protected override Zp GetRecombinedResult(IList <Zp> recvList, int prime) { // Scan recvList - if there are null elements replace them arbitrarily to Zp with zero value for (int i = 0; i < recvList.Count; i++) { if (recvList[i] == null) { recvList[i] = new Zp(prime, 0); } } var xVlaues = new List <Zp>(); int w = NumTheoryUtils.GetFieldMinimumPrimitive(prime); for (int i = 0; i < recvList.Count; i++) { xVlaues.Add(new Zp(prime, NumTheoryUtils.ModPow(w, i, prime))); } // Should call Welch-Berlekamp Decoder to fix error at last stage var fixedShares = WelchBerlekampDecoder.Decode(xVlaues, recvList, PolynomialDeg, PolynomialDeg, prime); if (fixedShares == null) { throw new Exception("There were more then polynomialDegree = " + PolynomialDeg + " Cheaters - cannot extract results."); } return(ShamirSharing.Recombine(fixedShares, PolynomialDeg, prime, true)); }
/// <summary> /// Creates a random polynomial f(x,y) and then to create from it for /// the i-th player two polynomials : fi(x) = f(x,w^i) and gi(y) = f(w^i,y). /// </summary> public static IList <SecretPolynomials> ShareByzantineCase(Zp secret, int numPlayers, int polynomDeg) { if (numPlayers <= 4 * polynomDeg) { throw new System.ArgumentException("Cannot use Byzantine algoritm -- numberOfPlayers <= 4*polynomDeg - " + "use regular computation instead"); } // Creating the Random Polynomial - f(x , y) // Note : there are (t+1)^2 coefficiet for the polynomial including the free coefficient (the secret) // first row coef are of (x^0,x^1,x^2,...,x^t)y^0, second row coef are (x^0, x1,...,x^t)y^1 and so forth... var randomMatrix_f_xy = ZpMatrix.GetRandomMatrix(polynomDeg + 1, polynomDeg + 1, secret.Prime); randomMatrix_f_xy.SetMatrixCell(0, 0, secret); var polynomialShares = new List <SecretPolynomials>(); for (int i = 0; i < numPlayers; i++) { var pSecret = new SecretPolynomials(); pSecret.Fi_xPolynomial = GenerateF_i_xPolynomial(randomMatrix_f_xy, secret, i); pSecret.Gi_yPolynomial = GenerateG_i_yPolynomial(randomMatrix_f_xy, secret, i); polynomialShares.Add(pSecret); } return(polynomialShares); }
private IList <Zp> ConstructRxPolynomial(ShareDetails aSharesDetails, ShareDetails bSharesDetails, ShareDetails abSharesDetails, ShareDetails rSharesDetails) { var fax = aSharesDetails.RandomPolynomial; var fbx = bSharesDetails.RandomPolynomial; var hx = abSharesDetails.RandomPolynomial; var rx = rSharesDetails.RandomPolynomial; var RxPolynomial = new Zp[2 * PolynomialDeg + 1]; /* Initialize RxPolynomial coefs with zeros */ for (int i = 0; i < 2 * PolynomialDeg + 1; i++) { RxPolynomial[i] = new Zp(Prime, 0); } /* First calculate fax*fbx - hx */ for (int i = 0; i < fax.Count; i++) { Zp temp = fax[i]; for (int j = 0; j < fax.Count; j++) { RxPolynomial[i + j].Add(temp.ConstMul(fbx[j])); } RxPolynomial[i].Sub(hx[i]); } /* Calculate x*rx+fax*fbx - hx*/ for (int i = 0; i < rx.Count; i++) { RxPolynomial[i + 1].Add(rx[i]); } return(new List <Zp>(RxPolynomial)); }
private void ReceiveVerifications(List <VerifShareMessage> verifShares, List <ShareMsg <Zp> > inputShares) { Zp recvShare_i = null; IList <Coordinate> wrongCoordinatesList = null; // all verif. shares must have the same state key var secretPoly = inputShares[verifShares[0].PlayerToVerify].Share as SecretPolynomials; // TODO: inefficient casting! if (verifShares[0].ReceivedGoodPoly) // had received a valid polynomial? { recvShare_i = new Zp(secretPoly.Fi_xPolynomial[0]); var verifyWithList_g_j_w_i = secretPoly.calculateG_i_yValuesForVerification(NumParties, Prime); wrongCoordinatesList = CompareCoordianteList(verifShares, verifyWithList_g_j_w_i); } else { // received a corrupted polynomials from player with ID 'playerToVerify' recvShare_i = new Zp(Prime, 0); } if (verifShares[0].PlayerToVerify == Party.Id) // am I the dealer? { Debug.Assert(MyInputShares != null); HandleDealer(MyInputShares, recvShare_i); } else { HandleNotDealer(verifShares[0].ReceivedGoodPoly, wrongCoordinatesList, verifShares[0].PlayerToVerify, recvShare_i, secretPoly); } sharesForComp.Add(recvShare_i); }
internal Zp InternalCalculate(IList <Zp> inputs) { var values = new List <Zp>(); foreach (Wire wire in InputWires) { if (wire.IsInput) { if (inputs.Count <= wire.InputIndex) { throw new Exception("Input " + wire.InputIndex + " is expected - not found in the list given"); } values.Add(inputs[wire.InputIndex]); } else { Debug.Assert(wire.SourceGate != null && wire.SourceGate.IsOutputReady); values.Add(wire.ConstValue != null ? wire.ConstValue : wire.SourceGate.OutputValue); } } OutputValue = new Zp(values[0]); values.RemoveAt(0); foreach (Zp value in values) { OutputValue.Calculate(value, Operation == Operation.Div && value.Value == 0 ? Operation.Mul : Operation); } return(OutputValue); }
private static Polynomial interpolatePolynomial(IList<Zp> XVlaues, IList<Zp> YVlaues, int e, int polynomDeg, int prime) { int n = XVlaues.Count; if ((e < 0) || (n < 2 * e)) // cannot fix e errors if e <0 or n < 2e. return null; var A = getWelchBerlekampMatrix(XVlaues, YVlaues, n, e, prime); // the matrix to hold the linear system we'll solve var b = getWelchBerlekampConstraintVector(XVlaues, YVlaues, n, e, prime); // coefficients of N and E as one vector var NE = linearSolve(A, new ZpMatrix(b, VectorType.Column), prime); if (NE != null) { var N = new Zp[n - e]; var E = new Zp[e + 1]; for (int i = 0; i < n - e; i++) N[i] = new Zp(NE[i]); for (int i = n - e; i < n; i++) E[i - (n - e)] = new Zp(NE[i]); // Constraint coeef - E has degree exactly e and is monic (shoudn't be zero) E[e] = new Zp(prime, 1); return (new Polynomial(new List<Zp>(N))).divideWithRemainder(new Polynomial(new List<Zp>(E))); } return null; }
private static Polynomial interpolatePolynomial(IList <Zp> XVlaues, IList <Zp> YVlaues, int e, int polynomDeg, int prime) { int n = XVlaues.Count; if ((e < 0) || (n < 2 * e)) // cannot fix e errors if e <0 or n < 2e. { return(null); } var A = getWelchBerlekampMatrix(XVlaues, YVlaues, n, e, prime); // the matrix to hold the linear system we'll solve var b = getWelchBerlekampConstraintVector(XVlaues, YVlaues, n, e, prime); // coefficients of N and E as one vector var NE = linearSolve(A, new ZpMatrix(b, VectorType.Column), prime); if (NE != null) { var N = new Zp[n - e]; var E = new Zp[e + 1]; for (int i = 0; i < n - e; i++) { N[i] = new Zp(NE[i]); } for (int i = n - e; i < n; i++) { E[i - (n - e)] = new Zp(NE[i]); } // Constraint coeef - E has degree exactly e and is monic (shoudn't be zero) E[e] = new Zp(prime, 1); return((new Polynomial(new List <Zp>(N))).divideWithRemainder(new Polynomial(new List <Zp>(E)))); } return(null); }
//public override void Receive(Message msg) //{ // Gate anchor, myGate; // var ssmpcMsg = msg as ScalableMpcMessage; // Debug.Assert(ssmpcMsg != null); // switch (ssmpcMsg.StateKey.Stage) // { // case Stage.Input: // var inputMsg = ssmpcMsg as InputMessage; // // start a heavy-weight smpc with parent and sibling gates // myGate = Circuit.FindGate(ssmpcMsg.StateKey.GateId); // RunChildMpc(myGate.OutNodes[0], myGate, inputMsg.Data); // break; // case Stage.Mpc: // MpcProtocol smpc; // var mpcMsg = ssmpcMsg as MpcMessage; // if (MpcSessions.ContainsKey(smpcMsg.StateKey)) // mpc = MpcSessions[mpcMsg.StateKey].Mpc; // else // { // // I must be in the anchor gate // Debug.Assert(mpcMsg.ToGateId == mpcMsg.AnchorId, "Synchronization exception: Why don't I have an session for this MPC?"); // // my child gate is asking me to participate in an MPC, so create an MPC protocol instance and join // anchor = Circuit.FindGate(mpcMsg.AnchorId); // mpc = RunAnchorMpc(anchor); // } // mpc.Receive(mpcMsg.InnerMessage); // break; // } //} /// <summary> /// Starts a heavy-weight SMPC instance for an SMPC child gate player. /// </summary> protected virtual BgwProtocol RunChildMpc(Gate anchor, Gate myGate, Zp myInput) { Debug.Assert(quorumsMap.ContainsKey(anchor.QuorumIndex)); Debug.Assert(quorumsMap.ContainsKey(myGate.QuorumIndex)); // find associated quorums var childGates = anchor.InNodes; var myGateId = myGate.Id; var virtualIds = new List <int>(quorumsMap[anchor.QuorumIndex].Select(p => (anchor.Id << 16) + p)); // TODO: IMPORTANT: THE ASSUMPTION HERE LIMITS ENTITY/GATE IDs TO 32768. TO INCREASE THIS LIMIT EITHER USE UINT/ULONG IDs OR CHANGE THIS CODE. foreach (var gate in childGates) { foreach (var playerId in quorumsMap[gate.QuorumIndex]) { virtualIds.Add((gate.Id << 16) + playerId); } } var myVirtualId = (myGateId << 16) + Party.Id; // run the protocol and keep it in a the session state var key = new MpcKey(myGateId, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //var mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, myInput, OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); //return mpc; }
/// <summary> /// The i-th user gets a Qj(i) List from users, each user j calculated Qj(i) - the j element in the List /// </summary> public static Zp CalculateRandomShare(Zp myShare, IList <Zp> polyUpdate) { var newShare = new Zp(myShare); newShare.AddListContent(polyUpdate); return(newShare); }
/// <summary> /// Creates a random poynomial Qj(x) ,for the j player,and creates a list of elements, /// such that the i-th element is Qj(i) /// </summary> public static IList<Zp> GetRandomizedSharesByzantineCase(int numPlayers, int polynomDeg, int prime) { //polynomial q(x) free element must be zero so it won't effect the final result var polyfreeElem = new Zp(prime, 0); return PrimitiveShare(polyfreeElem, numPlayers, polynomDeg); }
private bool IsMultStepShareLegal(MultStepBCaseShare recvShareFromPlayer_i, MultStepVerificationPoly recvVerifcationPolynomial) { if (!IsRecvShareLegal(recvShareFromPlayer_i)) { return(false); } var RxPolynomial = recvVerifcationPolynomial.RxPolynomial; Zp Ratpoint0 = Zp.EvalutePolynomialAtPoint(RxPolynomial, new Zp(Prime, 0)); if (!Ratpoint0.Equals(new Zp(Prime, 0))) { return(false); } int w = NumTheoryUtils.GetFieldMinimumPrimitive(Prime); var w_InMyIndex = new Zp(Prime, NumTheoryUtils.ModPow(w, Party.Id, Prime)); Zp RjFromPublicPolynomial = Zp.EvalutePolynomialAtPoint(RxPolynomial, w_InMyIndex); Zp temp = recvShareFromPlayer_i.AShare.ConstMul(recvShareFromPlayer_i.BShare).ConstSub(recvShareFromPlayer_i.AbShare); Zp RjFromRecvPrivateInfo = w_InMyIndex.ConstMul(recvShareFromPlayer_i.RShare).ConstAdd(temp); if (!RjFromPublicPolynomial.Equals(RjFromRecvPrivateInfo)) { return(false); } return(true); }
public MultStepBCaseShare(Zp aShare, Zp bShare, Zp abShare, Zp rShare) : base(BgwShareType.MULT_STEP_BCASE) { AShare = aShare; BShare = bShare; AbShare = abShare; RShare = rShare; }
/// <summary> /// Creates a random poynomial Qj(x) ,for the j player,and creates a list of elements, /// such that the i-th element is Qj(i) /// </summary> public static IList <Zp> GetRandomizedSharesByzantineCase(int numPlayers, int polynomDeg, int prime) { //polynomial q(x) free element must be zero so it won't effect the final result var polyfreeElem = new Zp(prime, 0); return(PrimitiveShare(polyfreeElem, numPlayers, polynomDeg)); }
public MultStepBCaseShare(Zp aShare, Zp bShare, Zp abShare, Zp rShare) : base(BgwShareType.MULT_STEP_BCASE) { AShare = aShare; BShare = bShare; AbShare = abShare; RShare = rShare; }
public Gate(GateType type, Zp quorumIndex, Common.FiniteField.Circuits.Circuit mpcCircuit) { Debug.Assert(type == GateType.Input || mpcCircuit != null, "Only input gates do not have MPC circuit."); Id = idGen++; Type = type; QuorumIndex = quorumIndex.Value; MpcCircuit = mpcCircuit; }
private static Zp[] getWelchBerlekampConstraintVector(IList<Zp> XVlaues, IList<Zp> YVlaues, int n, int e, int prime) { var bVector = new Zp[n]; for (int i = 0; i < n; i++) bVector[i] = new Zp(prime, NumTheoryUtils.ModPow(XVlaues[i].Value, e, prime) * YVlaues[i].Value); return bVector; }
public DkmsProtocol(Circuit circuit, AsyncParty p, IList<int> playerIds, Zp playerInput, int numSlots, StateKey stateKey) : base(p, playerIds, stateKey) { Circuit = circuit; Input = playerInput; Prime = playerInput.Prime; NumSlots = numSlots; }
public DkmsProtocol(Circuit circuit, AsyncParty p, IList <int> playerIds, Zp playerInput, int numSlots, StateKey stateKey) : base(p, playerIds, stateKey) { Circuit = circuit; Input = playerInput; Prime = playerInput.Prime; NumSlots = numSlots; }
/// <summary> /// Starts a heavy-weight SMPC instance for an anchor gate player. /// </summary> protected virtual BgwProtocol RunAnchorMpc(Gate anchor) { // NOTE: since in the HBC case all players have the same output, just one of them (the guy with min id) SMPCs his output to improve performance. Debug.Assert(quorumsMap.ContainsKey(anchor.QuorumIndex)); // find associated quorums var anchorChildren = anchor.InNodes; var myQuorum = quorumsMap[anchor.QuorumIndex]; var virtualIds = new List <int>(myQuorum.Select(p => (anchor.Id << 16) + p)); // TODO: IMPORTANT: THE ASSUMPTION HERE LIMITS ENTITY/GATE IDs TO 32768. TO INCREASE THIS LIMIT EITHER USE UINT/ULONG IDs OR CHANGE THIS CODE. foreach (var childGate in anchorChildren) { foreach (var playerId in quorumsMap[childGate.QuorumIndex]) { virtualIds.Add((childGate.Id << 16) + playerId); } } var myVirtualId = (anchor.Id << 16) + Party.Id; // if my id is the minimum in my quorum, then I should just SMPC with a zero, otherwise just SMPC with a random number (r_g). // save this random number in the session because it will be my input in next level's SMPC. BgwProtocol mpc; if (Party.Id == myQuorum.Min()) { // run the protocol and keep it in a the session state var key = new MpcKey(anchor.Id, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, new Zp(Prime), OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); } else { // pick a number uniformly at random (r_g) // this random along with other players' randoms forms a global random in the quorum. var randomShare = new Zp(Prime, StaticRandom.Next(0, Prime)); // run an SMPC protocol and keep it in a session state var key = new MpcKey(anchor.Id, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, randomShare, OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); } return(mpc); }
private static Zp[] getWelchBerlekampConstraintVector(IList <Zp> XVlaues, IList <Zp> YVlaues, int n, int e, int prime) { var bVector = new Zp[n]; for (int i = 0; i < n; i++) { bVector[i] = new Zp(prime, NumTheoryUtils.ModPow(XVlaues[i].Value, e, prime) * YVlaues[i].Value); } return(bVector); }
public ByzantineBgwProtocol(AsyncParty e, Circuit circuit, ReadOnlyCollection<int> playerIds, Zp playerInput, StateKey stateKey) : base(e, circuit, playerIds, playerInput, stateKey) { throw new NotImplementedException(); // PolynomialDeg = NumParties % 4 == 0 ? (NumParties / 4 - 1) : (NumParties / 4); // Mahdi: Changed to the following since n/3 - 1 of players can be dishonest. // degree = n - t, where t is the number of dishonest players PolynomialDeg = (int)Math.Floor(2 * NumParties / 3.0); }
public ByzantineBgwProtocol(AsyncParty e, Circuit circuit, ReadOnlyCollection <int> playerIds, Zp playerInput, StateKey stateKey) : base(e, circuit, playerIds, playerInput, stateKey) { throw new NotImplementedException(); // PolynomialDeg = NumParties % 4 == 0 ? (NumParties / 4 - 1) : (NumParties / 4); // Mahdi: Changed to the following since n/3 - 1 of players can be dishonest. // degree = n - t, where t is the number of dishonest players PolynomialDeg = (int)Math.Floor(2 * NumParties / 3.0); }
private static IList<Zp> GenerateF_i_xPolynomial(ZpMatrix f_x_y, Zp secret, int playerNum) { int w = NumTheoryUtils.GetFieldMinimumPrimitive(secret.Prime); int w_i = NumTheoryUtils.ModPow(w, playerNum, secret.Prime); var y_values = new int[f_x_y.ColCount]; for (int i = 0; i < f_x_y.ColCount; i++) { y_values[i] = NumTheoryUtils.ModPow(w_i, i, secret.Prime); } return f_x_y.MulMatrixByScalarsVector(y_values).SumMatrixRows(); }
protected void ShareSecret(Zp secret, IList <int> players, DkmsKey key) { var shares = ShamirSharing.Share(secret, players.Count, players.Count - 1); var shareMsgs = new List <ShareMsg <Zp> >(); foreach (var share in shares) { shareMsgs.Add(new ShareMsg <Zp>(new Share <Zp>(share), key)); } Send(players, shareMsgs); }
private static IList <Zp> GenerateF_i_xPolynomial(ZpMatrix f_x_y, Zp secret, int playerNum) { int w = NumTheoryUtils.GetFieldMinimumPrimitive(secret.Prime); int w_i = NumTheoryUtils.ModPow(w, playerNum, secret.Prime); var y_values = new int[f_x_y.ColCount]; for (int i = 0; i < f_x_y.ColCount; i++) { y_values[i] = NumTheoryUtils.ModPow(w_i, i, secret.Prime); } return(f_x_y.MulMatrixByScalarsVector(y_values).SumMatrixRows()); }
private static IList<Zp> GenerateG_i_yPolynomial(ZpMatrix f_x_y, Zp secret, int playerNum) { int w = NumTheoryUtils.GetFieldMinimumPrimitive(secret.Prime); int w_i = NumTheoryUtils.ModPow(w, playerNum, secret.Prime); var x_values = new Zp[f_x_y.RowCount]; for (int i = 0; i < f_x_y.RowCount; i++) { x_values[i] = new Zp(secret.Prime, NumTheoryUtils.ModPow(w_i, i, secret.Prime)); } var tempArr = f_x_y.Times(new ZpMatrix(x_values, VectorType.Column)).ZpVector; return tempArr; }
private void UpdateRecvShare(IList <SecretPolynomials> recvPublicPolysList, Zp recvSecretShare_i) { if ((recvPublicPolysList != null)) { var newRecvSercretPoly = recvPublicPolysList[Party.Id]; if (newRecvSercretPoly != null) { var recvShare = newRecvSercretPoly.Fi_xPolynomial[0]; if (recvShare != null) { recvSecretShare_i.Value = recvShare.Value; } } } }
private static Zp[] TruncateVector(Zp[] vector, int toSize) { if (vector.Length < toSize) { return(null); } var truncVec = new Zp[toSize]; for (int i = 0; i < toSize; i++) { truncVec[i] = new Zp(vector[i]); } return(truncVec); }
/// <summary> /// Each party in the new quorum needs to call this with the shares received from the old quorum to calculate its share /// </summary> public static Zp CombineReshares(IList<Zp> reshares, int newQuorumSize, int prime) { int oldQuorumSize = reshares.Count; if (oldQuorumSize != newQuorumSize) throw new System.ArgumentException("Do not support case where quorums are of different sizes"); // Compute the first row of the inverse Vandermonde matrix var vandermonde = ZpMatrix.GetVandermondeMatrix(oldQuorumSize, newQuorumSize, prime); var vandermondeInv = vandermonde.Inverse.GetMatrixColumn(0); var S = new Zp(prime); for (var i = 0; i < newQuorumSize; i++) S += vandermondeInv[i] * reshares[i]; return S; }
private static IList <Zp> GenerateG_i_yPolynomial(ZpMatrix f_x_y, Zp secret, int playerNum) { int w = NumTheoryUtils.GetFieldMinimumPrimitive(secret.Prime); int w_i = NumTheoryUtils.ModPow(w, playerNum, secret.Prime); var x_values = new Zp[f_x_y.RowCount]; for (int i = 0; i < f_x_y.RowCount; i++) { x_values[i] = new Zp(secret.Prime, NumTheoryUtils.ModPow(w_i, i, secret.Prime)); } var tempArr = f_x_y.Times(new ZpMatrix(x_values, VectorType.Column)).ZpVector; return(tempArr); }
public void Init(int numPlayers, int numQuorums, int numSlots, int quorumSize, QuorumBuildingMethod qbMethod, AdversaryModel model, Zp[] inputs, int prime) { switch (model) { case AdversaryModel.HonestButCurious: Circuit = CreateHbcCircuit(numPlayers, numQuorums, numSlots, quorumSize, prime); break; case AdversaryModel.Byzantine: Circuit = CreateByzantineCircuit(numPlayers, numQuorums, numSlots, quorumSize, prime); break; default: throw new Exception("Unknown adversary model."); } base.Init(numPlayers, numQuorums, numSlots, quorumSize, qbMethod, Circuit, inputs, prime); }
public override void Run() { Debug.Assert(quorumsMap != null); Debug.Assert(Circuit.InputGates.Count == NumParties * NumSlots); // TODO: input must be encrypted with a random number and the random must be secret shared. // share my input in a random input gate (random slot) and share zero in others var randomSlot = StaticRandom.Next(0, NumSlots); for (int s = 0; s < NumSlots; s++) { // TODO: IMPORTANT: EntityId's are assumed to be continous integers with option base 0. Not other parts of the code have this assumption. var gate = Circuit.InputGates[Party.Id * NumSlots + s]; var quorum = quorumsMap[gate.QuorumIndex]; // in the byzantine case, we have to secret share the input among 'quorum' members but // here in the HBC case, we send the masked input to only one member of 'quorum' and randoms to other players. // These randoms form a global random, which is added to the input to mask it. Zp toSend; if (s == randomSlot) { toSend = Input; } else { toSend = new Zp(Prime); // send a zero } int mask = 0; var minPlayer = quorum.Min(); var stateKey = new DkmsKey(Stage.Input, gate.Id); foreach (var player in quorum) { if (player != minPlayer) { var rand = StaticRandom.Next(0, Prime); mask += rand; Send(Party.Id, player, new InputMsg(new Zp(Prime, rand), stateKey)); } } Send(Party.Id, minPlayer, new InputMsg(Input + mask, stateKey)); } }
//public override void loadFromByteArrayNoHeader(BitStream bs, int prime) //{ // if (bs.readBoolean()) // fi_x = bs.readList(prime); // if (bs.readBoolean()) // gi_y = bs.readList(prime); //} //public override void writeToBitStreamNoHeader(BitStream bs) //{ // bs.writeBoolean(fi_x != null); // if (fi_x != null) // bs.writeList(fi_x); // bs.writeBoolean(gi_y != null); // if (gi_y != null) // bs.writeList(gi_y); //} //public override byte[] writeToByteArray() //{ // var bs = new BitStream(); // bs.writeMessageType(MessageType.ZP_LISTS); // writeToBitStreamNoHeader(bs); // bs.close(); // return bs.ByteArray; //} public virtual IList <Zp> CalculateF_i_xValuesForPlayers(int numOfPlayers, int prime) { int w_i, w = Zp.GetFieldMinimumPrimitive(prime); int value; var f_i_xValues = new List <Zp>(); for (int playerNum = 0; playerNum < numOfPlayers; playerNum++) { w_i = Zp.CalculatePower(w, playerNum, prime); value = 0; for (int j = 0; j < fi_x.Count; j++) { value += Zp.CalculatePower(w_i, j, prime) * fi_x[j].Value; } f_i_xValues.Add(new Zp(prime, value)); } return(f_i_xValues); }
/// <summary> /// Evaluates the shares of secret with polynomial of degree 'polynomDeg' and 'numPlayers' players. /// </summary> private static IList <Zp> Share(Zp secret, int numPlayers, int polynomDeg, bool usePrimitiveShare, out IList <Zp> coeffs) { #if NO_COMPUTATION // send some dummy shares var shares = new Zp[numPlayers]; for (int i = 0; i < numPlayers; i++) { shares[i] = new Zp(secret.Prime); } return(shares); #else Debug.Assert(numPlayers > polynomDeg, "Polynomial degree cannot be greater than or equal to the number of players!"); // Create a random polynomial - f(x) // Note: Polynomial of degree d has d+1 coefficients var randomMatrix = ZpMatrix.GetRandomMatrix(1, polynomDeg + 1, secret.Prime); // The free variable in the Random Polynomial (i.e. f(x)) is the secret randomMatrix.SetMatrixCell(0, 0, secret); // Polynomial coefficients coeffs = randomMatrix.GetMatrixRow(0); // Create vanderMonde matrix ZpMatrix vanderMonde; if (usePrimitiveShare) { vanderMonde = ZpMatrix.GetPrimitiveVandermondeMatrix(polynomDeg + 1, numPlayers, secret.Prime); } else { vanderMonde = ZpMatrix.GetVandermondeMatrix(polynomDeg + 1, numPlayers, secret.Prime); } // Compute f(i) for the i-th player var sharesArr = randomMatrix.Times(vanderMonde).ZpVector; Debug.Assert(sharesArr != null); Debug.Assert(sharesArr.Length == numPlayers); return(sharesArr); #endif }
/// <summary> /// Evaluates the shared secrets of secret with polynom of degree t and numberOfPlayers players. /// </summary> public static ShareDetails DetailedShare(Zp secret, int numPlayers, int polynomDeg) { if (numPlayers <= polynomDeg) throw new ArgumentException("Polynomial degree cannot be bigger or equal to the number of players"); // Creating the Random Polynomial - f(x) var randomMatrix = ZpMatrix.GetRandomMatrix(1, polynomDeg + 1, secret.Prime); // The free variable in the Random Polynomial( f(x) ) is the seceret randomMatrix.SetMatrixCell(0, 0, secret); // Create vanderMonde matrix var vanderMonde = ZpMatrix.GetPrimitiveVandermondeMatrix(polynomDeg + 1, numPlayers, secret.Prime); // Compute f(i) for the i-th player var sharesArr = randomMatrix.Times(vanderMonde).ZpVector; var details = new ShareDetails(randomMatrix.GetMatrixRow(0), sharesArr); return details; }
static void Main(string[] args) { Console.WriteLine("Started."); StaticRandom.Init(seed); int quorumSize = 20; int degree = quorumSize / 3; var secret = new Zp(Prime, 3); var shareMatrix = ZpMatrix.GetIdentityMatrix(quorumSize, Prime); // create the initial shares var initalShares = ShamirSharing.Share(secret, quorumSize, degree); for (var i = 0; i < quorumSize; i++) { IList <Zp> reshares = QuorumSharing.CreateReshares(initalShares[i], quorumSize, degree); for (var j = 0; j < quorumSize; j++) { shareMatrix.SetMatrixCell(j, i, reshares[j]); } } // combine the reshares List <Zp> finalShares = new List <Zp>(); for (var i = 0; i < quorumSize; i++) { Zp finalShare = QuorumSharing.CombineReshares(shareMatrix.GetMatrixRow(i), quorumSize, Prime); finalShares.Add(finalShare); } // combine the shares Zp final = ShamirSharing.Recombine(finalShares, degree, Prime); Console.WriteLine(final.Value); Console.WriteLine("Press any key to continue..."); Console.ReadKey(); }
/// <summary> /// Each party in the new quorum needs to call this with the shares received from the old quorum to calculate its share /// </summary> public static Zp CombineReshares(IList <Zp> reshares, int newQuorumSize, int prime) { int oldQuorumSize = reshares.Count; if (oldQuorumSize != newQuorumSize) { throw new System.ArgumentException("Do not support case where quorums are of different sizes"); } // Compute the first row of the inverse Vandermonde matrix var vandermonde = ZpMatrix.GetVandermondeMatrix(oldQuorumSize, newQuorumSize, prime); var vandermondeInv = vandermonde.Inverse.GetMatrixColumn(0); var S = new Zp(prime); for (var i = 0; i < newQuorumSize; i++) { S += vandermondeInv[i] * reshares[i]; } return(S); }
/// <summary> /// Creates a random polynomial f(x,y) and then to create from it for /// the i-th player two polynomials : fi(x) = f(x,w^i) and gi(y) = f(w^i,y). /// </summary> public static IList<SecretPolynomials> ShareByzantineCase(Zp secret, int numPlayers, int polynomDeg) { if (numPlayers <= 4 * polynomDeg) throw new System.ArgumentException("Cannot use Byzantine algoritm -- numberOfPlayers <= 4*polynomDeg - " + "use regular computation instead"); // Creating the Random Polynomial - f(x , y) // Note : there are (t+1)^2 coefficiet for the polynomial including the free coefficient (the secret) // first row coef are of (x^0,x^1,x^2,...,x^t)y^0, second row coef are (x^0, x1,...,x^t)y^1 and so forth... var randomMatrix_f_xy = ZpMatrix.GetRandomMatrix(polynomDeg + 1, polynomDeg + 1, secret.Prime); randomMatrix_f_xy.SetMatrixCell(0, 0, secret); var polynomialShares = new List<SecretPolynomials>(); for (int i = 0; i < numPlayers; i++) { var pSecret = new SecretPolynomials(); pSecret.Fi_xPolynomial = GenerateF_i_xPolynomial(randomMatrix_f_xy, secret, i); pSecret.Gi_yPolynomial = GenerateG_i_yPolynomial(randomMatrix_f_xy, secret, i); polynomialShares.Add(pSecret); } return polynomialShares; }
// Mahdi's recombine method based on Lagrange interpolation for finite fields. public static Zp SimpleRecombine(IList <Zp> sharedSecrets, int polyDeg, int prime) { if (sharedSecrets.Count < polyDeg) { throw new System.ArgumentException("Polynomial degree cannot be bigger or equal to the number of shares"); } // find Lagrange basis polynomials free coefficients var L = new Zp[polyDeg + 1]; for (int i = 0; i < polyDeg + 1; i++) { L[i] = new Zp(prime, 1); } int ix = 0; for (var i = new Zp(prime, 1); i < polyDeg + 2; i++, ix++) { for (var j = new Zp(prime, 1); j < polyDeg + 2; j++) { if (j != i) { var additiveInverse = j.AdditiveInverse; L[ix] = L[ix] * (additiveInverse / (i + additiveInverse)); // note: division done in finite-field } } } // find the secret by multiplying each share to the corresponding Lagrange's free coefficient var secret = new Zp(prime, 0); for (int i = 0; i < polyDeg + 1; i++) { secret = secret + (L[i] * sharedSecrets[i]); } return(secret); }
static void Main(string[] args) { Console.WriteLine("Started."); StaticRandom.Init(seed); int quorumSize = 20; int degree = quorumSize / 3; var secret = new Zp(Prime, 3); var shareMatrix = ZpMatrix.GetIdentityMatrix(quorumSize, Prime); // create the initial shares var initalShares = ShamirSharing.Share(secret, quorumSize, degree); for (var i = 0; i < quorumSize; i++) { IList<Zp> reshares = QuorumSharing.CreateReshares(initalShares[i], quorumSize, degree); for (var j = 0; j < quorumSize; j++) { shareMatrix.SetMatrixCell(j, i, reshares[j]); } } // combine the reshares List<Zp> finalShares = new List<Zp>(); for (var i = 0; i < quorumSize; i++) { Zp finalShare = QuorumSharing.CombineReshares(shareMatrix.GetMatrixRow(i), quorumSize, Prime); finalShares.Add(finalShare); } // combine the shares Zp final = ShamirSharing.Recombine(finalShares, degree, Prime); Console.WriteLine(final.Value); Console.WriteLine("Press any key to continue..."); Console.ReadKey(); }
/// <summary> /// Evaluates the shared secrets of secret with polynom of degree t and numberOfPlayers players. /// </summary> public static ShareDetails DetailedShare(Zp secret, int numPlayers, int polynomDeg) { if (numPlayers <= polynomDeg) { throw new ArgumentException("Polynomial degree cannot be bigger or equal to the number of players"); } // Creating the Random Polynomial - f(x) var randomMatrix = ZpMatrix.GetRandomMatrix(1, polynomDeg + 1, secret.Prime); // The free variable in the Random Polynomial( f(x) ) is the seceret randomMatrix.SetMatrixCell(0, 0, secret); // Create vanderMonde matrix var vanderMonde = ZpMatrix.GetPrimitiveVandermondeMatrix(polynomDeg + 1, numPlayers, secret.Prime); // Compute f(i) for the i-th player var sharesArr = randomMatrix.Times(vanderMonde).ZpVector; var details = new ShareDetails(randomMatrix.GetMatrixRow(0), sharesArr); return(details); }
private void ShareSimple(Zp sharedSecrets, Stage targetStage) { Send(new ShareMsg<Zp>(new Share<Zp>(sharedSecrets), targetStage), BadPlayers); }
private void ReceiveVerifications(List<VerifShareMessage> verifShares, List<ShareMsg<Zp>> inputShares) { Zp recvShare_i = null; IList<Coordinate> wrongCoordinatesList = null; // all verif. shares must have the same state key var secretPoly = inputShares[verifShares[0].PlayerToVerify].Share as SecretPolynomials; // TODO: inefficient casting! if (verifShares[0].ReceivedGoodPoly) // had received a valid polynomial? { recvShare_i = new Zp(secretPoly.Fi_xPolynomial[0]); var verifyWithList_g_j_w_i = secretPoly.calculateG_i_yValuesForVerification(NumParties, Prime); wrongCoordinatesList = CompareCoordianteList(verifShares, verifyWithList_g_j_w_i); } else { // received a corrupted polynomials from player with ID 'playerToVerify' recvShare_i = new Zp(Prime, 0); } if (verifShares[0].PlayerToVerify == Party.Id) // am I the dealer? { Debug.Assert(MyInputShares != null); HandleDealer(MyInputShares, recvShare_i); } else { HandleNotDealer(verifShares[0].ReceivedGoodPoly, wrongCoordinatesList, verifShares[0].PlayerToVerify, recvShare_i, secretPoly); } sharesForComp.Add(recvShare_i); }
private bool IsPublicDataContradictPrivate(SecretPolynomials myRecvPolys, IList<SecretPolynomials> recvPublicPolysList, IList<PlayerNotification> recvComplaintesList, Zp myRecvShare) { if ((recvPublicPolysList == null) || (recvPublicPolysList.Count != NumParties)) return true; var myG_j_w_iValues = myRecvPolys.calculateG_i_yValuesForVerification(NumParties, Prime); var myF_j_w_iValues = myRecvPolys.CalculateF_i_xValuesForPlayers(NumParties, Prime); for (int k = 0; k < NumParties; k++) { if ((recvComplaintesList[k] != null) && (recvComplaintesList[k].Confirmation == Confirmation.Complaint)) { var playerKNewPolys = recvPublicPolysList[k]; // Check if the dealer didn't publish all the required data or published a corrupted data if (!IsSecretPolynomialsLegal(playerKNewPolys)) return true; // Verify that the public information doesn't contradict itself - check that : f(w^k, w^k) = fk(w^k) = gk(w^k) = f(w^k, w^k) var playerKNewFk_x_w_iValues = playerKNewPolys.CalculateF_i_xValuesForPlayers(NumParties, Prime); var playerKNewGk_y_w_iValues = playerKNewPolys.calculateG_i_yValuesForVerification(NumParties, Prime); if (!playerKNewFk_x_w_iValues[k].Equals(playerKNewGk_y_w_iValues[k])) return true; if (k == Party.Id) { // Verify that the new public polynomials equals the old polynomials if (!IsSecretPolynomialsLegal(myRecvPolys) || !myRecvPolys.Equals(playerKNewPolys)) return true; } else { // Verify that the public information doesn't contradict the old information : // f(w^j, w^k) = fk(w^j) = gj(w^k) = f(w^j, w^k) && f(w^k, w^j) = fj(w^k) = gk(w^j) = f(w^k, w^j) if ((!myG_j_w_iValues[k].Equals(playerKNewFk_x_w_iValues[Party.Id])) || (!myF_j_w_iValues[k].Equals(playerKNewGk_y_w_iValues[Party.Id]))) return true; } } } return false; }
/// <summary> /// Implementation according to GRR. /// </summary> public virtual Zp ReductionRandomizationStep(Zp a, Zp b, Zp ab) { throw new NotImplementedException(); //// performing reduction & randomization step ///* Create a detailed share of a,b and ab */ //var aSharesDetails = Shamir.DetailedShare(a, NumPlayers, PolynomialDeg); //var bSharesDetails = Shamir.DetailedShare(b, NumPlayers, PolynomialDeg); //var abSharesDetails = Shamir.DetailedShare(ab, NumPlayers, PolynomialDeg); ///* Share a random polynomial r(x) of degree 2t-1 */ //var rSharesDetails = Shamir.DetailedShare( // new Zp(Prime, (int)(new Random(1).NextDouble() * Prime)), NumPlayers, 2 * PolynomialDeg - 1); //var RxPolynomial = new MultStepVerificationPoly(ConstructRxPolynomial(aSharesDetails, bSharesDetails, abSharesDetails, rSharesDetails)); ///* Build verified shares for users */ //var aShares = aSharesDetails.CreatedShares; //var bShares = bSharesDetails.CreatedShares; //var abShares = abSharesDetails.CreatedShares; //var rShares = rSharesDetails.CreatedShares; //var toSendmultStepShares = new List<MultStepBCaseShare>(); //for (int i = 0; i < NumPlayers; i++) //{ // var playerShares = new MultStepBCaseShare(); // playerShares.AShare = aShares[i]; // playerShares.BShare = bShares[i]; // playerShares.AbShare = abShares[i]; // playerShares.RShare = rShares[i]; // toSendmultStepShares.Add(playerShares); //} ///* Send and receive shares from all players */ //var toRecvmultStepShares = Sendable.asMultStepBCaseShares(Adapter.shareSecrets(toSendmultStepShares, Prime, BadPlayers)); ///* Start verifying player shares and construct a list of the received shares of ab - this list will be used to compute the regular multStep*/ //int playerToVerify = 0; //var abVerifiedList = new List<Zp>(); //foreach (var recvShareFromPlayer_i in toRecvmultStepShares) //{ // if (playerToVerify == EntityId) // { // // I'm the dealer // // Put Rx polynomial on the bulletin board // BulletinBoardProtocol.publish(RxPolynomial, BadPlayers, Adapter); // // Should advertise a demo complaint on the bulletin board - I'm not complaining about myself // var myDemoComplaint = new PlayerNotification(PlayerNotification.Confirmation.APPROVAL); // var complaintesOnMe = Sendable.asPlayerNotifications(BulletinBoardProtocol.publishAndRead(myDemoComplaint, Prime, BadPlayers, Adapter)); // // Build a message containing all the requested data // var requstedData = new List<MultStepBCaseShare>(); // for (int i = 0; i < NumPlayers; i++) // { // if ((complaintesOnMe[i] != null) && (complaintesOnMe[i].Msg.Equals(PlayerNotification.Confirmation.COMPLAINT))) // { // requstedData.Add(toSendmultStepShares[i]); // } // else requstedData.Add(null); // } // var requstedDataToPublish = new MultStepBCaseShareBundle(requstedData); // // Put the requested shares on the bulletin board . // // Note : even if you are a cheater you should publish the real shares here otherwise you will be considered as cheater // BulletinBoardProtocol.publish(requstedDataToPublish, BadPlayers, Adapter); // // Add my ab share to abShares any way // abVerifiedList.Add(toSendmultStepShares[EntityId].AbShare); // } // else // { // if (BadPlayers[playerToVerify]) // { // // Mult Step - verifying player number playerToVerify share // bool dealerIsCheater = false; // PlayerNotification myComplaint; // IList<PlayerNotification> recvComplaints; // MultStepBCaseShareBundle recvPublicShares; // // Get Rx polynomial of the 'playerToVerify' from bulletin board // var recvVerificationPolynomial = BulletinBoardProtocol.read(playerToVerify, Prime, Adapter).asMultStepVerificationPoly(); // if (IsMultStepPolynomialLegal(recvVerificationPolynomial)) // { // if (!IsMultStepShareLegal(recvShareFromPlayer_i, recvVerificationPolynomial)) // { // // Should prepare a massege that te dealer is a cheater // myComplaint = new PlayerNotification(PlayerNotification.Confirmation.COMPLAINT); // } // else // { // // Should prepare a massege that te dealer is not a cheater // myComplaint = new PlayerNotification(PlayerNotification.Confirmation.APPROVAL); // } // // Help verify complaining users shares : // // Should advertise what you thinks about the dealer on the bulletin board // recvComplaints = Sendable.asPlayerNotifications(BulletinBoardProtocol.publishAndRead(myComplaint, Prime, BadPlayers, Adapter)); // // Get complaining players share from the bulletin board - it is now a public share // recvPublicShares = BulletinBoardProtocol.read(playerToVerify, Prime, Adapter).asMultStepBCaseShareBundle(); // // Check that the dealer had published all the requested data and that the data is consistent // IList<MultStepBCaseShare> publishedShareList = null; // if (recvPublicShares != null) // publishedShareList = recvPublicShares.List; // MultStepBCaseShare publishedShare; // for (int i = 0; i < NumPlayers; i++) // { // if ((recvComplaints[i] != null) && // (recvComplaints[i].Msg.Equals(PlayerNotification.Confirmation.COMPLAINT))) // { // publishedShare = publishedShareList[i]; // if (!IsMultStepShareLegal(publishedShare, recvVerificationPolynomial)) // { // // No need to send any more complaints or aproval- the shares and the R(x) polynomial is public data // dealerIsCheater = true; // Adapter.removePlayer(playerToVerify); //don't send and receive from this player anymore... // break; // } // } // } // } // else // Multistep polynomial, R(x) isn't legal // dealerIsCheater = true; // if (dealerIsCheater) // { // // Found a cheater in multiplication step. Cheater is player number playerToVerify. // RemoveCheaterPlayer(playerToVerify); // } // else abVerifiedList.Add(recvShareFromPlayer_i.AbShare); // } // } // playerToVerify++; //} //// Finally //var firstLineAtInvVanderMonde = GetMultStepCoeffsForCheaters(0); // Contains only the needed coeffs //// Calculate the value of the polynomial H(x) at i = H(i) as defined at GRR //var tempSecret = new Zp(Prime, 0); //int goodPlayerNum = NumGoodPlayers; //for (int i = 0; i < goodPlayerNum; i++) //{ // tempSecret.Add(abVerifiedList[i].Mul(firstLineAtInvVanderMonde[i])); //} //return tempSecret; }
public override void Run() { Debug.Assert(quorumsMap != null); Debug.Assert(Circuit.InputGates.Count == NumParties * NumSlots); // TODO: input must be encrypted with a random number and the random must be secret shared. // share my input in a random input gate (random slot) and share zero in others var randomSlot = StaticRandom.Next(0, NumSlots); for (int s = 0; s < NumSlots; s++) { // TODO: IMPORTANT: EntityId's are assumed to be continous integers with option base 0. Not other parts of the code have this assumption. var gate = Circuit.InputGates[Party.Id * NumSlots + s]; var quorum = quorumsMap[gate.QuorumIndex]; // in the byzantine case, we have to secret share the input among 'quorum' members but // here in the HBC case, we send the masked input to only one member of 'quorum' and randoms to other players. // These randoms form a global random, which is added to the input to mask it. Zp toSend; if (s == randomSlot) toSend = Input; else toSend = new Zp(Prime); // send a zero int mask = 0; var minPlayer = quorum.Min(); var stateKey = new DkmsKey(Stage.Input, gate.Id); foreach (var player in quorum) { if (player != minPlayer) { var rand = StaticRandom.Next(0, Prime); mask += rand; Send(Party.Id, player, new InputMsg(new Zp(Prime, rand), stateKey)); } } Send(Party.Id, minPlayer, new InputMsg(Input + mask, stateKey)); } }
public ShareMessage(BroadcastStage stage, Zp share, int k) : base(stage, k) { Share = share; }
protected virtual void HandleDealer(IList<SecretPolynomials> shareMySecrets, Zp recvSecretShare_i) { // Should send & receive complaints on the bulletin board 1 - I'm not complaining on myself var myDemoComplaint = new PlayerNotification(Confirmation.Approval); // broadcast the complaint using BA //var bcaster = new SecureBroadcaster<PlayerNotification>( // EntityId, myDemoComplaint, EntityIds.Except(BadPlayers).ToList().AsReadOnly(), true, Prime, Send); //bcaster.Run(); //var complaintesOnMe = SecureBroadcaster.PublishAndRead(myDemoComplaint, Prime, BadPlayers); //// Prepare wanted polys according to players complaintes //var wantedPolysList = new List<SecretPolynomials>(); //bool recvCompOnMe = CreateWantedPolynomials(wantedPolysList, complaintesOnMe, shareMySecrets); //if (recvCompOnMe) //{ // // Publish wanted polynomials on the bulletin board // var secretBundle = new SecretPolynomialsBundle(wantedPolysList); // SecureBroadcaster.Publish(secretBundle, BadPlayers); // // Should send&receive complaints on the bulletin board 2 - I'm not complaining on myself // complaintesOnMe = Sendable.asPlayerNotifications( // BulletinBoardProtocol.PublishAndRead(myDemoComplaint, Prime, BadPlayers)); // // Prepare wanted polys according to players complaintes // recvCompOnMe = CreateWantedPolynomials(wantedPolysList, complaintesOnMe, shareMySecrets); // if (recvCompOnMe) // { // // Publish wanted polynomials on the bulletin board // secretBundle = new SecretPolynomialsBundle(wantedPolysList); // BulletinBoardProtocol.Publish(secretBundle, BadPlayers); // // Should send&receive complaints on the bulletin board 3 - I'm not complaining on myself // complaintesOnMe = Sendable.asPlayerNotifications( // BulletinBoardProtocol.PublishAndRead(myDemoComplaint, Prime, BadPlayers)); // // Count complaints number // int numOfcomplaints = GetNumberOfComplaints(complaintesOnMe); // if (numOfcomplaints > PolynomialDeg) // { // // Take the zero polynomial as my input (Not mandatodry) and throw exception // recvSecretShare_i.Value = 0; // throw new Exception("Other players decided that I'm a cheater :- ( - taking my input as zero."); // } // } //} }
protected override Zp GetRecombinedResult(IList<Zp> recvList, int prime) { // Scan recvList - if there are null elements replace them arbitrarily to Zp with zero value for (int i = 0; i < recvList.Count; i++) { if (recvList[i] == null) recvList[i] = new Zp(prime, 0); } var xVlaues = new List<Zp>(); int w = NumTheoryUtils.GetFieldMinimumPrimitive(prime); for (int i = 0; i < recvList.Count; i++) xVlaues.Add(new Zp(prime, NumTheoryUtils.ModPow(w, i, prime))); // Should call Welch-Berlekamp Decoder to fix error at last stage var fixedShares = WelchBerlekampDecoder.Decode(xVlaues, recvList, PolynomialDeg, PolynomialDeg, prime); if (fixedShares == null) throw new Exception("There were more then polynomialDegree = " + PolynomialDeg + " Cheaters - cannot extract results."); return ShamirSharing.Recombine(fixedShares, PolynomialDeg, prime, true); }
/// <summary> /// Starts a heavy-weight SMPC instance for an anchor gate player. /// </summary> protected virtual BgwProtocol RunAnchorMpc(Gate anchor) { // NOTE: since in the HBC case all players have the same output, just one of them (the guy with min id) SMPCs his output to improve performance. Debug.Assert(quorumsMap.ContainsKey(anchor.QuorumIndex)); // find associated quorums var anchorChildren = anchor.InNodes; var myQuorum = quorumsMap[anchor.QuorumIndex]; var virtualIds = new List<int>(myQuorum.Select(p => (anchor.Id << 16) + p)); // TODO: IMPORTANT: THE ASSUMPTION HERE LIMITS ENTITY/GATE IDs TO 32768. TO INCREASE THIS LIMIT EITHER USE UINT/ULONG IDs OR CHANGE THIS CODE. foreach (var childGate in anchorChildren) { foreach (var playerId in quorumsMap[childGate.QuorumIndex]) virtualIds.Add((childGate.Id << 16) + playerId); } var myVirtualId = (anchor.Id << 16) + Party.Id; // if my id is the minimum in my quorum, then I should just SMPC with a zero, otherwise just SMPC with a random number (r_g). // save this random number in the session because it will be my input in next level's SMPC. BgwProtocol mpc; if (Party.Id == myQuorum.Min()) { // run the protocol and keep it in a the session state var key = new MpcKey(anchor.Id, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, new Zp(Prime), OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); } else { // pick a number uniformly at random (r_g) // this random along with other players' randoms forms a global random in the quorum. var randomShare = new Zp(Prime, StaticRandom.Next(0, Prime)); // run an SMPC protocol and keep it in a session state var key = new MpcKey(anchor.Id, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, randomShare, OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); } return mpc; }
/// <summary> /// Implementation according to Ran Canetti /// </summary> public override void RunReductionRandomization(Zp ab) { throw new NotImplementedException(); //// performing Improved reduction & randomization step //bool cheaterFound = true; //IList<Zp> recvSharesFromPlayers = null; //while (cheaterFound) //{ // cheaterFound = false; // /* Share secret by VSS */ // recvSharesFromPlayers = SendInput(ab); // /* Generate a t degree polynomial, hi(x) , with a free coeef that equals 'ab' and create share for users from it */ // //List<Zp> shareResultWithPlayers = Shamir.primitiveShare(ab, numberOfPlayers , polynomialDeg); // /* Send to the j-th user hi(j) and receive from every other k player hk(i) */ // //recvSharesFromPlayers = shareSimple(shareResultWithPlayers); // /* Check if there were some null elements - from not playing players or cheater players and put zero instead - arbitrarily */ // for (int i = recvSharesFromPlayers.Count - 1; i >= 0; i--) // { // if (recvSharesFromPlayers[i] == null) // recvSharesFromPlayers[i] = new Zp(Prime, 0); // if (BadPlayers.Contains(i)) // recvSharesFromPlayers.RemoveAt(i); // } // var calculationPolyCoeffs = new List<Zp>(); // /* Fill the first 2t+1 coeff with zero arbitrarily */ // for (int i = 0; i < 2 * PolynomialDeg + 1; i++) // calculationPolyCoeffs.Add(new Zp(Prime, 0)); // /* Perform the following iteration to calculate the 2t+1...n coeffs of the calculation polynomial*/ // for (int k = 2 * PolynomialDeg + 1; k < recvSharesFromPlayers.Count; k++) // { // var K_LineAtInvVanderMonde = GetMultStepCoeffsForCheaters(k); // /* Calculate your share of the K-th coeff at the calculation polynomial */ // var myK_CoeffShare = new Zp(Prime, 0); // for (int i = 0; i < recvSharesFromPlayers.Count; i++) // { // myK_CoeffShare.Add(recvSharesFromPlayers[i].ConstMul(K_LineAtInvVanderMonde[i])); // } // /* Send this to all other players so all of you could recombine the real k-th coeff - no need to use the bulletin board */ // var K_CoeffShares = ShareSimple(myK_CoeffShare); // /* Fix the received codeword and get the Recombined result */ // calculationPolyCoeffs.Add(GetRecombinedResult(K_CoeffShares, Prime)); // } // var calculationPoly = new Polynomial(calculationPolyCoeffs); // if (calculationPoly.Degree == -1) // { // /* No one cheated at this stage */ // break; // } // var XValues = new List<Zp>(); // int w = Zp.GetFieldMinimumPrimitive(Prime); // for (int i = 0; i < NumPlayers; i++) // { // XValues.Add(new Zp(Prime, Zp.CalculatePower(w, i, Prime))); // } // /* Create the distorted code word */ // var distortedCodeword = new List<Zp>(); // for (int i = 0; i < NumPlayers; i++) // distortedCodeword.Add(calculationPoly.Sample(XValues[i])); // var fixedCodeword = WelchBerlekampDecoder.decode(XValues, distortedCodeword, PolynomialDeg, 2 * PolynomialDeg, Prime); // // Check For exception in codeword fixing // if (fixedCodeword == null) // { // string errorStr = "There were more then polynomialDegree = " + PolynomialDeg + " Cheaters - cannot complete mult step."; // throw new Exception(errorStr); // } // for (int i = 0; i < fixedCodeword.Count; i++) // { // if (!BadPlayers.Contains(i) && !fixedCodeword[i].Equals(distortedCodeword[i])) // { // // Player Number i is a multi-step cheater! // cheaterFound = true; // RemoveCheaterPlayer(i); // // Continue at iteration till no one will cheat // } // } //} ///* Finally calculate your share - we will get here if no one had tried to cheat */ //var firstLineAtInvVanderMonde = GetMultStepCoeffsForCheaters(0); ///* Calculate your share of the K-th coeff at the calculation polynomial */ //var tempSecret = new Zp(Prime, 0); //for (int i = 0; i < recvSharesFromPlayers.Count; i++) //{ // tempSecret.Add(recvSharesFromPlayers[i].ConstMul(firstLineAtInvVanderMonde[i])); //} //return tempSecret; }
//public override void Receive(Message msg) //{ // Gate anchor, myGate; // var ssmpcMsg = msg as ScalableMpcMessage; // Debug.Assert(ssmpcMsg != null); // switch (ssmpcMsg.StateKey.Stage) // { // case Stage.Input: // var inputMsg = ssmpcMsg as InputMessage; // // start a heavy-weight smpc with parent and sibling gates // myGate = Circuit.FindGate(ssmpcMsg.StateKey.GateId); // RunChildMpc(myGate.OutNodes[0], myGate, inputMsg.Data); // break; // case Stage.Mpc: // MpcProtocol smpc; // var mpcMsg = ssmpcMsg as MpcMessage; // if (MpcSessions.ContainsKey(smpcMsg.StateKey)) // mpc = MpcSessions[mpcMsg.StateKey].Mpc; // else // { // // I must be in the anchor gate // Debug.Assert(mpcMsg.ToGateId == mpcMsg.AnchorId, "Synchronization exception: Why don't I have an session for this MPC?"); // // my child gate is asking me to participate in an MPC, so create an MPC protocol instance and join // anchor = Circuit.FindGate(mpcMsg.AnchorId); // mpc = RunAnchorMpc(anchor); // } // mpc.Receive(mpcMsg.InnerMessage); // break; // } //} /// <summary> /// Starts a heavy-weight SMPC instance for an SMPC child gate player. /// </summary> protected virtual BgwProtocol RunChildMpc(Gate anchor, Gate myGate, Zp myInput) { Debug.Assert(quorumsMap.ContainsKey(anchor.QuorumIndex)); Debug.Assert(quorumsMap.ContainsKey(myGate.QuorumIndex)); // find associated quorums var childGates = anchor.InNodes; var myGateId = myGate.Id; var virtualIds = new List<int>(quorumsMap[anchor.QuorumIndex].Select(p => (anchor.Id << 16) + p)); // TODO: IMPORTANT: THE ASSUMPTION HERE LIMITS ENTITY/GATE IDs TO 32768. TO INCREASE THIS LIMIT EITHER USE UINT/ULONG IDs OR CHANGE THIS CODE. foreach (var gate in childGates) { foreach (var playerId in quorumsMap[gate.QuorumIndex]) virtualIds.Add((gate.Id << 16) + playerId); } var myVirtualId = (myGateId << 16) + Party.Id; // run the protocol and keep it in a the session state var key = new MpcKey(myGateId, anchor.Id); // Mahdi (3/25/14: Do we really need virtual ids?) throw new NotImplementedException(); //var mpc = new BgwProtocol(anchor.MpcCircuit, virtualIds.AsReadOnly(), myVirtualId, myInput, OnMpcSend, key); //mpc.MpcFinish += new FinishHandler(OnMpcFinish); //MpcSessions.Collect(key, new MpcSession(mpc)); //mpc.Run(); //return mpc; }
protected void ShareSecret(Zp secret, IList<int> players, DkmsKey key) { var shares = ShamirSharing.Share(secret, players.Count, players.Count - 1); var shareMsgs = new List<ShareMsg<Zp>>(); foreach (var share in shares) shareMsgs.Add(new ShareMsg<Zp>(new Share<Zp>(share), key)); Send(players, shareMsgs); }
private void UpdateRecvShare(IList<SecretPolynomials> recvPublicPolysList, Zp recvSecretShare_i) { if ((recvPublicPolysList != null)) { var newRecvSercretPoly = recvPublicPolysList[Party.Id]; if (newRecvSercretPoly != null) { var recvShare = newRecvSercretPoly.Fi_xPolynomial[0]; if (recvShare != null) recvSecretShare_i.Value = recvShare.Value; } } }
public ShareMessage(BroadcastStage stage, Zp share, int k) : base(stage, k) { Share = share; }
protected virtual void HandleNotDealer(bool isOrigPolyLegal, IList<Coordinate> wrongCoordinatesList, int playerToVerify, Zp recvSecretShare_i, SecretPolynomials secretPoly_i) { //// Step 2 - Check and advertise results to players on the bulletin board //var foundWrongValue1 = !isOrigPolyLegal || (wrongCoordinatesList.Count != 0); //var complaintValue = new PlayerNotification(foundWrongValue1 ? Confirmation.Complaint : Confirmation.Approval); //var recvComplaintesList = Sendable.asPlayerNotifications( // BulletinBoardProtocol.PublishAndRead(complaintValue, Prime, BadPlayers)); //// Count complaints number //int numOfcomplaints = GetNumberOfComplaints(recvComplaintesList); //// Step 3 - If there is a need, receive polynomials for the complainig sides and verify it //// currently check only polynomials - not wrong coordinates //if (numOfcomplaints != 0) //{ // // Should get a list of the public polynomials from player 'playerToVerify' - get info from the bulletin board // var sendablePolysRecv = BulletinBoardProtocol.Read(playerToVerify, Prime); // IList<SecretPolynomials> recvPublicPolysList1 = null; // if (sendablePolysRecv != null) // recvPublicPolysList1 = sendablePolysRecv.asSecretPolynomialsBundle().List; // if (foundWrongValue1) // UpdateRecvShare(recvPublicPolysList1, recvSecretShare_i); // bool foundWrongValue2 = (!isOrigPolyLegal) || IsPublicDataContradictPrivate(secretPoly_i, recvPublicPolysList1, recvComplaintesList, recvSecretShare_i); // // Check and advertise results to players on the bulletin board // complaintValue = new PlayerNotification(foundWrongValue2 ? Confirmation.Complaint : Confirmation.Approval); // recvComplaintesList = Sendable.asPlayerNotifications( // BulletinBoardProtocol.PublishAndRead(complaintValue, Prime, BadPlayers)); // // Count complaints number // numOfcomplaints = GetNumberOfComplaints(recvComplaintesList); // // Step 4 - If there is a need, recieve polynomials for the complainig sides and verify it // if (numOfcomplaints != 0) // { // // Should get a list of the public polynomials from player 'playerToVerify' - get info from the bulletin board // sendablePolysRecv = BulletinBoardProtocol.Read(playerToVerify, Prime); // IList<SecretPolynomials> recvPublicPolysList2 = null; // if (sendablePolysRecv != null) // recvPublicPolysList2 = sendablePolysRecv.asSecretPolynomialsBundle().List; // if (foundWrongValue2) // UpdateRecvShare(recvPublicPolysList2, recvSecretShare_i); // bool foundWrongValue3 = (!isOrigPolyLegal) || IsPublicDataContradictPrivate(secretPoly_i, recvPublicPolysList2, recvComplaintesList, recvSecretShare_i); // foundWrongValue3 = foundWrongValue3 || IsNewPublicDataContradictOld(recvPublicPolysList1, recvPublicPolysList2); // // Check and advertise results to players on the bulletin board // complaintValue = new PlayerNotification(foundWrongValue3 ? Confirmation.Complaint : Confirmation.Approval); // recvComplaintesList = Sendable.asPlayerNotifications( // BulletinBoardProtocol.PublishAndRead(complaintValue, Prime, BadPlayers)); // // Count complaints number // numOfcomplaints = GetNumberOfComplaints(recvComplaintesList); // /* Step 5 - Check if there is more than 'polynomialDeg' complaintes or recption timeout occured */ // if (numOfcomplaints > PolynomialDeg) // { // // Found a cheater player: playerToVerify - taking its input as zero. // // Take the zero polynomial as this user input // recvSecretShare_i.Value = 0; // RemoveCheaterPlayer(playerToVerify); // don't send and receive from this player anymore... // } // } //} //throw new NotImplementedException(); }
private IList<Zp> ConstructRxPolynomial(ShareDetails aSharesDetails, ShareDetails bSharesDetails, ShareDetails abSharesDetails, ShareDetails rSharesDetails) { var fax = aSharesDetails.RandomPolynomial; var fbx = bSharesDetails.RandomPolynomial; var hx = abSharesDetails.RandomPolynomial; var rx = rSharesDetails.RandomPolynomial; var RxPolynomial = new Zp[2 * PolynomialDeg + 1]; /* Initialize RxPolynomial coefs with zeros */ for (int i = 0; i < 2 * PolynomialDeg + 1; i++) RxPolynomial[i] = new Zp(Prime, 0); /* First calculate fax*fbx - hx */ for (int i = 0; i < fax.Count; i++) { Zp temp = fax[i]; for (int j = 0; j < fax.Count; j++) RxPolynomial[i + j].Add(temp.ConstMul(fbx[j])); RxPolynomial[i].Sub(hx[i]); } /* Calculate x*rx+fax*fbx - hx*/ for (int i = 0; i < rx.Count; i++) RxPolynomial[i + 1].Add(rx[i]); return new List<Zp>(RxPolynomial); }
private bool IsMultStepShareLegal(MultStepBCaseShare recvShareFromPlayer_i, MultStepVerificationPoly recvVerifcationPolynomial) { if (!IsRecvShareLegal(recvShareFromPlayer_i)) return false; var RxPolynomial = recvVerifcationPolynomial.RxPolynomial; Zp Ratpoint0 = Zp.EvalutePolynomialAtPoint(RxPolynomial, new Zp(Prime, 0)); if (!Ratpoint0.Equals(new Zp(Prime, 0))) { return false; } int w = NumTheoryUtils.GetFieldMinimumPrimitive(Prime); var w_InMyIndex = new Zp(Prime, NumTheoryUtils.ModPow(w, Party.Id, Prime)); Zp RjFromPublicPolynomial = Zp.EvalutePolynomialAtPoint(RxPolynomial, w_InMyIndex); Zp temp = recvShareFromPlayer_i.AShare.ConstMul(recvShareFromPlayer_i.BShare).ConstSub(recvShareFromPlayer_i.AbShare); Zp RjFromRecvPrivateInfo = w_InMyIndex.ConstMul(recvShareFromPlayer_i.RShare).ConstAdd(temp); if (!RjFromPublicPolynomial.Equals(RjFromRecvPrivateInfo)) return false; return true; }
public UserAssignment(long bridgePseudonym, Zp bridgeShare) { BridgePseudonym = bridgePseudonym; BridgeShare = bridgeShare; }
/* * Finds a solution to a system of linear equations represtented by an * n-by-n+1 matrix A: namely, denoting by B the left n-by-n submatrix of A * and by C the last column of A, finds a column vector x such that Bx=C. * If more than one solution exists, chooses one arbitrarily by setting some * values to 0. If no solutions exists, returns false. Otherwise, places * a solution into the first argument and returns true. * * Note : matrix A changes (gets converted to row echelon form). */ private static Zp[] linearSolve(ZpMatrix A, ZpMatrix B, int prime) { var invArray = NumTheoryUtils.GetFieldInverse(prime); var C = ZpMatrix.GetConcatenationMatrix(A, B); // augmented matrix int n = C.RowCount; int[] solution = new int[n]; int temp; int firstDeterminedValue = n; // we will be determining values of the solution // from n-1 down to 0. At any given time, // values from firstDeterminedValue to n-1 have been // found. Initializing to n means // no values have been found yet. // To put it another way, the variabe firstDeterminedValue // stores the position of first nonzero entry in the row just examined // (except at initialization) int rank = C.Gauss(); int[][] cContent = C.Data; // can start at rank-1, because below that are all zeroes for (int row = rank - 1; row >= 0; row--) { // remove all the known variables from the equation temp = cContent[row][n]; int col; for (col = n - 1; col >= firstDeterminedValue; col--) temp = Zp.Modulo(temp - (cContent[row][col] * solution[col]), prime); // now we need to find the first nonzero coefficient in this row // if it exists before firstDeterminedValue // because the matrix is in row echelon form, the first nonzero // coefficient cannot be before the diagonal for (col = row; col < firstDeterminedValue; col++) { if (cContent[row][col] != 0) break; } if (col < firstDeterminedValue) // this means we found a nonzero coefficient { // we can determine the variables in position from col to firstDeterminedValue // if this loop executes even once, then the system is undertermined // we arbitrarily set the undetermined variables to 0, because it make math easier for (int j = col + 1; j < firstDeterminedValue; j++) solution[j] = 0; // Now determine the variable at the nonzero coefficient //div(solution[col], temp, A.getContent()[row][col]); solution[col] = temp * invArray[Zp.Modulo(cContent[row][col], prime)]; firstDeterminedValue = col; } else { // this means there are no nonzero coefficients before firstDeterminedValue. // Because we skip all the zero rows at the bottom, the matrix is in // row echelon form, and firstDeterminedValue is equal to the // position of first nonzero entry in row+1 (unless it is equal to n), // this means we are at a row with all zeroes except in column n // The system has no solution. return null; } } // set the remaining undetermined values, if any, to 0 for (int col = 0; col < firstDeterminedValue; col++) solution[col] = 0; var ResultVec = new Zp[n]; for (int i = 0; i < n; i++) ResultVec[i] = new Zp(prime, solution[i]); return ResultVec; }