Study ChillDKG and CocktailDKG to help ZIP 312 move forward

[conradoplg]

[conradoplg]

Done, this helped guide #1032 and C2SP/C2SP#216.

Here is a small writeup on the main points to be aware:

• The DKG we have implemented is also named "PedPop" by the Chill-DKG authors.
• ChillDKG is based on a variant of PedPop named SimplPedPop, which has two main differences over PepPop
  • There is a "DKG Coordinator" role with aggregates commitments and thus reduces the number of message sents, but introduces some complexity related to cheater identification
  • All the data is sent in the first round, while in PedPop some is sent in round 1 and some in round 2 (for reasons I don't understand).
• ChillDKG adds mainly two things on top of SimplPedPop:
  • encryption (using ephemeral-static diffie-hellman and XOR encryption)
  • a certification phase (CertEq) to ensure everyone has the same data (this addresses Lack of agreement despite broadcast #577)
• CocktailDKG is a generalization of ChillDKG for arbitrary ciphersuites, but not only that, it also has some changes related to ChillDKG, namely:
  • Ephemeral-static and static-static diffie-hellman for more assurance (see spec for detailed rationale)
  • AEAD encryption
  • No longer uses coordinator aggregation (or at least does not spell that out directly)