feat: Update cryptography tools to support `tssEncryptionKey` loading and generation #16780

derektriley · 2024-11-25T18:37:17Z

Description:
This pull request addresses the need for the cryptography code to load a tssEncryptionKey from disk or generate it and write the private key to disk.

Enhancements to TSS key handling:

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java: Added a new method generateBlsKeyPair to generate a BlsKeyPair using a SignatureSchema and an optional SecureRandom instance.
platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoader.java:
- Added private fields tssPrivateKeys and tssPublicKeys to store TSS encryption keys as they are being read from disk or generated.
- Updated the scan, generate, and verify methods to handle TSS keys. [1] [2] [3]
- Added a new method resolveTssPrivateKey to load TSS private keys from disk.
platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java:
- Updated the KeysAndCerts record to include TSS encryption keys.
- Modified the generate and loadExistingAndCreateAgrKeyIfMissing methods to handle TSS keys. [1] [2]

Updates to dependencies and tests:

platform-sdk/swirlds-platform-core/src/main/java/module-info.java: Added a dependency on com.hedera.cryptography.bls.
platform-sdk/swirlds-platform-core/src/test/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoaderTest.java:
- Updated the keyStoreLoaderPositiveTest to include a new test case for TSS keys.
- Added assertions to check for the presence of TSS keys.
Added TSS private key files for new test cases. [1] [2] [3]

Related issue(s):

Fixes #14767

Notes for reviewer:

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

…rate-tssEncryptionKey

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

codacy-production · 2024-11-25T19:40:50Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.01% (target: -1.00%)	✅ 83.05%

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`935fdb1`)	97511	63616	65.24%
Head commit (`3d7c771`)	97578 (+67)	63669 (+53)	65.25% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#16780)	59	49	83.05%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

_{Codacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more}

codecov · 2024-11-25T19:51:50Z

Codecov Report

Attention: Patch coverage is 79.66102% with 12 lines in your changes missing coverage. Please review.

Project coverage is 63.54%. Comparing base (935fdb1) to head (3d7c771).
Report is 6 commits behind head on develop.

Files with missing lines	Patch %	Lines
...wirlds/platform/crypto/EnhancedKeyStoreLoader.java	75.00%	9 Missing and 2 partials ⚠️
...java/com/swirlds/platform/crypto/KeysAndCerts.java	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             develop   #16780   +/-   ##
==========================================
  Coverage      63.53%   63.54%           
- Complexity     20370    20381   +11     
==========================================
  Files           2537     2537           
  Lines          94746    94813   +67     
  Branches        9902     9910    +8     
==========================================
+ Hits           60198    60250   +52     
- Misses         30941    30955   +14     
- Partials        3607     3608    +1

Files with missing lines	Coverage Δ
...java/com/swirlds/platform/crypto/CryptoStatic.java	`56.88% <100.00%> (+1.01%)`	⬆️
...java/com/swirlds/platform/crypto/KeysAndCerts.java	`63.93% <90.00%> (+5.44%)`	⬆️
...wirlds/platform/crypto/EnhancedKeyStoreLoader.java	`70.07% <75.00%> (+0.39%)`	⬆️

... and 11 files with indirect coverage changes

…rate-tssEncryptionKey

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

thomas-swirlds-labs · 2024-11-26T11:06:53Z

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java

+        final SignatureSchema SIGNATURE_SCHEMA =
+                SignatureSchema.create(Curve.ALT_BN128, GroupAssignment.SHORT_SIGNATURES);
+        if (secureRandom == null) {
+            return BlsKeyPair.generate(SIGNATURE_SCHEMA);


Nit: might be beneficial to add a debug log that the default secure random generator is being used here ?

thomas-swirlds-labs · 2024-11-26T11:25:10Z

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/KeysAndCerts.java

@@ -171,6 +179,11 @@ public static KeysAndCerts generate(
        agrDetRandom.setSeed(AGR_SEED);
        agrKeyGen.initialize(CryptoConstants.AGR_KEY_SIZE_BITS, agrDetRandom);

+        tssEncryptionKeyRandom.setSeed(masterKey);


Repeated code for setting seeds for different key generators. Could be refactored/extracted into separate methods (but not required 😄 ).

thomas-swirlds-labs · 2024-11-26T11:32:08Z

...m/swirlds/platform/crypto/EnhancedKeyStoreLoader/enhanced-invalid-case-1/t-private-alice.tss

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+AVS7ccxMt5screfvBWYJkUhm3SRhdkNxvsk8KcDMEXgl
+-----END PRIVATE KEY-----


Would add newlines for consistency, compatibility etc.

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

Neeharika-Sompalli · 2024-11-27T16:22:35Z

hedera-dependency-versions/build.gradle.kts

@@ -238,16 +238,16 @@ dependencies.constraints {
    api("com.google.protobuf:protoc:3.25.4")
    api("io.grpc:protoc-gen-grpc-java:1.66.0")

-    api("com.hedera.cryptography:hedera-cryptography-pairings-api:0.1.0-SNAPSHOT") {
+    api("com.hedera.cryptography:hedera-cryptography-pairings-api:0.1.1-SNAPSHOT") {


You can merge back develop. This change should be merged

…rate-tssEncryptionKey

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

thomas-swirlds-labs · 2024-11-29T13:05:25Z

...rlds-platform-core/src/test/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoaderTest.java

+    @Test
+    @DisplayName("KeyStore Loader Corrupt TSS Key Test")
+    void keyStoreLoaderNegativeCorruptTssKey() throws IOException {
+        final Path keyDirectory = testDataDirectory.resolve("enhanced-invalid-case-3");


nit: could pass in directoryName as a parameter for testing multiple versions

thomas-swirlds-labs · 2024-11-29T13:07:32Z

...rlds-platform-core/src/test/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoaderTest.java

+
+        assertThat(loader).isNotNull();
+        assertThatCode(loader::migrate).doesNotThrowAnyException();
+        assertThatCode(loader::scan).isInstanceOf(KeyLoadingException.class);


optional: add custom assertion messages e.g.

assertThatCode(loader::scan) .as("Scan operation should throw KeyLoadingException when processing a corrupt TSS key in '%s'", keyDirectory) .isInstanceOf(KeyLoadingException.class);

thomas-swirlds-labs · 2024-11-29T13:15:10Z

.../swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/EnhancedKeyStoreLoader.java

+        Objects.requireNonNull(nodeId, MSG_NODE_ID_NON_NULL);
+        Objects.requireNonNull(nodeAlias, MSG_NODE_ALIAS_NON_NULL);
+
+        Path keyLocation = keyStoreDirectory.resolve(String.format("t-private-%s.tss", nodeAlias));


could validate or sanitize nodeAlias to ensure it is always safe for filenames before using it to construct the path.

thomas-swirlds-labs · 2024-11-29T13:22:01Z

platform-sdk/swirlds-platform-core/src/main/java/com/swirlds/platform/crypto/CryptoStatic.java

+     */
+    public static BlsKeyPair generateBlsKeyPair(@Nullable final SecureRandom secureRandom)
+            throws NoSuchAlgorithmException {
+        final SignatureSchema SIGNATURE_SCHEMA =


Signature_Schema is constant and could be made static for re-use to avoid recreating it for every call

thomas-swirlds-labs

A few minor comments otherwise LGTM. Thanks! @derektriley

derektriley added 6 commits November 14, 2024 17:21

Added TSS Encryption Key generation in EnhancedKeyStoreLoader

9acf000

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

wip

6fe3072

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

Merge remote-tracking branch 'remotes/origin/develop' into 14542-gene…

bd19e1a

…rate-tssEncryptionKey

Added test resources, cleanup gradle

79edcb1

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

Update KeysAndCerts for deterministic generation

da91b85

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

wip

59cd3bc

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

derektriley added this to the v0.58 milestone Nov 25, 2024

derektriley self-assigned this Nov 25, 2024

derektriley requested review from a team as code owners November 25, 2024 18:37

derektriley requested review from edward-swirldslabs and hendrikebbers November 25, 2024 18:37

derektriley linked an issue Nov 25, 2024 that may be closed by this pull request

Update cryptography tools to support tssEncryptionKey loading and generation. #14767

Open

derektriley requested review from andrewb1269hg and jeromy-cannon November 25, 2024 18:37

module info and codacy

1d5bd12

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

derektriley marked this pull request as draft November 25, 2024 18:59

Added another test case

186b839

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

Merge remote-tracking branch 'remotes/origin/develop' into 14542-gene…

1d91d3f

…rate-tssEncryptionKey

derektriley marked this pull request as ready for review November 25, 2024 22:26

additional test resources

105fd61

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

thomas-swirlds-labs reviewed Nov 26, 2024

View reviewed changes

Update gradle build and module-info

3d7c771

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

derektriley requested a review from a team as a code owner November 26, 2024 18:25

derektriley requested a review from povolev15 November 26, 2024 18:25

Neeharika-Sompalli reviewed Nov 27, 2024

View reviewed changes

derektriley added 2 commits November 27, 2024 13:15

Merge remote-tracking branch 'remotes/origin/develop' into 14542-gene…

232c5c0

…rate-tssEncryptionKey

module-info

899eef1

Signed-off-by: Derek Riley <derek.riley@swirldslabs.com>

thomas-swirlds-labs reviewed Nov 29, 2024

View reviewed changes

thomas-swirlds-labs approved these changes Nov 30, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Update cryptography tools to support `tssEncryptionKey` loading and generation #16780

feat: Update cryptography tools to support `tssEncryptionKey` loading and generation #16780

derektriley commented Nov 25, 2024

codacy-production bot commented Nov 25, 2024 •

edited

Loading

codecov bot commented Nov 25, 2024 •

edited

Loading

thomas-swirlds-labs Nov 26, 2024

thomas-swirlds-labs Nov 26, 2024 •

edited

Loading

thomas-swirlds-labs Nov 26, 2024 •

edited

Loading

Neeharika-Sompalli Nov 27, 2024

thomas-swirlds-labs Nov 29, 2024

thomas-swirlds-labs Nov 29, 2024

thomas-swirlds-labs Nov 29, 2024

thomas-swirlds-labs Nov 29, 2024

thomas-swirlds-labs left a comment

feat: Update cryptography tools to support tssEncryptionKey loading and generation #16780

Are you sure you want to change the base?

feat: Update cryptography tools to support tssEncryptionKey loading and generation #16780

Conversation

derektriley commented Nov 25, 2024

Enhancements to TSS key handling:

Updates to dependencies and tests:

codacy-production bot commented Nov 25, 2024 • edited Loading

Coverage summary from Codacy

codecov bot commented Nov 25, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

thomas-swirlds-labs Nov 26, 2024 • edited Loading

Choose a reason for hiding this comment

thomas-swirlds-labs Nov 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thomas-swirlds-labs left a comment

Choose a reason for hiding this comment

feat: Update cryptography tools to support `tssEncryptionKey` loading and generation #16780

feat: Update cryptography tools to support `tssEncryptionKey` loading and generation #16780

codacy-production bot commented Nov 25, 2024 •

edited

Loading

codecov bot commented Nov 25, 2024 •

edited

Loading

thomas-swirlds-labs Nov 26, 2024 •

edited

Loading

thomas-swirlds-labs Nov 26, 2024 •

edited

Loading