Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix formatting of code blocks #3

Merged
merged 3 commits into from
Mar 18, 2024
Merged

Fix formatting of code blocks #3

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
32c9146
Fix code block syntax
emlun Mar 5, 2024
9369b79
Fix line lengths in txt output
emlun Mar 5, 2024
6d5c7df
Remove unused references
emlun Mar 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
105 changes: 53 additions & 52 deletions draft-bradleylundberg-cfrg-arkg.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,13 +41,10 @@ contributor:
organization: Yubico

normative:
hkdf: RFC5869
RFC2104:
RFC2119:
RFC3279:
RFC4949:
RFC6090:
RFC5869:
RFC6090:
BIP32:
target: https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki
title: BIP 32 Hierarchical Deterministic Wallets
Expand Down Expand Up @@ -363,24 +360,25 @@ The delegating party generates the ARKG seed pair `(pk, sk)`
and keeps the private seed `sk` secret, while the public seed `pk` is provided to the subordinate party.
The subordinate party will then be able to generate public keys on behalf of the delegating party.

```
~~~pseudocode
ARKG-Generate-Seed() -> (pk, sk)
Options:
BL The key blinding scheme chosen for the ARKG instantiation.
KEM The key encapsulation mechanism chosen for the ARKG instantiation.
BL A key blinding scheme.
KEM A key encapsulation mechanism.

Inputs: None

Output:
(pk, sk) An ARKG seed key pair with public key pk and private key sk.
(pk, sk) An ARKG seed key pair with public key pk
and private key sk.

The output (pk, sk) is calculated as follows:
The output (pk, sk) is calculated as follows:

(pk_kem, sk_kem) = KEM-Generate-Keypair()
(pk_bl, sk_bl) = BL-Generate-Keypair()
pk = (pk_kem, pk_bl)
sk = (sk_kem, sk_bl)
```
(pk_kem, sk_kem) = KEM-Generate-Keypair()
(pk_bl, sk_bl) = BL-Generate-Keypair()
pk = (pk_kem, pk_bl)
sk = (sk_kem, sk_bl)
~~~


### The function ARKG-Derive-Public-Key
Expand All @@ -392,26 +390,28 @@ and the resulting key handle `kh` can be used by the delegating party to derive
This function may be invoked any number of times with the same public seed,
in order to generate any number of public keys.

```
~~~pseudocode
ARKG-Derive-Public-Key((pk_kem, pk_bl), info) -> (pk', kh)
Options:
BL The key blinding scheme chosen for the ARKG instantiation.
KEM The key encapsulation mechanism chosen for the ARKG instantiation.
MAC The MAC scheme chosen for the ARKG instantiation.
KDF The key derivation function chosen for the ARKG instantiation.
L_bl The length in octets of the blinding factor tau of the key blinding scheme BL.
L_mac The length in octets of the MAC key of the MAC scheme MAC.
BL A key blinding scheme.
KEM A key encapsulation mechanism.
MAC A MAC scheme.
KDF A key derivation function.
L_bl The length in octets of the blinding factor tau
of the key blinding scheme BL.
L_mac The length in octets of the MAC key
of the MAC scheme MAC.

Inputs:
pk_kem A key encapsulation public key.
pk_bl A key blinding public key.
info Optional context and application specific information
(can be a zero-length string).
pk_kem A key encapsulation public key.
pk_bl A key blinding public key.
info Optional context and application specific
information (can be a zero-length string).

Output:
pk' A blinded public key.
kh A key handle for deriving the blinded
secret key sk' corresponding to pk'.
pk' A blinded public key.
kh A key handle for deriving the blinded
secret key sk' corresponding to pk'.

The output (pk, sk) is calculated as follows:

Expand All @@ -422,7 +422,7 @@ ARKG-Derive-Public-Key((pk_kem, pk_bl), info) -> (pk', kh)

pk' = BL-Blind-Public-Key(pk_bl, tau)
kh = (c, tag)
```
~~~

If this procedure aborts due to an error,
for example because `KDF` returns an invalid `tau` or `mk`,
Expand All @@ -438,26 +438,27 @@ to prove possession of `sk'` to an external party that has the corresponding pub
This function may be invoked any number of times with the same private seed,
in order to derive the same or different secret keys any number of times.

```
~~~pseudocode
ARKG-Derive-Secret-Key((sk_kem, sk_bl), kh, info) -> sk'
Options:
BL The key blinding scheme chosen for the ARKG instantiation.
KEM The key encapsulation mechanism chosen for the ARKG instantiation.
MAC The MAC scheme chosen for the ARKG instantiation.
KDF The key derivation function chosen for the ARKG instantiation.
L_bl The length in octets of the blinding factor tau of the
key blinding scheme BL.
L_mac The length in octets of the MAC key of the MAC scheme MAC.
BL A key blinding scheme.
KEM A key encapsulation mechanism.
MAC A MAC scheme.
KDF A key derivation function.
L_bl The length in octets of the blinding factor tau
of the key blinding scheme BL.
L_mac The length in octets of the MAC key
of the MAC scheme MAC.

Inputs:
sk_kem A key encapsulation secret key.
sk_bl A key blinding secret key.
kh A key handle output from ARKG-Derive-Public-Key.
info Optional context and application specific information
(can be a zero-length string).
sk_kem A key encapsulation secret key.
sk_bl A key blinding secret key.
kh A key handle output from ARKG-Derive-Public-Key.
info Optional context and application specific
information (can be a zero-length string).

Output:
sk' A blinded secret key.
sk' A blinded secret key.

The output sk' is calculated as follows:

Expand All @@ -470,7 +471,7 @@ ARKG-Derive-Secret-Key((sk_kem, sk_bl), kh, info) -> sk'

tau = KDF("arkg-blind" || 0x00 || info, k, L_bl)
sk' = BL-Blind-Secret-Key(sk_bl, tau)
```
~~~

Errors in this procedure are typically unrecoverable.
For example, `KDF` might return an invalid `tau` or `mk`, or the `tag` may be invalid.
Expand Down Expand Up @@ -507,7 +508,7 @@ Then the `BL` parameter of ARKG may be instantiated as follows:
- `N` is the order of `crv`.
- `G` is the generator of `crv`.

```
~~~pseudocode
BL-Generate-Keypair() -> (pk, sk)

sk = Random(1, N)
Expand Down Expand Up @@ -536,7 +537,7 @@ BL-Blind-Secret-Key(sk, tau) -> sk_tau
sk_tau = sk_tau_tmp

TODO: Also reject 1?
```
~~~


### Using ECDH as the KEM
Expand All @@ -562,7 +563,7 @@ Then the `KEM` parameter of ARKG may be instantiated as follows:
- `N` is the order of `crv`.
- `G` is the generator of `crv`.

```
~~~pseudocode
KEM-Generate-Keypair() -> (pk, sk)

sk = Random(1, N)
Expand All @@ -584,7 +585,7 @@ KEM-Decaps(sk, c) -> k

pk' = c
k = ECDH(pk', sk)
```
~~~


### Using both elliptic curve arithmetic for key blinding and ECDH as the KEM
Expand All @@ -603,7 +604,7 @@ TODO: Caveats? I think I read in some paper or thesis about specific drawbacks o
Let `Hash` be a cryptographic hash function.
Then the `MAC` parameter of ARKG may be instantiated using HMAC [RFC2104] as follows:

```
~~~pseudocode
MAC-Tag(k, m) -> t

t = HMAC-Hash(K=k, text=m)
Expand All @@ -616,15 +617,15 @@ MAC-Verify(k, m, t) -> { 0, 1 }
return 1
Else:
return 0
```
~~~


### Using HKDF as the KDF

Let `Hash` be a cryptographic hash function.
Then the `KDF` parameter of ARKG may be instantiated using HKDF [RFC5869] as follows:

```
~~~pseudocode
KDF(info, ikm, L) -> okm

PRK = HKDF-Extract with the arguments:
Expand All @@ -637,7 +638,7 @@ KDF(info, ikm, L) -> okm
PRK: PRK
info: info
L: L
```
~~~


## Concrete ARKG instantiations
Expand Down
Loading