refactor: moving signature logic from ethlambda-types to ethlambda-crypto (#541)

## Description / Motivation

porting the lean-sig based signature logic from types crate to crypto
crate as mentioned
[here](#531 (comment))

It is first of all a cleaner and more idiomatic approach and secondly
ethlambda-types crate builds/compiles for the prover crate(zkVM prover),
which also leads to dependency conflicts between leansig dependencies
and the zkVM sdk dependencies being used. This port removes all leansig
dependencies from the ethlambda-types


## What Changed

- added a new `signature.rs` file to the crypto crate along with a
extension trait `ValidatorPublicKeys` with the same methods as before,
it helps in avoiding cyclic dependencies and the call sites remain the
same.
- removed the older `signature.rs` from the types crate and moved the
`SIGNATURE_SIZE` directly to the `attestation.rs`


## Verification Checklist

- [x] Ran `make fmt`
- [x] Ran `make lint` (clippy with `-D warnings`) 
- [x] Ran `cargo test --workspace --release` — all passing

---------

Co-authored-by: Pablo Deymonnaz <pdeymon@fi.uba.ar>

Author: Sahilgill24

Cargo.lock

@@ -36,6 +36,7 @@ use cli::CliOptions;
 use ethlambda_blockchain::MILLISECONDS_PER_SLOT;
 use ethlambda_blockchain::block_builder::ProposerConfig;
 use ethlambda_blockchain::key_manager::ValidatorKeyPair;
+use ethlambda_crypto::signature::ValidatorSecretKey;
 use ethlambda_network_api::{InitBlockChain, InitP2P, ToBlockChainToP2PRef, ToP2PToBlockChainRef};
 use ethlambda_p2p::{
     Bootnode, P2P, PeerId, SwarmConfig, attestation_subscription_subnets, build_swarm, parse_enrs,
@@ -44,7 +45,6 @@ use ethlambda_types::primitives::{H256, HashTreeRoot as _};
 use ethlambda_types::{
     aggregator::AggregatorController,
     genesis::GenesisConfig,
-    signature::ValidatorSecretKey,
     state::{State, ValidatorPubkeyBytes},
 };
 use eyre::WrapErr;

bin/ethlambda/src/main.rs

@@ -20,13 +20,13 @@ use std::collections::{HashMap, HashSet};
 use std::time::{Duration, Instant, SystemTime};
 
 use ethlambda_crypto::aggregate_mixed;
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_storage::Store;
 use ethlambda_types::{
     ShortRoot,
     attestation::{AggregationBits, AttestationData, HashedAttestationData},
     block::{ByteList512KiB, SingleMessageAggregate},
     primitives::H256,
-    signature::{ValidatorPublicKey, ValidatorSignature},
     state::Validator,
 };
 use spawned_concurrency::message::Message;
@@ -425,7 +425,7 @@ fn resolve_job(
         let Some(validator) = validators.get(*vid as usize) else {
             continue;
         };
-        let Ok(pubkey) = validator.get_attestation_pubkey() else {
+        let Ok(pubkey) = ValidatorPublicKey::from_bytes(&validator.attestation_pubkey) else {
             continue;
         };
         raw_by_id.insert(*vid, (pubkey, sig.clone()));
@@ -492,7 +492,10 @@ fn resolve_child_pubkeys(
         let participant_ids: Vec<u64> = proof.participant_indices().collect();
         let child_pubkeys: Vec<ValidatorPublicKey> = participant_ids
             .iter()
-            .filter_map(|&vid| validators.get(vid as usize)?.get_attestation_pubkey().ok())
+            .filter_map(|&vid| {
+                let v = validators.get(vid as usize)?;
+                ValidatorPublicKey::from_bytes(&v.attestation_pubkey).ok()
+            })
             .collect();
         if child_pubkeys.len() != participant_ids.len() {
             warn!(
@@ -796,7 +799,7 @@ mod tests {
     /// never checks signature validity, only that it clones and carries a
     /// resolvable id — mirrors `ethlambda_storage::store::tests::make_dummy_sig`.
     fn dummy_sig() -> ValidatorSignature {
-        use ethlambda_types::signature::LeanSignatureScheme;
+        use ethlambda_crypto::signature::LeanSignatureScheme;
         use leansig::{serialization::Serializable, signature::SignatureScheme};
         use rand::{SeedableRng, rngs::StdRng};
 

crates/blockchain/src/aggregation.rs

@@ -15,7 +15,7 @@ use std::{
     time::Instant,
 };
 
-use ethlambda_crypto::aggregate_proofs;
+use ethlambda_crypto::{aggregate_proofs, signature::ValidatorPublicKey};
 use ethlambda_state_transition::{
     attestation_data_matches_chain, justified_slots_ops, process_block, process_slots,
     slot_is_justifiable_after,
@@ -657,11 +657,11 @@ fn compact_attestations(
                 let pubkeys = proof
                     .participant_indices()
                     .map(|vid| {
-                        head_state
+                        let validator = head_state
                             .validators
                             .get(vid as usize)
-                            .ok_or(StoreError::InvalidValidatorIndex)?
-                            .get_attestation_pubkey()
+                            .ok_or(StoreError::InvalidValidatorIndex)?;
+                        ValidatorPublicKey::from_bytes(&validator.attestation_pubkey)
                             .map_err(|_| StoreError::PubkeyDecodingFailed(vid))
                     })
                     .collect::<Result<Vec<_>, _>>()?;

crates/blockchain/src/block_builder.rs

@@ -1,10 +1,10 @@
 use std::collections::HashMap;
 use std::time::Instant;
 
+use ethlambda_crypto::signature::{ValidatorSecretKey, ValidatorSignature};
 use ethlambda_types::{
     attestation::{AttestationData, XmssSignature},
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorSecretKey, ValidatorSignature},
 };
 use tracing::{info, warn};
 

crates/blockchain/src/key_manager.rs

@@ -1,6 +1,7 @@
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::time::{Duration, Instant, SystemTime};
 
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_network_api::{BlockChainToP2PRef, InitP2P};
 use ethlambda_state_transition::is_proposer;
 use ethlambda_storage::{ALL_TABLES, Store};
@@ -10,7 +11,6 @@ use ethlambda_types::{
     attestation::{SignedAggregatedAttestation, SignedAttestation},
     block::{ByteList512KiB, MultiMessageAggregate, SignedBlock},
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorPublicKey, ValidatorSignature},
 };
 
 use crate::aggregation::{
@@ -763,7 +763,10 @@ impl BlockChainServer {
         // Decode the proposer's proposal pubkey once and reuse it both for the
         // singleton single-message aggregate wrap and for the multi-message
         // aggregate merge inputs.
-        let Ok(proposer_pubkey) = proposer_validator.get_proposal_pubkey().inspect_err(
+        let Ok(proposer_pubkey) = ValidatorPublicKey::from_bytes(
+            &proposer_validator.proposal_pubkey,
+        )
+        .inspect_err(
             |err| error!(%slot, %validator_id, %err, "Failed to decode proposer proposal pubkey"),
         ) else {
             metrics::inc_block_building_failures();
@@ -802,7 +805,7 @@ impl BlockChainServer {
                     resolve_failed = true;
                     break;
                 };
-                match validator.get_attestation_pubkey() {
+                match ValidatorPublicKey::from_bytes(&validator.attestation_pubkey) {
                     Ok(pk) => pubkeys.push(pk),
                     Err(err) => {
                         error!(%slot, %validator_id, vid, %err, "Failed to decode attestation pubkey");

crates/blockchain/src/lib.rs

@@ -24,6 +24,7 @@
 
 use std::collections::HashSet;
 
+use ethlambda_crypto::signature::ValidatorPublicKey;
 use ethlambda_storage::Store;
 use ethlambda_types::{
     attestation::{
@@ -32,7 +33,6 @@ use ethlambda_types::{
     },
     block::{SignedBlock, SingleMessageAggregate},
     primitives::{H256, HashTreeRoot as _},
-    signature::ValidatorPublicKey,
 };
 use tracing::{debug, warn};
 
@@ -83,7 +83,9 @@ pub fn reaggregate_from_block(
                 warn!(vid, "Reaggregation aborted: participant out of range");
                 return Vec::new();
             }
-            let Ok(pk) = validators[vid as usize].get_attestation_pubkey() else {
+            let Ok(pk) =
+                ValidatorPublicKey::from_bytes(&validators[vid as usize].attestation_pubkey)
+            else {
                 warn!(vid, "Reaggregation aborted: bad attestation pubkey");
                 return Vec::new();
             };
@@ -94,7 +96,8 @@ pub fn reaggregate_from_block(
     if block.proposer_index >= num_validators {
         return Vec::new();
     }
-    let Ok(proposer_pubkey) = validators[block.proposer_index as usize].get_proposal_pubkey()
+    let Ok(proposer_pubkey) =
+        ValidatorPublicKey::from_bytes(&validators[block.proposer_index as usize].proposal_pubkey)
     else {
         return Vec::new();
     };
@@ -161,7 +164,9 @@ pub fn reaggregate_from_block(
                         bad = true;
                         break;
                     }
-                    match validators[vid as usize].get_attestation_pubkey() {
+                    match ValidatorPublicKey::from_bytes(
+                        &validators[vid as usize].attestation_pubkey,
+                    ) {
                         Ok(pk) => pubkeys.push(pk),
                         Err(_) => {
                             bad = true;

crates/blockchain/src/reaggregate.rs

@@ -1,5 +1,6 @@
 use std::collections::{HashMap, HashSet};
 
+use ethlambda_crypto::signature::{ValidatorPublicKey, ValidatorSignature};
 use ethlambda_state_transition::{is_proposer, slot_is_justifiable_after};
 use ethlambda_storage::{ForkCheckpoints, Store};
 use ethlambda_types::{
@@ -11,7 +12,6 @@ use ethlambda_types::{
     block::{Block, BlockHeader, SignedBlock, SingleMessageAggregate},
     checkpoint::Checkpoint,
     primitives::{H256, HashTreeRoot as _},
-    signature::{ValidatorPublicKey, ValidatorSignature},
     state::{HISTORICAL_ROOTS_LIMIT, State},
 };
 use tracing::{info, trace, warn};
@@ -418,9 +418,10 @@ pub fn on_gossip_attestation(
     if validator_id >= target_state.validators.len() as u64 {
         return Err(StoreError::InvalidValidatorIndex);
     }
-    let validator_pubkey = target_state.validators[validator_id as usize]
-        .get_attestation_pubkey()
-        .map_err(|_| StoreError::PubkeyDecodingFailed(validator_id))?;
+    let validator_pubkey = ValidatorPublicKey::from_bytes(
+        &target_state.validators[validator_id as usize].attestation_pubkey,
+    )
+    .map_err(|_| StoreError::PubkeyDecodingFailed(validator_id))?;
 
     // Verify the validator's XMSS signature
     let slot: u32 = attestation.data.slot.try_into().expect("slot exceeds u32");
@@ -513,8 +514,7 @@ fn on_gossip_aggregated_attestation_core(
     let pubkeys: Vec<_> = participant_indices
         .iter()
         .map(|&vid| {
-            validators[vid as usize]
-                .get_attestation_pubkey()
+            ValidatorPublicKey::from_bytes(&validators[vid as usize].attestation_pubkey)
                 .map_err(|_| StoreError::PubkeyDecodingFailed(vid))
         })
         .collect::<Result<_, _>>()?;
@@ -1142,8 +1142,7 @@ pub fn verify_block_signatures(
             let validator = validators
                 .get(vid as usize)
                 .ok_or(StoreError::InvalidValidatorIndex)?;
-            let pk = validator
-                .get_attestation_pubkey()
+            let pk = ValidatorPublicKey::from_bytes(&validator.attestation_pubkey)
                 .map_err(|_| StoreError::PubkeyDecodingFailed(vid))?;
             pubkeys.push(pk);
         }
@@ -1156,8 +1155,7 @@ pub fn verify_block_signatures(
     let proposer_validator = validators
         .get(block.proposer_index as usize)
         .ok_or(StoreError::InvalidValidatorIndex)?;
-    let proposer_pubkey = proposer_validator
-        .get_proposal_pubkey()
+    let proposer_pubkey = ValidatorPublicKey::from_bytes(&proposer_validator.proposal_pubkey)
         .map_err(|_| StoreError::PubkeyDecodingFailed(block.proposer_index))?;
     pubkeys_per_component.push(vec![proposer_pubkey]);
     let block_slot_u32 =

crates/blockchain/src/store.rs

@@ -1,10 +1,8 @@
 use std::sync::Once;
 
-use ethlambda_types::{
-    block::ByteList512KiB,
-    primitives::H256,
-    signature::{ValidatorPublicKey, ValidatorSignature},
-};
+use ethlambda_types::{block::ByteList512KiB, primitives::H256};
+
+use crate::signature::{ValidatorPublicKey, ValidatorSignature};
 use lean_multisig::{
     MultiMessageAggregateSignature as LMType2, ProofError,
     SingleMessageAggregateSignature as LMType1, aggregate_single_message_signatures,
@@ -14,6 +12,8 @@ use lean_multisig::{
 use leansig_wrapper::{XmssPublicKey as LeanSigPubKey, XmssSignature as LeanSigSignature};
 use thiserror::Error;
 
+pub mod signature;
+
 #[cfg(feature = "shadow-integration")]
 pub mod shadow_cost;
 
@@ -508,7 +508,7 @@ pub fn split_type_2_by_message(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use ethlambda_types::signature::LeanSignatureScheme;
+    use crate::signature::LeanSignatureScheme;
     use leansig::{serialization::Serializable, signature::SignatureScheme};
     use rand::{SeedableRng, rngs::StdRng};
 

crates/common/crypto/src/lib.rs

@@ -1,12 +1,14 @@
+//! Validator XMSS signatures, public/secret keys, and the leansig-backed
+//! primitives behind them.
+
 use std::ops::Range;
 
+use ethlambda_types::primitives::H256;
 use leansig::{
     serialization::Serializable,
     signature::{SignatureScheme, SignatureSchemeSecretKey as _, SigningError},
 };
 
-use crate::primitives::H256;
-
 /// The XMSS signature scheme used for validator signatures.
 ///
 /// This is a post-quantum secure signature scheme based on hash functions.
@@ -25,11 +27,6 @@ pub type LeanSigSecretKey = <LeanSignatureScheme as SignatureScheme>::SecretKey;
 
 pub type Signature = LeanSigSignature;
 
-/// Size of an XMSS signature in bytes.
-///
-/// Computed from: path(32*8*4) + rho(7*4) + hashes(46*8*4) + ssz_offsets(3*4) = 2536
-pub const SIGNATURE_SIZE: usize = 2536;
-
 /// Error returned when parsing signature or key bytes fails.
 #[derive(Debug, Clone, thiserror::Error)]
 #[error("signature parse error: {0}")]