Skip to main content

sodot

import "github.com/sodot-rs/sodot-go-sdk"

Sodot Go module provides the ability to run TSS protocols for both ECDSA and Ed25519.

Index​

Constants​

const SODOT_RELAY_URL = "us1.sodot.dev"

type Ecdsa​

Class providing the functionality for the ECDSA protocol via the DKLs19 MPC protocol.

type Ecdsa struct {
    HostUrl string
}
Example​
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"

ecdsa := NewEcdsa("")
keygenRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties call initKeygen to get a KeygenID and a KeygenPrivateKey
keygenID, keygenPrivKey, err := ecdsa.InitKeygen()
if err != nil {
    panic(err)
}
// Send the keygenID to all other parties
_ = keygenID
// All parties receive the keygenIds from all other parties
keygenIds := []KeygenID{"keygenID1", "keygenID2"}
// All parties join the keygen room
secretShare, pk, err := ecdsa.Keygen(keygenRoomUuid, N, T, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// The public key can now be used to verify signatures
_ = pk

// Pick the derivation path of the public key you want to sign for
derivationPath := []uint32{44, 60, 0, 0, 0}
// Get the public key for the derivation path
derivedPubKey, err := ecdsa.DerivePubkey(secretShare, derivationPath)
if err != nil {
    panic(err)
}
// The derived public key can now be used to verify signatures with the same derivation path
_ = derivedPubKey
// To sign a message, create a signing room on the server side, using your API_KEY
signingRoomUuid, err := ecdsa.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}
// Hash the message
messageHash := MessageHashFromSha256([]byte("my message"))
// 2 parties join the signing room
signature, err := ecdsa.Sign(signingRoomUuid, secretShare, messageHash, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature
// Refreshing the secret key material
// Your server creates a room for 3 parties
refreshRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties join the refresh room
// Note: the public key returned here is the same as the one returned by the keygen
refreshedShare, _, err := ecdsa.Refresh(refreshRoomUuid, secretShare)
if err != nil {
    panic(err)
}

// Signing using the new secret key material
// The room is again created by the server
signingRoomUuid2, err := ecdsa.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}

messageHash2 := MessageHashFromSha256([]byte("my new message"))
signature2, err := ecdsa.Sign(signingRoomUuid2, refreshedShare, messageHash2, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature2

func NewEcdsa​

func NewEcdsa(hostUrl string) Ecdsa

NewEcdsa creates a new Ecdsa instance

host URL to use, if "" is passed, the default host url(SODOT_RELAY_URL) will be used

func (Ecdsa) CreateRoom​

func (ecdsa Ecdsa) CreateRoom(numParties uint16, apiKey string) (RoomUUID, error)

Creates a room for the given number of parties. A room is a one time instance used to perform a single MPC operation(keygen/signing/refresh etc.) between parties.

This function should be called in the backend so to not embed the API key in code that is distributed to the users. After the backend calls this function, the other parties can join the room by calling the relevant keygen/signing/refresh/etc. operation.

Returns a RoomUUID of the created room.

func (Ecdsa) DerivePrivateKeyFromXpriv​

func (ecdsa Ecdsa) DerivePrivateKeyFromXpriv(xpriv string, derivationPath []uint32) (PrivateKey, error)

Parses an xpriv string according to BIP-32 non-hardened, and returns the derived private key for a given BIP-32 non-hardened derivation path xpriv must be a valid secp256k1 xpriv string.

func (Ecdsa) DerivePubkey​

func (ecdsa Ecdsa) DerivePubkey(share EcdsaSecretShare, derivationPath []uint32) (EcdsaPublicKey, error)

Returns the derived public key for a EcdsaSecretShare for a given BIP-32 non-hardened derivation path.

func (Ecdsa) ExportFullPrivateKey​

func (ecdsa Ecdsa) ExportFullPrivateKey(roomUuid RoomUUID, share EcdsaSecretShare, toExportID KeygenID) (string, error)

Combine all EcdsaSecretShare-s and export the full private key to a single party. Requires a threshold amount of parties to participate. toExportID specifies the KeygenID of the party that should receive the private key, all parties must provide the same KeygenID or else export will fail.

The party being exported to will receive a string containing the full xpriv, while the rest will receive an empty string.

func (Ecdsa) ExportID​

func (ecdsa Ecdsa) ExportID(share EcdsaSecretShare) (KeygenID, error)

Extracts the KeygenID from an EcdsaSecretShare. Useful for reshare operations.

func (Ecdsa) InitKeygen​

func (ecdsa Ecdsa) InitKeygen() (KeygenID, KeygenPrivateKey, error)

All parties must call this function before calling Keygen. All parties receive a (KeygenID, KeygenPrivateKey) as an output from this function. The KeygenID must be sent through an authenticated communication channel to all other devices we wish to perform Ecdsa.Keygen with. Once we have the KeygenID-s of all parties, then Ecdsa.Keygen can be called with the same KeygenPrivateKey as was returned here.

func (Ecdsa) Keygen​

func (ecdsa Ecdsa) Keygen(roomUuid RoomUUID, numParties uint16, threshold uint16, keygenPrivateKey KeygenPrivateKey, keygenIDs []KeygenID) (EcdsaSecretShare, EcdsaPublicKey, error)

Generate a keypair for the given number of parties and threshold.

Requires configuring the threshold and total number of participants (numParties) who will hold a secret share. This party's KeygenPrivateKey must be provided as well as an array of KeygenID-s (created using Ecdsa.InitKeygen) received from all other parties we wish to share the keypair with.

Returns a EcdsaSecretShare and an EcdsaPublicKey that contains the public key as well as the secret data that can be used for signing.

Example​
// Your server side creates a room for 3 parties using its API_KEY
// Creating a room uuid should always happen on the server side using your API_KEY
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"

ecdsa := NewEcdsa("")
keygenRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties call initKeygen to get a KeygenID and a KeygenPrivateKey
keygenID, keygenPrivKey, err := ecdsa.InitKeygen()
if err != nil {
    panic(err)
}
// Send the keygenID to all other parties
_ = keygenID
// All parties receive the keygenIds from all other parties
keygenIds := []KeygenID{"keygenID1", "keygenID2"}
// All parties join the keygen room
secretShare, pk, err := ecdsa.Keygen(keygenRoomUuid, N, T, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// The public key can now be used to verify signatures
_, _ = secretShare, pk

func (Ecdsa) OfflineExportFullPrivateKey​

func (ecdsa Ecdsa) OfflineExportFullPrivateKey(shares []EcdsaSecretShare) (string, error)

Receives as input an array of threshold EcdsaSecretShare-s and locally computes the full private key (xpriv). The main use case for this function is in an offline recovery setting where EcdsaSecretShare-s are collected manually and used to recover the full private key on an air-gapped server/device.

Returns a string containing the full xpriv.

func (Ecdsa) Refresh​

func (ecdsa Ecdsa) Refresh(roomUuid RoomUUID, share EcdsaSecretShare) (EcdsaSecretShare, EcdsaPublicKey, error)

Used for refreshing the secret material of all parties without altering the public key at all. Takes an EcdsaSecretShare as input and returns a new one for the same public key but with fresh key material. Be careful to delete the EcdsaSecretShare given as input before it is certain that all devices have properly stored the fresh EcdsaSecretShare that is output. Note that the new EcdsaSecretShare-s may only be used with each other, attempting to use older EcdsaSecretShare-s with newer ones for signing will result in failure.

The motivation for using refresh is to enhance security by switching the secret key material frequently, this means that an adversary will need to compromise multiple devices at the same time in order to compromise the private key.

Example​
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"
// An EcdsaSecretShare is generated using Keygen
// secretShare, pk, err := ecdsa.Keygen(...)
secretShare := EcdsaSecretShare{}
// Some time passes ...
// We now refresh the secret key material of our public key
ecdsa := NewEcdsa("")
refreshRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// Note: the public key returned here is the same as the one returned by the keygen
_, refreshedShare, err := ecdsa.Refresh(refreshRoomUuid, secretShare)
if err != nil {
    panic(err)
}
// refreshedShare can now be used for signing under the same T threshold, as well as be refreshed again
_ = refreshedShare

func (Ecdsa) ReshareNewParty​

func (ecdsa Ecdsa) ReshareNewParty(roomUuid RoomUUID, newThreshold uint16, keygenPrivateKey KeygenPrivateKey, keygenIDs []KeygenID) (EcdsaSecretShare, EcdsaPublicKey, error)

WARNING: Key resharing is an advanced feature of the SDK. We strongly advise consulting with the Sodot team before using it, as incorrect usage might lead to the detriment of the private key security. To use the feature correctly, developers using this feature must make sure that at least n - t + 1 parties of the t-of-n signing quorum delete their current shares before using the resharing of the private key. Also, after resharing, the resharing operation must not be considered complete until such deletion has occurred. Since deleting a share cannot be guaranteed cryptographically, it must be guaranteed by the software architecture (hence, by the developers using the SDK).

Resharing the private key of the t-of-n quorum of signers, the resultant key shares will be of the exact same public key as the previous quorum. Resharing should be used in cases where we aim to modify the current t-of-n quorum with a new quorum with newT-of-newN signers for the same public key.

This is the method that a new party (meaning one that does not currently have an EcdsaSecretShare ) should use for receiving a key share in the new newT-of-newN quorum. The method takes the same input parameters as Ecdsa.Keygen since for a new party joining the quorum the Reshare operation is very similar to a Keygen operation. In order to receive the KeygenID-s of parties that are already a part of the quorum, those parties will need to call [ExportID] and send the result to the parties in the new quorum.

Returns an EcdsaSecretShare with the secret data that can be used for signing as well as the EcdsaPublicKey.

Example​
const N = 5
const T = 3
const newN = 6
const newT = 5
const API_KEY = "MY_API_KEY"
// A signing quorum of `3-of-5` is set up without this party.
// Some time passes...
// Now this party wishes to be part of a new quorum of `5-of-6`.
//
// The app server creates a room for newN(= 6) parties.
ecdsa := NewEcdsa("")
reshareRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// At least T(= 3) parties now join the reshare room using the current secret key material (this will be done using `ReshareRemainingParty`), all new parties will then join the reshare room using their `KeygenPrivateKey` using `ReshareNewParty`.
keygenID, keygenPrivKey, err := ecdsa.InitKeygen()
if err != nil {
    panic(err)
}
// This new party will send its `KeygenID` to all other parties.
// This party will also receive the `KeygenID`s of all other parties of the new quorum.
keygenIds := []KeygenID{"keygenID1", keygenID, "keygenID3", "keygenID4", "keygenID5", "keygenID6"} // Note that here we must include our own `KeygenID` as well, the order of the ids doesn't matter.

// Note: the public key returned here is the same as the one returned by the keygen
newShare, _, err := ecdsa.ReshareNewParty(reshareRoomUuid, newT, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// newShare can now be used for signing under the newT(= 5) threshold with the same public key, as well as be reshared again
_ = newShare

func (Ecdsa) ReshareRemainingParty​

func (ecdsa Ecdsa) ReshareRemainingParty(roomUuid RoomUUID, newThreshold uint16, share EcdsaSecretShare, keygenIDs []KeygenID) (EcdsaSecretShare, EcdsaPublicKey, error)

WARNING: Key resharing is an advanced feature of the SDK. We strongly advise consulting with the Sodot team before using it, as incorrect usage might lead to the detriment of the private key security. To use the feature correctly, developers using this feature must make sure that at least n - t + 1 parties of the t-of-n signing quorum delete their current shares before using the resharing of the private key. Also, after resharing, the resharing operation must not be considered complete until such deletion has occurred. Since deleting a share cannot be guaranteed cryptographically, it must be guaranteed by the software architecture (hence, by the developers using the SDK).

Resharing the private key of the t-of-n quorum of signers, the resultant key shares will be of the exact same public key as the previous quorum. Resharing should be used in cases where we aim to modify the current t-of-n quorum with a new quorum with newT-of-newN signers for the same public key.

This is the method that a remaining party (meaning one that does currently have a key share) should use for receiving a new key share in the new newT-of-newN quorum. The method takes the same input parameters as Ecdsa.ReshareNewParty except that it will use its existing EcdsaSecretShare instead of a new KeygenPrivateKey. In order to receive the KeygenID-s of parties that are already a part of the quorum, those parties will need to call [ExportID] and send the result to the parties in the new quorum.

Returns a new EcdsaSecretShare with the secret data that can be used for signing as well as the EcdsaPublicKey.

Example​
const N = 5
const T = 3
const newN = 6
const newT = 5
const API_KEY = "MY_API_KEY"
// A signing quorum of `3-of-5` is set up with this party.
// secretShare, pk, err := ecdsa.Keygen(...)
secretShare := EcdsaSecretShare{}
//
// Some time passes...
// Now this party wishes to be part of a new quorum of `5-of-6`.
//
// The app server creates a room for newN(= 6) parties.
ecdsa := NewEcdsa("")
reshareRoomUuid, err := ecdsa.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// At least T(= 3) parties now join the reshare room using the current secret key material (this will be done using `ReshareRemainingParty`), all new parties will then join the reshare room using their `KeygenPrivateKey` using `ReshareNewParty`.
keygenID, err := ecdsa.ExportID(secretShare) // This is a remaining party
if err != nil {
    panic(err)
}

// This remaining party will send its `KeygenID` to all other parties (new - via an authenticated channel and remaining - via any channel).
// This party will also receive the `KeygenID`s of all other parties of the new quorum (new - via an authenticated channel and remaining - via any channel).
keygenIds := []KeygenID{"keygenID1", "keygenID2", keygenID, "keygenID4", "keygenID5", "keygenID6"} // Note that here we must include our own `KeygenID` as well, the order of the ids doesn't matter.

// Note: the public key returned here is the same as the one returned by the keygen
newShare, _, err := ecdsa.ReshareRemainingParty(reshareRoomUuid, newT, secretShare, keygenIds)
if err != nil {
    panic(err)
}
// newShare can now be used for signing under the newT(= 5) threshold with the same public key, as well as be reshared again
_ = newShare

func (Ecdsa) Sign​

func (ecdsa Ecdsa) Sign(roomUuid RoomUUID, share EcdsaSecretShare, msgHash MessageHash, derivationPath []uint32) (EcdsaSignature, error)

Sign a message with an EcdsaSecretShare created using Ecdsa.Keygen. The message must be hashed before signing, this can be done using the MessageHash type. derivationPath must be a BIP-32 non-hardened derivation path to use for signing msgHash.

Returns the signature of the message.

Example​
// To sign a message, create a signing room on the server side, using your API_KEY
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"
// An EcdsaSecretShare is generated using Keygen
// secretShare, pk, err := ecdsa.Keygen(...)
secretShare := EcdsaSecretShare{}
ecdsa := NewEcdsa("")
signingRoomUuid, err := ecdsa.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}

// Pick the derivation path of the public key you want to sign for
derivationPath := []uint32{44, 60, 0, 0, 0}
// Get the public key for the derivation path
derivedPubKey, err := ecdsa.DerivePubkey(secretShare, derivationPath)
if err != nil {
    panic(err)
}
// The derived public key can now be used to verify signatures with the same derivation path
_ = derivedPubKey

// Hash the message
messageHash := MessageHashFromSha256([]byte("my message"))
// 2 parties join the signing room
signature, err := ecdsa.Sign(signingRoomUuid, secretShare, messageHash, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature

type EcdsaPublicKey​

An ECDSA public key, generated by the Ecdsa.Keygen function. You can get the compressed form (33 bytes) via the EcdsaPublicKey.SerializeCompressed function, or the uncompressed form (65 bytes) via the EcdsaPublicKey.SerializeUncompressed function.

type EcdsaPublicKey [64]byte

func EcdsaPublicKeyFromString​

func EcdsaPublicKeyFromString(s string) (EcdsaPublicKey, error)

func (EcdsaPublicKey) Equal​

func (pubkey EcdsaPublicKey) Equal(other EcdsaPublicKey) bool

func (EcdsaPublicKey) SerializeCompressed​

func (pubkey EcdsaPublicKey) SerializeCompressed() (ret [33]byte)

SerializeCompressed returns the compressed public key as a [33]byte .

func (EcdsaPublicKey) SerializeUncompressed​

func (pubkey EcdsaPublicKey) SerializeUncompressed() (ret [65]byte)

SerializeUncompressed returns the uncompressed public key as a [65]byte .

func (EcdsaPublicKey) String​

func (pubkey EcdsaPublicKey) String() string

func (*EcdsaPublicKey) UnmarshalJSON​

func (pubkey *EcdsaPublicKey) UnmarshalJSON(b []byte) error

type EcdsaSecretShare​

The per-party private key material that is used for threshold signing

type EcdsaSecretShare []byte

func EcdsaSecretShareFromString​

func EcdsaSecretShareFromString(s string) (EcdsaSecretShare, error)

func (EcdsaSecretShare) String​

func (share EcdsaSecretShare) String() string

func (*EcdsaSecretShare) UnmarshalJSON​

func (secretShare *EcdsaSecretShare) UnmarshalJSON(b []byte) error

type EcdsaSignature​

An ECDSA signature, generated by the Ecdsa.Sign function. You can get the DER encoded signature via the EcdsaSignature.DER method, or the r,s,v form via the EcdsaSignature.R, EcdsaSignature.S and EcdsaSignature.V methods.

type EcdsaSignature struct {
    // contains filtered or unexported fields
}

func (EcdsaSignature) DER​

func (sig EcdsaSignature) DER() []byte

R returns the r value for an r,s,v encoding of an ECDSA signature.

func (EcdsaSignature) Equal​

func (sig EcdsaSignature) Equal(other EcdsaSignature) bool

func (EcdsaSignature) R​

func (sig EcdsaSignature) R() *[32]byte

R returns the r value for an r,s,v encoding of an ECDSA signature.

func (EcdsaSignature) S​

func (sig EcdsaSignature) S() *[32]byte

S returns the s value for an r,s,v encoding of an ECDSA signature.

func (EcdsaSignature) String​

func (sig EcdsaSignature) String() string

func (EcdsaSignature) V​

func (sig EcdsaSignature) V() byte

V returns the v value for an r,s,v encoding of an ECDSA signature.

type Ed25519​

Class providing the functionality for the Ed25519 protocol via the FROST MPC protocol.

type Ed25519 struct {
    HostUrl string
}
Example​
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"

ed25519 := NewEd25519("")
keygenRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties call initKeygen to get a KeygenID and a KeygenPrivateKey
keygenID, keygenPrivKey, err := ed25519.InitKeygen()
if err != nil {
    panic(err)
}
// Send the keygenID to all other parties
_ = keygenID
// All parties receive the keygenIds from all other parties
keygenIds := []KeygenID{"keygenID1", "keygenID2"}
// All parties join the keygen room
secretShare, pk, err := ed25519.Keygen(keygenRoomUuid, N, T, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// The public key can now be used to verify signatures
_ = pk

// Pick the derivation path of the public key you want to sign for
derivationPath := []uint32{44, 60, 0, 0, 0}
// Get the public key for the derivation path
derivedPubKey, err := ed25519.DerivePubkey(secretShare, derivationPath)
if err != nil {
    panic(err)
}
// The derived public key can now be used to verify signatures with the same derivation path
_ = derivedPubKey
// To sign a message, create a signing room on the server side, using your API_KEY
signingRoomUuid, err := ed25519.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}
// Define the message
message := []byte("my message")
// 2 parties join the signing room
signature, err := ed25519.Sign(signingRoomUuid, secretShare, message, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature
// Refreshing the secret key material
// Your server creates a room for 3 parties
refreshRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties join the refresh room
// Note: the public key returned here is the same as the one returned by the keygen
refreshedShare, _, err := ed25519.Refresh(refreshRoomUuid, secretShare)
if err != nil {
    panic(err)
}

// Signing using the new secret key material
// The room is again created by the server
signingRoomUuid2, err := ed25519.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}

message2 := []byte("my new message")
signature2, err := ed25519.Sign(signingRoomUuid2, refreshedShare, message2, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature2

func NewEd25519​

func NewEd25519(hostUrl string) Ed25519

NewEd25519 creates a new Ed25519 instance

host URL to use, if "" is passed, the default host url(SODOT_RELAY_URL) will be used

func (Ed25519) CreateRoom​

func (ed25519 Ed25519) CreateRoom(numParties uint16, apiKey string) (RoomUUID, error)

Creates a room for the given number of parties. A room is a one time instance used to perform a single MPC operation(keygen/signing/refresh etc.) between parties.

This function should be called in the backend so to not embed the API key in code that is distributed to the users. After the backend calls this function, the other parties can join the room by calling the relevant keygen/signing/refresh/etc. operation.

Returns a RoomUUID of the created room.

func (Ed25519) DerivePrivateKeyFromSpriv​

func (ed25519 Ed25519) DerivePrivateKeyFromSpriv(spriv string, derivationPath []uint32) (PrivateKey, error)

Parses an spriv string according to Sodot's non-hardened derivation, and returns the derived private key for a given BIP-32 non-hardened derivation path

func (Ed25519) DerivePubkey​

func (ed25519 Ed25519) DerivePubkey(share Ed25519SecretShare, derivationPath []uint32) (Ed25519PublicKey, error)

Returns the derived public key for a Ed25519SecretShare for a given BIP-32 non-hardened derivation path.

func (Ed25519) ExportFullPrivateKey​

func (ed25519 Ed25519) ExportFullPrivateKey(roomUuid RoomUUID, share Ed25519SecretShare, toExportID KeygenID) (string, error)

Combine all Ed25519SecretShare-s and export the full private key to a single party. Requires a threshold amount of parties to participate. toExportID specifies the KeygenID of the party that should receive the private key, all parties must provide the same KeygenID or else export will fail.

The party being exported to will receive a string containing the full spriv, while the rest will receive an empty string.

func (Ed25519) ExportID​

func (ed25519 Ed25519) ExportID(share Ed25519SecretShare) (KeygenID, error)

Extracts the KeygenID from an Ed25519SecretShare. Useful for reshare operations.

func (Ed25519) InitKeygen​

func (ed25519 Ed25519) InitKeygen() (KeygenID, KeygenPrivateKey, error)

All parties must call this function before calling Keygen. All parties receive a (KeygenID, KeygenPrivateKey) as an output from this function. The KeygenID must be sent through an authenticated communication channel to all other devices we wish to perform Ed25519.Keygen with. Once we have the KeygenID-s of all parties, then Ed25519.Keygen can be called with the same KeygenPrivateKey as was returned here.

func (Ed25519) Keygen​

func (ed25519 Ed25519) Keygen(roomUuid RoomUUID, numParties uint16, threshold uint16, keygenPrivateKey KeygenPrivateKey, keygenIDs []KeygenID) (Ed25519SecretShare, Ed25519PublicKey, error)

Generate a keypair for the given number of parties and threshold.

Requires configuring the threshold and total number of participants (numParties) who will hold a secret share. This party's KeygenPrivateKey must be provided as well as an array of KeygenID-s (created using Ed25519.InitKeygen) received from all other parties we wish to share the keypair with.

Returns an Ed25519PublicKey and an Ed25519SecretShare that contains the public key as well as the secret data that can be used for signing.

Example​
// Your server side creates a room for 3 parties using its API_KEY
// Creating a room uuid should always happen on the server side using your API_KEY
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"

ed25519 := NewEd25519("")
keygenRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}
// All parties call initKeygen to get a KeygenID and a KeygenPrivateKey
keygenID, keygenPrivKey, err := ed25519.InitKeygen()
if err != nil {
    panic(err)
}
// Send the keygenID to all other parties
_ = keygenID
// All parties receive the keygenIds from all other parties
keygenIds := []KeygenID{"keygenID1", "keygenID2"}
// All parties join the keygen room
secretShare, pk, err := ed25519.Keygen(keygenRoomUuid, N, T, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// The public key can now be used to verify signatures
_, _ = secretShare, pk

func (Ed25519) OfflineExportFullPrivateKey​

func (ed25519 Ed25519) OfflineExportFullPrivateKey(shares []Ed25519SecretShare) (string, error)

Receives as input an array of threshold Ed25519SecretShare-s and locally computes the full private key (spriv). The main use case for this function is in an offline recovery setting where Ed25519SecretShare-s are collected manually and used to recover the full private key on an air-gapped server/device.

Returns a string containing the full spriv.

func (Ed25519) Refresh​

func (ed25519 Ed25519) Refresh(roomUuid RoomUUID, share Ed25519SecretShare) (Ed25519SecretShare, Ed25519PublicKey, error)

Used for refreshing the secret material of all parties without altering the public key at all. Takes an Ed25519SecretShare as input and returns a new one for the same public key but with fresh key material. Be careful to delete the Ed25519SecretShare given as input before it is certain that all devices have properly stored the fresh Ed25519SecretShare that is output. Note that the new Ed25519SecretShare-s may only be used with each other, attempting to use older Ed25519SecretShare-s with newer ones for signing will result in failure.

The motivation for using refresh is to enhance security by switching the secret key material frequently, this means that an adversary will need to compromise multiple devices at the same time in order to compromise the private key.

Example​
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"
// An Ed25519SecretShare is generated using Keygen
// secretShare, pk, err := ed25519.Keygen(...)
secretShare := Ed25519SecretShare{}
// Some time passes ...
// We now refresh the secret key material of our public key
ed25519 := NewEd25519("")
refreshRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// Note: the public key returned here is the same as the one returned by the keygen
refreshedShare, _, err := ed25519.Refresh(refreshRoomUuid, secretShare)
if err != nil {
    panic(err)
}
// refreshedShare can now be used for signing under the same T threshold, as well as be refreshed again
_ = refreshedShare

func (Ed25519) ReshareNewParty​

func (ed25519 Ed25519) ReshareNewParty(roomUuid RoomUUID, newThreshold uint16, keygenPrivateKey KeygenPrivateKey, keygenIDs []KeygenID) (Ed25519SecretShare, Ed25519PublicKey, error)

WARNING: Key resharing is an advanced feature of the SDK. We strongly advise consulting with the Sodot team before using it, as incorrect usage might lead to the detriment of the private key security. To use the feature correctly, developers using this feature must make sure that at least n - t + 1 parties of the t-of-n signing quorum delete their current shares before using the resharing of the private key. Also, after resharing, the resharing operation must not be considered complete until such deletion has occurred. Since deleting a share cannot be guaranteed cryptographically, it must be guaranteed by the software architecture (hence, by the developers using the SDK).

Resharing the private key of the t-of-n quorum of signers, the resultant key shares will be of the exact same public key as the previous quorum. Resharing should be used in cases where we aim to modify the current t-of-n quorum with a new quorum with newT-of-newN signers for the same public key.

This is the method that a new party (meaning one that does not currently have an Ed25519SecretShare ) should use for receiving a key share in the new newT-of-newN quorum. The method takes the same input parameters as Ed25519.Keygen since for a new party joining the quorum the Reshare operation is very similar to a Keygen operation. In order to receive the KeygenID-s of parties that are already a part of the quorum, those parties will need to call [ExportID] and send the result to the parties in the new quorum.

Returns an Ed25519SecretShare with the secret data that can be used for signing as well as the Ed25519PublicKey.

Example​
const N = 5
const T = 3
const newN = 6
const newT = 5
const API_KEY = "MY_API_KEY"
// A signing quorum of `3-of-5` is set up without this party.
// Some time passes...
// Now this party wishes to be part of a new quorum of `5-of-6`.
//
// The app server creates a room for newN(= 6) parties.
ed25519 := NewEd25519("")
reshareRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// At least T(= 3) parties now join the reshare room using the current secret key material (this will be done using `ReshareRemainingParty`), all new parties will then join the reshare room using their `KeygenPrivateKey` using `ReshareNewParty`.
keygenID, keygenPrivKey, err := ed25519.InitKeygen()
if err != nil {
    panic(err)
}
// This new party will send its `KeygenID` to all other parties.
// This party will also receive the `KeygenID`s of all other parties of the new quorum.
keygenIds := []KeygenID{"keygenID1", keygenID, "keygenID3", "keygenID4", "keygenID5", "keygenID6"} // Note that here we must include our own `KeygenID` as well, the order of the ids doesn't matter.

// Note: the public key returned here is the same as the one returned by the keygen
newShare, _, err := ed25519.ReshareNewParty(reshareRoomUuid, newT, keygenPrivKey, keygenIds)
if err != nil {
    panic(err)
}
// newShare can now be used for signing under the newT(= 5) threshold with the same public key, as well as be reshared again
_ = newShare

func (Ed25519) ReshareRemainingParty​

func (ed25519 Ed25519) ReshareRemainingParty(roomUuid RoomUUID, newThreshold uint16, share Ed25519SecretShare, keygenIDs []KeygenID) (Ed25519SecretShare, Ed25519PublicKey, error)

WARNING: Key resharing is an advanced feature of the SDK. We strongly advise consulting with the Sodot team before using it, as incorrect usage might lead to the detriment of the private key security. To use the feature correctly, developers using this feature must make sure that at least n - t + 1 parties of the t-of-n signing quorum delete their current shares before using the resharing of the private key. Also, after resharing, the resharing operation must not be considered complete until such deletion has occurred. Since deleting a share cannot be guaranteed cryptographically, it must be guaranteed by the software architecture (hence, by the developers using the SDK).

Resharing the private key of the t-of-n quorum of signers, the resultant key shares will be of the exact same public key as the previous quorum. Resharing should be used in cases where we aim to modify the current t-of-n quorum with a new quorum with newT-of-newN signers for the same public key.

This is the method that a remaining party (meaning one that does currently have a key share) should use for receiving a new key share in the new newT-of-newN quorum. The method takes the same input parameters as Ed25519.ReshareNewParty except that it will use its existing Ed25519SecretShare instead of a new KeygenPrivateKey. In order to receive the KeygenID-s of parties that are already a part of the quorum, those parties will need to call [ExportID] and send the result to the parties in the new quorum.

Returns a new Ed25519SecretShare with the secret data that can be used for signing as well as the Ed25519PublicKey.

Example​
const N = 5
const T = 3
const newN = 6
const newT = 5
const API_KEY = "MY_API_KEY"
// A signing quorum of `3-of-5` is set up with this party.
// secretShare, pk, err := ed25519.Keygen(...)
secretShare := Ed25519SecretShare{}
//
// Some time passes...
// Now this party wishes to be part of a new quorum of `5-of-6`.
//
// The app server creates a room for newN(= 6) parties.
ed25519 := NewEd25519("")
reshareRoomUuid, err := ed25519.CreateRoom(N, API_KEY)
if err != nil {
    panic(err)
}

// At least T(= 3) parties now join the reshare room using the current secret key material (this will be done using `ReshareRemainingParty`), all new parties will then join the reshare room using their `KeygenPrivateKey` using `ReshareNewParty`.
keygenID, err := ed25519.ExportID(secretShare) // This is a remaining party
if err != nil {
    panic(err)
}

// This remaining party will send its `KeygenID` to all other parties (new - via an authenticated channel and remaining - via any channel).
// This party will also receive the `KeygenID`s of all other parties of the new quorum (new - via an authenticated channel and remaining - via any channel).
keygenIds := []KeygenID{"keygenID1", "keygenID2", keygenID, "keygenID4", "keygenID5", "keygenID6"} // Note that here we must include our own `KeygenID` as well, the order of the ids doesn't matter.

// Note: the public key returned here is the same as the one returned by the keygen
newShare, _, err := ed25519.ReshareRemainingParty(reshareRoomUuid, newT, secretShare, keygenIds)
if err != nil {
    panic(err)
}
// newShare can now be used for signing under the newT(= 5) threshold with the same public key, as well as be reshared again
_ = newShare

func (Ed25519) Sign​

func (ed25519 Ed25519) Sign(roomUuid RoomUUID, share Ed25519SecretShare, msg []byte, derivationPath []uint32) (Ed25519Signature, error)

Sign a message with an Ed25519SecretShare created using Ed25519.Keygen. derivationPath must be a BIP-32 non-hardened derivation path to use for signing msg.

Returns the signature of the message.

Example​
// To sign a message, create a signing room on the server side, using your API_KEY
const N = 3
const T = 2
const API_KEY = "MY_API_KEY"
// An Ed25519SecretShare is generated using Keygen
// secretShare, pk, err := ed25519.Keygen(...)
secretShare := Ed25519SecretShare{}
ed25519 := NewEd25519("")
signingRoomUuid, err := ed25519.CreateRoom(T, API_KEY)
if err != nil {
    panic(err)
}

// Pick the derivation path of the public key you want to sign for
derivationPath := []uint32{44, 60, 0, 0, 0}
// Get the public key for the derivation path
derivedPubKey, err := ed25519.DerivePubkey(secretShare, derivationPath)
if err != nil {
    panic(err)
}
// The derived public key can now be used to verify signatures with the same derivation path
_ = derivedPubKey

// Define the message
message := []byte("my message")
// 2 parties join the signing room
signature, err := ed25519.Sign(signingRoomUuid, secretShare, message, derivationPath)
if err != nil {
    panic(err)
}
// This signature can now be verified against pubkey
_ = signature

type Ed25519PublicKey​

An Ed25519 public key, generated by the Ed25519.Keygen function.

type Ed25519PublicKey [32]byte

func Ed25519PublicKeyFromString​

func Ed25519PublicKeyFromString(s string) (Ed25519PublicKey, error)

func (Ed25519PublicKey) String​

func (pubkey Ed25519PublicKey) String() string

func (*Ed25519PublicKey) UnmarshalJSON​

func (pubkey *Ed25519PublicKey) UnmarshalJSON(b []byte) error

type Ed25519SecretShare​

The per-party private key material that is used for threshold signing

type Ed25519SecretShare []byte

func Ed25519SecretShareFromString​

func Ed25519SecretShareFromString(s string) (Ed25519SecretShare, error)

func (Ed25519SecretShare) String​

func (share Ed25519SecretShare) String() string

func (*Ed25519SecretShare) UnmarshalJSON​

func (secretShare *Ed25519SecretShare) UnmarshalJSON(b []byte) error

type Ed25519Signature​

An Ed25519 signature, generated by the Ed25519.Sign function.

type Ed25519Signature [64]byte

func (Ed25519Signature) String​

func (sig Ed25519Signature) String() string

type KeygenID​

type KeygenID string

func (KeygenID) String​

func (id KeygenID) String() string

type KeygenPrivateKey​

type KeygenPrivateKey PrivateKey

func KeygenPrivateKeyFromString​

func KeygenPrivateKeyFromString(s string) (KeygenPrivateKey, error)

func (KeygenPrivateKey) String​

func (privkey KeygenPrivateKey) String() string

type MessageHash​

A 32 byte message hash used for signing ECDSA messages.

// A SHA256 hash of the string 'Hello World'
messageHash := MessageHashFromSha256([]byte('Hello World'))
// A Keccak256 hash of the string 'Hello World'
messageHash := MessageHashFromKeccak256([]byte('Hello World'))
// In case you already have a hashed value you can just call the constructor with it
messageHash := MessageHash{71, 111, 38, ... , 23}


type MessageHash [32]byte

func MessageHashFromKeccak256​

func MessageHashFromKeccak256(data []byte) MessageHash

Creates a MessageHash by hashing data with Keccak256

func MessageHashFromSha256​

func MessageHashFromSha256(data []byte) MessageHash

Creates a MessageHash by hashing data with SHA256

type PrivateKey​

type PrivateKey [32]byte

type RoomUUID​

A Room UUID, a Room is created for each MPC operation (e.g. Signing, Keygen, Refresh, etc.) and acts as a session identifier to synchronize all involved parties.

type RoomUUID [16]byte

func RoomUUIDFromString​

func RoomUUIDFromString(s string) (RoomUUID, error)

func (RoomUUID) String​

func (uuid RoomUUID) String() string