feat!: remove fallback and signing keys from pxe (#24451)

Follow up of #24416.
With this, PXE no longer has access to the message signing key nor the
fallback keys, as should be (since the semantics of those keys require
user approval before usage).

To keep things simple, I removed the option of passing a seed from which
all keys are derived to PXE and made it so the wallet must pass the
privacy keys plus the message signing and fallback public keys. The
wallet _does_ derive these from a seed, but that's a decision the wallet
makes, PXE doesn't force it.

Author: nventuro

docs/docs-developers/docs/foundational-topics/accounts/keys.md

@@ -66,7 +66,7 @@ The nullifier hiding key (`nhk`) — sometimes referred to in older documentatio
 |---------|----------|----------------|
 | Private (constrained) | `context.request_nhk_app(owner_npk_m_hash)` | Called on `&mut PrivateContext` |
 | Unconstrained | `get_nhk_app(owner_npk_m_hash)` | `use aztec::keys::getters::get_nhk_app` |
-| TypeScript (master key) | `deriveMasterNullifierHidingKey(secretKey)` | `import { deriveMasterNullifierHidingKey } from '@aztec/aztec.js/keys'` |
+| TypeScript (master key) | `deriveMasterNullifierHidingSecretKey(secretKey)` | `import { deriveMasterNullifierHidingSecretKey } from '@aztec/aztec.js/keys'` |
 | TypeScript (app-siloed) | `computeAppNullifierHidingKey(nhkM, app)` | `import { computeAppNullifierHidingKey } from '@aztec/aztec.js/keys'` |
 
 To get the owner's master nullifier public key hash (needed as input):
@@ -75,7 +75,7 @@ To get the owner's master nullifier public key hash (needed as input):
 let owner_npk_m_hash = get_public_keys(owner).npk_m_hash;
 ```
 
-`PublicKeys` exposes the nullifier, outgoing-viewing, and tagging keys directly as their hashes; only `ivpk_m` is held as a Grumpkin point (it is required as a point for address derivation and encrypt-to-address).
+`PublicKeys` exposes the nullifier, outgoing-viewing, tagging, message-signing, and fallback keys as their hashes; only `ivpk_m` is held as a Grumpkin point (it is required as a point for address derivation and encrypt-to-address).
 
 :::warning
 Do not compute nullifier keys by hand or derive custom blinding factors. The protocol kernel validates that `nhk_app` derives correctly from the master key — a hand-rolled value will fail verification.
@@ -159,7 +159,7 @@ The `Ovpk` (outgoing viewing key) and `Tpk` (tagging key) exist in the protocol'
 :::
 
 :::note
-The `Mspk` (master message-signing key) and `Fbpk` (master fallback key) hash slots exist in `PublicKeys` and participate in the address derivation above, but there is **no canonical derivation path for them yet**. `deriveKeys(secretKey)` stamps the canonical default hashes (`DEFAULT_MSPK_M_HASH`, `DEFAULT_FBPK_M_HASH`) into every account, so today they contribute no per-account entropy. When a real derivation lands in a future release, the address derived from the same secret will change — see the migration notes.
+The `Mspk` (master message-signing key) and `Fbpk` (master fallback key) are reserved for future protocol features (message signing and account recovery, respectively). Their public keys are derived per account and participate in the address derivation above. Unlike the other privacy keys, their **secret keys are held by the wallet, not the PXE**: the PXE receives only the corresponding public keys, since it is not trusted to hold these secrets.
 :::
 
 ## Key Management
@@ -215,9 +215,9 @@ Aztec's multi-key architecture is fundamental to its privacy and security model:
 | **Incoming Viewing** (`Ivpk_m`) | Decrypt received notes | No | No | Protocol (PXE) |
 | **Outgoing Viewing** (`Ovpk_m`) | Reserved | N/A | No | Protocol (PXE) |
 | **Tagging** (`Tpk_m`) | Reserved | N/A | No | Protocol (PXE) |
-| **Message-Signing** (`Mspk_m`) | Reserved | N/A | No | Protocol (PXE) |
-| **Fallback** (`Fbpk_m`) | Reserved | N/A | No | Protocol (PXE) |
-| **Signing** | Transaction authorization | N/A | Yes | Application |
+| **Message-Signing** (`Mspk_m`) | Reserved | N/A | No | Application (Wallet) |
+| **Fallback** (`Fbpk_m`) | Reserved | N/A | No | Application (Wallet) |
+| **Signing** | Transaction authorization | N/A | Yes | Account Contract (Wallet) |
 
 **Key takeaways:**
 

docs/docs-developers/docs/resources/migration_notes.md

@@ -27,9 +27,11 @@ Aztec is in active development. Each version may introduce breaking changes that
 + const secretKey = accountManager.getSecretKey();
 ```
 
-To do what `AccountWithSecretKey` was meant for (exporting an account into a separate PXE or wallet), account registration now also accepts a full set of master secret keys instead of only a single seed. `wallet.registerContract(instance, artifact?, secretKeyOrKeys?)` and `pxe.registerAccount(secretKeyOrKeys, partialAddress)` take either an `Fr` (as before) or a `MasterSecretKeys` object (exported from `@aztec/aztec.js/keys`), and `pxe.getAccountSecretKeys(address)` returns those keys. These keys guard the account's privacy, so they should never be exposed to applications.
+To do what `AccountWithSecretKey` was meant for (exporting an account into a separate PXE or wallet), account registration accepts a full set of master secret keys instead of only a single seed. `wallet.registerContract(instance, artifact?, secretKeyOrKeys?)` takes either an `Fr` seed (as before) or a `MasterSecretKeys` object (exported from `@aztec/aztec.js/keys`), for an account whose privacy keys were generated independently rather than from one seed.
 
-**Impact**: Importing `AccountWithSecretKey`, or calling `getSecretKey()`/`getEncryptionSecret()` on the result of `getAccount()`, no longer compiles. The signer `getAccount()` returns is otherwise unchanged, and passing a single `Fr` to the registration methods keeps working.
+The PXE never receives the seed nor the message-signing and fallback secret keys: it is not trusted to hold them. The wallet derives the account's privacy keys and passes the PXE only the four privacy secret keys (nullifier-hiding, incoming-viewing, outgoing-viewing, tagging) plus the message-signing and fallback *public* keys. Accordingly, `pxe.getAccountSecretKeys(address)` returns only those four privacy secret keys.
+
+**Impact**: Importing `AccountWithSecretKey`, or calling `getSecretKey()`/`getEncryptionSecret()` on the result of `getAccount()`, no longer compiles. The signer `getAccount()` returns is otherwise unchanged, and passing a single `Fr` or a `MasterSecretKeys` to `wallet.registerContract` keeps working.
 
 
 ### [PXE] Unconstrained delivery defaults to a non-interactive handshake for external recipients

docs/docs-developers/docs/tutorials/js_tutorials/wallet-extension/04-accounts.md

@@ -44,7 +44,7 @@ export function deriveSigningKey(secretKey: Fr): GrumpkinScalar {
   return sha512ToGrumpkinScalar([secretKey, GeneratorIndex.IVSK_M]);
 }
 
-export function deriveMasterNullifierHidingKey(secretKey: Fr): GrumpkinScalar {
+export function deriveMasterNullifierHidingSecretKey(secretKey: Fr): GrumpkinScalar {
   return sha512ToGrumpkinScalar([secretKey, GeneratorIndex.NHK_M]);
 }
 ```

yarn-project/aztec.js/src/api/keys.ts

@@ -3,6 +3,6 @@ export {
   computeAppNullifierHidingKey,
   deriveKeys,
   deriveMasterIncomingViewingSecretKey,
-  deriveMasterNullifierHidingKey,
+  deriveMasterNullifierHidingSecretKey,
 } from '@aztec/stdlib/keys';
 export { generatePublicKey } from '../utils/pub_key.js';

yarn-project/end-to-end/src/automine/accounts/keys.test.ts

@@ -10,7 +10,7 @@ import { siloNullifier } from '@aztec/stdlib/hash';
 import {
   computeAppNullifierHidingKey,
   computeAppSecretKey,
-  deriveMasterNullifierHidingKey,
+  deriveMasterNullifierHidingSecretKey,
   deriveMasterOutgoingViewingSecretKey,
   derivePublicKeyFromSecretKey,
   hashPublicKey,
@@ -74,8 +74,8 @@ describe('automine/accounts/keys', () => {
     // Creates a note, asserts 0 nullified notes. Destroys the note, scans all blocks for matching
     // nullifiers derived from nhk_app and asserts exactly 1 nullified note.
     it('nhk_app and contract address are enough to detect note nullification', async () => {
-      const masterNullifierHidingKey = deriveMasterNullifierHidingKey(secret);
-      const nhkApp = await computeAppNullifierHidingKey(masterNullifierHidingKey, testContract.address);
+      const masterNullifierHidingSecretKey = deriveMasterNullifierHidingSecretKey(secret);
+      const nhkApp = await computeAppNullifierHidingKey(masterNullifierHidingSecretKey, testContract.address);
 
       const noteValue = 5;
       const noteStorageSlot = 12;

yarn-project/end-to-end/src/automine/card_game.test.ts

@@ -1,7 +1,7 @@
 import { generateSchnorrAccounts } from '@aztec/accounts/testing';
 import { AztecAddress } from '@aztec/aztec.js/addresses';
 import type { GrumpkinScalar } from '@aztec/aztec.js/fields';
-import { computeAppNullifierHidingKey, deriveMasterNullifierHidingKey } from '@aztec/aztec.js/keys';
+import { computeAppNullifierHidingKey, deriveMasterNullifierHidingSecretKey } from '@aztec/aztec.js/keys';
 import type { Logger } from '@aztec/aztec.js/log';
 import type { Wallet } from '@aztec/aztec.js/wallet';
 import { toBufferLE } from '@aztec/foundation/bigint-buffer';
@@ -68,7 +68,7 @@ describe('automine/card_game', () => {
   let teardown: () => Promise<void>;
 
   let wallet: TestWallet;
-  let masterNullifierHidingKeys: GrumpkinScalar[];
+  let masterNullifierHidingSecretKeys: GrumpkinScalar[];
 
   let firstPlayer: AztecAddress;
   let secondPlayer: AztecAddress;
@@ -78,8 +78,8 @@ describe('automine/card_game', () => {
 
   const getPackedCards = async (accountIndex: number, seed: bigint): Promise<Card[]> => {
     // First we get the app nullifier hiding key for the account
-    const masterNullifierHidingKey = masterNullifierHidingKeys[accountIndex];
-    const appNullifierHidingKey = await computeAppNullifierHidingKey(masterNullifierHidingKey, contract.address);
+    const masterNullifierHidingSecretKey = masterNullifierHidingSecretKeys[accountIndex];
+    const appNullifierHidingKey = await computeAppNullifierHidingKey(masterNullifierHidingSecretKey, contract.address);
     // Then we compute the mix from it and hash it to get the random bytes the same way as in the contract
     const mix = appNullifierHidingKey.toBigInt() + seed;
     const randomBytes = sha256(toBufferLE(mix, 32));
@@ -106,7 +106,7 @@ describe('automine/card_game', () => {
     }
     [firstPlayer, secondPlayer, thirdPlayer] = players.map(p => p.address);
 
-    masterNullifierHidingKeys = players.map(({ secret }) => deriveMasterNullifierHidingKey(secret));
+    masterNullifierHidingSecretKeys = players.map(({ secret }) => deriveMasterNullifierHidingSecretKey(secret));
   });
 
   beforeEach(async () => {

yarn-project/key-store/src/account_privacy_keys.ts

@@ -0,0 +1,24 @@
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import type { PublicKey } from '@aztec/stdlib/keys';
+
+/**
+ * The four master privacy secret keys the key store holds for an account: the nullifier-hiding, incoming-viewing,
+ * outgoing-viewing, and tagging keys.
+ */
+export type AccountPrivacySecretKeys = {
+  masterNullifierHidingSecretKey: GrumpkinScalar;
+  masterIncomingViewingSecretKey: GrumpkinScalar;
+  masterOutgoingViewingSecretKey: GrumpkinScalar;
+  masterTaggingSecretKey: GrumpkinScalar;
+};
+
+/**
+ * The keys needed to register an account: the four privacy secret keys the key store holds, plus the *public*
+ * message-signing and fallback keys. The message-signing and fallback secret keys are withheld from the key store (and
+ * hence from PXE, which embeds it), since it is not trusted to hold them: only their public keys are needed (to
+ * reconstruct the account's address).
+ */
+export type AccountPrivacyKeys = AccountPrivacySecretKeys & {
+  masterMessageSigningPublicKey: PublicKey;
+  masterFallbackPublicKey: PublicKey;
+};

yarn-project/key-store/src/index.ts

@@ -1 +1,2 @@
+export * from './account_privacy_keys.js';
 export * from './key_store.js';

yarn-project/key-store/src/key_store.test.ts

@@ -2,21 +2,18 @@ import { Fr } from '@aztec/foundation/curves/bn254';
 import { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 import { openTmpStore } from '@aztec/kv-store/lmdb-v2';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
-import { type MasterSecretKeys, deriveKeys, derivePublicKeyFromSecretKey, hashPublicKey } from '@aztec/stdlib/keys';
+import { PublicKey, deriveKeys, derivePublicKeyFromSecretKey, hashPublicKey } from '@aztec/stdlib/keys';
 
+import type { AccountPrivacySecretKeys } from './account_privacy_keys.js';
 import { KeyStore } from './key_store.js';
 
-/** Picks the six master secret keys out of the full `deriveKeys` output. */
-function masterSecretKeysOf(derived: Awaited<ReturnType<typeof deriveKeys>>): MasterSecretKeys {
-  return {
-    masterNullifierHidingKey: derived.masterNullifierHidingKey,
-    masterIncomingViewingSecretKey: derived.masterIncomingViewingSecretKey,
-    masterOutgoingViewingSecretKey: derived.masterOutgoingViewingSecretKey,
-    masterTaggingSecretKey: derived.masterTaggingSecretKey,
-    masterMessageSigningSecretKey: derived.masterMessageSigningSecretKey,
-    masterFallbackSecretKey: derived.masterFallbackSecretKey,
-  };
-}
+/** The four privacy secret keys the key store holds and returns from `getAccountSecretKeys`. */
+const PRIVACY_SECRET_KEY_NAMES = [
+  'masterNullifierHidingSecretKey',
+  'masterIncomingViewingSecretKey',
+  'masterOutgoingViewingSecretKey',
+  'masterTaggingSecretKey',
+] as const satisfies readonly (keyof AccountPrivacySecretKeys)[];
 
 describe('KeyStore', () => {
   it('Adds account and returns keys', async () => {
@@ -25,22 +22,24 @@ describe('KeyStore', () => {
     // Arbitrary fixed values
     const sk = new Fr(8923n);
     const keys = await deriveKeys(sk);
-    const derivedMasterNullifierPublicKey = await derivePublicKeyFromSecretKey(keys.masterNullifierHidingKey);
-    const computedMasterNullifierPublicKeyHash = await hashPublicKey(derivedMasterNullifierPublicKey);
+    const derivedMasterNullifierHidingPublicKey = await derivePublicKeyFromSecretKey(
+      keys.masterNullifierHidingSecretKey,
+    );
+    const computedMasterNullifierHidingPublicKeyHash = await hashPublicKey(derivedMasterNullifierHidingPublicKey);
     const computedMasterIncomingViewingPublicKeyHash = await hashPublicKey(keys.publicKeys.ivpkM);
 
     const partialAddress = new Fr(243523n);
 
-    const { address: accountAddress } = await keyStore.addAccount(sk, partialAddress);
+    const { address: accountAddress } = await keyStore.addAccount(keys, partialAddress);
     expect(accountAddress.toString()).toMatchInlineSnapshot(
       `"0x0a3120bded2afb430e67e4bdb5326a673fbfd95642b6ea7f80d0cc958aac3940"`,
     );
 
     const { pkMHash: returnedNpkMHash } = await keyStore.getKeyValidationRequest(
-      computedMasterNullifierPublicKeyHash,
+      computedMasterNullifierHidingPublicKeyHash,
       await AztecAddress.random(), // Address is random because we are not interested in the app secret key here
     );
-    expect(returnedNpkMHash.equals(computedMasterNullifierPublicKeyHash)).toBe(true);
+    expect(returnedNpkMHash.equals(computedMasterNullifierHidingPublicKeyHash)).toBe(true);
 
     const masterIncomingViewingPublicKey = await keyStore.getMasterIncomingViewingPublicKey(accountAddress);
     expect(masterIncomingViewingPublicKey.equals(keys.publicKeys.ivpkM)).toBe(true);
@@ -58,13 +57,13 @@ describe('KeyStore', () => {
     const appAddress = AztecAddress.fromBigIntUnsafe(624n);
 
     const { pkMHash: obtainedNpkMHash, skApp: appNullifierHidingKey } = await keyStore.getKeyValidationRequest(
-      computedMasterNullifierPublicKeyHash,
+      computedMasterNullifierHidingPublicKeyHash,
       appAddress,
     );
     expect(appNullifierHidingKey.toString()).toMatchInlineSnapshot(
       `"0x165cc265d187ed42f0e3f5adbb5a0055a77e205daeb68dd1735796ee402e502f"`,
     );
-    expect(obtainedNpkMHash).toEqual(computedMasterNullifierPublicKeyHash);
+    expect(obtainedNpkMHash).toEqual(computedMasterNullifierHidingPublicKeyHash);
 
     const appOutgoingViewingSecretKey = await keyStore.getAppOutgoingViewingSecretKey(accountAddress, appAddress);
     expect(appOutgoingViewingSecretKey.toString()).toMatchInlineSnapshot(
@@ -78,8 +77,10 @@ describe('KeyStore', () => {
     );
 
     // Manages to find master nullifier hiding key for the pk_m hash
-    const masterNullifierHidingKey = await keyStore.getMasterSecretKey(computedMasterNullifierPublicKeyHash);
-    expect(masterNullifierHidingKey.equals(keys.masterNullifierHidingKey)).toBe(true);
+    const masterNullifierHidingSecretKey = await keyStore.getMasterSecretKey(
+      computedMasterNullifierHidingPublicKeyHash,
+    );
+    expect(masterNullifierHidingSecretKey.equals(keys.masterNullifierHidingSecretKey)).toBe(true);
 
     // Manages to find master incoming viewing secret key for the pk_m hash
     const masterIncomingViewingSecretKeyFromPublicKey = await keyStore.getMasterSecretKey(
@@ -88,38 +89,33 @@ describe('KeyStore', () => {
     expect(masterIncomingViewingSecretKeyFromPublicKey.equals(keys.masterIncomingViewingSecretKey)).toBe(true);
   });
 
-  it('registers an account from master secret keys, matching seed-based registration', async () => {
+  it('exports the privacy secret keys it was registered with', async () => {
     const keyStore = new KeyStore(await openTmpStore('test'));
 
-    const sk = new Fr(8923n);
-    const partialAddress = new Fr(243523n);
-    const secretKeys = masterSecretKeysOf(await deriveKeys(sk));
+    const privacyKeys = await deriveKeys(new Fr(8923n));
+    const { address } = await keyStore.addAccount(privacyKeys, new Fr(243523n));
 
-    // Registering with the keys derived from a secret must yield the same complete address as registering with the
-    // secret directly: the address is a pure function of the (derived) public keys and the partial address.
-    const fromSecretKey = await keyStore.addAccount(sk, partialAddress);
-    const fromKeys = await keyStore.addAccount(secretKeys, partialAddress);
-    expect(fromKeys.equals(fromSecretKey)).toBe(true);
+    const exported = await keyStore.getAccountSecretKeys(address);
+    for (const name of PRIVACY_SECRET_KEY_NAMES) {
+      expect(exported[name].equals(privacyKeys[name])).toBe(true);
+    }
   });
 
-  it('exports the master secret keys it was registered with', async () => {
+  it('rejects registering an account with secret key resulting in infinity public keys', async () => {
     const keyStore = new KeyStore(await openTmpStore('test'));
 
-    const secretKeys = masterSecretKeysOf(await deriveKeys(new Fr(8923n)));
-    const { address } = await keyStore.addAccount(secretKeys, new Fr(243523n));
+    const privacyKeys = await deriveKeys(new Fr(8923n));
+    privacyKeys.masterIncomingViewingSecretKey = GrumpkinScalar.ZERO;
 
-    const exported = await keyStore.getAccountSecretKeys(address);
-    for (const name of Object.keys(secretKeys) as (keyof MasterSecretKeys)[]) {
-      expect(exported[name].equals(secretKeys[name])).toBe(true);
-    }
+    await expect(keyStore.addAccount(privacyKeys, new Fr(243523n))).rejects.toThrow('masterIncomingViewingPublicKey');
   });
 
-  it('rejects registering an account with a zero secret key', async () => {
+  it('rejects registering an account with an infinity message-signing or fallback public key', async () => {
     const keyStore = new KeyStore(await openTmpStore('test'));
 
-    const secretKeys = masterSecretKeysOf(await deriveKeys(new Fr(8923n)));
-    secretKeys.masterIncomingViewingSecretKey = GrumpkinScalar.ZERO;
+    const privacyKeys = await deriveKeys(new Fr(8923n));
+    privacyKeys.masterMessageSigningPublicKey = PublicKey.INFINITY;
 
-    await expect(keyStore.addAccount(secretKeys, new Fr(243523n))).rejects.toThrow('masterIncomingViewingSecretKey');
+    await expect(keyStore.addAccount(privacyKeys, new Fr(243523n))).rejects.toThrow('masterMessageSigningPublicKey');
   });
 });