This release focuses on enhancing security, improving performance, and refining the API for better usability and robustness. It addresses several potential vulnerabilities and incorporates feedback from the alpha testing phase.
**Key Changes and Improvements:**
Security Enhancements
* **`hash_to_group` Bias Mitigation:**
* Increased the maximum attempts for rejection sampling in `hash_to_group` from 100 to 1000. This significantly reduces the already slight statistical bias introduced by the fallback modular reduction, making it even more negligible.
* **Enhanced Domain Separation in Hashing:**
* Replaced length-prefixed encoding in `_enhanced_encode_for_hash` with a more robust scheme that includes type tagging. This scheme explicitly encodes the type of each input (bytes, string, int/mpz) *before* its length, providing stronger domain separation. This prevents a wider range of potential collision attacks.
* **Deserialization Validation Improvements:**
* `deserialize_commitments` and `deserialize_commitments_with_proof` now include significantly more rigorous validation checks:
* **Generator Validation:** Verifies that the deserialized generator is within the valid range (1 < generator < prime - 1) and that it's a valid generator for the given prime. For safe primes, it checks `g^q != 1 mod p`, where `q = (p-1)/2`.
* **Commitment and Randomizer Range Checks:** Ensures all deserialized commitment and randomizer values are within the expected range [0, prime-1].
* **Commitment Structure Validation:** Confirms each commitment has the correct structure: `(commitment, randomizer)` or `(commitment, randomizer, extra_entropy)`.
* **Proof Structure Validation (for `deserialize_commitments_with_proof`):** Adds comprehensive checks for the presence and correct types of all required fields within the deserialized proof structure (`blinding_commitments`, `challenge`, `responses`, `commitment_randomizers`, `blinding_randomizers`, `timestamp`). Also verifies the consistency of lengths between the different proof components.
* **Timestamp Validation (for `deserialize_commitments_with_proof`):** Checks that the timestamp within the proof is not in the future (allowing for a small clock skew) and is not excessively old (warning if older than 90 days).
* **Byzantine Fault Tolerance in Share Refreshing:**
* The `_refresh_shares_additive` method (implementing Chen & Lindell's Protocol 5) has received several improvements to its Byzantine fault tolerance:
* **Adaptive Quorum-Based Byzantine Detection:** Consistency checks during share refreshing now use an adaptive quorum. The required consistency ratio for accepting a party's shares increases dynamically based on the number of participants and the detected threat level. This makes it harder for colluding adversaries to disrupt the refresh process.
* **Enhanced Evidence Collection:** The `_detect_byzantine_behavior` function now collects more detailed evidence when Byzantine behavior is detected, including information about inconsistent shares, invalid commitments, and equivocation (sending different values to different participants).
* **Improved Collusion Detection:** The `_enhanced_collusion_detection` function uses a more sophisticated graph analysis approach to identify potential collusion patterns. It considers both the number of invalid shares and the overlap in the participants targeted by those invalid shares.
* **Echo Consistency Protocol:** The `_process_echo_consistency` function has been significantly enhanced to provide stronger detection of equivocation. It uses cryptographically secure fingerprints of shared values to ensure consistent information among participants.
* **Constant-Time Operations:**
* The `_secure_matrix_solve` function now uses `gmpy2.invert()` instead of `powmod()` for modular inversion during Gaussian elimination. `gmpy2.invert()` is designed for constant-time modular inversion, offering better protection against timing side-channels.
* The `verify_dual_commitments` function now incorporates `constant_time_compare` to check the validity of commitment proofs. This ensures constant-time verification, preventing potential leakage of information about the secret values.
Performance Optimizations
* **Dynamic Window Sizing in `CyclicGroup`:**
* The `_precompute_powers` method in the `CyclicGroup` class now uses a more sophisticated dynamic window sizing strategy for precomputation. This adaptive logic considers the size of the prime and adjusts the small window size accordingly, leading to better performance across a wider range of prime sizes.
* **Verification Batch Size Calculation:**
* The `_calculate_optimal_batch_size` function now takes into account the number of available CPU cores (using `multiprocessing.cpu_count()`) to determine the optimal batch size for verification. This improves parallelism and reduces verification time, especially for large numbers of shares.
API and Usability Refinements
* **Clearer Error Messages and Warnings:** Many error messages and warnings have been improved to provide more specific and informative diagnostics.
* **Type Hinting and Documentation:** The code has been thoroughly reviewed and updated with comprehensive type hints and docstrings, improving readability and maintainability.
* **Consistent Use of `gmpy2`:** The code now consistently uses `gmpy2.mpz` for all integer arithmetic within the `CyclicGroup` and `FeldmanVSS` classes, ensuring consistent behavior and leveraging `gmpy2`'s performance optimizations.
Bug Fixes
* Fixed several minor inconsistencies and potential edge-case issues in serialization and deserialization methods.
* Addressed potential type errors in various functions by adding more robust input validation.
Potential Vulnerabilities (Acknowledged but Not Fully Addressed)
* **Timing Side-Channels (Partially Addressed):** Significant progress has been made in mitigating timing side-channels (e.g., `gmpy2.invert()`, `constant_time_compare` in `verify_dual_commitments`). However, a core concern remains: functions like `constant_time_compare`, `_secure_matrix_solve`, and `_find_secure_pivot` are implemented in pure Python. The Python interpreter and underlying hardware can still introduce timing variations. Full mitigation requires implementation in a lower-level language or using a well-vetted cryptographic library.
* **`secure_redundant_execution` Assumptions:** The `secure_redundant_execution` function still relies on the assumption that the provided function is deterministic and has no side effects.
* **Bias in `hash_to_group`:** Although reduced significantly, the `hash_to_group` function uses a fallback mechanism that can introduce a slight statistical bias. While negligible for large primes, this remains a theoretical weakness.
Note
This is a beta release. While extensive testing has been performed, there may still be undiscovered issues. It is recommended to thoroughly test this version in your environment before deploying it in a production setting.