multi-party-sig-cpp icon indicating copy to clipboard operation
multi-party-sig-cpp copied to clipboard

`MpcContext` with local share public to protocol Rounds(eg. gg18 and gg20) cause security issue

Open joyoFeng opened this issue 1 year ago • 0 comments

We notice that gg18 and gg20 protocols, their sub-protocols refresh and sign are implemented by importing keys, then constructing MpcContext and providing it to multiple Rounds to perform cryptographic operations. The MpcContext in a Round is a public member, and furthermore its local share (SSS slice) is also public, exposing the local share publicly during the execution of each Round, which is a security risk for key management!

Note: The private key slice (local share) should be destroyed as soon as it is used up, with strict lifecycle control and no public access. (From PlatON Cryptography Team)

joyoFeng avatar Apr 28 '23 08:04 joyoFeng