We’ve launched FROST v2.2.0, which features a safety repair. There aren’t any breaking adjustments on this launch. For full particulars, please check with the launch notes.
Safety Repair
This launch provides validation for the min_signers parameter within the frost_core::keys::refresh capabilities. Earlier than, it was not clear that it was not attainable to vary min_signers with the refresh process. Utilizing a smaller worth wouldn’t lower the brink, and makes an attempt to signal utilizing a smaller threshold would fail. Moreover, after refreshing the shares with a smaller threshold, it could nonetheless be attainable to signal with the unique threshold; nevertheless, this might trigger a safety loss to the participant’s shares. We’ve not decided the precise safety implications of doing so and judged it less complicated to only validate min_signers. If for some motive you’ve gotten accomplished a refresh share process with a smaller min_signers we strongly advocate migrating to a brand new key. Thanks BlockSec for reporting the discovering.
Different Adjustments
The Minimal Supported Rust Model (MSRV) has been up to date to 1.81, making all crates no-std, apart from frost-ed448. Distributed Key Era (DKG) refresh capabilities have been added to the crate-specific refresh modules. Moreover, we now have added serialize_whole and deserialize_whole strategies for VerifiableSecretSharingCommitment. To additional improve customization choices, a brand new post_generate methodology has been applied within the Ciphersuite, permitting for higher flexibility in ciphersuite configurations. We’ve additionally made documentation enhancements and improved take a look at protection.
Acknowledgments
A giant thanks to all of the contributors who made this launch attainable: @VolodymyrB, @StackOverflowExcept1on, @crStiv, @azuchi, @Conradoplg and @natalieesk
