dkg/bcast: bind broadcast signatures to cluster session - #4638
Merged
Conversation
Bind reliable-broadcast signatures to the cluster session and message ID. Previously the signed hash covered only the protobuf type URL and value, so signatures remained valid across DKG sessions and message IDs, allowing replay of captured messages into other ceremonies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #4638 +/- ##
==========================================
+ Coverage 58.16% 58.17% +0.01%
==========================================
Files 247 247
Lines 34056 34087 +31
==========================================
+ Hits 19807 19829 +22
- Misses 11779 11784 +5
- Partials 2470 2474 +4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
KaloyanTanev
approved these changes
Aug 12, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the DKG reliable-broadcast (bcast) signing scheme by binding signatures to a cluster session identifier and the message ID, preventing replay of captured bcast messages across DKG ceremonies within the same cluster.
Changes:
- Bind bcast hashes/signatures to
(session_hash, msg_id, type_url, value)using length-prefixing to avoid concatenation ambiguity. - Thread the session hash into all DKG bcast instantiations (definition hash for initial DKG; lock hash for mutation ceremonies).
- Bump the libp2p bcast protocol ID to
/charon/dkg/bcast/2.0.0and add tests for session-hash mismatch and hashing behavior.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| dkg/protocolsteps_internal_test.go | Updates test bcast construction to pass the session hash. |
| dkg/protocol_reshare.go | Binds reshare bcast signatures to the lock hash (session). |
| dkg/protocol_replaceoperator.go | Binds replace-operator bcast signatures to the lock hash (session). |
| dkg/protocol_removeoperators.go | Binds remove-operators bcast signatures to the lock hash (session). |
| dkg/protocol_addoperators.go | Binds add-operators bcast signatures to the lock hash (session). |
| dkg/pedersen/testutils.go | Passes the session into bcast for pedersen test boards. |
| dkg/nodesigs_internal_test.go | Updates node signature exchange tests to provide a session hash. |
| dkg/dkg.go | Passes definition hash as the initial DKG session hash to bcast. |
| dkg/bcast/server.go | Includes message ID in hashing during signature request handling. |
| dkg/bcast/impl.go | Adds session-bound hashing and plumbs hash function through signing/verification. |
| dkg/bcast/impl_test.go | Updates tests for new constructor signature and adds session mismatch coverage. |
| dkg/bcast/impl_internal_test.go | Adds internal unit test for new session/message-id bound hashing behavior. |
| dkg/bcast/helpers.go | Bumps bcast protocol ID to v2.0.0 and updates hashFunc signature. |
| dkg/bcast/client.go | Includes message ID in the client-side hashing for signing/verification. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bind reliable-broadcast signatures to the cluster session and message ID. Previously the signed hash covered only the protobuf type URL and value, so signatures stayed valid across DKG sessions and message IDs, allowing replay of captured messages into other ceremonies of the same cluster.
The signed hash is now the length-prefixed sha256 of (session hash, message ID, type URL, value). The initial DKG binds the definition hash; the add/remove/replace-operator and reshare protocols bind the lock hash, which changes with every cluster mutation, so messages from earlier ceremonies of the same cluster fail verification. The bcast libp2p protocol ID is bumped to 2.0.0 so mixed-version peers fail at stream negotiation instead of at signature verification.
category: bug
ticket: none