test(net): integration test for the /net multi-device signing flow#2
Merged
Conversation
Closes the automated-test gap flagged when /net moved to signing a real Orchard sighash. Drives the exact WASM API NetVault calls, in one process: a real 3-party DKG (2-of-3), then a signing ceremony over the real sighash, asserting every device derives the same group key and the aggregate verifies (coordinator + independent verifyRedpallas). Also asserts describeOutputs surfaces the recipient + value the UI shows before signing. Only the relay transport and React rendering remain uncovered; the cryptography is end-to-end.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The multi-device ceremony could only sign under a commitment-derived seed, which cannot express an Orchard spend's randomizer — the alpha is fixed by the transaction (read from the PCZT via pczt_bridge::extract_randomizers). Add the real-transaction signing path: - ceremony::participant_round2_with_randomizer / coordinator_aggregate_with_randomizer / verify_with_randomizer — sign and verify under an explicit alpha (frost-rerandomized's Randomizer + RandomizedParams::from_randomizer). - JS surface: participantRound2WithRandomizer + Coordinator.aggregateWithRandomizer / verifyWithRandomizer. - Native test: a 2-of-3 signs under the real mainnet alpha (aab00f90…) and verifies under ak+alpha; a mismatched alpha fails. This is the crypto unblock for a real browser broadcast: a signature produced this way verifies exactly as an Orchard spend does on-chain, so it can be injected (inject_sigs) and broadcast. Adds frost-rerandomized as a direct dep (pinned to reddsa 0.5.2's version).
Ship the randomizer signing surface in the wasm-pkg the browser loads, and extend the /net integration test: a 2-of-3 DKG-born vault signs the real sighash under the PCZT Orchard alpha (participantRound2WithRandomizer + aggregateWithRandomizer) and verifies under ak+alpha; a mismatched alpha fails. Refactor the shared DKG into a helper.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the automated-test gap for the live /net ceremony (flagged in the slice-2 merge review). Drives the exact WASM API the NetVault screen calls, in one process: a real 3-party DKG (2-of-3) → signing ceremony over the real Orchard sighash /net now signs → every device derives the same group key and the aggregate verifies (coordinator + independent
verifyRedpallas). Also assertsdescribeOutputssurfaces the recipient + value shown before signing.Only the relay transport and React rendering stay uncovered; the cryptography is end-to-end. 29 UI tests green.