[cryptography/bls12381] Batched Threshold Encryption #2184

patrick-ogrady · 2025-11-08T21:05:12Z

Summary

Adds TDH2-based Threshold Encryption support for BLS12-381 (with support for batch decryption via DLEQ).

Initial Benchmarks

cargo bench -p commonware-cryptography --bench bls12381 -- bte_encrypt
  bls12381::bte_encrypt               ≈ 0.69 ms per ciphertext

cargo bench -p commonware-cryptography --bench bls12381 -- bte_decrypt

Participants n = 10:
  Threads = 1  -> 10 cts ≈ 31.7 ms | 100 cts ≈ 236 ms  | 1000 cts ≈ 1.96 s
  Threads = 8  -> 10 cts ≈ 9.84 ms | 100 cts ≈ 66.5 ms | 1000 cts ≈ 0.48 s

Participants n = 100:
  Threads = 1  -> 10 cts ≈ 216 ms  | 100 cts ≈ 1.54 s  | 1000 cts ≈ 12.4 s
  Threads = 8  -> 10 cts ≈ 38.9 ms | 100 cts ≈ 0.27 s  | 1000 cts ≈ 2.34 s

cloudflare-workers-and-pages · 2025-11-08T21:05:27Z

Deploying monorepo with Cloudflare Pages

Latest commit:	`f973caa`
Status:	✅ Deploy successful!
Preview URL:	https://a781e8fa.monorepo-eu0.pages.dev
Branch Preview URL:	https://batched-tdh.monorepo-eu0.pages.dev

View logs

patrick-ogrady · 2025-11-08T21:10:40Z

cryptography/src/bls12381/benches/bte_decrypt.rs

+        for &participants in PARTICIPANTS.iter() {
+            let threshold = quorum(participants);
+            for &size in SIZES.iter() {
+                let id = format!("bte_decrypt/n={participants}/threads={threads}");


fix the formatting of this

patrick-ogrady · 2025-11-08T21:10:53Z

cryptography/src/bls12381/benches/bte_encrypt.rs

+    let public = PublicKey::<MinSig>::new(*commitment.constant());
+    let message = vec![0x42u8; 64];
+
+    c.bench_function(module_path!(), |b| {


fix the formatting of this

patrick-ogrady · 2025-11-08T21:11:14Z

cryptography/src/bls12381/bte.rs

+use thiserror::Error;
+
+/// Transcript namespace for ciphertext Chaum–Pedersen proofs.
+const CT_TRANSCRIPT: &[u8] = b"commonware.bls12381.bte.ct";


use - here?

patrick-ogrady · 2025-11-08T21:11:30Z

cryptography/src/bls12381/bte.rs

+
+/// Public key for TDH encryption (the commitment's constant term).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PublicKey<V: Variant> {


nit: shouldn't need this

patrick-ogrady · 2025-11-08T21:12:39Z

cryptography/src/bls12381/bte.rs

+//! The resulting `h^r` values are re-used in the TDH KDF to unmask the original
+//! plaintexts. Malformed ciphertexts simply appear as missing indices in the
+//! canonical batch, so a byzantine sender cannot block honest decryptions.
+//!


nit: add a "usage" section that defines how you would use this in a p2p network (each server generates request/response from a block and then sends response to all other players).

patrick-ogrady · 2025-11-08T21:13:18Z

cryptography/src/bls12381/bte.rs

+                    });
+            });
+        }
+        #[cfg(not(feature = "std"))]


do we need to support no-std?

patrick-ogrady · 2025-11-08T21:13:48Z

cryptography/src/bls12381/bte.rs

+        .collect()
+}
+
+fn keystream<V: Variant>(hr: &V::Public, label: &[u8], len: usize) -> Vec<u8> {


nit: move these to proper utilities (may be useful elsewhere)

patrick-ogrady · 2025-11-08T21:14:30Z

cryptography/src/bls12381/bte.rs

+    }
+
+    let mut sorted = share_indices.to_vec();
+    sorted.sort_unstable();


use .sort() instead

patrick-ogrady · 2025-11-08T21:15:48Z

cryptography/src/bls12381/benches/bte_decrypt.rs

+const PARTICIPANTS: [u32; 2] = [10, 100];
+const THREADS: [usize; 2] = [1, 8];
+
+struct BenchmarkData {


nit: just call this Data

cryptography/src/bls12381/bte.rs

patrick-ogrady · 2025-11-08T21:38:11Z

cryptography/src/bls12381/bte.rs

+pub struct BatchResponse<V: Variant> {
+    pub index: u32,
+    /// Positions of ciphertexts (0-indexed) that the server included in this proof.
+    pub valid_indices: Vec<u32>,


nit: BitVec?

codecov · 2025-11-09T02:14:59Z

Codecov Report

❌ Patch coverage is 92.98469% with 55 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.22%. Comparing base (fc5702b) to head (f973caa).

Files with missing lines	Patch %	Lines
cryptography/src/bls12381/bte.rs	92.98%	55 Missing ⚠️

@@           Coverage Diff            @@
##             main    #2184    +/-   ##
========================================
  Coverage   92.21%   92.22%            
========================================
  Files         316      317     +1     
  Lines       86325    87109   +784     
========================================
+ Hits        79607    80336   +729     
- Misses       6718     6773    +55

Files with missing lines	Coverage Δ
cryptography/src/bls12381/bte.rs	`92.98% <92.98%> (ø)`

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fc5702b...f973caa. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

cronokirby · 2025-11-09T21:35:00Z

This made me think of #2187 (comment) as a better way to handle parallelism in general.

patrick-ogrady · 2025-11-11T01:17:55Z

cryptography/src/bls12381/bte.rs

+/// Derive the per-ciphertext batching scalars used for the Chaum–Pedersen folding trick.
+///
+/// The transcript binds:
+/// * `context` – caller-chosen batch domain (e.g., request id) so coefficients cannot be replayed


Confirm this has equivalent security to https://eprint.iacr.org/2025/279

The proof of correctness may be tied to a context but the actual partials could be useful without it?

patrick-ogrady · 2025-11-11T01:21:41Z

cryptography/src/bls12381/bte.rs

+        .valid_indices
+        .iter()
+        .map(|idx| {
+            let mut partial = request.ciphertexts[*idx as usize].header;


This permits the partial to be used across requests?

(meaning we could only release once we know for sure it is finalized -> can't do during our finalize vote)

patrick-ogrady added 12 commits November 8, 2025 10:30

spike

e2295e1

progress

7230c7a

skip invalid

2fd2da5

reduce latency

591de06

progress

ba76f83

cleanup decrypt benchmark

39b93ac

add variable participants

a76c196

add verification concurrency

39b9dad

add parallelism

11cac6d

nits

de7cf96

resolve lint in bte

683e6a9

include more ops in benchmark

de26406

patrick-ogrady added 2 commits November 8, 2025 13:28

test for forged response

4f64fc5

add documentation

e0b7faf

patrick-ogrady commented Nov 8, 2025

View reviewed changes

add concurrency

1ff6b5d

patrick-ogrady changed the title ~~[cryptography/bls12381] Batched Threshold Decryption~~ [cryptography/bls12381] Batched Threshold Encryption Nov 8, 2025

patrick-ogrady added 4 commits November 8, 2025 13:59

nits

aa913d9

nit

ccc20da

nit

946a986

clarify DLEQ

f973caa

patrick-ogrady mentioned this pull request Nov 10, 2025

[cryptography/bte] First Optimization Pass #2189

Draft

patrick-ogrady commented Nov 11, 2025

View reviewed changes

patrick-ogrady mentioned this pull request Nov 11, 2025

[crytpography/bte] Context-Dependent Decryption #2203

Draft

[cryptography/bls12381] Batched Threshold Encryption #2184

Are you sure you want to change the base?

[cryptography/bls12381] Batched Threshold Encryption #2184

Uh oh!

Conversation

patrick-ogrady commented Nov 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Initial Benchmarks

Uh oh!

cloudflare-workers-and-pages bot commented Nov 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying monorepo with Cloudflare Pages

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Nov 9, 2025

Codecov Report

Uh oh!

cronokirby commented Nov 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

patrick-ogrady commented Nov 8, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Nov 8, 2025 •

edited

Loading