Subject: [Cfrg] Threshold Noise/Wireguard

From: Denis Kolegov <[email-masked]>
Date: Fri, 29 May 2020 10:26:34 +0700

Hello Everyone.

Noise Protocol Framework and WireGuard protocol implementing one of the
Noise's patterns have been becoming more popular in recent years.

I think it would be interesting and useful in many cases to apply WireGuard
in a threshold setting. WireGuard is based on Curve25519.

There is a draft "Threshold Modes in Elliptic Curves" (
https://tools.ietf.org/html/draft-hallambaker-threshold-02) that considers
threshold Diffie-Hellman. The basic idea that also can be used in WireGuard
is described in the sections 3/3.1 of the draft.

There are N parties and the basic threshold scheme is (N, N).
Let x1, ..., xN be the secret keys (shares) of p1, ..., pN parties working
on Bob side.
Let Y be the public key of Alice.

The initial idea was pretty straightforward:  xY = (x1 + ... + xN)Y = x1Y +
... + xnY.

The main problem is the distributed key generation without a dealer. Other
problems like point addition and encoding were considered in the draft.

WireGuard uses Curve25519. It is known that Curve25519's private key (the
first and the last bytes) must be masked:
     private[0] &= 248;
     private[31] &= 127;
     private[31] |= 64;

So Curve25519 private key must belong to S = {0, 8, 16, 24, ..., 248} × {0,
1, . . ., 255}^30 × {64, 65, 66, . . ., 127}.

This means that shares x1, ..., xN and the final private key must be from S.

I am very interested in the group working on this.

Is anyone interested to work on this scheme?
-- 
Sincerely,
Denis Kolegov
@dnkolegov