chore(sdk): upgrade kms (#1949)

* chore(sdk): upgrade kms

* ci(sdk): run tests on bindings update

Author: eudelins-zama

.github/workflows/sdk-rust-sdk-tests.yml

@@ -40,6 +40,7 @@ jobs:
             - 'sdk/rust-sdk/src/**'
             - 'sdk/rust-sdk/examples/**'
             - 'sdk/rust-sdk/Cargo.toml'
+            - gateway-contracts/rust-bindings/**
 
   start-runner:
     name: sdk-rust-sdk-tests/start-runner

sdk/rust-sdk/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gateway-sdk"
-version = "0.10.0"
+version = "0.12.0"
 edition = "2024"
 
 # Library configuration
@@ -9,11 +9,11 @@ name = "gateway_sdk"
 path = "src/lib.rs"
 
 [dependencies]
-fhevm_gateway_bindings = { git = "https://git@github.com/zama-ai/fhevm.git", tag = "v0.10.0-3", default-features = false }
-kms = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.12.4", default-features = false }
-kms-grpc = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.12.4", default-features = false }
-bc2wrap = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.12.4", default-features = false }
-tfhe = { version = "1.4.0-alpha.3", features = ["boolean", "integer", "zk-pok"] }
+fhevm_gateway_bindings = { path = "../../gateway-contracts/rust_bindings", default-features = false }
+kms = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.13.0-rc.3", default-features = false }
+kms-grpc = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.13.0-rc.3", default-features = false }
+bc2wrap = { git = "https://git@github.com/zama-ai/kms.git", tag = "v0.13.0-rc.3", default-features = false }
+tfhe = { version = "1.5.1", features = ["boolean", "integer", "zk-pok"] }
 
 alloy = { version = "1.0", default-features = false, features = [
     "essentials",

sdk/rust-sdk/src/decryption/user/deserializer.rs

@@ -100,7 +100,7 @@ fn decode_hex_field(hex_str: &str, field_name: &str) -> Result<Vec<u8>> {
 fn deserialize_payload(buf: &[u8]) -> Result<UserDecryptionResponsePayload> {
     debug!("Deserializing payload of {} bytes", buf.len());
 
-    bc2wrap::deserialize(buf)
+    bc2wrap::deserialize_safe(buf)
         .map_err(|e| FhevmError::DecryptionError(format!("Bincode deserialize error: {e}")))
 }
 

sdk/rust-sdk/src/decryption/user/response.rs

@@ -10,9 +10,7 @@ use kms_grpc::rpc_types::protobuf_to_alloy_domain;
 use kms_lib::client::js_api::{new_client, new_server_id_addr};
 use kms_lib::client::user_decryption_wasm::{CiphertextHandle, ParsedUserDecryptionRequest};
 use kms_lib::consts::SAFE_SER_SIZE_LIMIT;
-use kms_lib::cryptography::internal_crypto_types::{
-    PrivateEncKey, UnifiedPrivateEncKey, UnifiedPublicEncKey,
-};
+use kms_lib::cryptography::encryption::{PrivateEncKey, UnifiedPrivateEncKey, UnifiedPublicEncKey};
 use tracing::{debug, info};
 
 /// Builder for processing user decryption responses
@@ -228,7 +226,7 @@ impl ResponseProcessor {
         .map_err(|e| FhevmError::DecryptionError(format!("Invalid public key: {e:?}")))?;
 
         let ml_kem_priv_key =
-            bc2wrap::deserialize::<PrivateEncKey<ml_kem::MlKem512>>(&private_key_bytes)
+            bc2wrap::deserialize_safe::<PrivateEncKey<ml_kem::MlKem512>>(&private_key_bytes)
                 .map(UnifiedPrivateEncKey::MlKem512)
                 .map_err(|e| FhevmError::DecryptionError(format!("Invalid private key: {e:?}")))?;
 
@@ -246,11 +244,7 @@ impl ResponseProcessor {
                 .map_err(|e| FhevmError::DecryptionError(format!("KMS decryption failed: {e:?}")))?
         } else {
             client
-                .insecure_process_user_decryption_resp(
-                    &responses,
-                    &ml_kem_pub_key,
-                    &ml_kem_priv_key,
-                )
+                .insecure_process_user_decryption_resp(&responses, &ml_kem_priv_key)
                 .map_err(|e| FhevmError::DecryptionError(format!("KMS decryption failed: {e:?}")))?
         };