Merge branch 'main' into build/leanvm-track-main

Resolves the overlap with #541, which moved the signature primitives out of
`ethlambda-types` and into `ethlambda-crypto` while this branch was rewriting
those same primitives for leanVM's internalized XMSS.

The two wire-size constants cannot follow `signature.rs` into
`ethlambda-crypto`: `types::attestation::XmssSignature` and
`types::state::ValidatorPubkeyBytes` are defined in terms of them, and
`ethlambda-crypto` already depends on `ethlambda-types`. #541 hit the same
constraint and hardcoded `SIGNATURE_SIZE` in `types`. Keep that placement, but
source both from leanVM's xmss crate so they track the scheme parameters:
main's literal 2536 is the old leanSig size and is wrong for leanVM's wire
format.

`ethlambda-types` therefore keeps a narrow `xmss` dependency for the two
constants only, and `ssz`/`postcard` move to `ethlambda-crypto` along with the
signing code that needed them.

Author: MegaRedHand

Cargo.lock

@@ -36,6 +36,7 @@ use cli::CliOptions;
 use ethlambda_blockchain::MILLISECONDS_PER_SLOT;
 use ethlambda_blockchain::block_builder::ProposerConfig;
 use ethlambda_blockchain::key_manager::ValidatorKeyPair;
+use ethlambda_crypto::signature::ValidatorSecretKey;
 use ethlambda_network_api::{InitBlockChain, InitP2P, ToBlockChainToP2PRef, ToP2PToBlockChainRef};
 use ethlambda_p2p::{
     Bootnode, P2P, PeerId, SwarmConfig, attestation_subscription_subnets, build_swarm, parse_enrs,
@@ -44,7 +45,6 @@ use ethlambda_types::primitives::{H256, HashTreeRoot as _};
 use ethlambda_types::{
     aggregator::AggregatorController,
     genesis::GenesisConfig,
-    signature::ValidatorSecretKey,
     state::{State, ValidatorPubkeyBytes},
 };
 use eyre::WrapErr;
@@ -499,7 +499,7 @@ where
         .map_err(|_| {
             D::Error::custom(format!(
                 "ValidatorPubkey length != {}",
-                ethlambda_types::signature::PUBLIC_KEY_SIZE
+                ethlambda_types::state::PUBLIC_KEY_SIZE
             ))
         })?;
     Ok(pubkey)

bin/ethlambda/src/main.rs

@@ -20,13 +20,13 @@ use std::collections::{HashMap, HashSet};
 use std::time::{Duration, Instant, SystemTime};
 
 use ethlambda_crypto::aggregate_mixed;
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_storage::Store;
 use ethlambda_types::{
     ShortRoot,
     attestation::{AggregationBits, AttestationData, HashedAttestationData},
     block::{ByteList512KiB, SingleMessageAggregate},
     primitives::H256,
-    signature::{ValidatorPublicKey, ValidatorSignature},
     state::Validator,
 };
 use spawned_concurrency::message::Message;
@@ -425,7 +425,7 @@ fn resolve_job(
         let Some(validator) = validators.get(*vid as usize) else {
             continue;
         };
-        let Ok(pubkey) = validator.get_attestation_pubkey() else {
+        let Ok(pubkey) = ValidatorPublicKey::from_bytes(&validator.attestation_pubkey) else {
             continue;
         };
         raw_by_id.insert(*vid, (pubkey, sig.clone()));
@@ -492,7 +492,10 @@ fn resolve_child_pubkeys(
         let participant_ids: Vec<u64> = proof.participant_indices().collect();
         let child_pubkeys: Vec<ValidatorPublicKey> = participant_ids
             .iter()
-            .filter_map(|&vid| validators.get(vid as usize)?.get_attestation_pubkey().ok())
+            .filter_map(|&vid| {
+                let v = validators.get(vid as usize)?;
+                ValidatorPublicKey::from_bytes(&v.attestation_pubkey).ok()
+            })
             .collect();
         if child_pubkeys.len() != participant_ids.len() {
             warn!(
@@ -797,7 +800,7 @@ mod tests {
     /// mirrors `ethlambda_storage::store::tests::make_dummy_sig`. An all-zero
     /// blob decodes as a valid (unverifiable) signature.
     fn dummy_sig() -> ValidatorSignature {
-        use ethlambda_types::signature::SIGNATURE_SIZE;
+        use ethlambda_types::attestation::SIGNATURE_SIZE;
         ValidatorSignature::from_bytes(&vec![0u8; SIGNATURE_SIZE])
             .expect("all-zero test signature decodes")
     }

crates/blockchain/src/aggregation.rs

@@ -15,7 +15,7 @@ use std::{
     time::Instant,
 };
 
-use ethlambda_crypto::aggregate_proofs;
+use ethlambda_crypto::{aggregate_proofs, signature::ValidatorPublicKey};
 use ethlambda_state_transition::{
     attestation_data_matches_chain, justified_slots_ops, process_block, process_slots,
     slot_is_justifiable_after,
@@ -657,11 +657,11 @@ fn compact_attestations(
                 let pubkeys = proof
                     .participant_indices()
                     .map(|vid| {
-                        head_state
+                        let validator = head_state
                             .validators
                             .get(vid as usize)
-                            .ok_or(StoreError::InvalidValidatorIndex)?
-                            .get_attestation_pubkey()
+                            .ok_or(StoreError::InvalidValidatorIndex)?;
+                        ValidatorPublicKey::from_bytes(&validator.attestation_pubkey)
                             .map_err(|_| StoreError::PubkeyDecodingFailed(vid))
                     })
                     .collect::<Result<Vec<_>, _>>()?;

crates/blockchain/src/block_builder.rs

@@ -1,10 +1,10 @@
 use std::collections::HashMap;
 use std::time::Instant;
 
+use ethlambda_crypto::signature::{ValidatorSecretKey, ValidatorSignature};
 use ethlambda_types::{
     attestation::{AttestationData, XmssSignature},
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorSecretKey, ValidatorSignature},
 };
 use tracing::{info, warn};
 

crates/blockchain/src/key_manager.rs

@@ -1,6 +1,7 @@
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::time::{Duration, Instant, SystemTime};
 
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_network_api::{BlockChainToP2PRef, InitP2P};
 use ethlambda_state_transition::is_proposer;
 use ethlambda_storage::{ALL_TABLES, Store};
@@ -10,7 +11,6 @@ use ethlambda_types::{
     attestation::{SignedAggregatedAttestation, SignedAttestation},
     block::{ByteList512KiB, MultiMessageAggregate, SignedBlock},
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorPublicKey, ValidatorSignature},
 };
 
 use crate::aggregation::{
@@ -763,7 +763,10 @@ impl BlockChainServer {
         // Decode the proposer's proposal pubkey once and reuse it both for the
         // singleton single-message aggregate wrap and for the multi-message
         // aggregate merge inputs.
-        let Ok(proposer_pubkey) = proposer_validator.get_proposal_pubkey().inspect_err(
+        let Ok(proposer_pubkey) = ValidatorPublicKey::from_bytes(
+            &proposer_validator.proposal_pubkey,
+        )
+        .inspect_err(
             |err| error!(%slot, %validator_id, %err, "Failed to decode proposer proposal pubkey"),
         ) else {
             metrics::inc_block_building_failures();
@@ -802,7 +805,7 @@ impl BlockChainServer {
                     resolve_failed = true;
                     break;
                 };
-                match validator.get_attestation_pubkey() {
+                match ValidatorPublicKey::from_bytes(&validator.attestation_pubkey) {
                     Ok(pk) => pubkeys.push(pk),
                     Err(err) => {
                         error!(%slot, %validator_id, vid, %err, "Failed to decode attestation pubkey");

crates/blockchain/src/lib.rs

@@ -24,6 +24,7 @@
 
 use std::collections::HashSet;
 
+use ethlambda_crypto::signature::ValidatorPublicKey;
 use ethlambda_storage::Store;
 use ethlambda_types::{
     attestation::{
@@ -32,7 +33,6 @@ use ethlambda_types::{
     },
     block::{SignedBlock, SingleMessageAggregate},
     primitives::{H256, HashTreeRoot as _},
-    signature::ValidatorPublicKey,
 };
 use tracing::{debug, warn};
 
@@ -83,7 +83,9 @@ pub fn reaggregate_from_block(
                 warn!(vid, "Reaggregation aborted: participant out of range");
                 return Vec::new();
             }
-            let Ok(pk) = validators[vid as usize].get_attestation_pubkey() else {
+            let Ok(pk) =
+                ValidatorPublicKey::from_bytes(&validators[vid as usize].attestation_pubkey)
+            else {
                 warn!(vid, "Reaggregation aborted: bad attestation pubkey");
                 return Vec::new();
             };
@@ -94,7 +96,8 @@ pub fn reaggregate_from_block(
     if block.proposer_index >= num_validators {
         return Vec::new();
     }
-    let Ok(proposer_pubkey) = validators[block.proposer_index as usize].get_proposal_pubkey()
+    let Ok(proposer_pubkey) =
+        ValidatorPublicKey::from_bytes(&validators[block.proposer_index as usize].proposal_pubkey)
     else {
         return Vec::new();
     };
@@ -161,7 +164,9 @@ pub fn reaggregate_from_block(
                         bad = true;
                         break;
                     }
-                    match validators[vid as usize].get_attestation_pubkey() {
+                    match ValidatorPublicKey::from_bytes(
+                        &validators[vid as usize].attestation_pubkey,
+                    ) {
                         Ok(pk) => pubkeys.push(pk),
                         Err(_) => {
                             bad = true;

crates/blockchain/src/reaggregate.rs

@@ -1,5 +1,6 @@
 use std::collections::{HashMap, HashSet};
 
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_state_transition::{is_proposer, slot_is_justifiable_after};
 use ethlambda_storage::{ForkCheckpoints, Store};
 use ethlambda_types::{
@@ -11,7 +12,6 @@ use ethlambda_types::{
     block::{Block, BlockHeader, SignedBlock, SingleMessageAggregate},
     checkpoint::Checkpoint,
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorPublicKey, ValidatorSignature},
     state::{HISTORICAL_ROOTS_LIMIT, State},
 };
 use tracing::{info, trace, warn};
@@ -418,9 +418,10 @@ pub fn on_gossip_attestation(
     if validator_id >= target_state.validators.len() as u64 {
         return Err(StoreError::InvalidValidatorIndex);
     }
-    let validator_pubkey = target_state.validators[validator_id as usize]
-        .get_attestation_pubkey()
-        .map_err(|_| StoreError::PubkeyDecodingFailed(validator_id))?;
+    let validator_pubkey = ValidatorPublicKey::from_bytes(
+        &target_state.validators[validator_id as usize].attestation_pubkey,
+    )
+    .map_err(|_| StoreError::PubkeyDecodingFailed(validator_id))?;
 
     // Verify the validator's XMSS signature
     let slot: u32 = attestation.data.slot.try_into().expect("slot exceeds u32");
@@ -513,8 +514,7 @@ fn on_gossip_aggregated_attestation_core(
     let pubkeys: Vec<_> = participant_indices
         .iter()
         .map(|&vid| {
-            validators[vid as usize]
-                .get_attestation_pubkey()
+            ValidatorPublicKey::from_bytes(&validators[vid as usize].attestation_pubkey)
                 .map_err(|_| StoreError::PubkeyDecodingFailed(vid))
         })
         .collect::<Result<_, _>>()?;
@@ -1142,8 +1142,7 @@ pub fn verify_block_signatures(
             let validator = validators
                 .get(vid as usize)
                 .ok_or(StoreError::InvalidValidatorIndex)?;
-            let pk = validator
-                .get_attestation_pubkey()
+            let pk = ValidatorPublicKey::from_bytes(&validator.attestation_pubkey)
                 .map_err(|_| StoreError::PubkeyDecodingFailed(vid))?;
             pubkeys.push(pk);
         }
@@ -1156,8 +1155,7 @@ pub fn verify_block_signatures(
     let proposer_validator = validators
         .get(block.proposer_index as usize)
         .ok_or(StoreError::InvalidValidatorIndex)?;
-    let proposer_pubkey = proposer_validator
-        .get_proposal_pubkey()
+    let proposer_pubkey = ValidatorPublicKey::from_bytes(&proposer_validator.proposal_pubkey)
         .map_err(|_| StoreError::PubkeyDecodingFailed(block.proposer_index))?;
     pubkeys_per_component.push(vec![proposer_pubkey]);
     let block_slot_u32 =

crates/blockchain/src/store.rs

@@ -12,7 +12,10 @@ version.workspace = true
 [dependencies]
 ethlambda-types.workspace = true
 
+xmss.workspace = true
 lean-multisig.workspace = true
+ssz.workspace = true
+postcard.workspace = true
 
 thiserror.workspace = true
 rand.workspace = true

crates/common/crypto/Cargo.toml

@@ -1,7 +1,7 @@
-use ethlambda_types::{
-    block::ByteList512KiB,
-    primitives::H256,
-    signature::{LeanSigPublicKey, LeanSigSignature, ValidatorPublicKey, ValidatorSignature},
+use ethlambda_types::{block::ByteList512KiB, primitives::H256};
+
+use crate::signature::{
+    LeanSigPublicKey, LeanSigSignature, ValidatorPublicKey, ValidatorSignature,
 };
 use lean_multisig::{
     MultiMessageAggregateSignature as LMType2, SingleMessageAggregateSignature as LMType1,
@@ -13,6 +13,8 @@ use std::sync::{Mutex, MutexGuard};
 use thiserror::Error;
 use tracing::error;
 
+pub mod signature;
+
 #[cfg(feature = "shadow-integration")]
 pub mod shadow_cost;