@aztec-labs/p2p 6.0.0-nightly.20260829

package/src/services/reqresp/connection-sampler/connection_sampler.ts

@@ -0,0 +1,287 @@
+import { AbortError } from '@aztec-labs/foundation/error';
+import { createLogger } from '@aztec-labs/foundation/log';
+import type { Libp2p, PeerId, Stream } from '@libp2p/interface';
+
+const MAX_SAMPLE_ATTEMPTS = 4;
+
+export class RandomSampler {
+  random(max: number) {
+    return Math.floor(Math.random() * max);
+  }
+}
+
+/**
+ * A class that samples peers from the libp2p node and returns a peer that we don't already have a reqresp connection open to.
+ * If we already have a connection open, we try to sample a different peer.
+ * We do this MAX_SAMPLE_ATTEMPTS times, if we still don't find a peer we just go for it.
+ *
+ * @dev Close must always be called on connections, else memory leak
+ */
+export class ConnectionSampler {
+  private cleanupInterval: NodeJS.Timeout;
+
+  // Map from stringified peer id to number of active connections
+  protected readonly activeConnectionsCount: Map<string, number> = new Map();
+
+  // eslint-disable-next-line aztec-custom/no-non-primitive-in-collections
+  protected readonly streams: Set<Stream> = new Set();
+
+  private abortOnStop: AbortController = new AbortController();
+
+  constructor(
+    private readonly libp2p: Libp2p,
+    private readonly sampler: RandomSampler,
+    private readonly logger = createLogger('p2p:reqresp:connection-sampler'),
+    private readonly opts: { cleanupIntervalMs?: number; p2pOptimisticNegotiation?: boolean } = {},
+  ) {
+    this.cleanupInterval = setInterval(
+      () => void this.cleanupStaleConnections(),
+      this.opts.cleanupIntervalMs ?? 60_000,
+    );
+  }
+
+  /**
+   * Stops the cleanup job and closes all active connections
+   */
+  async stop() {
+    this.logger.info('Stopping connection sampler');
+    this.abortOnStop.abort(new AbortError('Connection sampler stopped'));
+    clearInterval(this.cleanupInterval);
+
+    // Close all active streams
+    const closePromises = Array.from(this.streams.values()).map(stream => this.close(stream));
+    await Promise.all(closePromises);
+    this.logger.info('Connection sampler stopped');
+  }
+
+  /**
+   *
+   * @param excluding - The peers to exclude from the sampling
+   *        This is to prevent sampling with replacement
+   * @returns
+   */
+  getPeer(excluding?: Map<string, boolean>): PeerId | undefined {
+    // In libp2p getPeers performs a shallow copy, so this array can be sliced from safetly
+    const peers = this.libp2p.getPeers();
+    const { peer } = this.getPeerFromList(peers, excluding);
+    return peer;
+  }
+
+  /**
+   * Samples a peer from a list of peers, excluding those that have active (reqresp) connections or are in the exclusion list
+   *
+   * @param peers - The list of peers to sample from
+   * @param excluding - The peers to exclude from the sampling
+   * @returns - A peer from the list, or undefined if no peers are available,
+   *          - a boolean indicating if the peer has active connections, and
+   *          - all sampled peers - to enable optional resampling
+   *
+   * @dev The provided list peers, should be mutated by this function. This allows batch sampling
+   *      to be performed without making extra copies of the list.
+   */
+  getPeerFromList(
+    peers: PeerId[],
+    excluding?: Map<string, boolean>,
+  ): {
+    peer: PeerId | undefined;
+    sampledPeers: PeerId[];
+  } {
+    if (peers.length === 0) {
+      return { peer: undefined, sampledPeers: [] };
+    }
+
+    const sampledPeers: PeerId[] = [];
+    // Try to find a peer that has no active connections and is not in the exclusion list
+    for (let attempts = 0; attempts < MAX_SAMPLE_ATTEMPTS && peers.length > 0; attempts++) {
+      const randomIndex = this.sampler.random(peers.length);
+      const peer = peers[randomIndex];
+      const hasActiveConnections = (this.activeConnectionsCount.get(peer.toString()) ?? 0) > 0;
+      const isExcluded = excluding?.get(peer.toString()) ?? false;
+
+      // Remove this peer from consideration
+      peers.splice(randomIndex, 1);
+
+      // If peer is suitable (no active connections and not excluded), return it
+      if (!hasActiveConnections && !isExcluded) {
+        this.logger.trace('Sampled peer', {
+          attempts,
+          peer,
+        });
+        return { peer, sampledPeers };
+      }
+
+      // Keep track of peers that have active reqresp channels, batch sampling will use these to resample
+      sampledPeers.push(peer);
+    }
+
+    // If we've exhausted our attempts or peers list is empty, return the last peer if available
+    const lastPeer = peers.length > 0 ? peers[this.sampler.random(peers.length)] : undefined;
+
+    this.logger.trace('Sampled peer', {
+      attempts: MAX_SAMPLE_ATTEMPTS,
+      peer: lastPeer?.toString(),
+    });
+    return { peer: lastPeer, sampledPeers };
+  }
+
+  /*
+   * Returns all peers sorted by connection count ascending,
+   * meaning that the peers with the least number of active connections are earlier in an array
+   *
+   * @param: excluding - peers to exclude
+   * @return: list of peer ids
+   * */
+  public getPeerListSortedByConnectionCountAsc(excluding?: Set<string>): PeerId[] {
+    return this.libp2p
+      .getPeers()
+      .filter(id => !excluding?.has(id.toString()))
+      .map(id => ({ id, count: this.activeConnectionsCount.get(id.toString()) ?? 0 }))
+      .sort((a, b) => a.count - b.count)
+      .map(p => p.id);
+  }
+
+  /**
+   * Samples a batch of unique peers from the libp2p node, prioritizing peers without active connections
+   *
+   * @param numberToSample - The number of peers to sample
+   * @param excluding - The peers to exclude from the sampling
+   * @returns Array of unique sampled peers, prioritizing those without active connections
+   */
+  samplePeersBatch(numberToSample: number, excluding?: Map<string, boolean>): PeerId[] {
+    const peers = this.libp2p.getPeers();
+    this.logger.debug('Sampling peers batch', { numberToSample, peers });
+
+    // Only sample as many peers as we have available
+    numberToSample = Math.min(numberToSample, peers.length);
+
+    const batch: PeerId[] = [];
+    // eslint-disable-next-line aztec-custom/no-non-primitive-in-collections
+    const withActiveConnections: Set<PeerId> = new Set();
+    for (let i = 0; i < numberToSample; i++) {
+      const { peer, sampledPeers } = this.getPeerFromList(peers, excluding);
+      if (peer) {
+        batch.push(peer);
+      }
+      if (sampledPeers.length > 0) {
+        sampledPeers.forEach(peer => withActiveConnections.add(peer));
+      }
+    }
+    const lengthWithoutConnections = batch.length;
+
+    // If we still need more peers, sample from those with connections
+    while (batch.length < numberToSample && withActiveConnections.size > 0) {
+      const randomIndex = this.sampler.random(withActiveConnections.size);
+
+      const peer = Array.from(withActiveConnections)[randomIndex];
+      withActiveConnections.delete(peer);
+      batch.push(peer);
+    }
+
+    this.logger.trace('Batch sampled peers', {
+      length: batch.length,
+      peers: batch,
+      withoutConnections: lengthWithoutConnections,
+      withConnections: numberToSample - lengthWithoutConnections,
+    });
+
+    return batch;
+  }
+
+  // Set of passthrough functions to keep track of active connections
+
+  /**
+   * Dials a protocol and returns the stream
+   *
+   * @param peerId - The peer id
+   * @param protocol - The protocol
+   * @param timeout - Abort connection if it takes too long
+   * @returns The stream
+   */
+  async dialProtocol(peerId: PeerId, protocol: string, timeout?: number): Promise<Stream> {
+    const stream = await this.libp2p.dialProtocol(peerId, protocol, {
+      signal: AbortSignal.any(
+        timeout ? [this.abortOnStop.signal, AbortSignal.timeout(timeout!)] : [this.abortOnStop.signal],
+      ),
+      negotiateFully: !this.opts.p2pOptimisticNegotiation,
+    });
+    stream.metadata.peerId = peerId;
+    this.streams.add(stream);
+
+    const peerIdString = peerId.toString();
+    const updatedActiveConnectionsCount = (this.activeConnectionsCount.get(peerIdString) ?? 0) + 1;
+    this.activeConnectionsCount.set(peerIdString, updatedActiveConnectionsCount);
+
+    this.logger.trace('Dialed protocol', {
+      streamId: stream.id,
+      protocol,
+      peerId: peerIdString,
+      activeConnectionsCount: updatedActiveConnectionsCount,
+    });
+    return stream;
+  }
+
+  /**
+   * Closes a stream and updates the active connections count
+   */
+  async close(stream: Stream): Promise<void> {
+    let peerId: PeerId | undefined = undefined;
+
+    try {
+      peerId = stream.metadata.peerId;
+      let updatedActiveConnectionsCount = undefined;
+
+      if (!peerId) {
+        this.logger.warn(`Stream ${stream.id} does not have a peerId set`);
+      } else {
+        updatedActiveConnectionsCount = (this.activeConnectionsCount.get(peerId.toString()) ?? 1) - 1;
+        this.activeConnectionsCount.set(peerId.toString(), updatedActiveConnectionsCount);
+      }
+
+      this.logger.trace('Closing connection', {
+        streamId: stream.id,
+        peerId: peerId?.toString(),
+        protocol: stream.protocol,
+        activeConnectionsCount: updatedActiveConnectionsCount,
+      });
+
+      if (!this.streams.has(stream)) {
+        this.logger.debug(`Stream ${stream.id} is not in the active streams set`);
+      }
+
+      await stream.close();
+    } catch (error) {
+      this.logger.error(`Failed to close connection to peer ${peerId ?? 'unknown'} with stream id ${stream.id}`, error);
+      // graceful close failed, abort the stream
+      stream.abort(new AbortError('Failed to close stream gracefully'));
+    } finally {
+      this.streams.delete(stream);
+    }
+  }
+
+  /**
+   * Cleans up stale connections that we have lost accounting for
+   */
+  private async cleanupStaleConnections() {
+    // Look for streams without anything in the activeConnectionsCount
+    // If we find anything, close the stream
+    for (const stream of this.streams.values()) {
+      try {
+        // Check if we have lost track of accounting
+        const peerId: PeerId = stream.metadata.peerId;
+        if (!peerId) {
+          this.logger.warn(`Stream ${stream.id} does not have a peerId set`);
+        } else if (this.activeConnectionsCount.get(peerId.toString()) === 0) {
+          await this.close(stream);
+          this.logger.debug('Cleaned up stale connection', { streamId: stream.id, peerId: peerId.toString() });
+        }
+      } catch (error) {
+        this.logger.error(
+          `Error cleaning up stale connection to peer ${stream.metadata.peerId?.toString() ?? 'unknown'} stream ${
+            stream.id
+          }`,
+          { error },
+        );
+      }
+    }
+  }
+}

package/src/services/reqresp/constants.ts

@@ -0,0 +1,14 @@
+/**
+ * Constants for P2P message deserialization bounds checking.
+ * These constants define maximum allowed sizes during deserialization
+ * to prevent DoS attacks via maliciously crafted messages.
+ */
+
+/** Max transactions per block for deserialization validation (~300x default of 32) */
+export { MAX_TXS_PER_BLOCK } from '@aztec-labs/stdlib/deserialization';
+
+/** Max version string length (e.g., "1.0.0-alpha.123") */
+export const MAX_VERSION_STRING_LENGTH = 64;
+
+/** Max block hash string length (hex: 0x + 64 chars, with generous headroom) */
+export const MAX_BLOCK_HASH_STRING_LENGTH = 128;

package/src/services/reqresp/index.ts

@@ -0,0 +1,6 @@
+/**
+ * Request Response protocol allows nodes to ask their peers for data
+ * that they missed via the traditional gossip protocol.
+ */
+export * from './protocols/index.js';
+export * from './interface.js';

package/src/services/reqresp/interface.ts

@@ -0,0 +1,241 @@
+import { TxArray, TxHashArray } from '@aztec-labs/stdlib/tx';
+import type { PeerId } from '@libp2p/interface';
+
+import type { P2PReqRespConfig } from './config.js';
+import type { ConnectionSampler } from './connection-sampler/connection_sampler.js';
+import { AuthRequest, AuthResponse } from './protocols/auth.js';
+import {
+  BlockTxsRequest,
+  BlockTxsResponse,
+  calculateBlockTxsResponseSize,
+} from './protocols/block_txs/block_txs_reqresp.js';
+import { StatusMessage } from './protocols/status.js';
+import { calculateTxResponseSize } from './protocols/tx.js';
+import type { ReqRespStatus } from './status.js';
+
+/*
+ * Request Response Sub Protocols
+ */
+export const PING_PROTOCOL = '/aztec/req/ping/1.0.0';
+export const STATUS_PROTOCOL = '/aztec/req/status/1.0.0';
+export const GOODBYE_PROTOCOL = '/aztec/req/goodbye/1.0.0';
+export const TX_REQ_PROTOCOL = '/aztec/req/tx/1.0.0';
+export const AUTH_PROTOCOL = '/aztec/req/auth/1.0.0';
+export const BLOCK_TXS_REQ_PROTOCOL = '/aztec/req/block_txs/1.0.0';
+
+export enum ReqRespSubProtocol {
+  PING = PING_PROTOCOL,
+  STATUS = STATUS_PROTOCOL,
+  GOODBYE = GOODBYE_PROTOCOL,
+  TX = TX_REQ_PROTOCOL,
+  AUTH = AUTH_PROTOCOL,
+  BLOCK_TXS = BLOCK_TXS_REQ_PROTOCOL,
+}
+
+/**
+ * A handler for a sub protocol
+ * The message will arrive as a buffer, and the handler must return a buffer
+ */
+export type ReqRespSubProtocolHandler = (peerId: PeerId, msg: Buffer) => Promise<Buffer>;
+
+/**
+ * A type mapping from supprotocol to it's rate limits
+ */
+export type ReqRespSubProtocolRateLimits = Record<ReqRespSubProtocol, ProtocolRateLimitQuota>;
+
+/**
+ * The response from the ReqResp protocol
+ * Consists of a status
+ * And, optionally, a data buffer (in case status is SUCCESS)
+ */
+export type ReqRespResponse =
+  | { status: ReqRespStatus.SUCCESS; data: Buffer }
+  | { status: Exclude<ReqRespStatus, ReqRespStatus.SUCCESS> };
+
+/**
+ * A rate limit quota
+ */
+export interface RateLimitQuota {
+  /**
+   * The time window in ms
+   */
+  quotaTimeMs: number;
+  /**
+   * The number of requests allowed within the time window
+   */
+  quotaCount: number;
+}
+
+export interface ProtocolRateLimitQuota {
+  /**
+   * The rate limit quota for a single peer
+   */
+  peerLimit: RateLimitQuota;
+  /**
+   * The rate limit quota for the global peer set
+   */
+  globalLimit: RateLimitQuota;
+}
+
+/**
+ * A type mapping from supprotocol to it's handling function
+ */
+export type ReqRespSubProtocolHandlers = Record<ReqRespSubProtocol, ReqRespSubProtocolHandler>;
+
+/**
+ * Protocols that are always allowed without authentication, even when p2pAllowOnlyValidators is enabled.
+ * These are needed for the handshake and connection management flow.
+ * All other protocols require the remote peer to be authenticated.
+ */
+export const UNAUTHENTICATED_ALLOWED_PROTOCOLS: ReadonlySet<ReqRespSubProtocol> = new Set([
+  ReqRespSubProtocol.PING,
+  ReqRespSubProtocol.STATUS,
+  ReqRespSubProtocol.AUTH,
+  ReqRespSubProtocol.GOODBYE,
+]);
+
+/**
+ * Callback that checks whether a peer should be rejected from req/resp data protocols.
+ * Returns true if the peer should be rejected (i.e. p2pAllowOnlyValidators is on and peer is unauthenticated).
+ */
+export type ShouldRejectPeer = (peerId: string) => boolean;
+
+/*
+ * Helper class to sub-protocol validation error*/
+export class ValidationError extends Error {
+  constructor(message: string) {
+    super(message);
+  }
+}
+
+/**
+ * Sub protocol map determines the request and response types for each
+ * Req Resp protocol
+ */
+export type SubProtocolMap = {
+  [S in ReqRespSubProtocol]: RequestResponsePair<
+    InstanceType<(typeof subProtocolMap)[S]['request']>,
+    InstanceType<(typeof subProtocolMap)[S]['response']>
+  >;
+};
+
+/**
+ * The Request Response Pair interface defines the methods that each
+ * request response pair must implement
+ */
+interface RequestResponsePair<Req extends { toBuffer(): Buffer }, Res> {
+  /**
+   * The request must implement the toBuffer method (generic serialisation)
+   */
+  request: new (...args: any[]) => Req;
+  /**
+   * The response must implement the static fromBuffer method (generic serialisation)
+   */
+  response: {
+    new (...args: any[]): Res;
+    fromBuffer(buffer: Buffer): Res;
+  };
+}
+
+/*
+ * Small helper function which parses buffer into specific response type
+ * It is needed to make TypeScript happy, as it cannot infer the type from the buffer
+ *
+ * @param proto - The sub protocol to parse the response for
+ * @param buffer - The buffer to parse
+ *
+ * @returns - The parsed response object
+ * */
+export function responseFromBuffer<P extends ReqRespSubProtocol>(
+  proto: P,
+  buffer: Buffer,
+): InstanceType<(typeof subProtocolMap)[P]['response']> {
+  return subProtocolMap[proto].response.fromBuffer(buffer) as InstanceType<(typeof subProtocolMap)[P]['response']>;
+}
+
+/**
+ * RequestableBuffer is a wrapper around a buffer that allows it to be
+ * used in generic request response protocols
+ *
+ * An instance of the RequestResponsePair defined above
+ */
+export class RequestableBuffer {
+  constructor(public buffer: Buffer) {}
+
+  toBuffer() {
+    return this.buffer;
+  }
+
+  static fromBuffer(buffer: Buffer) {
+    return new RequestableBuffer(buffer);
+  }
+}
+
+/**
+ * A mapping from each protocol to their request and response types
+ * This defines the request and response types for each sub protocol, used primarily
+ * as a type rather than an object
+ */
+export const subProtocolMap = {
+  [ReqRespSubProtocol.PING]: {
+    request: RequestableBuffer,
+    response: RequestableBuffer,
+  },
+  [ReqRespSubProtocol.STATUS]: {
+    request: StatusMessage,
+    response: StatusMessage,
+  },
+  [ReqRespSubProtocol.TX]: {
+    request: TxHashArray,
+    response: TxArray,
+  },
+  [ReqRespSubProtocol.GOODBYE]: {
+    request: RequestableBuffer,
+    response: RequestableBuffer,
+  },
+  [ReqRespSubProtocol.AUTH]: {
+    request: AuthRequest,
+    response: AuthResponse,
+  },
+  [ReqRespSubProtocol.BLOCK_TXS]: {
+    request: BlockTxsRequest,
+    response: BlockTxsResponse,
+  },
+};
+
+/**
+ * Type for a function that calculates the expected response size in KB for a given request.
+ */
+export type ExpectedResponseSizeCalculator = (requestBuffer: Buffer) => number;
+
+/**
+ * Map of sub-protocols to their expected response size calculators.
+ * These are used to validate that responses don't exceed expected sizes based on request parameters.
+ */
+export const subProtocolSizeCalculators: Record<ReqRespSubProtocol, ExpectedResponseSizeCalculator> = {
+  [ReqRespSubProtocol.TX]: calculateTxResponseSize,
+  [ReqRespSubProtocol.BLOCK_TXS]: calculateBlockTxsResponseSize,
+  [ReqRespSubProtocol.STATUS]: () => 1,
+  [ReqRespSubProtocol.PING]: () => 1,
+  [ReqRespSubProtocol.AUTH]: () => 1,
+  [ReqRespSubProtocol.GOODBYE]: () => 1, // No response expected, but provide minimal limit
+};
+
+export interface ReqRespInterface {
+  start(subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>): Promise<void>;
+  addSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void>;
+  stop(): Promise<void>;
+  sendRequestToPeer(
+    peerId: PeerId,
+    subProtocol: ReqRespSubProtocol,
+    payload: Buffer,
+    dialTimeout?: number,
+  ): Promise<ReqRespResponse>;
+
+  updateConfig(config: Partial<P2PReqRespConfig>): void;
+
+  /** Sets the callback used to reject unauthenticated peers on gated req/resp protocols. */
+  setShouldRejectPeer(checker: ShouldRejectPeer): void;
+
+  getConnectionSampler(): Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'>;
+}

package/src/services/reqresp/metrics.ts

@@ -0,0 +1,68 @@
+// Request response metrics
+import { Attributes, Metrics, createUpDownCounterWithDefault } from '@aztec-labs/telemetry-client';
+import type { TelemetryClient, Tracer, UpDownCounter } from '@aztec-labs/telemetry-client';
+
+import { ReqRespSubProtocol } from './interface.js';
+
+export class ReqRespMetrics {
+  public readonly tracer: Tracer;
+
+  private readonly sentRequests: UpDownCounter;
+  private readonly receivedRequests: UpDownCounter;
+
+  private readonly failedOutboundRequests: UpDownCounter;
+  private readonly failedInboundRequests: UpDownCounter;
+
+  constructor(
+    readonly telemetryClient: TelemetryClient,
+    name = 'ReqResp',
+  ) {
+    this.tracer = telemetryClient.getTracer(name);
+
+    const meter = telemetryClient.getMeter(name);
+    const protocolAttrs = {
+      [Attributes.P2P_REQ_RESP_PROTOCOL]: [
+        ReqRespSubProtocol.PING,
+        ReqRespSubProtocol.STATUS,
+        ReqRespSubProtocol.GOODBYE,
+        ReqRespSubProtocol.TX,
+        ReqRespSubProtocol.AUTH,
+        ReqRespSubProtocol.BLOCK_TXS,
+      ],
+    };
+    this.sentRequests = createUpDownCounterWithDefault(meter, Metrics.P2P_REQ_RESP_SENT_REQUESTS, protocolAttrs);
+    this.receivedRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_RECEIVED_REQUESTS,
+      protocolAttrs,
+    );
+
+    this.failedOutboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_OUTBOUND_REQUESTS,
+      protocolAttrs,
+    );
+
+    this.failedInboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_INBOUND_REQUESTS,
+      protocolAttrs,
+    );
+  }
+
+  public recordRequestSent(protocol: ReqRespSubProtocol) {
+    this.sentRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
+  }
+
+  public recordRequestReceived(protocol: ReqRespSubProtocol) {
+    this.receivedRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
+  }
+
+  public recordRequestError(protocol: ReqRespSubProtocol) {
+    this.failedOutboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
+  }
+
+  public recordResponseError(protocol: ReqRespSubProtocol) {
+    this.failedInboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
+  }
+}

package/src/services/reqresp/protocols/auth.ts

@@ -0,0 +1,83 @@
+import { Buffer32 } from '@aztec-labs/foundation/buffer';
+import { keccak256 } from '@aztec-labs/foundation/crypto/keccak';
+import { Fr } from '@aztec-labs/foundation/curves/bn254';
+import { Signature } from '@aztec-labs/foundation/eth-signature';
+import { BufferReader, serializeToBuffer } from '@aztec-labs/foundation/serialize';
+
+import { StatusMessage } from './status.js';
+
+export const VALIDATOR_AUTH_DOMAIN_SEPARATOR = 'Aztec Validator Challenge:';
+export const VALIDATOR_AUTH_FULL_CHALLENGE_ENCODED_LENGTH =
+  VALIDATOR_AUTH_DOMAIN_SEPARATOR.length + Fr.random().toString().length;
+
+/*
+ * P2P Auth Message
+ * Superset of the StatusMessage, used to establish a handshake between peers and authenticate them.
+ */
+export class AuthRequest {
+  constructor(
+    readonly status: StatusMessage,
+    readonly challenge: Fr,
+  ) {}
+
+  /**
+   * Deserializes the AuthRequest object from a Buffer.
+   * @param buffer - Buffer or BufferReader object to deserialize.
+   * @returns An instance of StatusMessage.
+   */
+  static fromBuffer(buffer: Buffer | BufferReader): AuthRequest {
+    const reader = BufferReader.asReader(buffer);
+    return new AuthRequest(
+      StatusMessage.fromBuffer(reader), // Deserialize StatusMessage
+      Fr.fromBuffer(reader), // challenge
+    );
+  }
+
+  /**
+   * Serializes the AuthRequest object into a Buffer.
+   * @returns Buffer representation of the StatusMessage object.
+   */
+  toBuffer() {
+    return serializeToBuffer([this.status, this.challenge]);
+  }
+
+  getPayloadToSign(): Buffer32 {
+    const fullChallenge = VALIDATOR_AUTH_DOMAIN_SEPARATOR + this.challenge.toString();
+    return Buffer32.fromBuffer(keccak256(Buffer.from(fullChallenge, 'utf-8')));
+  }
+
+  static random(): AuthRequest {
+    return new AuthRequest(StatusMessage.random(), Fr.random());
+  }
+}
+
+export class AuthResponse {
+  constructor(
+    readonly status: StatusMessage,
+    readonly signature: Signature,
+  ) {}
+  /**
+   * Deserializes the AuthResponse object from a Buffer.
+   * @param buffer - Buffer or BufferReader object to deserialize.
+   * @returns An instance of StatusMessage.
+   */
+  static fromBuffer(buffer: Buffer | BufferReader): AuthResponse {
+    const reader = BufferReader.asReader(buffer);
+    return new AuthResponse(
+      StatusMessage.fromBuffer(reader), // Deserialize StatusMessage
+      Signature.fromBuffer(reader), // response
+    );
+  }
+
+  /**
+   * Serializes the AuthRequest object into a Buffer.
+   * @returns Buffer representation of the StatusMessage object.
+   */
+  toBuffer() {
+    return serializeToBuffer([this.status, this.signature]);
+  }
+
+  static random(): AuthResponse {
+    return new AuthResponse(StatusMessage.random(), Signature.random());
+  }
+}