-
Notifications
You must be signed in to change notification settings - Fork 305
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pcli
threshold interface is unnecessarily brittle
#4335
Comments
cross-referencing #4343, which makes some improvements re: hitting enter twice. |
A common pattern in the threshold code seems to be code like for _ in 1..self.config.threshold() {
let reply_str = self
.terminal
.next_response()
.await?
.ok_or(anyhow!("expected round1 reply"))?;
let reply = from_json::<sign::FollowerRound1>(&reply_str)?;
acc.push(reply);
} This would be cumbersome to add retry logic to in every place. I'm wondering if instead we could change |
I implemented the suggestion in #4335 and then tested running a ceremony in three split-pane terminal windows for maximum confusion about which messages go where. The resulting code is robust to mistaken entry, ensuring: - messages are validly parseable (so cannot mix round 1 and round 2, and resilient to typos) - messages are not duplicated (so pasting twice does not kill the ceremony) - messages are not self-broadcast (so pasting our own message is ignored)
I implemented the suggestion in #4335 and then tested running a ceremony in three split-pane terminal windows for maximum confusion about which messages go where. The resulting code is robust to mistaken entry, ensuring: - messages are validly parseable (so cannot mix round 1 and round 2, and resilient to typos) - messages are not duplicated (so pasting twice does not kill the ceremony) - messages are not self-broadcast (so pasting our own message is ignored)
## Describe your changes Improves UX for the DKG ceremony based on user feedback, so we can actually tell people to use it. This is a PR on top of #4343 to make it as easy as possible to merge. ## Issue ticket number and link #4335 ## Checklist before requesting a review - [x] If this code contains consensus-breaking changes, I have added the "consensus-breaking" label. Otherwise, I declare my belief that there are not consensus-breaking changes, for the following reason: > client-side key generation logic only
Closed by #4352 |
## Describe your changes Improves UX for the DKG ceremony based on user feedback, so we can actually tell people to use it. This is a PR on top of #4343 to make it as easy as possible to merge. ## Issue ticket number and link #4335 ## Checklist before requesting a review - [x] If this code contains consensus-breaking changes, I have added the "consensus-breaking" label. Otherwise, I declare my belief that there are not consensus-breaking changes, for the following reason: > client-side key generation logic only
## Describe your changes Improves UX for the DKG ceremony based on user feedback, so we can actually tell people to use it. This is a PR on top of #4343 to make it as easy as possible to merge. ## Issue ticket number and link #4335 ## Checklist before requesting a review - [x] If this code contains consensus-breaking changes, I have added the "consensus-breaking" label. Otherwise, I declare my belief that there are not consensus-breaking changes, for the following reason: > client-side key generation logic only
Describe the bug
Using the DKG through
pcli
involves copy-pasting JSON messages between the participants. We chose this design for two reasons:However, the way this is currently implemented causes a terrible user experience:
We do want to have the behavior of "abort on failure" causing a ceremony restart, without the possibility of improperly reusing any state. But, if we could distinguish between errors caused by copy paste problems and errors caused by a cryptographic adversary, we could substantially improve the UX here.
To do this, we should change the code that reads a single message to retry on any parse failure. This handles issues like #4260 as a side effect, and cannot leak any secrets (because parsing the message does not involve secret data).
The text was updated successfully, but these errors were encountered: