fix: store private mpcv2 prv with local encryption

Ticket: WP-5150

Author: mohammadalfaiyazbitgo

src/api/enclaved/handlers/mpcV2Finalize.ts

@@ -6,7 +6,6 @@ import {
 } from '../../../enclavedBitgoExpress/routers/enclavedApiSpec';
 import { KmsClient } from '../../../kms/kmsClient';
 import assert from 'assert';
-import { MPCv2PartiesEnum } from '@bitgo/sdk-core/dist/src/bitgo/utils/tss/ecdsa';
 
 export async function mpcV2Finalize(
   req: EnclavedApiSpecRouteRequest<'v1.mpcv2.finalize', 'post'>,
@@ -35,12 +34,7 @@ export async function mpcV2Finalize(
     throw new Error('Session data is missing for finalization');
   }
   sessionData.dkgSessionBytes = new Uint8Array(Object.values(sessionData.dkgSessionBytes));
-  const session = await DklsDkg.Dkg.restoreSession(
-    3,
-    2,
-    source === 'user' ? MPCv2PartiesEnum.USER : MPCv2PartiesEnum.BACKUP,
-    sessionData,
-  );
+  const session = await DklsDkg.Dkg.restoreSession(3, 2, source === 'user' ? 0 : 1, sessionData);
 
   // processing incoming messages
   const incomingMessages = await DklsComms.decryptAndVerifyIncomingMessages(
@@ -65,6 +59,17 @@ export async function mpcV2Finalize(
     'Source and Bitgo Common keychains do not match',
   );
 
+  await kms.postKey({
+    coin: req.decoded.coin,
+    source: req.decoded.source,
+    pub: commonKeychain,
+    prv: privateMaterial.toString('base64'),
+    type: 'tss',
+    options: {
+      useLocalEncipherment: true,
+    },
+  });
+
   return {
     source,
     commonKeychain,

src/api/enclaved/handlers/signMpcTransaction.ts

@@ -89,9 +89,15 @@ export async function signMpcTransaction(req: EnclavedApiSpecRouteRequest<'v1.mp
 
   const bitgo = req.bitgo;
   const coinInstance = bitgo.coin(coin);
+  const options =
+    coinInstance.getMPCAlgorithm() === 'ecdsa'
+      ? {
+          useLocalEncipherment: true,
+        }
+      : undefined;
 
   // Get private key from KMS
-  const prv = await retrieveKmsPrvKey({ pub, source, cfg: req.config });
+  const prv = await retrieveKmsPrvKey({ pub, source, cfg: req.config, options });
 
   if (!prv) {
     const errorMsg = `Error while MPC signing, missing prv key for pub=${pub}, source=${source}`;

src/api/enclaved/utils.ts

@@ -8,16 +8,20 @@ export async function retrieveKmsPrvKey({
   pub,
   source,
   cfg,
+  options,
 }: {
   pub: string;
   source: string;
   cfg: EnclavedConfig;
+  options?: {
+    useLocalEncipherment?: boolean;
+  };
 }): Promise<string> {
   const kms = new KmsClient(cfg);
   // Retrieve the private key from KMS
   let prv: string;
   try {
-    const res = await kms.getKey({ pub, source });
+    const res = await kms.getKey({ pub, source, options });
     prv = res.prv;
     return prv;
   } catch (error: any) {

src/kms/kmsClient.ts

@@ -65,7 +65,10 @@ export class KmsClient {
     try {
       kmsResponse = await superagent
         .get(`${this.url}/key/${params.pub}`)
-        .query({ source: params.source });
+        .query({
+          source: params.source,
+          useLocalEncipherment: params.options?.useLocalEncipherment ?? false,
+        });
     } catch (error: any) {
       console.log('Error getting key from KMS', error);
       throw error;

src/kms/types/getKey.ts

@@ -3,6 +3,9 @@ import * as z from 'zod';
 export interface GetKeyParams {
   pub: string;
   source: string;
+  options?: {
+    useLocalEncipherment?: boolean;
+  };
 }
 
 export interface GetKeyResponse {

src/kms/types/postKey.ts

@@ -7,6 +7,9 @@ export interface PostKeyParams {
   source: string;
   type: 'independent' | 'tss';
   seed?: string; // Optional seed for key generation
+  options?: {
+    useLocalEncipherment?: boolean;
+  };
 }
 
 export interface PostKeyResponse {