feat: merge-train/fairies-v5 (#24505)

BEGIN_COMMIT_OVERRIDE
fix(pxe): return no shared secrets when scope keys are not held (#24487)
END_COMMIT_OVERRIDE

Author: AztecBot

noir-projects/aztec-nr/aztec/src/messages/delivery/handshake.nr

@@ -233,6 +233,26 @@ mod test {
         });
     }
 
+    #[test]
+    unconstrained fn get_handshake_secrets_returns_empty_when_scope_keys_not_held() {
+        let env = TestEnvironment::new();
+        let scope = AztecAddress::from_field(1);
+        let contract_address = AztecAddress { inner: 0xdeadbeef };
+
+        env.utility_context_at(contract_address, |_| {
+            let mut items = BoundedVec::new();
+            items.push(DiscoveredHandshake { eph_pk: point_from_x_coord(1).unwrap() });
+            let page = HandshakePage { items, total_count: 1 };
+            let _ = OracleMock::mock("aztec_utl_callUtilityFunction").returns(page.serialize());
+
+            let empty: [Field; 0] = [];
+            mock_get_shared_secrets(empty);
+
+            let secrets = get_handshake_secrets(contract_address, scope);
+            assert_eq(secrets.len(), 0);
+        });
+    }
+
     unconstrained fn mock_get_shared_secrets<let N: u32>(response_values: [Field; N]) {
         let response_slot: Field = 99;
         let response_array: EphemeralArray<Field> = EphemeralArray::at(response_slot);

noir-projects/aztec-nr/aztec/src/messages/encryption/aes128.nr

@@ -376,51 +376,53 @@ impl MessageEncryption for AES128 {
             .and_then(|(eph_pk_x, masked_fields)| {
                 // With the x-coordinate of the ephemeral public key we can reconstruct the point as we know that the
                 // y-coordinate must be positive. This may fail however, as not all x-coordinates are on the curve. In
-                // that case, we simply return `Option::none`.
-                point_from_x_coord_and_sign(eph_pk_x, true).and_then(|eph_pk| {
-                    let s_app = get_shared_secret(recipient, eph_pk, contract_address);
-
-                    let unmasked_fields = masked_fields.mapi(|i, field| {
-                        let unmasked = unmask_field(s_app, i, field);
-                        // If we failed to unmask the field, we are dealing with the random padding. We'll ignore it
-                        // later, so we can simply set it to 0
-                        unmasked.unwrap_or(0)
-                    });
-                    let ciphertext_without_eph_pk_x = decode_bytes_from_fields(unmasked_fields);
-
-                    // Derive symmetric keys:
-                    let pairs = derive_aes_symmetric_key_and_iv_from_shared_secret::<2>(s_app);
-                    let (body_sym_key, body_iv) = pairs[0];
-                    let (header_sym_key, header_iv) = pairs[1];
-
-                    // Extract the header ciphertext
-                    let header_start = 0;
-                    let header_ciphertext: [u8; HEADER_CIPHERTEXT_SIZE_IN_BYTES] =
-                        array::subarray(ciphertext_without_eph_pk_x.storage(), header_start);
-                    // We need to convert the array to a BoundedVec because the oracle expects a BoundedVec as it's
-                    // designed to work with messages with unknown length at compile time. This would not be necessary
-                    // here as the header ciphertext length is fixed. But we do it anyway to not have to have duplicate
-                    // oracles.
-                    let header_ciphertext_bvec =
-                        BoundedVec::<u8, HEADER_CIPHERTEXT_SIZE_IN_BYTES>::from_array(header_ciphertext);
-
-                    try_aes128_decrypt(header_ciphertext_bvec, header_iv, header_sym_key)
-                    // Extract ciphertext length from header (2 bytes, big-endian)
-                    .and_then(|header_plaintext| extract_ciphertext_length(header_plaintext))
-                        .filter(|ciphertext_length| ciphertext_length <= MESSAGE_PLAINTEXT_SIZE_IN_BYTES)
-                        .map(|ciphertext_length| {
-                            // Extract and decrypt main ciphertext
-                            let ciphertext_start = header_start + HEADER_CIPHERTEXT_SIZE_IN_BYTES;
-                            let ciphertext_with_padding: [u8; MESSAGE_PLAINTEXT_SIZE_IN_BYTES] =
-                                array::subarray(ciphertext_without_eph_pk_x.storage(), ciphertext_start);
-                            BoundedVec::from_parts(ciphertext_with_padding, ciphertext_length)
-                        })
-                        // Decrypt main ciphertext and return it
-                        .and_then(|ciphertext| try_aes128_decrypt(ciphertext, body_iv, body_sym_key))
-                        // Convert bytes back to fields (32 bytes per field). Returns None if the actual bytes are
-                        // not valid.
-                        .and_then(|plaintext_bytes| try_decode_fields_from_bytes(plaintext_bytes))
-                })
+                // that case, we simply return `Option::none`. Secret derivation may also fail when the PXE does not
+                // hold the recipient's keys (e.g. when syncing the scope of an address we don't control), in which
+                // case the message is undecryptable and equally skipped.
+                point_from_x_coord_and_sign(eph_pk_x, true)
+                    .and_then(|eph_pk| get_shared_secret(recipient, eph_pk, contract_address))
+                    .and_then(|s_app| {
+                        let unmasked_fields = masked_fields.mapi(|i, field| {
+                            let unmasked = unmask_field(s_app, i, field);
+                            // If we failed to unmask the field, we are dealing with the random padding. We'll ignore it
+                            // later, so we can simply set it to 0
+                            unmasked.unwrap_or(0)
+                        });
+                        let ciphertext_without_eph_pk_x = decode_bytes_from_fields(unmasked_fields);
+
+                        // Derive symmetric keys:
+                        let pairs = derive_aes_symmetric_key_and_iv_from_shared_secret::<2>(s_app);
+                        let (body_sym_key, body_iv) = pairs[0];
+                        let (header_sym_key, header_iv) = pairs[1];
+
+                        // Extract the header ciphertext
+                        let header_start = 0;
+                        let header_ciphertext: [u8; HEADER_CIPHERTEXT_SIZE_IN_BYTES] =
+                            array::subarray(ciphertext_without_eph_pk_x.storage(), header_start);
+                        // We need to convert the array to a BoundedVec because the oracle expects a BoundedVec as it's
+                        // designed to work with messages with unknown length at compile time. This would not be
+                        // necessary here as the header ciphertext length is fixed. But we do it anyway to not have to
+                        // have duplicate oracles.
+                        let header_ciphertext_bvec =
+                            BoundedVec::<u8, HEADER_CIPHERTEXT_SIZE_IN_BYTES>::from_array(header_ciphertext);
+
+                        try_aes128_decrypt(header_ciphertext_bvec, header_iv, header_sym_key)
+                        // Extract ciphertext length from header (2 bytes, big-endian)
+                        .and_then(|header_plaintext| extract_ciphertext_length(header_plaintext))
+                            .filter(|ciphertext_length| ciphertext_length <= MESSAGE_PLAINTEXT_SIZE_IN_BYTES)
+                            .map(|ciphertext_length| {
+                                // Extract and decrypt main ciphertext
+                                let ciphertext_start = header_start + HEADER_CIPHERTEXT_SIZE_IN_BYTES;
+                                let ciphertext_with_padding: [u8; MESSAGE_PLAINTEXT_SIZE_IN_BYTES] =
+                                    array::subarray(ciphertext_without_eph_pk_x.storage(), ciphertext_start);
+                                BoundedVec::from_parts(ciphertext_with_padding, ciphertext_length)
+                            })
+                            // Decrypt main ciphertext and return it
+                            .and_then(|ciphertext| try_aes128_decrypt(ciphertext, body_iv, body_sym_key))
+                            // Convert bytes back to fields (32 bytes per field). Returns None if the actual bytes are
+                            // not valid.
+                            .and_then(|plaintext_bytes| try_decode_fields_from_bytes(plaintext_bytes))
+                    })
             })
     }
 }

noir-projects/aztec-nr/aztec/src/oracle/shared_secret.nr

@@ -11,15 +11,21 @@ unconstrained fn get_shared_secrets_oracle(
 ) -> EphemeralArray<Field> {}
 
 /// Convenience wrapper around [`get_shared_secrets`] for a single ephemeral public key.
+///
+/// Returns `none` when the PXE does not hold `address`'s keys and therefore cannot derive the secret.
 pub unconstrained fn get_shared_secret(
     address: AztecAddress,
     eph_pk: EmbeddedCurvePoint,
     contract_address: AztecAddress,
-) -> Field {
+) -> Option<Field> {
     let eph_pks: EphemeralArray<EmbeddedCurvePoint> = EphemeralArray::empty_at(GET_SHARED_SECRET_SINGLE_SLOT);
     eph_pks.push(eph_pk);
     let secrets = get_shared_secrets(address, eph_pks, contract_address);
-    secrets.get(0)
+    if secrets.len() == 1 {
+        Option::some(secrets.get(0))
+    } else {
+        Option::none()
+    }
 }
 
 /// Returns app-siloed shared secrets between `address` and someone who knows the secret keys behind the given
@@ -41,19 +47,26 @@ pub unconstrained fn get_shared_secret(
 ///
 /// Callers derive indexed subkeys from `s_app` via
 /// [`derive_shared_secret_subkey`](crate::keys::ecdh_shared_secret::derive_shared_secret_subkey).
+///
+/// Returns an empty array when the PXE does not hold `address`'s keys and therefore cannot derive any secrets. This
+/// happens when syncing the scope of an address the PXE does not control, and is an expected outcome rather than an
+/// error. Any other response length mismatch is a malformed oracle response.
 pub unconstrained fn get_shared_secrets(
     address: AztecAddress,
     eph_pks: EphemeralArray<EmbeddedCurvePoint>,
     contract_address: AztecAddress,
 ) -> EphemeralArray<Field> {
     let response = get_shared_secrets_oracle(address, eph_pks, contract_address);
-    assert(response.len() == eph_pks.len(), "get_shared_secrets: response length does not match request length");
+    assert(
+        (response.len() == eph_pks.len()) | (response.len() == 0),
+        "get_shared_secrets: response length does not match request length",
+    );
     response
 }
 
 mod test {
     use crate::ephemeral::EphemeralArray;
-    use crate::oracle::shared_secret::get_shared_secrets;
+    use crate::oracle::shared_secret::{get_shared_secret, get_shared_secrets};
     use crate::protocol::{address::AztecAddress, traits::FromField};
     use crate::test::helpers::test_environment::TestEnvironment;
     use crate::utils::point::point_from_x_coord;
@@ -110,6 +123,54 @@ mod test {
         });
     }
 
+    #[test]
+    unconstrained fn returns_empty_when_pxe_does_not_hold_keys() {
+        let env = TestEnvironment::new();
+        env.utility_context(|_| {
+            let empty: [Field; 0] = [];
+            let _ = mock_get_shared_secrets(empty);
+
+            let pk = point_from_x_coord(1).unwrap();
+            let eph_pks: EphemeralArray<_> = EphemeralArray::empty_at(200);
+            eph_pks.push(pk);
+
+            let results: EphemeralArray<Field> = get_shared_secrets(
+                AztecAddress::from_field(1),
+                eph_pks,
+                AztecAddress::from_field(2),
+            );
+
+            assert_eq(results.len(), 0);
+        });
+    }
+
+    #[test]
+    unconstrained fn single_secret_returns_the_secret() {
+        let env = TestEnvironment::new();
+        env.utility_context(|_| {
+            let _ = mock_get_shared_secrets([111]);
+
+            let pk = point_from_x_coord(1).unwrap();
+            let secret = get_shared_secret(AztecAddress::from_field(1), pk, AztecAddress::from_field(2));
+
+            assert_eq(secret.unwrap(), 111);
+        });
+    }
+
+    #[test]
+    unconstrained fn single_secret_returns_none_when_pxe_does_not_hold_keys() {
+        let env = TestEnvironment::new();
+        env.utility_context(|_| {
+            let empty: [Field; 0] = [];
+            let _ = mock_get_shared_secrets(empty);
+
+            let pk = point_from_x_coord(1).unwrap();
+            let secret = get_shared_secret(AztecAddress::from_field(1), pk, AztecAddress::from_field(2));
+
+            assert(secret.is_none());
+        });
+    }
+
     #[test(should_fail_with = "response length does not match request length")]
     unconstrained fn cannot_return_mismatched_length() {
         let env = TestEnvironment::new();

noir-projects/aztec-nr/aztec/src/standard_addresses.nr

@@ -2,17 +2,17 @@
 use protocol_types::{address::AztecAddress, traits::FromField};
 
 pub global STANDARD_AUTH_REGISTRY_ADDRESS: AztecAddress = AztecAddress::from_field(
-    0x0e7d3c56a185c40e4ce459eee03075b7dee2e9dc8f860157063afb3fde5ce097,
+    0x0f53c9d679c6aa851b46bfc07e14bd070d5948b6ad1a4f7c54909f61dceb146a,
 );
 
 pub global STANDARD_MULTI_CALL_ENTRYPOINT_ADDRESS: AztecAddress = AztecAddress::from_field(
-    0x03264f902d92f27dd0719cd6f5cc9c9d03ec6f5a48482e2158ebc2886e997210,
+    0x251d9cb1aa645672268b9b9082dedba22986ba9068d5ad8ecfae53f24e16c109,
 );
 
 pub global STANDARD_PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress::from_field(
-    0x05b4a7bf960bac46cc0c22aa6ee5b663a928787c9e7410fcf99e78182f634c0b,
+    0x2ebeb911fc3963e7d1869af2dc7fee318d1edbc957edb46a0e99b46867ba4492,
 );
 
 pub global STANDARD_HANDSHAKE_REGISTRY_ADDRESS: AztecAddress = AztecAddress::from_field(
-    0x26f11691c7efea98db7eb7b4460cbc3f75db19772db2c2dbb8978979bcc5e388,
+    0x1523a141a33e5aa8d72624823b8592b87799c9ee0c086dd9f3c80661905366ab,
 );

noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr

@@ -466,7 +466,7 @@ unconstrained fn non_interactive_handshake_is_discovered_by_recipient() {
     // The recipient derives the same app-siloed secret from the discovered eph_pk via ECDH.
     let handshake = discovered.items.get(0);
     let recipient_secret = env.utility_context_at(sender, |_| get_shared_secret(recipient, handshake.eph_pk, sender));
-    assert_eq(recipient_secret, returned_secrets.shared);
+    assert_eq(recipient_secret.unwrap(), returned_secrets.shared);
 
     // The custom sync hook falls through to `do_sync_state`, so default note discovery still works.
     let utility_secrets = env

noir-projects/noir-contracts/pinned-standard-contracts.tar.gz

@@ -158,10 +158,7 @@ describe('automine/accounts/2_pxes', () => {
 
   // Mints private balances for two accounts, each on their own PXE. Verifies that querying
   // the balance for account A from PXE B returns 0 (key not registered), and vice versa.
-  // TODO(F-741): `expectTokenBalance(walletB, token, accountAAddress, 0n)` throws
-  // "No public key registered". Handshake discovery (get_shared_secrets) needs the scope's
-  // keys, which this PXE lacks for a foreign account.
-  it.skip('private state is zero when PXE does not have the account secret key', async () => {
+  it('private state is zero when PXE does not have the account secret key', async () => {
     const userABalance = 100n;
     const userBBalance = 150n;
 

yarn-project/end-to-end/src/automine/accounts/2_pxes.parallel.test.ts

@@ -60,10 +60,7 @@ describe('automine/token/transfer', () => {
 
   // Transfers to a randomly generated non-deployed address. Because the recipient's keys aren't in the PXE,
   // the note can't be decrypted; TokenSimulator models this as a transfer to AztecAddress.ZERO.
-  // TODO(F-741): the unconstrained delivery now establishes a non-interactive handshake, and checking the
-  // non-deployed recipient's private balance throws "No public key registered". Handshake discovery
-  // (get_shared_secrets) needs the scope's keys, which this PXE lacks for a foreign account.
-  it.skip('transfer less than balance to non-deployed account', async () => {
+  it('transfer less than balance to non-deployed account', async () => {
     const { result: balance0 } = await asset.methods.balance_of_private(adminAddress).simulate({ from: adminAddress });
     const amount = balance0 / 2n;
     expect(amount).toBeGreaterThan(0n);

yarn-project/end-to-end/src/automine/token/transfer.test.ts

@@ -160,11 +160,9 @@ describe('Utility Execution test suite', () => {
       return Promise.resolve(GrumpkinScalar.random());
     });
 
+    // Like the real AddressStore, resolve undefined for addresses never registered via registerAccount.
     addressStore.getCompleteAddress.mockImplementation((account: AztecAddress) => {
-      if (account.equals(owner)) {
-        return Promise.resolve(ownerCompleteAddress);
-      }
-      throw new Error(`Unknown address ${account}`);
+      return Promise.resolve(account.equals(owner) ? ownerCompleteAddress : undefined);
     });
   });
 
@@ -581,6 +579,17 @@ describe('Utility Execution test suite', () => {
           /expected/,
         );
       });
+
+      it('returns no secrets when the PXE does not hold the keys for the address', async () => {
+        const ephSk = GrumpkinScalar.random();
+        const ephPk = await Grumpkin.mul(Grumpkin.generator, ephSk);
+
+        const foreignAddress = await AztecAddress.random();
+        const ephPksArray = EphemeralArray.fromValues<EmbeddedCurvePoint>(service, [ephPk]);
+        const response = await utilityExecutionOracle.getSharedSecrets(foreignAddress, ephPksArray, contractAddress);
+
+        expect(response.readAll(service)).toEqual([]);
+      });
     });
 
     describe('getPendingTaggedLogs', () => {

yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution.test.ts

@@ -852,7 +852,8 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
    * @param address - The recipient address.
    * @param ephPks - Ephemeral array containing the serialized Points.
    * @param contractAddress - The contract address for app-siloing (validated against execution context).
-   * @returns A new ephemeral array containing the computed shared secrets.
+   * @returns A new ephemeral array containing the computed shared secrets, or an empty array when the PXE does not
+   * hold the keys for `address`, signaling that no secrets can be derived for it.
    */
   public async getSharedSecrets(
     address: AztecAddress,
@@ -864,7 +865,17 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
         `getSharedSecrets called with contract address ${contractAddress}, expected ${this.contractAddress}`,
       );
     }
-    const recipientCompleteAddress = await this.getCompleteAddressOrFail(address);
+    const recipientCompleteAddress = await this.addressStore.getCompleteAddress(address);
+    if (!recipientCompleteAddress) {
+      this.logger.warn(
+        `Computing shared secrets for address ${address} whose keys are not held - returning no secrets`,
+        {
+          address,
+          contractAddress: this.contractAddress,
+        },
+      );
+      return EphemeralArray.fromValues<Fr>(this.ephemeralArrayService, []);
+    }
     const ivpkMHash = await hashPublicKey(recipientCompleteAddress.publicKeys.ivpkM);
     const ivskM = await this.keyStore.getMasterSecretKey(ivpkMHash);
     const addressSecret = await computeAddressSecret(await recipientCompleteAddress.getPreaddress(), ivskM);