feat: Multiple Block Signatures (#3174)

* Initial sig impl

* Add as_keys()

* Refactor BlockSignatures

* Lint

* Move verification to sig construction

* Add min sig check to constructor

* Use vec instead of constant

* Remove invariants from new()

* Dedupe test fns

* Changelog

* Fix changelog

* Use with_capacity

* Max 5 validators

* Move changelog line

* RM assert_signatures_verify

* Bump crossbeam-epoch for cargo deny check

* Check block sigs count

Author: sergerad

CHANGELOG.md

@@ -1,5 +1,4 @@
 # Changelog
-
 ## v0.16.0 (TBD)
 
 ### Changes
@@ -87,6 +86,7 @@
 - Documented that the `ecdsa_k256_keccak` authentication scheme discloses the signer's public key and signature at proving time via precompile calldata ([#3178](https://github.com/0xMiden/protocol/pull/3178)).
 - Renamed the `Authority` config value slot, expressed the authority kind as a MASM `enum Authority : u8`, and enforced the canonical config-word encoding on read ([#3209](https://github.com/0xMiden/protocol/pull/3209)).
 - Unified procedure ordering and document sender-based access control's authentication assumption in the `ownable2step` and `rbac` access control modules ([#3205](https://github.com/0xMiden/protocol/pull/3205)).
+- [BREAKING] Updated `BlockHeader` to support multiple validator keys and added `ValidatorKeys` and `BlockSignatures` types ([#3174](https://github.com/0xMiden/protocol/pull/3174)).
 
 ### Fixes
 

crates/miden-protocol/src/block/block_signatures.rs

@@ -0,0 +1,229 @@
+use alloc::vec::Vec;
+
+use miden_crypto::dsa::ecdsa_k256_keccak::Signature;
+
+use crate::Word;
+use crate::block::ValidatorKeys;
+use crate::utils::serde::{
+    ByteReader,
+    ByteWriter,
+    Deserializable,
+    DeserializationError,
+    Serializable,
+};
+
+// SIGNATURE VERIFICATION ERROR
+// ================================================================================================
+
+/// Error returned when verifying [`BlockSignatures`] against a validator set (see
+/// [`BlockSignatures::verify_against`]).
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum SignatureVerificationError {
+    #[error("block has {actual} signatures but the validator set has {expected} keys")]
+    SignatureCountMismatch { expected: usize, actual: usize },
+    #[error(
+        "block signature at position {position} does not verify against the validator key at that position"
+    )]
+    InvalidSignatureAtPosition { position: usize },
+}
+
+// BLOCK SIGNATURES ERROR
+// ================================================================================================
+
+/// Error returned when constructing an invalid [`BlockSignatures`] set.
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum BlockSignaturesError {
+    #[error(
+        "block signature set contains {count} signatures but must contain at most {max}",
+        max = ValidatorKeys::MAX,
+    )]
+    TooManySignatures { count: usize },
+}
+
+// BLOCK SIGNATURES
+// ================================================================================================
+
+/// The set of validator signatures over a block header ordered by validator key.
+///
+/// The signatures are expected to be ordered with respect to a validator set (see
+/// [`ValidatorKeys`]): the signature in slot `i` is produced by, and verified against, the
+/// validator key at index `i`. Every validator in the set must sign; there is no partial-signing or
+/// threshold support.
+///
+/// This is a plain, unchecked container: neither [`BlockSignatures::new`] nor deserialization
+/// verify anything about the signatures they hold. The only way to establish that a
+/// [`BlockSignatures`] value is valid is to call [`BlockSignatures::verify_against`].
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BlockSignatures {
+    /// Positional signatures; `signatures[i]` corresponds to validator key `i`.
+    signatures: Vec<Signature>,
+}
+
+impl BlockSignatures {
+    // CONSTRUCTORS
+    // --------------------------------------------------------------------------------------------
+
+    /// Returns a new [`BlockSignatures`] from the provided signatures, ordered positionally.
+    ///
+    /// This performs no validation beyond checking that the number of signatures does not exceed
+    /// [`ValidatorKeys::MAX`]: the caller is responsible for ordering `signatures` to align
+    /// with the validator set it is meant to be checked against. Call
+    /// [`BlockSignatures::verify_against`] to establish that the signatures are valid.
+    pub fn new(signatures: Vec<Signature>) -> Result<Self, BlockSignaturesError> {
+        if signatures.len() > ValidatorKeys::MAX {
+            return Err(BlockSignaturesError::TooManySignatures { count: signatures.len() });
+        }
+        Ok(Self { signatures })
+    }
+
+    // PUBLIC ACCESSORS
+    // --------------------------------------------------------------------------------------------
+
+    /// Returns the positional signatures, where signature `i` corresponds to validator key `i`.
+    pub fn as_signatures(&self) -> &[Signature] {
+        &self.signatures
+    }
+
+    /// Returns the number of signatures.
+    pub fn len(&self) -> usize {
+        self.signatures.len()
+    }
+
+    /// Returns `true` if there are no signatures.
+    pub fn is_empty(&self) -> bool {
+        self.signatures.is_empty()
+    }
+
+    // VERIFICATION
+    // --------------------------------------------------------------------------------------------
+
+    /// Verifies the signatures positionally against `validator_keys` over `block_commitment`.
+    ///
+    /// This is the canonical verification of an ordered signature set, and the only place that
+    /// establishes a [`BlockSignatures`] value is valid: the number of signatures must match the
+    /// number of validator keys, and the signature in slot `i` must verify against the validator
+    /// key at index `i`.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the number of signatures does not match the number of validator keys, or
+    /// if a signature does not verify against the validator key at its position.
+    pub fn verify_against(
+        &self,
+        block_commitment: Word,
+        validator_keys: &ValidatorKeys,
+    ) -> Result<(), SignatureVerificationError> {
+        if self.signatures.len() != validator_keys.len() {
+            return Err(SignatureVerificationError::SignatureCountMismatch {
+                expected: validator_keys.len(),
+                actual: self.signatures.len(),
+            });
+        }
+
+        for (position, (signature, validator_key)) in
+            self.signatures.iter().zip(validator_keys.as_keys()).enumerate()
+        {
+            if !signature.verify(block_commitment, validator_key) {
+                return Err(SignatureVerificationError::InvalidSignatureAtPosition { position });
+            }
+        }
+
+        Ok(())
+    }
+}
+
+// SERIALIZATION
+// ================================================================================================
+
+impl Serializable for BlockSignatures {
+    fn write_into<W: ByteWriter>(&self, target: &mut W) {
+        self.signatures.write_into(target);
+    }
+}
+
+impl Deserializable for BlockSignatures {
+    fn read_from<R: ByteReader>(source: &mut R) -> Result<Self, DeserializationError> {
+        let signatures = Vec::<Signature>::read_from(source)?;
+        Ok(Self { signatures })
+    }
+}
+
+// TESTS
+// ================================================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::testing::random_secret_key::random_secret_key;
+    use crate::testing::validator_keys::{random_validator_set, sign_all};
+
+    #[test]
+    fn verify_against_accepts_correctly_ordered_signatures() {
+        let (signers, keys) = random_validator_set(5);
+        let commitment = Word::empty();
+
+        let signatures = sign_all(&keys, &signers, commitment);
+
+        assert_eq!(signatures.len(), 5);
+        signatures.verify_against(commitment, &keys).unwrap();
+    }
+
+    #[test]
+    fn verify_against_rejects_invalid_signature() {
+        let (signers, keys) = random_validator_set(3);
+        let commitment = Word::empty();
+        let outsider = random_secret_key();
+
+        // Position 1 holds a signature that does not verify against the key committed there.
+        let mut signatures = sign_all(&keys, &signers, commitment).as_signatures().to_vec();
+        signatures[1] = outsider.sign(commitment);
+        let signatures = BlockSignatures::new(signatures).unwrap();
+
+        assert!(matches!(
+            signatures.verify_against(commitment, &keys),
+            Err(SignatureVerificationError::InvalidSignatureAtPosition { position: 1 })
+        ));
+    }
+
+    #[test]
+    fn verify_against_rejects_mismatched_keys() {
+        let (signers, keys) = random_validator_set(3);
+        let commitment = Word::empty();
+        let signatures = sign_all(&keys, &signers, commitment);
+
+        // The same, fully valid set does not verify against a different validator set of the same
+        // size.
+        let (_, other_keys) = random_validator_set(3);
+        assert!(matches!(
+            signatures.verify_against(commitment, &other_keys),
+            Err(SignatureVerificationError::InvalidSignatureAtPosition { .. })
+        ));
+    }
+
+    #[test]
+    fn verify_against_rejects_count_mismatch() {
+        let (signers, keys) = random_validator_set(3);
+        let commitment = Word::empty();
+        let signatures = sign_all(&keys, &signers, commitment);
+
+        // A validator set of a different size cannot align positionally.
+        let (_, other_keys) = random_validator_set(4);
+        assert!(matches!(
+            signatures.verify_against(commitment, &other_keys),
+            Err(SignatureVerificationError::SignatureCountMismatch { expected: 4, actual: 3 })
+        ));
+    }
+
+    #[test]
+    fn serde_round_trip() {
+        let (signers, keys) = random_validator_set(3);
+        let commitment = Word::empty();
+        let signatures = sign_all(&keys, &signers, commitment);
+
+        let bytes = signatures.to_bytes();
+        let deserialized = BlockSignatures::read_from_bytes(&bytes).unwrap();
+        assert_eq!(signatures, deserialized);
+    }
+}