[experimental][threshold_ecdsa] Add threshold ECDSA module with native Paillier and YACL-style cleanup

.github/workflows/cla.yml

@@ -20,8 +20,21 @@ on:
   pull_request_target:
     types: [opened, closed, synchronize]
 permissions:
+  contents: write
+  issues: write
   pull-requests: write
 jobs:
   CLAssistant:
-    uses: secretflow/.github/.github/workflows/cla.yml@main
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: CLA Assistant
+        if: github.event_name == 'pull_request_target' || github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-document: https://github.com/secretflow/.github/blob/main/CLA.md
+          path-to-signatures: signatures/version1/cla.json
+          branch: main
+          allowlist: jjllzhang,test,renovate[bot],dependabot[bot],pre-commit-ci[bot],github-actions[bot],snyk-bot,Copilot
+          lock-pullrequest-aftermerge: true

yacl/crypto/experimental/threshold_signatures/BUILD.bazel

@@ -0,0 +1,98 @@
+# Copyright 2026 Ant Group Co., Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("//bazel:yacl.bzl", "yacl_cc_binary", "yacl_cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+TECDSA_COPTS = ["-std=gnu++20"]
+
+TSIG_CORE_SRCS = glob([
+    "core/**/*.cc",
+])
+
+TSIG_CORE_HDRS = glob([
+    "common/*.h",
+    "core/**/*.h",
+])
+
+TSIG_ECDSA_SRCS = glob([
+    "ecdsa/**/*.cc",
+])
+
+TSIG_ECDSA_HDRS = glob([
+    "ecdsa/**/*.h",
+])
+
+TSIG_COMMON_DEPS = [
+    "//yacl/crypto/ecc/openssl:openssl",
+    # Big integer backend used across scalar/paillier/proof/protocol code paths.
+    "//yacl/math/mpint",
+]
+
+yacl_cc_library(
+    name = "tsig_core",
+    srcs = TSIG_CORE_SRCS,
+    hdrs = TSIG_CORE_HDRS,
+    copts = TECDSA_COPTS,
+    deps = TSIG_COMMON_DEPS + [
+        "//yacl/base:exception",
+        "//yacl/crypto/hash:ssl_hash",
+        "//yacl/crypto/rand",
+    ],
+)
+
+yacl_cc_library(
+    name = "tsig_ecdsa",
+    srcs = TSIG_ECDSA_SRCS,
+    hdrs = TSIG_ECDSA_HDRS,
+    copts = TECDSA_COPTS,
+    deps = [
+        ":tsig_core",
+    ],
+)
+
+yacl_cc_library(
+    name = "tsig_sm2",
+    srcs = glob([
+        "sm2/**/*.cc",
+    ]),
+    hdrs = glob([
+        "sm2/**/*.h",
+    ]),
+    copts = TECDSA_COPTS,
+    deps = [
+        ":tsig_core",
+    ],
+)
+
+yacl_cc_binary(
+    name = "sign_flow_tests",
+    srcs = [
+        "tests/ecdsa_flow_test.cc",
+        "tests/test_helpers.h",
+    ],
+    copts = TECDSA_COPTS,
+    deps = [":tsig_ecdsa"],
+)
+
+yacl_cc_binary(
+    name = "sm2_sign_flow_tests",
+    srcs = [
+        "tests/sm2_flow_test.cc",
+        "tests/test_helpers.h",
+    ],
+    copts = TECDSA_COPTS,
+    deps = [":tsig_sm2"],
+)

yacl/crypto/experimental/threshold_signatures/README.md

@@ -0,0 +1,98 @@
+# Threshold Signatures
+
+## Introduction
+
+This directory contains experimental C++20 implementations of threshold ECDSA
+and threshold SM2. The two schemes have independent protocol flows and share
+common cryptographic building blocks through `core/`.
+
+The code is intended for protocol review and integration experiments. It does
+not include transport, persistent storage, wallet integration, or production
+hardening.
+
+## Implementation
+
+### Code Structure
+
+1. `common/` defines shared aliases, participant ids, peer maps, and error
+   helpers.
+2. `core/` contains the shared primitives used by both schemes:
+   - `algebra/`: curve point and scalar wrappers over YACL ECC.
+   - `bigint/`: protocol-facing `MPInt` encoding and validation helpers.
+   - `commitment/`, `transcript/`, `proof/`, `vss/`: commitment,
+     Fiat-Shamir transcript, Schnorr proof, and Feldman VSS helpers.
+   - `mta/`: semantic MtA/MtAwc session API and the corresponding proof
+     primitives.
+   - `paillier/`: Paillier provider, auxiliary RSA setup, and paper proof
+     helpers.
+   - `protocol/`: peer-message checks and a simple linear round driver.
+   - `random/`, `suite/`: threshold-signature random helpers, suite
+     descriptors, group contexts, and hash dispatch.
+3. `ecdsa/` implements threshold ECDSA key generation, signing, relation
+   proofs, and signature verification.
+4. `sm2/` implements threshold SM2 key generation, offline presigning, online
+   signing, identifiable-abort data types, SM2-specific proofs, ZID binding,
+   and signature verification.
+5. `tests/` contains executable ECDSA and SM2 flow tests.
+
+### Threshold ECDSA
+
+1. Key generation uses dealerless Feldman VSS, Paillier parameters, auxiliary
+   RSA parameters, square-free/auxiliary proofs, and public-share checks.
+2. `VerifiedPublicKeygenData` validates and owns the public keygen data consumed
+   by signing.
+3. Signing is exposed as explicit round methods on `SignParty`. The large
+   signing flow is split by round, and `SigningMtaExchange` hides pairwise
+   MtA/MtAwc message and proof details from the scheme-level round code.
+4. Finalization verifies the produced ECDSA signature before returning it.
+
+### Threshold SM2
+
+1. Key generation derives SM2 public-key material from distributed `z_i` shares,
+   pairwise MtA sigma shares, group relation proofs, square-free proofs, and
+   Paillier auxiliary proof artifacts.
+2. Offline presigning computes nonce/product state with MtAwc and validates the
+   aggregate product relation.
+3. Online signing binds the SM2 ZID digest, computes partial signatures, and
+   returns identifiable-abort evidence for invalid partials when possible.
+
+## Build / Test
+
+Build all threshold-signature targets:
+
+```bash
+bazel build //yacl/crypto/experimental/threshold_signatures:all
+```
+
+Build individual libraries:
+
+```bash
+bazel build //yacl/crypto/experimental/threshold_signatures:tsig_core
+bazel build //yacl/crypto/experimental/threshold_signatures:tsig_ecdsa
+bazel build //yacl/crypto/experimental/threshold_signatures:tsig_sm2
+```
+
+Run the executable flow tests:
+
+```bash
+bazel run //yacl/crypto/experimental/threshold_signatures:sign_flow_tests
+bazel run //yacl/crypto/experimental/threshold_signatures:sm2_sign_flow_tests
+```
+
+## Dependencies
+
+- Elliptic-curve operations use YACL ECC support.
+- Big integer operations use YACL `MPInt`.
+- Random bytes are sourced through `yacl::crypto::SecureRandBytes`.
+- Hashing is routed through YACL hash abstractions such as `SslHash` and
+  `HashAlgorithm`.
+
+## Notes
+
+- The module keeps ECDSA and SM2 protocol messages separate and shares only
+  primitives that are common to both schemes.
+- Scheme-level code calls semantic MtA APIs such as `InitiatorInit`,
+  `ResponderMid`, and `InitiatorEnd`; low-level proof construction and
+  verification remain inside `core/mta`.
+- `core/bigint` is a protocol adapter for encoding and validation. It should
+  not be expanded into a mirror of the full `MPInt` API.

yacl/crypto/experimental/threshold_signatures/common/errors.h

@@ -0,0 +1,24 @@
+// Copyright 2026 Ant Group Co., Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include "yacl/base/exception.h"
+
+// Use YACL-style exceptions with a safe "{}" wrapper so dynamic messages are
+// treated as plain text instead of runtime format strings.
+#define TECDSA_THROW(msg) YACL_THROW("{}", (msg))
+#define TECDSA_THROW_ARGUMENT(msg) YACL_THROW_ARGUMENT_ERROR("{}", (msg))
+#define TECDSA_THROW_LOGIC(msg) YACL_THROW_LOGIC_ERROR("{}", (msg))
+#define TECDSA_ENFORCE(cond, msg) YACL_ENFORCE((cond), "{}", (msg))

yacl/crypto/experimental/threshold_signatures/common/ids.h

@@ -0,0 +1,31 @@
+// Copyright 2026 Ant Group Co., Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace tecdsa {
+
+using Bytes = std::vector<uint8_t>;
+using PartyIndex = uint32_t;
+
+struct PartyInfo {
+  PartyIndex id;
+  std::string endpoint;
+};
+
+}  // namespace tecdsa

yacl/crypto/experimental/threshold_signatures/common/types.h

@@ -0,0 +1,30 @@
+// Copyright 2026 Ant Group Co., Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include "yacl/crypto/experimental/threshold_signatures/core/algebra/point.h"
+#include "yacl/crypto/experimental/threshold_signatures/core/algebra/scalar.h"
+#include "yacl/crypto/experimental/threshold_signatures/core/paillier/paillier.h"
+
+namespace tecdsa {
+
+using BigInt = core::paillier::BigInt;
+using ECPoint = core::Point;
+using Scalar = core::Scalar;
+
+using PaillierProvider = core::paillier::PaillierProvider;
+using PaillierPublicKey = core::paillier::PaillierPublicKey;
+
+}  // namespace tecdsa