feat(tss): bump tss-lib v2.0.3 to v3.0.1 - #164
Merged
Merged
Conversation
Migrate to fystack/tss-lib v3.0.1 (GG20 session binding + SRC-2026-573 hardening). Update module path v2->v3 across root and e2e modules. Adapt pkg/mpc/ckd.go to the v3 API change where ckd.ExtendedKey.PublicKey moved from *crypto.ECPoint to ecdsa.PublicKey; the ECDSA/EdDSA UpdateSinglePublicKeyAndAdjustBigXj helpers now take an ecdsa.PublicKey child key and convert internally. Compatibility with v2-generated wallets verified: - LocalPartySaveData JSON format unchanged; existing shares load and sign. - EdDSA CKD addresses unchanged (local reimpl already reduced IL mod N, which v3 now matches). Add regression tests: - pkg/ckdutil golden vectors pinning ECDSA/EdDSA child pubkeys so any future derivation drift fails loudly. - pkg/mpc CKD update-and-adjust invariants. Verified: unit tests + full e2e (keygen, signing, CKD signing, resharing) green on 3 v3 nodes.
vietddude
force-pushed
the
feat/bump-tss-lib-v3
branch
from
August 31, 2026 02:55
186564b to
f9ae2e1
Compare
tss-lib v3 mixes an optional session nonce into the SSID that every ZK proof
is bound to (GG20 session binding). Without it, keygen and resharing run with
ssidNonce = 0, so two ceremonies among the same node set share an SSID and a
proof from one is valid in the other.
Derive the nonce as SHA-256(domainTag || 0x1f || initiatorPayload), where
initiatorPayload is the exact signed body of the initiator request
(msg.Raw()). Every node already verifies the same signed request, so every
node derives an identical nonce with no extra coordination round; the domain
tag keeps keygen / signing / resharing nonces disjoint.
- pkg/mpc/session_nonce.go: SessionNonceFromInitiator + newTSSParameters /
newTSSReSharingParameters wrappers that require the nonce (fail-fast).
- Thread sessionNonce through Create{KeyGen,Signing,Reshare}Session and the
session constructors; KeyGenSession.Init() now returns error.
- eventconsumer derives the nonce right after AuthorizeInitiatorMessage and
handles the new Init() errors.
No client-facing change: pkg/types wire messages are untouched, the nonce is
derived server-side from fields the client already sends and signs. All nodes
must upgrade together (mixed nonce/no-nonce nodes compute different SSIDs).
|
anhthii
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrate to
fystack/tss-libv3.0.1 (GG20 session binding + SRC-2026-573 hardening). Module path bumpedv2→v3across root ande2emodules.The only API break requiring code changes:
ckd.ExtendedKey.PublicKeymoved from*crypto.ECPointtoecdsa.PublicKey. Adaptedpkg/mpc/ckd.go— the ECDSA/EdDSAUpdateSinglePublicKeyAndAdjustBigXjhelpers now take anecdsa.PublicKeychild key and convert internally.Compatibility with existing (v2-generated) wallets
LocalPartySaveDataJSON format is identical between v2.0.3 and v3.0.1 (only import paths differ).IL mod N; v3 now matches it (v3 actually fixes non-hardened EdDSA CKD, which errored ~94% of the time under v2).Tests added
pkg/ckdutil/golden_compat_test.go— golden vectors pinning ECDSA/EdDSA child pubkeys so any future derivation drift fails loudly.pkg/mpc/ckd_update_test.go— invariants of the CKD update-and-adjust helpers.Verification
TestKeyGeneration,TestSigning,TestCKDSigning(ECDSA+EdDSA),TestResharing+ signing-after-reshare — all PASS, 0 fail / 0 skip.v3 binds
ssidinto proofs, so v2 and v3 nodes cannot interoperate. All 3 nodes must be upgraded together (no rolling/mixed-version rollout).