Library Usage

The public API is accessible through the Pvss class. Each instance stores the public state of a complete PVSS workflow. Messages created in one instance must be transferred somehow (network, git repo, etc.) and be imported into the other instances.

Example

The following code is equivalent to the CLI example, if it would be ran inside a single python process:

from pvss import Pvss
from pvss.ristretto_255 import create_ristretto_255_parameters

# init, genparams
pvss_init = Pvss()
params = create_ristretto_255_parameters(pvss_init)

# alice, genuser
pvss_alice = Pvss()
pvss_alice.set_params(params)
alice_priv, alice_pub = pvss_alice.create_user_keypair("Alice")

# boris, genuser
pvss_boris = Pvss()
pvss_boris.set_params(params)
boris_priv, boris_pub = pvss_boris.create_user_keypair("Boris")

# chris, genuser
pvss_chris = Pvss()
pvss_chris.set_params(params)
chris_priv, chris_pub = pvss_chris.create_user_keypair("Chris")

# dealer, splitsecret
pvss_dealer = Pvss()
pvss_dealer.set_params(params)
pvss_dealer.add_user_public_key(chris_pub)
pvss_dealer.add_user_public_key(alice_pub)
pvss_dealer.add_user_public_key(boris_pub)
secret0, shares = pvss_dealer.share_secret(2)

# receiver, genreceiver
pvss_receiver = Pvss()
pvss_receiver.set_params(params)
recv_priv, recv_pub = pvss_receiver.create_receiver_keypair("receiver")

# boris, reencrypt
pvss_boris.add_user_public_key(alice_pub)
pvss_boris.add_user_public_key(chris_pub)
pvss_boris.set_shares(shares)
pvss_boris.set_receiver_public_key(recv_pub)
reenc_boris = pvss_boris.reencrypt_share(boris_priv)

# alice, reencrypt
pvss_alice.add_user_public_key(boris_pub)
pvss_alice.add_user_public_key(chris_pub)
pvss_alice.set_shares(shares)
pvss_alice.set_receiver_public_key(recv_pub)
reenc_alice = pvss_alice.reencrypt_share(alice_priv)

# receiver, reconstruct
pvss_receiver.add_user_public_key(boris_pub)
pvss_receiver.add_user_public_key(chris_pub)
pvss_receiver.add_user_public_key(alice_pub)
pvss_receiver.set_shares(shares)
pvss_receiver.add_reencrypted_share(reenc_alice)
pvss_receiver.add_reencrypted_share(reenc_boris)
secret1 = pvss_receiver.reconstruct_secret(recv_priv)

print(secret0 == secret1)

API reference

pvss.qr.create_qr_params(pvss: pvss.pvss.Pvss, params: Union[int, str, ByteString]) → bytes[source]

Create and set QR parameters.

If params is str or a ByteString, assume it’s a diffie-hellman parameter file such as created by “openssl dhparam 4096”, either DER or PEM encoded.

Parameters
  • pvss – Pvss object with public values

  • params – if int, must be a safe prime, otherwise must be a DH params file with a safe prime.

Returns

DER encoded QR system parameters.

pvss.ristretto_255.create_ristretto_255_parameters(pvss: pvss.pvss.Pvss) → bytes[source]

Create and set Ristretto255 parameters.

Parameters

pvss – Pvss object with public values

Returns

DER encoded Ristretto255 system parameters.

class pvss.Pvss[source]

Main class to work with Pvss. Stores all public messages and exposes the PVSS operations.

The constructor takes no parameters.

add_reencrypted_share(data: ByteString) → pvss.pvss.ReencryptedShare[source]

Add a re-encrypted share to the internal state.

Parameters

data – DER encoded re-encrypted share.

Returns

Decoded reencrypted share.

Raises

ValueError – On duplicate

add_user_public_key(data: ByteString) → pvss.pvss.PublicKey[source]

Add a user public key to the internal state.

Parameters

data – DER encoded public key

Returns

Decoded user public key.

Raises

ValueError – On duplicate name or public key value

create_receiver_keypair(name: str) → Tuple[bytes, bytes][source]

Create a random key pair for the receiver.

Parameters

name – Name of key; will be included in the public key.

Returns

DER encoded private key and public key

create_user_keypair(name: str) → Tuple[bytes, bytes][source]

Create a random key pair for a user.

Parameters

name – Name of key; will be included in the public key.

Returns

DER encoded private key and public key

property params

Retrieve system parameters.

Returns

The system parameters.

property receiver_public_key

Retrieve receiver’s public key.

Returns

Receiver’s public key.

reconstruct_secret(der_private_key: ByteString) → bytes[source]

Decrypt the re-encrypted shares with the private key and reconstruct the secret

Parameters

der_private_key – Receiver’s DER encoded private key

Returns

DER encoded secret

reencrypt_share(der_private_key: ByteString) → bytes[source]

Decrypt a share of the encrypted secret with the private_key and re-encrypt it with another public key

Parameters

der_private_key – A user’s DER encoded private key

Returns

DER encoded re-encrypted share

property reencrypted_shares

Retrieve the list of reencrypted shares.

Returns

List of reencrypted shares.

set_params(data: ByteString) → pvss.pvss.SystemParameters[source]

Set system parameters.

Args

data: DER encoded system parameters.

Returns

Decoded system parameters.

Raises

Exception – If already set.

set_receiver_public_key(data: ByteString) → pvss.pvss.PublicKey[source]

Add the receiver’s public key to the internal state.

Parameters

data – DER encoded receiver’s public key.

Returns

Decoded receiver’s public key.

Raises

Exception – On duplicate

set_shares(data: ByteString) → pvss.pvss.SharedSecret[source]

Set the shares of the secret.

Parameters

data – DER encoded secret shares.

Returns

Decoded secret shares.

Raises

Exception – If already set.

share_secret(qualified_size: int) → Tuple[bytes, bytes][source]

Create a secret, split it and compute the encrypted shares.

Parameters

qualified_size – Number of shares required to reconstruct the secret

Returns

DER encoded shared secret and the DER encoded encrypted shares

property shares

Retrieve the shares of the secret.

Returns

Shares of the secret.

property user_public_keys

Retrieve all user public keys, as mapping from username to PublicKey.

Returns

Mapping of username to PublicKey.