[experimental][threshold_ecdsa] Add threshold ECDSA module with native Paillier and YACL-style cleanup

yacl/crypto/experimental/threshold_ecdsa/BUILD.bazel

@@ -0,0 +1,86 @@
+# Copyright 2026 Ant Group Co., Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("//bazel:yacl.bzl", "yacl_cc_binary", "yacl_cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+TECDSA_COPTS = ["-std=gnu++20"]
+
+TECDSA_CORE_SRCS = glob([
+    "crypto/*.cc",
+    "net/*.cc",
+    "protocol/*.cc",
+])
+
+TECDSA_CORE_HDRS = glob([
+    "common/*.h",
+    "crypto/*.h",
+    "net/*.h",
+    "protocol/*.h",
+])
+
+TECDSA_CORE_DEPS = [
+    "//yacl/crypto/ecc/openssl:openssl",
+]
+
+TECDSA_CORE_LINKOPTS = [
+    "-lcrypto",
+    "-lgmpxx",
+    "-lgmp",
+]
+
+yacl_cc_library(
+    name = "tecdsa_core",
+    srcs = TECDSA_CORE_SRCS,
+    hdrs = TECDSA_CORE_HDRS,
+    copts = TECDSA_COPTS,
+    deps = TECDSA_CORE_DEPS + [
+        "//yacl/base:exception",
+    ],
+    linkopts = TECDSA_CORE_LINKOPTS,
+)
+
+alias(
+    name = "tecdsa_m0",
+    actual = ":tecdsa_core",
+)
+
+yacl_cc_binary(
+    name = "crypto_primitives_tests",
+    srcs = ["tests/crypto_primitives_test.cc"],
+    copts = TECDSA_COPTS,
+    deps = [":tecdsa_core"],
+)
+
+yacl_cc_binary(
+    name = "protocol_infrastructure_tests",
+    srcs = ["tests/protocol_infrastructure_test.cc"],
+    copts = TECDSA_COPTS,
+    deps = [":tecdsa_core"],
+)
+
+yacl_cc_binary(
+    name = "keygen_flow_tests",
+    srcs = ["tests/keygen_flow_test.cc"],
+    copts = TECDSA_COPTS,
+    deps = [":tecdsa_core"],
+)
+
+yacl_cc_binary(
+    name = "sign_flow_tests",
+    srcs = ["tests/sign_flow_test.cc"],
+    copts = TECDSA_COPTS,
+    deps = [":tecdsa_core"],
+)

yacl/crypto/experimental/threshold_ecdsa/CMakeLists.txt

@@ -0,0 +1,61 @@
+cmake_minimum_required(VERSION 3.22)
+project(threshold_ecdsa LANGUAGES C CXX)
+
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+find_package(OpenSSL QUIET)
+
+set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
+
+add_library(tecdsa_core
+  crypto/scalar.cc
+  crypto/ec_point.cc
+  crypto/ecdsa_verify.cc
+  crypto/hash.cc
+  crypto/random.cc
+  crypto/commitment.cc
+  crypto/encoding.cc
+  crypto/paillier.cc
+  crypto/strict_proofs.cc
+  crypto/transcript.cc
+  net/envelope.cc
+  net/in_memory_transport.cc
+  protocol/session.cc
+  protocol/session_router.cc
+  protocol/keygen_session.cc
+  protocol/sign_session.cc
+)
+
+target_include_directories(tecdsa_core PUBLIC
+  ${CMAKE_CURRENT_SOURCE_DIR}/../../../../
+  ${CMAKE_CURRENT_SOURCE_DIR}
+)
+
+target_link_libraries(tecdsa_core PUBLIC gmpxx gmp)
+if(OpenSSL_FOUND)
+  target_link_libraries(tecdsa_core PUBLIC OpenSSL::Crypto)
+else()
+  target_link_libraries(tecdsa_core PUBLIC crypto)
+endif()
+
+add_library(tecdsa_m0 ALIAS tecdsa_core)
+
+add_executable(crypto_primitives_tests tests/crypto_primitives_test.cc)
+target_link_libraries(crypto_primitives_tests PRIVATE tecdsa_core)
+
+add_executable(protocol_infrastructure_tests tests/protocol_infrastructure_test.cc)
+target_link_libraries(protocol_infrastructure_tests PRIVATE tecdsa_core)
+
+add_executable(keygen_flow_tests tests/keygen_flow_test.cc)
+target_link_libraries(keygen_flow_tests PRIVATE tecdsa_core)
+
+add_executable(sign_flow_tests tests/sign_flow_test.cc)
+target_link_libraries(sign_flow_tests PRIVATE tecdsa_core)
+
+enable_testing()
+add_test(NAME crypto_primitives_tests COMMAND crypto_primitives_tests)
+add_test(NAME protocol_infrastructure_tests COMMAND protocol_infrastructure_tests)
+add_test(NAME keygen_flow_tests COMMAND keygen_flow_tests)
+add_test(NAME sign_flow_tests COMMAND sign_flow_tests)

yacl/crypto/experimental/threshold_ecdsa/README.md

@@ -0,0 +1,130 @@
+# threshold_ecdsa
+
+Research artifact for a C++20 implementation of the GG2019 threshold ECDSA protocol.
+
+## Paper Reference
+
+- Rosario Gennaro, Steven Goldfeder.  
+  *Fast Multiparty Threshold ECDSA with Fast Trustless Setup* (CCS 2019).
+
+This repository implements protocol components as executable state machines and emphasizes:
+
+- protocol-correct message flow,
+- strict input validation and abort behavior,
+- reproducible tests.
+
+It is not a production-ready wallet/signing service.
+
+## Scope of This Artifact
+
+### Implemented Components
+
+- Elliptic-curve scalar/point operations (`yacl::crypto::EcGroup` with openssl backend).
+- Native Paillier encryption implementation (`yacl-native`).
+- Hashing, commitments, transcript/challenge utilities, wire encoding.
+- Session model with lifecycle management (`running/completed/aborted/timed-out`).
+- In-memory transport and session routing.
+- Threshold key generation (`KeygenSession`, 3 phases).
+- Threshold signing (`SignSession`, Phase1 to Phase5E).
+- Strict/dev gating for square-free and auxiliary-parameter proof artifacts.
+
+### Current Engineering Goal
+
+The repository targets protocol engineering reproducibility, not hardened deployment.
+
+## Repository Layout
+
+```text
+common/        # bytes/secure_zeroize/thread_pool
+crypto/        # Scalar/ECPoint/Paillier/hash/commitment/encoding/transcript/proofs
+net/           # Envelope, transport interfaces, in-memory network
+protocol/      # Session base, router, keygen/sign state machines
+tests/
+  crypto_primitives_test.cc
+  protocol_infrastructure_test.cc
+  keygen_flow_test.cc
+  sign_flow_test.cc
+```
+
+## Reproducibility
+
+### Requirements
+
+- CMake >= 3.22
+- C++20 compiler (`clang++`/`g++`)
+- GMP / gmpxx
+- OpenSSL `libcrypto`
+
+### Build
+
+```bash
+cmake -S . -B build
+cmake --build build -j
+```
+
+### Bazel
+
+```bash
+bazelisk build //yacl/crypto/experimental/threshold_ecdsa:tecdsa_core
+bazelisk build //yacl/crypto/experimental/threshold_ecdsa:all
+```
+
+If your environment resolves `rules_foreign_cc` to `built_make` and fails on
+`BootstrapGNUMake`, run with one-off toolchain flags:
+
+```bash
+bazelisk build //yacl/crypto/experimental/threshold_ecdsa:tecdsa_core \
+  --extra_toolchains=@rules_foreign_cc//toolchains:preinstalled_make_toolchain,@rules_foreign_cc//toolchains:preinstalled_pkgconfig_toolchain
+```
+
+### Test Suite
+
+Run all tests:
+
+```bash
+ctest --test-dir build --output-on-failure
+```
+
+Run individual executables:
+
+```bash
+./build/crypto_primitives_tests
+./build/protocol_infrastructure_tests
+./build/keygen_flow_tests
+./build/sign_flow_tests
+```
+
+### Test Coverage Summary
+
+- `crypto_primitives_tests`: basic crypto primitives and wire format checks.
+- `protocol_infrastructure_tests`: transport/router/session skeleton behavior.
+- `keygen_flow_tests`: end-to-end keygen, strict gating, and adversarial tampering.
+- `sign_flow_tests`: end-to-end signing, proof checks, and adversarial failure paths.
+
+## Error Handling Style
+
+- Runtime argument/logic/runtime failures in module code are normalized through
+  `common/errors.h` (`TECDSA_THROW*`) and map to YACL exception macros.
+
+## Protocol Flow (Implemented)
+
+### Keygen (`KeygenSession`)
+
+1. Phase1: broadcast commitment + Paillier public parameters.
+2. Phase2: broadcast opens/commitments and send shares point-to-point.
+3. Phase3: broadcast `X_i = g^{x_i}` with Schnorr proof.
+4. Finalization: aggregate `x_i`, `y`, all `X_i`, and Paillier/public proof artifacts.
+
+### Sign (`SignSession`)
+
+1. Phase1: commit to `Gamma_i`.
+2. Phase2: MtA/MtAwc interaction with Appendix-A style proof checks.
+3. Phase3: broadcast `delta_i` and aggregate inversion path.
+4. Phase4: open `Gamma_i`, verify proof, derive `R` and `r`.
+5. Phase5A~5E: commit/open rounds with relation proofs, then finalize `(r, s)`.
+
+## Limitations
+
+- Network layer is in-memory only (no real transport security/retransmission/persistence).
+- No claim of production security hardening.
+- Intended for protocol implementation study and testing.

yacl/crypto/experimental/threshold_ecdsa/common/bytes.h

@@ -0,0 +1,10 @@
+#pragma once
+
+#include <cstdint>
+#include <vector>
+
+namespace tecdsa {
+
+using Bytes = std::vector<uint8_t>;
+
+}  // namespace tecdsa

yacl/crypto/experimental/threshold_ecdsa/common/errors.h

@@ -0,0 +1,24 @@
+// Copyright 2026 Ant Group Co., Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include "yacl/base/exception.h"
+
+// Use YACL-style exceptions with a safe "{}" wrapper so dynamic messages are
+// treated as plain text instead of runtime format strings.
+#define TECDSA_THROW(msg) YACL_THROW("{}", (msg))
+#define TECDSA_THROW_ARGUMENT(msg) YACL_THROW_ARGUMENT_ERROR("{}", (msg))
+#define TECDSA_THROW_LOGIC(msg) YACL_THROW_LOGIC_ERROR("{}", (msg))
+#define TECDSA_ENFORCE(cond, msg) YACL_ENFORCE((cond), "{}", (msg))