We’ve got launched FROST v2.2.0, which features a safety repair. There aren’t any breaking adjustments on this launch. For full particulars, please confer with the launch notes.
Safety Repair
This launch provides validation for the min_signers parameter within the frost_core::keys::refresh capabilities. Earlier than, it was not clear that it was not attainable to vary min_signers with the refresh process. Utilizing a smaller worth wouldn’t lower the brink, and makes an attempt to signal utilizing a smaller threshold would fail. Moreover, after refreshing the shares with a smaller threshold, it might nonetheless be attainable to signal with the unique threshold; nonetheless, this might trigger a safety loss to the participant’s shares. We’ve got not decided the precise safety implications of doing so and judged it less complicated to simply validate min_signers. If for some motive you’ve achieved a refresh share process with a smaller min_signers we strongly suggest migrating to a brand new key. Thanks BlockSec for reporting the discovering.
Different Modifications
The Minimal Supported Rust Model (MSRV) has been up to date to 1.81, making all crates no-std, aside from frost-ed448. Distributed Key Technology (DKG) refresh capabilities have been added to the crate-specific refresh modules. Moreover, we now have added serialize_whole and deserialize_whole strategies for VerifiableSecretSharingCommitment. To additional improve customization choices, a brand new post_generate technique has been carried out within the Ciphersuite, permitting for better flexibility in ciphersuite configurations. We’ve additionally made documentation enhancements and improved check protection.
Acknowledgments
A giant thanks to all of the contributors who made this launch attainable: @VolodymyrB, @StackOverflowExcept1on, @crStiv, @azuchi, @conradoplg and @natalieesk
