Collective Edwards-Curve Digital Signature Algorithm

Under Development and sparsely tested, please use at your own risk.

Installation

The only dependency is libsodium (tested with version 1.0.17).

git clone https://github.com/jpopesculian/ed25519-cosi.git $INSTALL_DIR
cd $INSTALL_DIR
make
sudo make install

Testing

Requires libcheck

make check

Usage

The Collective Edwards-Curve Digital Signature Algorithm is based upon B.
Ford’s draft at
https://tools.ietf.org/id/draft-ford-cfrg-cosi-00.html.
This library includes both creating and verifying collective signatures.

Signature Generation

Include

Include <ed25519_cosi.h> header in your source file and compile with
-led25519_cosi and -lsodium ld flags.

Setup

It’s up to the implementation to decide how to communicate with participants.
The Draft suggests Protocol Buffers and has appropriate schemas. In addition an
ordered list of public keys needs to be available for the “Leader” and
a verifier to reference. In addition collective public key will be made and
distributed by using ed25519_cosi_update_public_key (using
ed25519_cosi_SC_ONE as a base value).

Announcement

It’s up to the implementation to decide how to the Leader will announce to the
participants that a message will be signed. A collective signature mask should
be initialized here for the signature (a byte array of length
ed25519_cosi_mask_len(n) where n is the number of participants
corresponding to the public key list and should be initialized with
ed25519_cosi_mask_init).

Commitment

If a participant wants to sign he/she will create a commitment
ed25519_cosi_commit generating a nonce he/she must store and a public
commitment to be sent to the Leader. The Leader will then collect the public
commitments using ed25519_cosi_update_commit (using ed25519_cosi_SC_ONE as
a base value).

On commitment receipt, the Leader needs to update the collective signature mask
using ed25519_cosi_mask_enable for responding participants.

Challenge

After creating the collective commitment, the Leader will then create
a challenge with ed25519_cosi_challenge and broadcast the collective
challenge participants (he/she should include the message and commitment so
that the participants can verify).

Response

After receiving and verifying the challenge, participants will create
a response with ed25519_cosi_response and their stored nonce value and send
back to the Leader. On receipt of a response, the Leader will use
ed25519_cosi_update_response to collect the responses (using
ed25519_cosi_SC_ZERO as a base).

Signature Creation

The Leader will then combine the collective commitment, collective response and
collective signature mask together with ed25519_cosi_signature to create the
signature itself.

Signature Verification

To signature can be verified in two steps. Through a policy and through cryptography.

Policy Verification

A policy is used to check who participated in a collective signature. It can be
such things as m of n or checking that certain people signed or any
combination / permutation of those. The library offers helpers such as
ed25519_cosi_did_sign and ed25519_cosi_num_signatures to help build such
a policy (ed25519_cosi_valid_length or ed25519_cosi_valid_signature should
be called before verifying a policy).

Cryptographic Verification

Given the message, signature and the list of participants public keys (in the
same order as used in the signature generation process), someone can verify the
collective signature using ed25519_cosi_valid_signature.