HIP-1398: TSS ceremony

[rsinha]

Description:
This HIP specifies the TSS ceremony operations, which is necessary to perform TSS operations (as specified in HIP-1200).

[jsync-swirlds]

Thanks for putting this together.
Just a few minor comments.

[Neurone]

I suggest this change for the HIP to highlight we can potentially include selected community members in the TSS ceremony process.

[dmueller2001]

The link to the Hedera Cryptography repository for the reference implementation is broken, is this not yet a public repo? @rsinha

[dmueller2001]

Request for further governance / participation clarification

The HIP states that the ceremony will be executed by “the council members — specifically, those council members that also run consensus nodes.” However, the participation model is not fully specified. It would be helpful to clarify the intended governance and participation requirements for the ceremony.

In particular:

• Is participation expected from all eligible council members running consensus nodes, or is participation optional?
• Is there a minimum number of contributors required for the ceremony to be considered valid?
• What happens operationally if some eligible participants decline or are unavailable during the ceremony window?
• Are contributors limited strictly to council-operated nodes, or can additional participants contribute entropy?
• Is there a role for independent observers or auditors in verifying the ceremony transcript?

Since the security model relies on the assumption that at least one participant contributes honest randomness and deletes their secret material, clearly specifying the eligibility and quorum expectations for contributors would strengthen the operational clarity of the proposal.

Additionally, it would be helpful to clarify how this ceremony applies to third-party deployments of a Hiero-ledger–based network.

For example:

• If an organization deploys its own (possibly private) network based on Hiero Ledger, is running a TSS ceremony required?
• Can such deployments reuse the parameters generated by this ceremony, or are they expected to run their own ceremony?
• If they must run their own ceremony, what guidance or tooling is expected to support that process?

Clarifying the intended model for downstream or private deployments would help ensure that the specification is usable by implementers beyond the initial network environment.

[rsinha]

The link to the Hedera Cryptography repository for the reference implementation is broken, is this not yet a public repo? @rsinha

It is not yet public. We are working towards making it public.

[jsync-swirlds]

Request for further governance / participation clarification

• Is participation expected from all eligible council members running consensus nodes, or is participation optional?

The consensus node servers will run the software autonomously. Participation means letting their servers run as normal.

• Is there a minimum number of contributors required for the ceremony to be considered valid?

As long as at least 1 honest entity participates in the ceremony, the result is valid.
We will rerun the ceremony if we do not have results from more than 1/3 of active nodes.

• What happens operationally if some eligible participants decline or are unavailable during the ceremony window?

The software automatically times out if a prior node does not produce output and continues the ceremony without that node.

• Are contributors limited strictly to council-operated nodes, or can additional participants contribute entropy?

We are looking into options for a selected number of additional participants. @Neurone is working on that process.

• Is there a role for independent observers or auditors in verifying the ceremony transcript?

Yes, all inputs and outputs will be public and independent observers are welcome and encouraged to verify the integrity and validity of the result.

• If an organization deploys its own (possibly private) network based on Hiero Ledger, is running a TSS ceremony required?
• Can such deployments reuse the parameters generated by this ceremony, or are they expected to run their own ceremony?
• If they must run their own ceremony, what guidance or tooling is expected to support that process?

This should be clear in the text (if not, we need to add this). All Hiero networks can use the output of this one ceremony without any reduction in cryptographic quality or security. There is no requirement nor expectation that any entity will repeat this ceremony.
Any given Hiero network could choose to run the ceremony, and I agree that we should provide some helpful documentation to assist in that if anyone wishes to do so. That's beyond the scope of the HIP, but I'll bring that suggestion to the team for follow-up.