feat(c&c): vsss integration on setup

[cyphersnake]

Prerequisites

This assumes GarbleMode already supports VSSS input generation (#66 completed).

Overview

Integrate VSSS-enabled GarbleMode into the C&C protocol. The key challenge: polynomial sharing across all circuit instances and enabling polynomial reconstruction by the evaluator.

Problem

• GarbleMode now expects pre-computed VSSS shares
• C&C needs to coordinate polynomial generation across all instances
• Evaluator must collect polynomial points to reconstruct secrets later

Architecture Changes

1. Garbler Changes

Before garbling any circuits:

// Input: seed, n_input_wires, n_circuits
// Generate polynomials ONCE for all circuits
let vsss = VSSSInputPolynomials::generate(seed, n_input_wires, n_circuits);

// Create circuits with different shares
for circuit_id in 0..n_circuits {
    let shares = vsss.get_circuit_shares(circuit_id);
    let mode = GarbleMode::new_from_labels(
        capacity, vsss.delta, shares, handler
    );
    // garble...
}

In commit phase:

• Add polynomial commitments to the commitment structure
• Share these commitments across ALL circuit instances

In open_commit phase:

• Reveal polynomial shares for checked circuits
• Include whatever seeds are needed for regarbling

2. Evaluator Changes

New responsibility: Track polynomial points

struct EvaluatorState {
    polynomial_points: Vec<Map<usize, (Fr, Fr)>>, // wire → circuit → shares
}

During verification:

1. Verify revealed shares match polynomial commitments
2. Store these points for later reconstruction
3. When regarbling, extract input labels and convert to shares - store these too

After protocol (with adaptor signature):

// Now have 175 points (174 checked + 1 from signature)
let polynomials = reconstruct_polynomials(polynomial_points);
// Can now generate ANY circuit's input labels

Opening Structure

For checked circuits, garbler reveals:

• Circuit-specific data needed for regarbling
• Polynomial shares: Vec<(Fr, Fr)> for each input wire

Implementation Steps

Phase 1: Modify Garbler

• Add VSSSInputPolynomials generation before circuit creation
• Pass polynomial shares to each GarbleMode instance
• Include polynomial commitments in commit() output
• Modify open_commit() to reveal shares for checked circuits

Phase 2: Modify Evaluator

• Add polynomial point storage
• Verify polynomial commitments during checking
• Extract and store shares during regarbling
• Implement polynomial reconstruction after final share

Phase 3: Protocol Updates

• Update commitment structures to include VSSS commitments
• Modify message formats for share revelation
• Integrate with adaptor signature for final share

Data Flow

Garbler                          Evaluator
-------                          ---------
Generate polynomials
Create n circuits
                    →
                    commitments
                    ←
                    select k to check
                    →
                    shares for k circuits
Verify & store points
Regarble → extract more points
...
                    ←
                    adaptor signature
                    →
                    final share
                                 Reconstruct polynomials!

Key Invariants

1. Same polynomials used across ALL circuits
2. Each circuit gets different evaluation point
3. Evaluator needs exactly k+1 points to reconstruct

Success Criteria

• Evaluator can verify all VSSS commitments
• Evaluator successfully reconstructs polynomials with k+1 points
• Free-XOR maintained throughout

[cyphersnake]

Transaction Sighash Requirement for Adaptor Signature Binding

An important detail for the integration: The protocol needs to establish the transaction sighash early in the flow, before the C&C protocol begins.

Why: The adaptor signature (used for revealing n polynomial point) must be cryptographically bound to a specific Bitcoin transaction. This requires:

1. Early sighash computation: Both parties need to agree on the transaction structure and compute its sighash BEFORE starting the C&C protocol

2. Commitment binding: The garbler's polynomial commitments should be bound to this sighash to prevent substitution attacks

3. Protocol flow:

Agree on tx structure →
Compute sighash →
Generate VSSS polynomials →
Run C&C →
Create adaptor with same sighash

Without early sighash agreement, the evaluator cannot create a valid adaptor signature that the garbler can complete on-chain. This binding ensures the final polynomial share revelation is tied to the specific transaction both parties agreed upon.