[samgbafa]

Primitive vector checker

Computes the S0.1 primitive vectors in a separate TypeScript implementation session using @noble/curves 2.4.0 and a frozen Bun lockfile. The existing threshold CI command runs the checker tests, typecheck and real CLI.

• Branch: skgbafa/tc-2219-threshold-checker
• Base branch: skgbafa/tc-2219-threshold-s0-1 (parent feat(threshold): add context-bound derivation and FullIdent wrapping #482)
• Base: 8e052208d2e2023b05ef8e522c01395c3f289002
• Head: fda4b4af8ba4e24544ac8c46521fcfb6ea985797
• Changed paths: only tinycloud-threshold/vectors/check/** (13 new files).
• Draft child PR; no merge requested here.

Computations

H1 with the specified DST; Pedersen h; H3 modulo r with L=48; H2/H4; generator and 5/7 reduced pairings with the SPEC GT tower serialization; FullIdent wrapping from explicit sigma and unwrapping; each encrypted share's two equations; all three 2-of-3 combinations and unwrapping with each derived key.

Checks canonical context/identity/request bytes, the amended 259-byte encoded shares, matching supplied/stored RequestDigest values and response signing preimages. Every negative record executes its decoder, verification or unwrap operation and compares the actual typed result. Share c1/c2 are public group inputs; c3 is recomputed from the explicit scalar share and transport scalar. Producer RNG state is not reconstructed.

Exercised verification

Bun 1.4.4, with private tool homes:

bun install --frozen-lockfile && bun run check
Checked 9 installs across 10 packages (no changes)
21 pass
0 fail
143 expect() calls
Ran 21 tests across 2 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
exit 0

The tests were written before the checker implementation; the initial computation test failed before implementation. Independently chosen protocol cases cover point/scalar encodings, both share equations, identity c3, request/signing bindings, combine binding precedence, duplicate indices, zero aggregate randomness and FullIdent errors. Additional runs of the real CLI against a throwaway perturbed pairing_5_7 expected GT output and an empty case set each exited 1. Throwaway JSON inputs were removed. Both test files run through bun run check in the existing threshold CI lane.

A read-only GitHub API check reported parent #482 open, draft, on skgbafa/tc-2219-threshold-s0-1 at the base above. No Rust command was run in this checker lane.

Provenance

The checker was written in a separate session from SPEC, public JSON vectors and the JSON-only schema/byte-layout handoff. No Rust source, Rust tests, Rust diffs or Rust implementation traces were opened. Dependency implementation files were not opened or used as design inputs.

Consulted source	Use
TinyCloud approved design/plan and tinycloud-threshold/SPEC.md §§3.1–3.6 plus S0.1 appendix	Equations, DSTs, layouts, error ordering and RequestDigest amendment
tinycloud-threshold/vectors/v1/primitives.json and JSON-only schema/byte-layout handoff	Public inputs, expected output bytes and current record format
RFC 9380 §§5.2–5.3.1	Scalar-field reduction and SHA-256 XMD
noble-curves 2.4.0 API documentation	Group, hashing, pairing and field APIs
npm registry metadata for the exact locked versions	Version, integrity and license declarations

Runtime dependencies: @noble/curves 2.4.0 and @noble/hashes 2.4.0 (MIT). Development dependencies: TypeScript 5.9.3 (Apache-2.0); @types/bun 1.3.1, bun-types 1.3.1, @types/node 26.6.6, undici-types 8.9.0, @types/react 19.3.0, csstype 3.2.3 (MIT). Versions and integrity digests are frozen in bun.lock.

Clean-room statement. tinycloud-threshold is written from published papers and standards only: Shamir 1979; Feldman 1987; Pedersen 1991; Gennaro–Jarecki–Krawczyk–Rabin 1999/2007; Boneh–Franklin 2001/2003; Fujisaki–Okamoto 1999; Desmedt–Jajodia 1997; Wong–Wang–Wing 2002; Herzberg–Jarecki–Krawczyk–Yung 1995; CHURP (ePrint 2019/017); vetKeys (ePrint 2023/616); RFC 9380; RFC 9180; the IRTF pairing-friendly-curves draft; and TinyCloud's own design and plan. No source code, tests, issues or other material from TACo, nucypher, nucypher-core, ferveo, umbral or taco-web (GPL-3.0/AGPL-3.0) was opened, fetched, cloned, searched or used. Dependencies are permissively licensed and listed in the PR. Each PR keeps a provenance log of the sources consulted.

Details: TC-2219

[samgbafa]

Primitive checker coverage and N1 base

• Base branch: skgbafa/tc-2219-threshold-s0-1
• Base: d91c16c8e9e4b43006f1a8942952f935a7005c51
• Checker branch: skgbafa/tc-2219-threshold-checker
• Head: 12170d45b1a93f3c37887e3cc2a33fd7d98763c0
• Added tinycloud-threshold/vectors/check/corruption.test.ts; restacked the existing checker commit. All child-owned paths remain within vectors/check/**.

Current-parent command, with private tool homes:

bun install --frozen-lockfile && bun run check
41 pass
0 fail
227 expect() calls
Ran 41 tests across 3 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
exit 0

The new test supplies cloned JSON to the real CLI through /dev/stdin, preserving the committed fixture. It checks exactly one decoded field byte changes and the CLI exits exactly 1 for each current named vector:

Vector	Chosen change and observed comparison
h1_custom_dst	Expected point byte 47; computed point comparison
pedersen_h	Expected point byte 95; computed point comparison
h3_scalar_r	Expected scalar byte 31; computed scalar comparison
h2_gt	Expected bytes byte 31; computed H2 comparison
h4_sigma	Expected bytes byte 31; computed H4 comparison
pairing_generators	Expected GT byte 575; computed reduced GT comparison
pairing_5_7	Expected GT byte 575; computed reduced GT comparison
fullident_wrap_unwrap	Expected tuple byte 159; computed tuple comparison
threshold_2of3	Expected member-1 signing preimage byte 31; computed signing preimage comparison
noncanonical_scalar	Input scalar byte 31 changes r to r−1; decoder succeeds instead of the declared error
identity_transport	Input flags byte 0; actual error becomes InvalidPoint
identity_mpk	Input flags byte 0; actual error becomes InvalidPoint
share_c3_mutated	Input share request-digest byte 35; actual error becomes ContextMismatch
share_context_transplanted	Input member byte 2 becomes zero; actual error becomes InvalidEncoding
share_identity_transplanted	Input request transport flags byte 210; actual error becomes InvalidPoint
fullident_u_mutated	Declared error-label UTF-8 byte 16; schema comparison
fullident_v_mutated	Input tuple byte 96 restored; unwrap succeeds instead of the declared error
fullident_w_mutated	Input tuple byte 128 restored; unwrap succeeds instead of the declared error

The U row has a separate semantic probe: substituting the original valid tuple in memory makes unwrap succeed, and the real CLI exits 1 on its expected-error comparison. This is distinct from its one-byte error-label probe; no assertion is made that an arbitrary ciphertext byte change changes the unwrap verdict.

The primitive fixture object is unchanged across the original parent, N1 parent and checker head: b10bd357d54647c114ff78036187401e711c12e6. The independent supplied/stored RequestDigest mismatch signing-preimage test passed on the N1 parent; valid response bytes remain unchanged. The TC-2222 handoff was read as an interface inventory only; no certificate or S0.5 checker work was added.

Independent review of this exact head remains outstanding. This records exercised local checks, not item-10 acceptance or a merge request.

Details: TC-2219

[samgbafa]

Primitive checker constant inputs

• Delta head: 7bb34b04c2929cfcc4db7a6d672beabba48453a2
• Previous review head: 12170d45b1a93f3c37887e3cc2a33fd7d98763c0
• Checked ancestry: d91c16c8e9e4b43006f1a8942952f935a7005c51
• One commit, five owned files under tinycloud-threshold/vectors/check/**.

The Pedersen derivation message is the compiled SPEC literal 706564657273656e2d68 (pedersen-h), required by the schema and used directly by the computation. H1 and Pedersen hashing use compiled DSTs. Pairing computation uses independently constructed input points after comparing their encodings. The identity prefix and the key-context/request/share tagged-hash domains remain compiled SPEC constants.

constants.test.ts adds 16 real-CLI rejection cases using in-memory documents:

• pedersen-i with its matching independently calculated point;
• all five metadata DSTs with matching alternate-domain outputs;
• both row-local DST copies, independently of metadata;
• G1 and G2 substitutions for both pairing records, with matching GT outputs;
• an alternate identity prefix with matching derived key and ciphertext;
• alternate key-context, request and share-signing tagged-hash outputs.

The existing test assertions and committed fixture are unchanged. The primitive JSON SHA-256 remains 654ab5445323840e78d930889d0db6aed19eafa2894f7db0c7a743a8ead12d92.

Executed after the code delta, using isolated tool homes:

bun install --frozen-lockfile && bun run check
57 pass
0 fail
259 expect() calls
Ran 57 tests across 4 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
exit 0

These results are for the stated d91 ancestry. The live parent branch was subsequently observed at d0e7fa1b446432c19af01beb1ac2305ef0931d65; this delta was not restacked or represented as checked on that later parent. Exact-head independent delta review remains outstanding. No Rust or fixture changes are included.

Details: TC-2219

[samgbafa]

Checked primitive checker parent update

• Exact base: d0e7fa1b446432c19af01beb1ac2305ef0931d65
• Exact head: 730e4d7310b425ac7ce756bbcbeaa2a924f54c5b
• Branch: skgbafa/tc-2219-threshold-checker

Restacked the existing owned checker commits, including the SPEC-literal Pedersen message, actual hash computation, alternate-message/matching-point rejection test and README behavior note. No additional source changes or fixture updates were made during this restack.

Executed on this exact parent/head with isolated tool homes:

bun install --frozen-lockfile && bun run check
57 pass
0 fail
259 expect() calls
Ran 57 tests across 4 files.
tsc --noEmit: exit 0
Primitive vectors: 18/18; combinations: 1+2, 1+3, 2+3
exit 0

One explicit corrected-path CLI probe cloned the primitive document in memory, set the Pedersen message to 706564657273656e2d69 (pedersen-i), independently recomputed its matching point with noble and the SPEC DST, then supplied that JSON to the real CLI through /dev/stdin:

point_changed: true
cli_exit: 1
cli_error: FAIL schema: vectors.cases[1].pedersen_h.inputs.message

The public fixture remains unchanged after both runs. Its SHA-256 is 654ab5445323840e78d930889d0db6aed19eafa2894f7db0c7a743a8ead12d92.

The new head was published with an explicit old-head lease. Exact-head independent delta review remains outstanding; no integration or merge is requested here.

Details: TC-2219

[samgbafa]

Folded into #482 (merged as 00643ae). Details: TC-2219