Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BLST Rust bindings: Aggregation fails if vk or sig lists include identity elements #2321

Open
curiecrypt opened this issue Feb 19, 2025 · 0 comments · May be fixed by #2322
Open

BLST Rust bindings: Aggregation fails if vk or sig lists include identity elements #2321

curiecrypt opened this issue Feb 19, 2025 · 0 comments · May be fixed by #2322
Assignees
Labels
bug ⚠️ Something isn't working cryptography 🔐 Cryptography related

Comments

@curiecrypt
Copy link
Collaborator

Context & versions

In the C implementation of the pippenger function, it mentions that;

/*
 * Infinite point among inputs would be devastating. Shall we change it?
 */

Meaning that C function breaks if you provide the identity of the group among the inputs. It does not make sense to add it, as the identity scaled and added will not alter the answer, but it does imply that this function is unsafe without a proper check that the inputs do not include zero.
Now, the weird thing is, the rust bindings for blst do not make this check.
And indeed, if you add this identity to the inputs, the result of running this little test is that the msm indeed returns infinity and not the expected unchanged non-zero point:

Steps to reproduce

These lines in /mithril-stm/src/multi_sig.rs are impacted:

let grouped_vks = p2_affines::from(transmuted_vks.as_slice());
let grouped_sigs = p1_affines::from(transmuted_sigs.as_slice());

If the transmuted_{vks/sigs} contains the identity element, both p2_affines::from() and p1_affines::from() will return the identity element (which may trivially satisfy conditions like signatures checks).

Actual behavior

If the transmuted_{vks/sigs} contains the identity element, both p2_affines::from() and p1_affines::from() convert all elements in the lists to identity elements.

Expected behavior

There should be no identity element in the signature and verification key list. Even if there is any, functions should not convert all elements to identity elements.

@curiecrypt curiecrypt self-assigned this Feb 19, 2025
@curiecrypt curiecrypt added bug ⚠️ Something isn't working cryptography 🔐 Cryptography related labels Feb 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug ⚠️ Something isn't working cryptography 🔐 Cryptography related
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant