doc: update book with key recovery scheme from DKG paper

doc/src/SUMMARY.md

@@ -50,7 +50,7 @@
   - [ZK explainer](crypto/zk_explainer.md)
   - [Research](crypto/research.md)
   - [Rate-Limit Nullifiers](crypto/rln.md)
-  - [Trustless 2 of 3 Key Recovery Scheme](crypto/key-recovery-2-of-3.md)
+  - [Key Recovery Scheme](crypto/key-recovery.md)
   - [Reading maths books](crypto/reading-maths-books.md)
 - [Miscellaneous tools](misc/misc.md)
   - [vanityaddr](misc/vanityaddr.md)

doc/src/crypto/key-recovery-2-of-3.md

@@ -1,70 +0,0 @@
-# Trustless 2 of 3 Key Recovery Scheme
-
-The aim of this scheme is to enable 3 players to generate a single public key
-which can be recovered using any 2 of 3 players. It is trustless and anonymous.
-
-The basic concept relies on the additivity of functions $(f\circ g)(a) = f(a) + g(a)$,
-and additive homomorphism of EC points. That way we avoid heavy MPC multiplications
-and keep the scheme lightweight.
-
-The values $x_1, \dots, x_6$ are fixed strings known by all players.
-
-## Constructing the Line
-
-Players 1 and 2 each construct their own lines, with the resulting line
-being the sum of both. Given any 2 points, we can recover the original line and
-hence the secret.
-
-### Player 1 creates line 1
-
-Player 1 creates a random line $\ell_1 = a_1 X + b_1 Y$
-and samples points
-$$ R_1 = (x_1, y_1), R_2 = (x_2, y_2), R_3 = (x_3, y_3) \in V(\ell_1) $$
-Player 1 then sends to:
-
-* Player 2: $x_1, R_2, x_3$
-* Player 3: $x_1, x_2, R_3$
-
-### Player 2 creates line 2
-
-Player 2 creates a random line $\ell_2 = a_2 X + b_2 Y$
-and samples points
-$$ R_4 = (x_4, y_4), R_5 = (x_5, y_5), R_6 = (x_6, y_6) \in V(\ell_2) $$
-Player 2 then sends to:
-
-* Player 1: $x_4, R_5, x_6$
-* Player 3: $x_4, x_5, R_6$
-
-## Compute Points on $\ell_1 + \ell_2$ for Each Player
-
-* Player 1 computes $Q_1 = R_1 + R_5$
-* Player 2 computes $Q_2 = R_2 + R_4$
-* Player 3 computes $Q_3 = R_3 + R_6$
-
-Note that $Q_1, Q_2, Q_3 \in V(\ell_1 + \ell_2)$ but $\ell_1 + \ell_2$
-is unknown to anyone. However 2 actors can collude to recover the original line.
-
-The secret key (unknown to any player) is:
-$$ d = y(Q_1) + y(Q_2) + y(Q_3) $$
-
-## Compute Shared Public Key
-
-Player's 1, 2 and 3 create blinding values $b_1, b_2, b_3$ and sends over
-$y(Q_i) + b_i$.
-
-We then compute the blinded public key as
-$$ \bar{P} = \sum_{i = 1}^3 (y(Q_i) + b_i)G $$
-then each player unblinds $\bar{P}_0 = \bar{P}$ by computing
-$\bar{P}_i = \bar{P}_{i - 1} - b_i G$, which gives us
-$$ P = \bar{P}_3 = (y(Q_1) + y(Q_2) + y(Q_3))G $$
-
-## Key Recovery
-
-WLOG assume player 1 is recovering the secret key with player 2's $Q_2$.
-They compute the line $\ell_1 + \ell_2$ by
-$$ m = \frac{y(Q_2) - y(Q_1)}{x(Q_2) - x(Q_1)} $$
-$$ L(X) = m(X - x(Q_1)) + y(Q_1) $$
-which allows us to compute $Q_3 = (x_2 + x_5, L(x_2 + x_5))$, and so
-we are able to recover the secret $d$.
-
-

doc/src/crypto/key-recovery.md

@@ -0,0 +1,51 @@
+# Key Recovery Scheme
+
+The aim of this scheme is to enable 3 players to generate a single public key
+which can be recovered using any $t$ of $n$ players. It is trustless and anonymous.
+The scheme can be used for multisig payments which appear on chain as normal payments.
+
+The basic concept relies on the additivity of functions $(f∘g)(a) = f(a) + g(a)$,
+and additive homomorphism of EC points. That way we avoid heavy MPC multiplications
+and keep the scheme lightweight.
+
+The values $x₁, …, xₙ$ are fixed strings known by all players.
+
+Let $⟨x⟩ = \textrm{commit}(x)$ denote a hiding pedersen commitment to $x$.
+
+## Constructing the Curve
+
+Each player $i$ constructs their own curves, with the resulting curve
+being the sum of them all. Given any t points, we can recover the original curve and
+hence the secret.
+
+### Player $i$ creates curve $i$
+
+Player $i$ creates a random curve $Cᵢ = Y + a₀ + a₁X + ⋯ + aₜ₋₁Xᵗ⁻¹$, and broadcasts
+commits $A₀ = ⟨a₀⟩, …, Aₜ₋₁ = ⟨aₜ₋₁⟩$.
+
+Then player $i$ lifts points
+$$ Rⱼ = (xⱼ, yⱼ) ∈ V(Cᵢ) $$
+sending each to player $j$.
+
+### Check $Rⱼ ∈ V(Cᵢ)$
+
+Upon receiving player $j$ receiving $Rⱼ$, they check that
+$$ ⟨yⱼ⟩ + ⟨a₀⟩ + xⱼ⟨a₁⟩ + ⋯ + xⱼᵗ⁻¹⟨aₜ₋₁⟩ = ∞ $$
+
+## Compute Shared Public Key
+
+Let $C = C₁ + ⋯ + Cₙ$, then the secret key (unknown to any player) is:
+$$ d = C(𝟎) $$
+The corresponding public key is:
+$$ P = A₀₁ + ⋯ + A₀ₙ = ⟨C₁(𝟎) + ⋯ + Cₙ(𝟎)⟩ = ⟨C(𝟎)⟩ $$
+
+## Key Recovery
+
+Let $T ⊆ N$ be the subset $|T| = t$ of players recovering the secret key.
+Reordering as needed, all players in $T$ send their points $Rⱼ$ for curves $C₁, …, Cₙ$ to player 1.
+
+For each curve $Cᵢ$, player 1 now has $t$ points. Using either lagrange interpolation or row reduction, they
+can recover curves $C₁, …, Cₙ$ and compute $C = C₁ + ⋯ + Cₙ$.
+
+Then player 1 computes the shared secret $d = C(𝟎)$.
+