# bron-crypto

Bron's Advanced Cryptography Library

This library provides implementations of state-of-the-art cryptographic protocols, written by cryptographers for cryptographers, using modern software engineering practices. Our approach is characterized by the following principles:

1. **Redundancy**: Since we operate at the frontier of cryptographic research rather than in the domain of "settled" cryptography, we plan for yet-unknown protocol-level vulnerabilities by providing alternative implementations that rely on different cryptographic assumptions and tools.

2. **Reusability**: Cryptography code is typically written once, audited, and then forgotten. We aim for reusability through modular design. For example, our [sigma protocols](./pkg/proofs/sigma/) can be made non-interactive using different [compilers](./pkg/proofs/sigma/compiler/) ([Fiat-Shamir](./pkg/proofs/sigma/compiler/fiatshamir/), [Fischlin](./pkg/proofs/sigma/compiler/fischlin/), [Randomised Fischlin](./pkg/proofs/sigma/compiler/randfischlin/)) or [composed](./pkg/proofs/sigma/compose/) together ([AND](./pkg/proofs/sigma/compose/sigand/), [OR](./pkg/proofs/sigma/compose/sigor/)) with minimal additional code. Similarly, our [CRT](./pkg/base/nt/crt) and [Fast modular arithmetic](./pkg/base/nt/modular/) is implemented independently so that both [Paillier](./pkg/encryption/paillier/) and future applications like RSA can use it. We have also made extensive use of interfaces (see [commitments.go](./pkg/commitments/commitments.go) or [encryption.go](./pkg/encryption/encryption.go)/[kemdem.go](./pkg/encryption/kemdem.go)) to maximally cover future applications.

## Focus

The primary focus of this library is MPC (Multi-Party Computation), specifically MPC signing over arbitrary monotone access structures (threshold, unanimity, CNF, hierarchical conjunctive, boolean-expression, …). We support the following protocols:

- **MPC Schnorr**: [Lindell22](./pkg/mpc/signatures/schnorr/lindell22/) ([Reference](https://eprint.iacr.org/2022/374))
- **MPC ECDSA**: [DKLs23](./pkg/mpc/signatures/ecdsa/dkls23/) ([Reference](https://eprint.iacr.org/2023/765)) and [Lindell17](./pkg/mpc/signatures/ecdsa/lindell17/) for qualified two-party MSP quorums ([Reference](https://eprint.iacr.org/2017/552)). We provide two variants of DKLs23: [one](./pkg/mpc/signatures/ecdsa/dkls23/signing_softspoken/) using OT extensions, and [one](./pkg/mpc/signatures/ecdsa/dkls23/signing_bbot/) without OT extensions.
- **MPC BLS**: [Boldyreva02](./pkg/mpc/signatures/bls/boldyreva02/) ([Reference](https://link.springer.com/chapter/10.1007/3-540-36288-6_3))

The design of MPC signing protocols are stateless. Orchestrating them is not in scope of this library; this includes implementation of the networking layer as well. For example, to establish the broadcast channel one typically has to do [Echo-Broadcast](./pkg/network/echo/) yet this is implemented as a separate package.

## Security Notice

This library is not designed to be fully side-channel resistant. We build higher-level protocols on top of a side-channel resistant foundation of elliptic curve (usually generated by fiat-cryptography, for example see [K256](./pkg/base/curves/k256/impl/)) and [big integer operations](./pkg/base/nt/numct/) (wraps [saferith](https://github.com/cronokirby/saferith) and [BoringSSL](./pkg/base/cgo/boring/)).

**Secure erasure**: Bron protocols are stateless and do not securely erase or invalidate secret material for callers. Applications integrating this library are responsible for the lifecycle and secure erasure of private keys, shares, witnesses, transcripts, serialized copies, backups, and any other secret state. This is especially important for share refresh, recovery, and redistribution: these protocols create new shares, but old shares may remain valid and security may be undermined unless the application reliably destroys every obsolete copy.

**Important**: This library is intended for use by experienced cryptographers and developers who understand the security implications of the protocols involved. If you are not familiar with the underlying cryptographic primitives, please consult with a cryptography expert before using this library in production.

**Audit**: The MPC signing packages of this library and all their direct and indirect dependencies have been audited by [Trail of Bits](https://github.com/trailofbits/publications?tab=readme-ov-file#cryptography-reviews) and the audit report may be found in the [audits](./audits/) directory. The current Lindell17 MSP adaptation postdates that review; see its [package documentation](./pkg/mpc/signatures/ecdsa/lindell17/) for scope details.

For the full Security Notice, including how to submit bugs, see [SECURITY.md](./SECURITY.md)

## Documentation

Public documentations can be found at [https://pkg.go.dev/github.com/bronlabs/bron-crypto](https://pkg.go.dev/github.com/bronlabs/bron-crypto)

To access the documentation of the local version, run godoc -http=:6060 and open the following url in your browser.

[http://localhost:6060/pkg/github.com/bronlabs/bron-crypto](http://localhost:6060/pkg/github.com/bronlabs/bron-crypto)

### Specification

A draft of our formal specification can be found in [docs](./docs/bron_spec.pdf). However, based on our experience, LaTeX-based specification tends always be trailing the code. We are experimenting with new kinds of specifications and will update the repo in time.

## Installation

```bash
go get github.com/bronlabs/bron-crypto
```

Note: This library requires CGO and links against BoringSSL. See [DEVELOPMENT.md](./DEVELOPMENT.md) for build prerequisites and setup instructions.

## Development

To set up the repository for development, see [DEVELOPMENT.md](./DEVELOPMENT.md).

## Maintainers

- [Alireza Rafiei](https://www.linkedin.com/in/alireza-rafiei/)
- [Mateusz Kramarczyk](https://www.linkedin.com/in/mateusz-kramarczyk-9b211125/)

### Alumni

- [Alberto Ibarrondo Luis](https://www.linkedin.com/in/albertoibarrondo/)
- [Hoang Ong](https://www.linkedin.com/in/hoangong/)
- [Paul Germouty](https://www.linkedin.com/in/paul-germouty-01506314a/)
- [Alexandre Adomnicai](https://www.linkedin.com/in/alexandre-adomnicai/)
- [Mohammad Sarraf](https://www.linkedin.com/in/mohammad-sarraf/)

## License

SPDX-License-Identifier: Apache-2.0

See [LICENSE](./LICENSE) and [thirdparty/NOTICE](thirdparty/NOTICE) files for details.