Random access for presignatures (#933)

* Random access for presignatures

* docs

Author: jonas-lj

fastcrypto-tbls/src/threshold_schnorr/mod.rs

@@ -279,7 +279,7 @@ mod tests {
             .map(|node| {
                 generate_partial_signatures(
                     message,
-                    presigs.get_mut(&node.id).unwrap(),
+                    presigs.get_mut(&node.id).unwrap().next().unwrap(),
                     &beacon_value,
                     &merged_shares.get(&node.id).unwrap().my_shares,
                     &vk,
@@ -459,7 +459,7 @@ mod tests {
             .map(|node| {
                 generate_partial_signatures(
                     message_2,
-                    presigs.get_mut(&node.id).unwrap(),
+                    presigs.get_mut(&node.id).unwrap().next().unwrap(),
                     &beacon_value,
                     &merged_shares_after_rotation
                         .get(&node.id)
@@ -618,7 +618,7 @@ mod tests {
                 };
                 generate_partial_signatures(
                     message,
-                    presigning,
+                    presigning.next().unwrap(),
                     &beacon_value,
                     &my_shares,
                     &vk_element,
@@ -744,7 +744,7 @@ mod tests {
                 };
                 generate_partial_signatures(
                     message,
-                    presigning,
+                    presigning.next().unwrap(),
                     &beacon_value,
                     &my_shares,
                     &vk_element,

fastcrypto-tbls/src/threshold_schnorr/presigning.rs

@@ -9,15 +9,14 @@ use fastcrypto::error::FastCryptoError::InvalidInput;
 use fastcrypto::error::FastCryptoResult;
 use itertools::Itertools;
 
-/// An iterator that yields presigning tuples (i, t_i, p_i).
+/// An iterator that yields presigning tuples (t_i, p_i).
 pub struct Presignatures {
     secret: Vec<LazyPascalMatrixMultiplier<S>>,
     public: LazyPascalMatrixMultiplier<G>,
-    index: usize,
 }
 
 impl Iterator for Presignatures {
-    type Item = (usize, Vec<S>, G);
+    type Item = (Vec<S>, G);
 
     fn next(&mut self) -> Option<Self::Item> {
         let secret = self
@@ -28,10 +27,7 @@ impl Iterator for Presignatures {
         let public = self.public.next();
 
         match (secret, public) {
-            (Some(s), Some(p)) => {
-                self.index += 1;
-                Some((self.index, s, p))
-            }
+            (Some(s), Some(p)) => Some((s, p)),
             (None, None) => None,
             _ => unreachable!(),
         }
@@ -126,10 +122,6 @@ impl Presignatures {
         );
         assert_eq!(public.len(), expected_len);
 
-        Ok(Self {
-            secret,
-            public,
-            index: 0,
-        })
+        Ok(Self { secret, public })
     }
 }

fastcrypto-tbls/src/threshold_schnorr/signing.rs

@@ -3,17 +3,17 @@
 
 use crate::polynomial::{Eval, Poly};
 use crate::threshold_schnorr::key_derivation::{compute_tweak, derive_verifying_key_internal};
-use crate::threshold_schnorr::presigning::Presignatures;
 use crate::threshold_schnorr::{avss, Address, G, S};
-use fastcrypto::error::FastCryptoError::{InputTooShort, OutOfPresigs};
+use fastcrypto::error::FastCryptoError::InputTooShort;
 use fastcrypto::error::{FastCryptoError, FastCryptoResult};
 use fastcrypto::groups::secp256k1::schnorr::{
     bip0340_hash_to_scalar, SchnorrPublicKey, SchnorrSignature, Tag,
 };
 use fastcrypto::groups::GroupElement;
 use itertools::Itertools;
 
-/// Generate partial threshold Schnorr signatures for a given message using a presigning triple.
+/// Generate partial threshold Schnorr signatures for a given message using a presigning tuple.
+/// The presigning tuple must be taken from a [Presignatures] iterator, the other parties should use the same tuple and one tuple may only be used once.
 /// Returns also the public nonce R.
 ///
 /// The signatures produced follow the BIP-0340 standard (https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
@@ -22,20 +22,16 @@ use itertools::Itertools;
 /// [derive_verifying_key]), and the signature is adjusted accordingly.
 /// The signature will be valid for the derived verifying key.
 ///
-/// Returns an `OutOfPresigs` error if the presignatures iterator is exhausted.
 /// `GeneralOpaqueError` is returned if the generated nonce R is the identity element (should happen only with negligible probability).
 /// `InvalidInput` is returned if the verifying key is the identity element.
 pub fn generate_partial_signatures(
     message: &[u8],
-    presignatures: &mut Presignatures,
+    (mut secret_presigs, public_presig): (Vec<S>, G),
     beacon_value: &S,
     my_signing_key_shares: &avss::SharesForNode,
     verifying_key: &G,
     derivation_address: Option<&Address>,
 ) -> FastCryptoResult<(G, Vec<Eval<S>>)> {
-    // TODO: Each output from an instance of Presigning has a unique index. Perhaps this is needed for coordination?
-    let (_, mut secret_presigs, public_presig) = presignatures.next().ok_or(OutOfPresigs)?;
-
     let r_g = public_presig + G::generator() * beacon_value;
 
     // Since both the public_presig and the beacon_value are random, this should happen only with negligible probability.