Check for sufficient signers when verifying multisignature, in tECDSA…

… create_transcript
dfinity · Dec 8, 2021 · 08fbca3 · 08fbca3
1 parent f86294a
commit 08fbca3
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 6 deletions.
diff --git a/rs/crypto/src/sign/canister_threshold_sig/idkg/transcript.rs b/rs/crypto/src/sign/canister_threshold_sig/idkg/transcript.rs
@@ -29,6 +29,7 @@ pub fn create_transcript<C: IDkgProtocolCspClient + CspSigner>(
     ensure_sufficient_dealings_collected(params, dealings)?;
     ensure_dealers_allowed_by_params(params, dealings)?;
     ensure_signers_allowed_by_params(params, dealings)?;
+    ensure_sufficient_signatures_collected(params, dealings)?;
     verify_multisignatures(csp_client, registry, dealings, params.registry_version())?;
 
     let internal_dealings = internal_dealings_by_index_from_dealings(
@@ -157,6 +158,29 @@ fn ensure_signers_allowed_by_params(
     Ok(())
 }
 
+fn ensure_sufficient_signatures_collected(
+    params: &IDkgTranscriptParams,
+    dealings: &BTreeMap<NodeId, IDkgMultiSignedDealing>,
+) -> Result<(), IDkgCreateTranscriptError> {
+    for (dealer, dealing) in dealings {
+        if dealing.signers.len() < params.verification_threshold().get() as usize {
+            return Err(
+                IDkgCreateTranscriptError::UnsatisfiedVerificationThreshold {
+                    threshold: params.verification_threshold().get(),
+                    signature_count: dealing
+                        .signers
+                        .len()
+                        .try_into()
+                        .expect("if this is an error, we know it's small enough for 32 bits"),
+                    dealer_id: *dealer,
+                },
+            );
+        }
+    }
+
+    Ok(())
+}
+
 fn verify_multisignatures<C: IDkgProtocolCspClient + CspSigner>(
     csp_client: &C,
     registry: &Arc<dyn RegistryClient>,

diff --git a/rs/types/types/src/crypto/canister_threshold_sig/error.rs b/rs/types/types/src/crypto/canister_threshold_sig/error.rs
@@ -52,12 +52,30 @@ impl_display_using_debug!(IDkgTranscriptParsingError);
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum IDkgCreateTranscriptError {
-    SerializationError { internal_error: String },
-    InternalError { internal_error: String },
-    DealerNotAllowed { node_id: NodeId },
-    SignerNotAllowed { node_id: NodeId },
-    UnsatisfiedCollectionThreshold { threshold: u32, dealer_count: u32 },
-    InvalidMultisignature { crypto_error: CryptoError },
+    SerializationError {
+        internal_error: String,
+    },
+    InternalError {
+        internal_error: String,
+    },
+    DealerNotAllowed {
+        node_id: NodeId,
+    },
+    SignerNotAllowed {
+        node_id: NodeId,
+    },
+    UnsatisfiedCollectionThreshold {
+        threshold: u32,
+        dealer_count: u32,
+    },
+    UnsatisfiedVerificationThreshold {
+        threshold: u32,
+        signature_count: u32,
+        dealer_id: NodeId,
+    },
+    InvalidMultisignature {
+        crypto_error: CryptoError,
+    },
 }
 impl_display_using_debug!(IDkgCreateTranscriptError);