Frost component doesn't work with jubjub::ExtendedPoint

[mikelodder7]

When I run the Frost DKG for jubjub and try to sign it fails about 8 out of 10 times. When I switch it to use jubjub::SubgroupPoint, then it works every time. Is this supposed to be the case? If so, I can submit a PR to make the fix.

[conradoplg]

😨 That's certainly a bug! A PR would be welcome, thanks

[mikelodder7]

Another problem too. It doesn't happen every time, but randomly after refreshing the shares, I test to make sure the underlying secret hasn't changed and that also fails. Is this something with this library or with the curve itself?

[conradoplg]

Another problem too. It doesn't happen every time, but randomly after refreshing the shares, I test to make sure the underlying secret hasn't changed and that also fails. Is this something with this library or with the curve itself?

I haven't looked into it but I guess it's related to the issue you pointed out. Did you try that with ExtendedPoint or SubgroupPoint?

[mikelodder7]

It doesn’t matter because it’s in the scalar field

[str4d]

It should indeed fail with ExtendedPoint. FROST requires a prime order group, which is what SubgroupPoint provides; ExtendedPoint is the full group with cofactor.

[mikelodder7]

That's what I figured but the code here uses ExtendedPoint in the frost section when it should be SubgroupPoint.
The other issue with the refresh still remains as it applies to the Scalar field.

[conradoplg]

Got it, I'll look into it

[conradoplg]

When I run the Frost DKG for jubjub and try to sign it fails about 8 out of 10 times. When I switch it to use jubjub::SubgroupPoint, then it works every time. Is this supposed to be the case? If so, I can submit a PR to make the fix.

I'm looking into the first issue. I can't reproduce this. While using SubgroupPoint would probably be safer, I can't see where in the code it could leave the prime-order subgroup; everything is computed based on the prime-order generator, and deserialization checks for prime-order membership.

I ran 1024 iterations of the DKG & signing and it didn't fail once. Do you have code to reproduce the issue?