multi-party-sig-cpp
multi-party-sig-cpp copied to clipboard
`MpcContext` with local share public to protocol Rounds(eg. gg18 and gg20) cause security issue
We notice that gg18 and gg20 protocols, their sub-protocols refresh and sign are implemented by importing keys, then constructing MpcContext
and providing it to multiple Rounds
to perform cryptographic operations. The MpcContext in a Round is a public member, and furthermore its local share (SSS slice) is also public, exposing the local share publicly during the execution of each Round, which is a security risk for key management!
Note: The private key slice (local share
) should be destroyed as soon as it is used up, with strict lifecycle control and no public access. (From PlatON Cryptography Team)