MtA (Multiplicative to Additive) share conversion protocol for Ed25519

[HRezaei]

multi-party-ecdsa/src/utilities/mta/test.rs

Line 7 in fc4a0ed

fn test_mta() {

This test function works fine with the secp256_k1 curve, but if you change the underlying curve scalars and points to those of Ed25519, it fails always. To see the issue you need to refactor the test function and also MessageA, MessageB, etc. You can take a look at this repo where I prepared the mta_test in isolation and performed tests over all the curves (using curv-kzen v0.9). The result shows issues with Ed25519 and Ristretto, others curves work fine.

[elichai]

Yes, the range proofs assume it is secp256k1, See: https://github.com/ZenGo-X/multi-party-ecdsa/blob/master/src/utilities/mta/range_proofs.rs#L153

[HRezaei]

More broadly, we need {t,n} threshold EdDSA for signing Solana or Stellar transactions.

[elichai]

@HRezaei Maybe look here instead? https://github.com/zenGo-X/multi-party-eddsa

[HRezaei]

@elichai: Yeah, I did. Indeed, I ported gg18 examples into the repo you mentioned.

[DmytroTym]

More broadly, we need {t,n} threshold EdDSA for signing Solana or Stellar transactions.

Yep, you definitely rather need https://github.com/zenGo-X/multi-party-eddsa. Also, afaik, its simpler and faster than GG18 or GG20.

[elichai]

Yes, It's at least a couple of orders of magnitude simpler :)
also, There's also a great implementation of FROST here if you want Ristretto: https://docs.rs/frost-dalek/latest/frost_dalek/