Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: pure JS BLS verification #817

Merged
merged 17 commits into from
Mar 25, 2024
Merged

feat: pure JS BLS verification #817

merged 17 commits into from
Mar 25, 2024

Conversation

krpeacock
Copy link
Contributor

@krpeacock krpeacock commented Jan 8, 2024

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context.

Fixes # (issue)

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.

Checklist:

  • My changes follow the guidelines in CONTRIBUTING.md.
  • The title of this PR complies with Conventional Commits.
  • I have edited the CHANGELOG accordingly.
  • I have made corresponding changes to the documentation.

@krpeacock krpeacock changed the title Kai/bls verify feat: pure JS BLS verification Jan 8, 2024
Copy link
Contributor

github-actions bot commented Jan 8, 2024

size-limit report 📦

Path Size
@dfinity/agent 84.81 KB (-17.05% 🔽)
@dfinity/candid 13.58 KB (-0.31% 🔽)
@dfinity/principal 4.97 KB (-1.27% 🔽)
@dfinity/auth-client 59.81 KB (-35.58% 🔽)
@dfinity/assets 79.51 KB (-15.31% 🔽)
@dfinity/identity 57.13 KB (-36.6% 🔽)
@dfinity/identity-secp256k1 281.23 KB (-0.17% 🔽)

@krpeacock
Copy link
Contributor Author

After investigating, I confirmed that this commit broke the noble curves short signature implementation shortly before the release. If we fix the issue, this PR should be ready to ship once the next version of @noble/curves containing the patch is out

@krpeacock krpeacock marked this pull request as ready for review March 14, 2024 15:56
@krpeacock krpeacock requested a review from a team as a code owner March 14, 2024 15:56
Copy link
Contributor

@dfx-json dfx-json left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any new tests added. Are we reasonably confident the noble/curves implementation is secure and provides parity with the existing?

@krpeacock
Copy link
Contributor Author

krpeacock commented Mar 14, 2024

I don't see any new tests added. Are we reasonably confident the noble/curves implementation is secure and provides parity with the existing?

@randombit added support for the library, and also authored the latest patch that restored functionality - paulmillr/noble-curves#124

The existing tests, including tests against mainnet, should be adequate. Happy to wait for prodsec to review, however.

Additionally, we could pin the version for key crypto dependencies like this, and require manual bumping for any changes, including patches

@krpeacock krpeacock requested a review from dfx-json March 25, 2024 16:28
@@ -122,7 +122,7 @@ function isBufferEqual(a: ArrayBuffer, b: ArrayBuffer): boolean {
return true;
}

type VerifyFunc = (pk: Uint8Array, sig: Uint8Array, msg: Uint8Array) => Promise<boolean>;
type VerifyFunc = (pk: Uint8Array, sig: Uint8Array, msg: Uint8Array) => Promise<boolean> | boolean;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this (=> Promise<boolean> | boolean) for backwards compatibility? An approach I've seen elsewhere is to return a completed future in cases like this.

Copy link
Contributor Author

@krpeacock krpeacock Mar 25, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's to allow an interface to have the option to make a call synchronously. The new library is synchronous, and the Promise is the backwards compatibility. There's no harm in supporting both interfaces, apart from the slight increase in type verbosity

@krpeacock krpeacock merged commit 5ec7238 into main Mar 25, 2024
15 checks passed
@krpeacock krpeacock deleted the kai/bls-verify branch March 25, 2024 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants