Skip to content

Commit 1732ae8

Browse files
isaacdecodedobatiroueudelins-zama
authored
feat(test-suite): introduce context-aware extraData changes
* feat(host-contracts): implement context-aware KMSVerifier (#2028) * feat(kms-connector): context-aware extraData handling for decryption (#2032) * chore(kms-connector): rename fhe module to handle * chore(kms-connector): add and use helper function * chore(kms-connector): add kms_context table * chore(kms-connector): prepare ethereum listener * feat(kms-connector): kms context validation * chore(kms-connector): kms context tests * chore(kms-connector): ethereum listener termination * feat(gateway-contracts): implement context-aware KMS node configs and decryption * feat: implement context-aware KMS node configs and decryption * chore(gateway-contracts): apply a few arguments renaming * fix(gateway-contracts): refresh rust bindings * chore(gateway-contracts): reuse setter methods and adjust NatSpecs * chore(gateway-contracts): refresh rust bindings * refactor: apply suggested naming * refactor(gateway-contracts): apply suggested renaming * refactor: revert updateKmsContext naming * refactor(gateway-contracts): enable decryption upgrade workflow * chore(gateway-contracts): refresh bindings * chore(test-suite): introduce getExtraData() method from SDK * chore(test-suite): restore missed user decrypt ebool test case * feat(kms-connector): propagate empty extra_data for 0x00 * feat(kms-connector): propagate empty extra_data for 0x00 * chore(kms-connector): add TODO comment for the workaround and upgrade quinn-proto * chore(kms-connector): add TODO comment for the workaround and upgrade quinn-proto * chore(kms-connector): use dedicated core config for tests --------- Co-authored-by: Simon Eudeline <simon.eudeline@zama.ai> * chore(test-suite): upgrade relayer-sdk version * chore(test-suite): upgrade test-suite version in fhevm-cli --------- Co-authored-by: Oba <obatirou@gmail.com> Co-authored-by: Simon E. <simon.eudeline@zama.ai>
1 parent f31aefe commit 1732ae8

File tree

14 files changed

+137
-53
lines changed

14 files changed

+137
-53
lines changed

‎kms-connector/Cargo.lock‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎kms-connector/crates/kms-worker/src/core/event_processor/decryption.rs‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,19 @@ where
304304
let ciphertexts = self.prepare_ciphertexts(&key_id, sns_materials).await?;
305305

306306
let request_id = Some(u256_to_request_id(decryption_id));
307-
let extra_data = extra_data.to_vec();
307+
308+
// TODO(https://github.com/zama-ai/fhevm-internal/issues/1167):
309+
// Workaround for backward compatibility with relayer-sdk <=0.4.2.
310+
// The SDK sends extraData=0x00 in the user decryption request, but does not pass extraData
311+
// to the TKMS library during response signature verification (reconstruction step),
312+
// effectively verifying against empty bytes. We normalize 0x00 → vec![] here so the KMS
313+
// signs over empty extraData, matching what the SDK expects during verification.
314+
// This is fixed in relayer-sdk v0.5.0.
315+
let extra_data = if extra_data.as_ref() == [0x00] {
316+
vec![]
317+
} else {
318+
extra_data.to_vec()
319+
};
308320

309321
if let Some(user_decrypt_data) = user_decrypt_data {
310322
let client_address = user_decrypt_data.user_address.to_checksum(None);

‎kms-connector/crates/utils/src/tests/setup/kms.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ impl KmsInstance {
5353
.with_copy_to(
5454
"/app/kms/core/service/config/config.toml".to_string(),
5555
PathBuf::from_str(&format!(
56-
"{}/../../../test-suite/fhevm/config/kms-core/config.toml",
56+
"{}/tests/data/core-service-config.toml",
5757
env!("CARGO_MANIFEST_DIR"),
5858
))
5959
.unwrap(),

‎kms-connector/crates/utils/tests/data/core-service-config.toml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# See default_1.toml for the documentation.
2+
3+
[service]
4+
listen_address = "0.0.0.0"
5+
listen_port = 50051
6+
timeout_secs = 360
7+
grpc_max_message_size = 104857600 # 100 MiB
8+
9+
[telemetry]
10+
tracing_service_name = "kms-centralized"
11+
tracing_otlp_timeout_ms = 10000
12+
metrics_bind_address = "0.0.0.0:9646"
13+
14+
[telemetry.batch]
15+
max_queue_size = 8192
16+
max_export_batch_size = 2048
17+
max_concurrent_exports = 4
18+
scheduled_delay_ms = 500
19+
export_timeout_ms = 5000
20+
21+
[aws]
22+
region = "eu-west-1"
23+
s3_endpoint = "http://minio:9000"
24+
25+
[public_vault]
26+
storage_cache_size = 1000
27+
28+
[public_vault.storage.s3]
29+
bucket = "kms-public"
30+
prefix = "PUB"
31+
32+
[private_vault.storage.file]
33+
path = "./keys"
34+
35+
[rate_limiter_conf]
36+
bucket_size = 50000
37+
pub_decrypt = 1
38+
user_decrypt = 1
39+
crsgen = 100
40+
preproc = 25000
41+
keygen = 1000
42+
reshare = 25
43+

‎package-lock.json‎

Lines changed: 12 additions & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎test-suite/e2e/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@
1616
"dependencies": {
1717
"@fhevm/solidity": "*",
1818
"@openzeppelin/contracts": "^5.3.0",
19-
"@zama-fhe/relayer-sdk": "^0.4.2",
19+
"@zama-fhe/relayer-sdk": "^0.5.0-alpha.1",
2020
"bigint-buffer": "^1.1.5",
2121
"dotenv": "^16.0.3",
2222
"encrypted-types": "^0.0.4"
2323
}
24-
}
24+
}

‎test-suite/e2e/test/userDecryption/userDecryption.ts‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,10 @@ describe('User decryption', function () {
167167
const durationDays = 10;
168168
const contractAddresses = [this.signers.alice.address];
169169

170-
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays);
170+
// Build the extraData field
171+
const extraData = await this.instances.alice.getExtraData();
172+
173+
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays, extraData);
171174

172175
const signature = await this.signers.alice.signTypedData(
173176
eip712.domain,
@@ -186,6 +189,7 @@ describe('User decryption', function () {
186189
this.signers.alice.address,
187190
startTimeStamp,
188191
durationDays,
192+
extraData,
189193
);
190194

191195
expect.fail('Expected an error to be thrown - userAddress and contractAddress cannot be equal');
@@ -208,7 +212,11 @@ describe('User decryption', function () {
208212
const startTimeStamp = Math.floor(Date.now() / 1000);
209213
const durationDays = 10;
210214
const contractAddresses = [wrongContractAddress];
211-
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays);
215+
216+
// Build the extraData field
217+
const extraData = await this.instances.alice.getExtraData();
218+
219+
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays, extraData);
212220
const signature = await this.signers.alice.signTypedData(
213221
eip712.domain,
214222
{ UserDecryptRequestVerification: eip712.types.UserDecryptRequestVerification },
@@ -225,6 +233,7 @@ describe('User decryption', function () {
225233
this.signers.alice.address,
226234
startTimeStamp,
227235
durationDays,
236+
extraData,
228237
);
229238
expect.fail('Expected an error - contract should not be allowed');
230239
} catch (error) {
@@ -245,7 +254,10 @@ describe('User decryption', function () {
245254
const durationDays = 10;
246255
const contractAddresses = [this.contractAddress];
247256

248-
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays);
257+
// Build the extraData field
258+
const extraData = await this.instances.alice.getExtraData();
259+
260+
const eip712 = this.instances.alice.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays, extraData);
249261

250262
const signature = await this.signers.alice.signTypedData(
251263
eip712.domain,
@@ -265,6 +277,7 @@ describe('User decryption', function () {
265277
this.signers.alice.address,
266278
startTimeStamp,
267279
durationDays,
280+
extraData,
268281
);
269282
expect.fail('Expected an error to be thrown - request should have expired');
270283
} catch (error) {

‎test-suite/e2e/test/utils.ts‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,11 @@ export const userDecryptSingleHandle = async (
141141
const durationDays = 10; // Relayer-sdk expects numbers from now on
142142
const contractAddresses = [contractAddress];
143143

144+
// Build the extraData field
145+
const extraData = await instance.getExtraData();
146+
144147
// Use the new createEIP712 function
145-
const eip712 = instance.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays);
148+
const eip712 = instance.createEIP712(publicKey, contractAddresses, startTimeStamp, durationDays, extraData);
146149

147150
// Update the signing to match the new primaryType
148151
const signature = await signer.signTypedData(
@@ -163,6 +166,7 @@ export const userDecryptSingleHandle = async (
163166
signerAddress,
164167
startTimeStamp,
165168
durationDays,
169+
extraData,
166170
);
167171

168172
const decryptedValue = result[handle];
@@ -189,13 +193,17 @@ export const delegatedUserDecryptSingleHandle = async (
189193
const durationDays = 10;
190194
const contractAddresses = [contractAddress];
191195

196+
// Build the extraData field
197+
const extraData = await instance.getExtraData();
198+
192199
// The `delegate` creates a EIP712 with the `delegator` address
193200
const eip712 = instance.createDelegatedUserDecryptEIP712(
194201
delegatePublicKey,
195202
contractAddresses,
196203
delegatorAddress,
197204
startTimeStamp,
198205
durationDays,
206+
extraData,
199207
);
200208

201209
// Update the signing to match the new primaryType
@@ -217,6 +225,7 @@ export const delegatedUserDecryptSingleHandle = async (
217225
delegateAddress,
218226
startTimeStamp,
219227
durationDays,
228+
extraData,
220229
);
221230

222231
return result[handle];

‎test-suite/fhevm/config/kms-core/config.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,4 +39,4 @@ user_decrypt = 1
3939
crsgen = 100
4040
preproc = 25000
4141
keygen = 1000
42-
reshare = 25
42+
new_epoch = 1

‎test-suite/fhevm/config/relayer/local.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,9 @@ gateway:
5252
- type: subscription
5353
url: "ws://gateway-node:8546"
5454
tx_engine:
55-
private_key: 0xcb97ef45d352446a6adf810cf8f63c73ada027160c271da9bb8cfcb3d944d257
55+
signer:
56+
type: "private_key"
57+
private_key: "0xcb97ef45d352446a6adf810cf8f63c73ada027160c271da9bb8cfcb3d944d257"
5658
max_concurrency: 100
5759
retry:
5860
max_attempts: 100

0 commit comments

Comments
 (0)