check_zero_key_fails::<Ed448Shake256>();
+}
+
 #[test]
 fn check_sign_with_dkg() {
     let rng = thread_rng();

frost-p256/tests/integration_tests.rs

@@ -3,6 +3,11 @@ use lazy_static::lazy_static;
 use rand::thread_rng;
 use serde_json::Value;
 
+#[test]
+fn check_zero_key_fails() {
+    frost_core::tests::ciphersuite_generic::check_zero_key_fails::<P256Sha256>();
+}
+
 #[test]
 fn check_sign_with_dkg() {
     let rng = thread_rng();

frost-ristretto255/tests/integration_tests.rs

@@ -3,6 +3,11 @@ use lazy_static::lazy_static;
 use rand::thread_rng;
 use serde_json::Value;
 
+#[test]
+fn check_zero_key_fails() {
+    frost_core::tests::ciphersuite_generic::check_zero_key_fails::<Ristretto255Sha512>();
+}
+
 #[test]
 fn check_sign_with_dkg() {
     let rng = thread_rng();

frost-secp256k1/tests/integration_tests.rs

@@ -3,6 +3,11 @@ use lazy_static::lazy_static;
 use rand::thread_rng;
 use serde_json::Value;
 
+#[test]
+fn check_zero_key_fails() {
+    frost_core::tests::ciphersuite_generic::check_zero_key_fails::<Secp256K1Sha256>();
+}
+
 #[test]
 fn check_sign_with_dkg() {
     let rng = thread_rng();