fastcrypto

The fastcrypto-tbls crate provides implementations for threshold signatures and distributed key generation. Its core features include:

• Threshold BLS (tbls): Supports partial signing and aggregation of BLS signatures over a shared key using Shamir secret sharing over polynomials (polynomial).
• Distributed Key Generation (dkg_v1): A DKG protocol designed for a weighted set of nodes (nodes). It utilizes ECIES encryption (ecies_v1) for share handling and discrete-log NIZKs (nizk, dl_verification) to prove correctness. A mocked_dkg variant is available for deterministic testing.
• Weight Reduction (knapsack_weight_reduction): A utility to reduce the total weight of a weighted node set while preserving the threshold structure, optimizing protocol costs for large committees.
• Threshold Schnorr (threshold_schnorr): Implements asynchronous verifiable secret sharing (AVSS) in several variants: plain (avss), batched (batch_avss), and AVID-backed (avid, batch_avss_avid). It also includes support for presigning, signing, key_derivation, and mechanisms for complaints and recovery proofs.
• Random Oracle (random_oracle): Provides domain-separated hashing used across the protocols mentioned above.

WARNING

The threshold Schnorr modules are still under development and have not been audited.

fastcrypto is a common cryptography library used at Mysten Labs. It is a Cargo workspace designed for high performance, security, and determinism, specifically optimized for use cases like the Sui Network where signing and verifying large volumes of transactions and certificates is critical.

Key characteristics of the library include:

• Security & Performance: Carefully selected crates that are resistant to known attack vectors and optimized via extensive benchmarking.
• Determinism: Focus on non-malleable signatures.
• Robust Testing: Integration of Wycheproof tests and prop tests to protect against edge cases.
• Zeroization: Uses the zeroize trait to clear sensitive private key materials from memory when they go out of scope (best effort).
• Standardized Serialization: Ensures effective and consistent data formats.

The fastcrypto repository is composed of several specialized crates. Depending on your requirements, you may need to include one or more of the following in your project:

• fastcrypto-zkp: Groth16 proof verification (BN254 and BLS12381 curves) using Arkworks and blst. Includes Sui's zkLogin verifier and Poseidon hash implementation.
• fastcrypto-tbls: Threshold BLS signatures and distributed key generation (DKG), including Shamir secret sharing, ECIES, and threshold Schnorr protocols.
• fastcrypto-vdf: Verifiable Delay Functions (Wesolowski and Pietrzak constructions). Note: This crate is gated behind the experimental feature flag and has not been audited.
• fastcrypto-pq: Post-quantum signature schemes (ML-DSA-65 and SLH-DSA). Note: This crate is not published and has not been audited.
• fastcrypto-derive: Procedural macros for security and convenience, such as SilentDisplay/SilentDebug (to prevent leaking private keys in logs) and GroupOpsExtend (for expanded group element operations).
• fastcrypto-cli: Debugging tools for various primitives.

The fastcrypto-vdf crate provides experimental implementations of Verifiable Delay Functions (VDFs).

Warning: This crate is experimental, has not been audited, and should not be used in production.

All functionality in this crate is gated behind the experimental feature flag. To use it, you must enable this feature in your Cargo.toml.

Key components include:

• VDF constructions (vdf): Implements Wesolowski (wesolowski) and Pietrzak (pietrzak) VDFs, generic over an underlying group of unknown order.
• Imaginary class groups (class_group): Elements represented as binary quadratic forms, including form reduction, discriminant generation, and a hash-to-group construction.
• RSA groups (rsa_group): An alternative group of unknown order used for comparison and testing.
• Supporting math (math): Includes extended GCD, Chinese Remainder Theorem, Jacobi symbols, modular square roots, and hash-to-prime.

# Example Cargo.toml configuration
[dependencies]
fastcrypto-vdf = { version = "0.1.0", features = ["experimental"] }

ML-DSA-65 is designed to be a drop-in replacement for classical schemes like Ed25519 within the fastcrypto ecosystem.

Key Traits and Types

• MLDSA65KeyPair
• MLDSA65PrivateKey
• MLDSA65PublicKey
• MLDSA65Signature

These types implement standard fastcrypto traits such as KeyPair, Signer, VerifyingKey, and ToFromBytes. This allows existing call sites to treat ML-DSA-65 similarly to Ed25519, though with significantly larger byte arrays.

Technical Specifications

• Private Key Serialization: The serialized form is the 32-byte FIPS 204 seed. Deserializing a key pair re-derives the public key from this seed.
• Signing Behavior: Signing is hedged (FIPS 204 default), using fresh OS randomness for every signature. Consequently, signatures are neither reproducible nor unique for a given key and message.
• Serialization Formats:
  • Raw encoding: bincode, BCS, and as_ref() produce identical bytes.
  • Human-readable: serde produces base64.
• Sizes:
  • Public Key: 1,952 B
  • Signature: 3,309 B
  • Private Key: 32 B

When using Bulletproofs++, be aware of the following technical constraints and security properties:

• Side-Channel Warning: The implementation is not constant-time. It uses variable-time MSMs (Multi-Scalar Multiplications). Do not use this implementation where prover timing side-channels are a concern.
• Zero-Knowledge: The proofs are honest-verifier zero-knowledge (perfect outside a challenge set of density $O(1)/q$).
• Soundness: Knowledge soundness holds under the discrete-logarithm assumption in the random-oracle model.
• Verification Mechanism: Verification is performed as a single multi-scalar multiplication (MSM). The verifier does not perform generator folding; instead, it computes base generator coefficients from bit indices and folds the combined commitment into the same MSM.
• CRS Caching: Derived Common Reference Strings (CRSs), including hash-to-curve generators and tables, are cached per size for the lifetime of the process.

The fastcrypto crate uses a set of standardized traits to ensure cryptographic agility, allowing you to swap different signature schemes while maintaining a consistent interface.

Key traits include:

• SigningKey: Implemented by private keys; includes associated types for the public key and signature.
• VerifyingKey: Implemented by public keys; includes associated types for the private key and signature. It provides a default implementation for batch verification.
• Authenticator: Implemented by the signature; includes associated types for the public and private keys.
• AggregateAuthenticator: Implemented by aggregated signatures; allows adding new signatures to an existing aggregate and verifying them against corresponding public keys.
• KeyPair: Represents a public/private keypair; provides functions for retrieving keys and generating keypairs using seeded randomness.
• ToFromBytes: A trait for minimizing steps when obtaining serializable keys.
• EncodeDecodeBase64: Extends ToFromBytes for immediate conversion to/from Base64 strings (the standard storage format for cryptographic materials).