Add djordon's security proof to white paper

.doc/install-latex-ubuntu.sh

@@ -1,4 +1,4 @@
 # Update apt
 sudo apt-get update
-# Install LaTeX base and extra packages
-sudo apt-get install texlive texlive-latex-extra
+# Install texlive with minimal extra packages
+sudo apt-get install texlive texlive-latex-extra texlive-science

wsts.tex

@@ -5,12 +5,29 @@
 \usepackage{amsmath}
 \usepackage{amsfonts}
 \usepackage{amssymb}
+\usepackage{amsthm}
 \usepackage{mathtools}
 \usepackage[symbol]{footmisc}
 \usepackage{caption}
 
+\usepackage{enumitem}               % In texlive-latex-extra
+\usepackage[mathcal]{eucal}                  % Changes mathcal script
+\usepackage[english]{babel}         % English blindtext
+\usepackage{tabularx,booktabs}
+\usepackage[operators, sets]{cryptocode}
 \renewcommand{\thefootnote}{\fnsymbol{footnote}}
 
+\newenvironment{setup}[1]{\vspace{1mm}\textbf{#1}:}{\vspace{1mm}}
+
+\newtheorem{thm}{Theorem}[section]
+\newtheorem{lem}[thm]{Lemma}
+
+\theoremstyle{definition}
+\newtheorem{definition}[thm]{Definition}
+
+\theoremstyle{remark}
+\newtheorem{rem}[thm]{Remark}
+
 \newcommand\Set[2]{\{\,#1\mid#2\,\}}
 \newcommand\underoverset[3]{\underset{#1}{\overset{#2}{#3}}}
 
@@ -180,15 +197,19 @@ \subsubsection{
 
 Remember that in polynomial interpolation, you need $k+1$ points to interpolate a degree $k$ polynomial.  FROST specifies a threshold $T$, which is the number of signers necessary to sign a message.  Thus we will need a group polynomial of degree $T-1$ so that any group of $T$ signers will be able to interpolate the key, and thereby sign.  This group polynomial $f$ will be the sum of the party polynomials $f_i$; the group private key $x$ will be $f(0)$, and the group public key $Y$ will be $P(0)$, where $P = f \cdot G$.
 
-First, each party is given a sequential ID $i \in [1, N]$, which will be used both to identify it and as an element in the underlying math.  Next, each party $i$ constructs a random private scalar polynomial $f_i$ of degree $T-1$, where the coefficients are also scalars.  A public DKG share is constructed from $f_i$ by multiplying each coefficient by a generator $G$.  The ID $i$ and public polynomial $P_i$ are then shared to all other parties.
+First, each party is given a sequential ID $i \in [1, N]$, which will be used both for identification and as an element in the underlying math.  Next, each party $i$ constructs a random private scalar polynomial $f_i$ of degree $T-1$, where the coefficients $a_{ij}$ are scalars sampled as such: $a_{ij} \sample \ZZ_p$, $j \in [T]$.  A public DKG share is constructed from $f_i$ by multiplying each coefficient by a generator $G$.  The ID $i$ and public polynomial $P_i$ are then shared to all other parties.
+
+\begin{align}\label{equation:wsts-polynomial}
+f_i(x) = \sum_{j=0}^{t-1} a_{ij}x^j, \qquad P_i(x) = f_{i}(x) \cdot G.
+\end{align}
 
 Each party $i$ evaluates its own $f_i$ at each $j \in [1,N]$, and sends a private DKG share to each consisting of $(j, f_i(j))$.  Each receiving party checks each private share for consistency with the public polynomial of the sending party.  This is done for party $i$ by checking that:
-\begin{align}
+\begin{align}\label{equation:public-commitment-verification}
   \forall j \in [1,N] \ni j \neq i;\;f_j(i) \cdot G = P_j(i)
 \end{align}
 
 Once the private shares are verified, each party $i$ computes its share $s_i$ of the group secret key by summing the private polynomial evaluations at $i$ from all parties, then uses it to construct its public key $Y_i$:
-\begin{align}
+\begin{align}\label{equation:secret-share-definition}
   s_i = \sum_{j=1}^{N} f_j(i) ;\; Y_i = s_i \cdot G
 \end{align}
 
@@ -232,7 +253,6 @@ \subsubsection{
   z_i = d_i + \rho_i \cdot e_i + s_i \cdot c \cdot \lambda_i
 \end{align}
 
-
 \subsubsection{
   Aggregating the Group Signature
 }
@@ -430,7 +450,6 @@ \section{
   \end{tabular}
 \end{center}
 
-
 \section{
   Robustness
 }
@@ -457,7 +476,6 @@ \subsection{
 
 When running a FIRE round with WSTS vs FROST, the only difference is that we must count the number of keys controlled by each party who responds with a nonce in every session.  Only when the sum of keys controlled by the given nonces equals or exceeds $T$ do we form $S_j$ and begin the signing portion of the session.  
 
-
 \subsection{
   ROAST
 }
@@ -533,13 +551,115 @@ \section{
   Security
 }
 
-\subsection{
-  Correctness
-}
+In this section we prove the security of WSTS. We demonstrate
+security of WSTS against the standard notion of existential unforgeability against chosen message attacks (EUF-CMA) by reducing the security of WSTS to the security of FROST, which in turn reduces to the the difficulty of computing the discrete logarithm problem.
+
+\subsection{Adversary Powers}
+
+We take the forger $\mathcal{F}$ to be a routine that with non-negligible probability $\epsilon$ and within a polynomial amount of time $\tau$, can do the following:
+\begin{itemize}
+    \item \textbf{Oracle Access}: \( \mathcal{F} \) can query a signing oracle with messages of their choice and receive valid signatures.
+    \item \textbf{Protocol Participation}: \( \mathcal{F} \) follows WSTS by being a participant to obtain information useful for forgery.
+    \item \textbf{Output}: \( \mathcal{F} \) outputs a pair \((m, \sigma)\), where \(m\) is a message not previously signed by the oracle during \( \mathcal{F} \)'s attack, and \(\sigma\) is a valid signature for \(m\).
+\end{itemize}
+
+When performing its forgery attack, we grant $\mathcal{F}$ the role of the signature aggregator. Without loss of generality, we assume $\mathcal{F}$ controls $C$ compromised participants with combined key share equal to $t-1$, and has full power over how these participants behave, what secret and public values they generate, etc. Moreover, we assume the $t$-th participant controls only one share.
+
+\subsection{From WSTS to FROST}
+
+As mentioned above, our security proof relies on a reduction of WSTS to FROST. To do so, we map configurations of WSTS to configurations of FROST, where a \textbf{configuration} is the total number of participants, the threshold, the number of key IDs, the number of secret keys, and private nonces among the participants.
+
+Before start we introduce a useful definition. Let a \textbf{dummy participant} be a participant where their secret polynomial coefficients and private nonces are all zero. These participants abide by the FROST protocol in every other way.
+
+\begin{lem}[Mapping between WSTS and FROST]\label{lemma:wsts-frost-equivalence}
+    Suppose we are given a valid configuration for $n$ participants in WSTS and $\kappa$ key IDs. Then we can uniquely identify a configuration of FROST with $\kappa$ participants with the following properties:
+    \begin{enumerate}
+        \item the participants have the same secret shares as in the WSTS configuration,
+        \item the first $n$ participants have the same secret polynomial as in WSTS,
+        \item the remaining $\kappa - n$ participants are dummy participants,
+        \item the group private and public keys are the same,
+        \item the group can produce the same valid signature given the same message.
+    \end{enumerate}
+\end{lem}
+
+\begin{proof} 
+Let $t$ denote the threshold, $\kappa > n$ denote the number of key IDs, and $\{ f_i \}_{i\in [1,n]}$ denote the private polynomials of the WSTS participants (the WSTS protocol with $\kappa = n$ is the same as the FROST protocol so we skip it). To find the FROST configuration, we will have $\kappa$ participants. Make the first $n$ participants in the FROST configuration have the same private polynomials as those in the WSTS configuration. The remaining $\kappa - n$ participants are all dummy participants where
+\begin{align}\label{equation:dummy-participant-polynomial}
+    f_i(x) \equiv 0, \qquad i \in [n+1, \kappa].
+\end{align}
+%%
+In the FROST configuration just described, we can compute the group private key as:
+\begin{align}
+    f(0) = \sum_{i=1}^n f_i(0) + \sum_{i = n+1}^\kappa f_i(0) = \sum_{i=1}^n f_i(0),
+\end{align}
+%%
+where we used \eqref{equation:dummy-participant-polynomial} in the final equality. This implies that the public and private key in this FROST configuration is the same as the public and private key in the WSTS configuration.
+
+These dummy participants still send and receive secret shares during DKG. Specifically, they send $(j, f_i(j)) = (j, 0)$ to participant $j$. This implies that the $i$-th participant has secret share
+\begin{align}
+    s_i = \sum_{k=1}^\kappa f_k(i) = \sum_{k=1}^n f_k(i),
+\end{align}
+%%
+which is the same as the secret key share definition for the $i$-th key in WSTS \eqref{equation:secret-share-definition}.
+
+When it comes time to sign message $m$, recall that the signature in WSTS would be
+\begin{align}\label{equation:signature-wsts-appendix}
+    z & = \sum_{i \in S}^{} z_{i} 
+   = \sum_{i \in S}^{} d_{i} + \rho_{i} \cdot e_{i} + c \cdot \sum_{k \in K_i}^{} \lambda_{k} \cdot s_{k}
+\end{align}
+%%
+where $S$ is the signing set, $d_i$ and $e_i$ are private nonces, $K_i$ is the key ID set for participant $i$, $\rho_i$ is a hash of the message with identifier $i$ and the nonces \eqref{equation:message-participant-hash}, and $c$ is a hash of the message with the public key \eqref{equation:message-public-key-hash}. Luckily, equation \eqref{equation:signature-wsts-appendix} tells us who to include in the signature on the FROST side to generate the same signature. Specifically, we select the participants in $S$, along with the dummy participants identified by the key IDs in $\bigcup_{i \in S} K_i$. These dummy participants do not contribute to the $\sum_{i \in S}^{} d_{i} + \rho_{i} \cdot e_{i}$ portion of the signature in \eqref{equation:signature-wsts-appendix}, since their private nonces are zero. Thus the FROST signature is:
+\begin{align}\label{equation:signature-frost-appendix}
+    % z & %= \sum_{i \in S_{}}^{} z_{i} 
+   \underbrace{\sum_{i \in S}^{} d_{i} + \rho_{i} \cdot e_{i} + c \cdot \lambda_{i} \cdot s_{i}}_{\text{From normal participants}} + \underbrace{\sum_{k \in K_i - \{i\}}^{} c \cdot \lambda_{k} \cdot s_{k}}_{\text{From dummy participants}},
+\end{align}
+%%
+where we assumed WLOG that $K_i = \{ i \} \cup K_i^{\prime}$ with $K_i^\prime \subset [n + 1, \kappa]$. Since the signature \eqref{equation:signature-wsts-appendix} is identical to the one generated in WSTS, \eqref{equation:wsts-signature-definition}, the proof is complete.
+\end{proof}
+
+\begin{rem}
+    We can place further restrictions on our dummy participants. Suppose dummy participants:
+    \begin{enumerate}
+        \item Did not send polynomial commitments and secret shares during DKG (since they're all zero anyway).
+        \item Sent in secret signing shares whenever participants $i$ sent in secret signing shares, for some fixed $i \in [1, n]$.
+    \end{enumerate}
+    In this case we would see by Lemma~\ref{lemma:wsts-frost-equivalence} that WSTS with $n$ participants, threshold $t$, and key distribution $\{K_i\}_{i\in [1,n]}$ is really just FROST with $n$ regular participants and $\kappa - n$ dummy participants, where regular participant $i$ controls dummy participants with IDs in $K_i - \{ i\}$. The security of WSTS relies on the fact that FROST is $(\tau, \epsilon)$-unforgeable even if an adversary controlled $\kappa - 1$ participants, assuming the discrete logarithm problem is $(\tau, \epsilon)$-hard. 
+    %A FROST adversary with control over $\kappa - 1$ keys could always simulate WSTS.
+\end{rem}
+
+\subsection{EUF-CMA proof of WSTS}
+
+We say a problem is $(\tau, \epsilon)$-hard if, with probability $\epsilon$, it takes $\tau$ amount of time to compute. We now give a security proof of WSTS. When we say WSTS or FROST is $(\tau, \epsilon)$-secure, we are saying that with probability $\epsilon$ it takes $\tau$ amount of time to compute a forgery of a signature of a chosen message.
+
+\begin{thm}[EUF-CMA of WSTS]
+    Assume the discrete logarithm problem is $(\tau, \epsilon)$-hard. Then WSTS is $(\tau, \epsilon)$-secure if and only if FROST is $(\tau, \epsilon)$-secure.
+\end{thm}
+
+\begin{proof}
+Suppose WSTS is $(\tau, \epsilon)$-secure. Then WSTS where the key sets are $K_i = \{i\}$ would be $(\tau, \epsilon)$-secure. Since this protocol is FROST, we see that FROST is $(\tau, \epsilon)$-secure.
+
+The proof that FROST being $(\tau, \epsilon)$-secure implies WSTS being $(\tau, \epsilon)$-secure is a proof by contradiction. Suppose there exists a forger $\mathcal{F}$ for WSTS where there are $n$ participants and some distribution of key IDs $\{ K_i\}_{i\in [1, n]}$, and threshold $\kappa$, where the forger controlled the participants identified by the set $C$ with a total of $\sum_{i \in C}|K_i| \leq \kappa - 1$ keys. That is, assume $\mathcal{F}$ could construct a forgery $\sigma$ for a public key $Y$ with a chosen message $m$ with probability $\epsilon$ and time $\tau$ but does not control the threshold of secret shares. Furthermore, assume the stipulations in the adversary powers section for the forger.
+
+\begin{setup}{Step 1}
+    Setup the FROST topology for $\mathcal{F}^\prime$.
+\end{setup}
+
+Construct $\kappa$ participants in a FROST protocol with threshold $\kappa$ and give an adversary control of $\kappa - 1$ participants. We now define how a forger $\mathcal{F}^\prime$ for a FROST configuration that could generate a forgery with the same effort as the WSTS forger.
+
+\begin{setup}{Step 2}
+    Distributed Key Generation (DKG) under $\mathcal{F}^\prime$.
+\end{setup}
+
+The FROST forger $\mathcal{F}^\prime$ is a routine that takes the same inputs as the WSTS forger $\mathcal{F}$, including the particular WSTS setup that $\mathcal{F}$ needs. $\mathcal{F}^\prime$ first supplies these inputs into $\mathcal{F}$ to do WSTS DKG. It then use Lemma~\ref{lemma:wsts-frost-equivalence} to construct a FROST configuration that is analogous to the WSTS forger's configuration. Afterwards, the FROST forger $\mathcal{F}^\prime$ has access to the same secret shares and the same public key as the WSTS forger.
 
-In Sections 4.4.1 and 2.7.5, we show how WSTS and FROST reduce to a Schnorr proof.  This is sufficient to show correctness.  
+\begin{setup}{Step 3}
+    $\mathcal{F}^\prime$ forges a signature.
+\end{setup}
 
+We must detail the routine that generates a forgery of a signature in our chosen FROST configuration. Luckily, we have routine that forges signatures, namely $\mathcal{F}$. It takes as input the private key shares it controls, private nonces, the public key, an oracle producing valid signatures, and can produce a valid signature for message $m$ of it's choice. It does this using the information under it's control and by interacting with the participant(s) not within its control. Since $\mathcal{F}^\prime$ has access to the same information (by Lemma~\ref{lemma:wsts-frost-equivalence}) and interacts with the participant(s) not within its control in the same way (since WSTS is a derivative of FROST), it can carry out the same procedure as $\mathcal{F}$ to forge a signature.
 
+Thus we have constructed a FROST forger that $(\tau, \epsilon)$-breaks the unforgeability property of FROST. This violates Theorem \cite[\S A.2]{frost}, yielding the desired contradiction.
+\end{proof}
 
 \end{document}