feat(frost/roast): Phase 7.2b-2 share-submission member authentication

[mswilkison]

What

Member-side authentication for the Round2 share submission (#4058 added the wire type). This completes the share-submission sign/authenticate path; network distribution is the next increment.

How

• AuthenticateShareSubmission(verifier, sub, electedCoordinator, liveAttemptContextHash, liveSigningPackageHash) — mirrors AuthenticateSigningPackage. In order (cheap → expensive): signature present → coordinator_id == electedCoordinator → attempt_context_hash == live → signing_package_hash == the distributed package → signature verifies under the submitter's operator key over the domain-tagged body.
  • The signature is verified over sub.SubmitterID(), so a forged submitter_id doesn't verify — the signature binds the declared submitter to the actual signer.
  • Pass = attributable + package-bound, so the caller retains the exact received bytes for the 7.2b-4 equivocation compare; fail = reject without retention. Included-set membership and de-dup remain the caller's responsibility.
• SignShareSubmission(signer, sub) — sets SubmitterSignature over SignableBytes().
• SigningPackage.EnvelopeHash() — SHA-256 of the on-wire SignedSigningPackage envelope, the value a share commits to in signing_package_hash. For a parsed package it hashes the received bytes verbatim, so the submitter and every verifier derive the same binding over the bytes the coordinator distributed.

Testing

gofmt/vet/build clean; full pkg/frost/roast suite passes under go test -race. New tests: round-trip authenticate + 6 rejections (missing/tampered signature, non-elected coordinator, wrong attempt, wrong package, non-submitter signer), an end-to-end binding test (a share bound to a real package's EnvelopeHash authenticates; a different package is rejected with ErrShareSubmissionWrongPackage), and EnvelopeHash wire-stability.

Next

Network distribution of the share submission, then 7.2b-3 (FFI candidate culprits) and 7.2b-4 (equivocation compare + f+1 quorum blame). Carried-forward design item for 7.2b-4: the envelope-hash binding assumes canonical/non-malleable operator signatures (documented on the signing_package_hash field) — to be confirmed, or the blame compare made body-aware, before blame lands.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af5415b1-ad3f-4172-82f6-7dc89570e6c3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/phase-7-2b-2-share-auth-2026-06-14

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}