@aztec/stdlib 5.0.0-rc.2 → 5.0.0

package/src/kernel/hints/find_private_kernel_reset_dimensions.ts

@@ -1,8 +1,7 @@
-import { isDefined } from '@aztec/foundation/types';
-
 import {
   PrivateKernelResetDimensions,
   type PrivateKernelResetDimensionsConfig,
+  type ResetCatalogEntry,
   privateKernelResetDimensionNames,
 } from '../private_kernel_reset_dimensions.js';
 
@@ -12,13 +11,6 @@ interface DimensionOption {
   remainder?: PrivateKernelResetDimensions;
 }
 
-function computeCost(dimensions: PrivateKernelResetDimensions, config: PrivateKernelResetDimensionsConfig) {
-  return privateKernelResetDimensionNames.reduce(
-    (accum, name) => accum + dimensions[name] * config.dimensions[name].cost,
-    0,
-  );
-}
-
 function getSize(dimensions: PrivateKernelResetDimensions) {
   return privateKernelResetDimensionNames.reduce((accum, name) => accum + dimensions[name], 0);
 }
@@ -38,124 +30,42 @@ function getRemainder(
   return remainingDimensions ? remainder : undefined;
 }
 
-function pickFromValues(targetValue: number, values: number[]) {
-  // Find the min value in `values` that's greater than or equal to `targetValue`.
-  const minGte = values.reduce(
-    (prev: number | undefined, curr) => (curr >= targetValue && (prev === undefined || curr < prev) ? curr : prev),
-    undefined,
-  );
-
-  // If no such value is found, returns the max value.
-  return minGte ?? Math.max(...values);
-}
-
-function pickCheapest(options: DimensionOption[]) {
-  return options.reduce((prev, curr) => (curr.cost < prev.cost ? curr : prev), options[0]);
-}
-
-function pickSmallestRemainder(options: DimensionOption[]) {
-  const optionsWithSize = options
-    .filter(o => o.remainder)
-    .map(option => ({ option, size: getSize(option.remainder!) }));
-  return optionsWithSize.reduce((prev, curr) => (curr.size < prev.size ? curr : prev), optionsWithSize[0])?.option;
-}
-
-function pickBestOption(options: DimensionOption[]) {
-  const optionsResetAll = options.filter(opt => !opt.remainder);
-  const optionsResetPartial = options.filter(opt => opt.remainder);
-  // The best option is the cheapest one that can reset all dimensions.
-  // If no such option exists, find one that can reset the most data.
-  return pickCheapest(optionsResetAll) || pickSmallestRemainder(optionsResetPartial);
-}
-
-function findVariant(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const variant = PrivateKernelResetDimensions.empty();
-  privateKernelResetDimensionNames.forEach(name => {
-    variant[name] = pickFromValues(requestedDimensions[name], config.dimensions[name].variants);
-  });
-  if (!isQualified(variant)) {
-    return;
+// Returns the cheapest option that fully covers the request, or the option with the smallest
+// remainder if none do. Caller must pass a non-empty list.
+function pickBestOption(options: DimensionOption[]): DimensionOption {
+  const fullCoverage = options.filter(opt => !opt.remainder);
+  if (fullCoverage.length) {
+    return fullCoverage.reduce((prev, curr) => (curr.cost < prev.cost ? curr : prev));
   }
-
-  return {
-    dimensions: variant,
-    cost: computeCost(variant, config),
-    remainder: getRemainder(requestedDimensions, variant),
-  };
+  return options.reduce((prev, curr) => (getSize(curr.remainder!) < getSize(prev.remainder!) ? curr : prev));
 }
 
-function findStandalone(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const needsReset = privateKernelResetDimensionNames.filter(name => requestedDimensions[name] > 0);
-  if (needsReset.length !== 1) {
-    // At the moment, we only use standalone to reset one dimension when it's about to overflow.
-    return;
-  }
-
-  const name = needsReset[0];
-  const value = pickFromValues(requestedDimensions[name], config.dimensions[name].standalone);
-  if (!value) {
-    return;
-  }
-
-  const dimensions = PrivateKernelResetDimensions.from({ [name]: value });
-  if (!isQualified(dimensions)) {
-    return;
-  }
-
+function buildOption(entry: ResetCatalogEntry, requestedDimensions: PrivateKernelResetDimensions): DimensionOption {
+  const dimensions = PrivateKernelResetDimensions.fromValues(entry.dimensions);
   return {
     dimensions,
-    cost: computeCost(dimensions, config),
+    cost: entry.cost,
     remainder: getRemainder(requestedDimensions, dimensions),
   };
 }
 
-function findSpecialCase(
-  requestedDimensions: PrivateKernelResetDimensions,
-  config: PrivateKernelResetDimensionsConfig,
-  isQualified: (dimensions: PrivateKernelResetDimensions) => boolean,
-): DimensionOption | undefined {
-  const specialCases = config.specialCases.map(PrivateKernelResetDimensions.fromValues);
-  const options = specialCases.filter(isQualified).map(dimensions => ({
-    dimensions,
-    cost: computeCost(dimensions, config),
-    remainder: getRemainder(requestedDimensions, dimensions),
-  }));
-  return pickBestOption(options);
-}
+/**
+ * Picks which catalog group the selector should search. Mid-tx resets go to `inner` (no
+ * siloing); terminal kernels go to `finalTail` or `finalTailToPublic`, depending on whether
+ * the tx has public function calls.
+ */
+export type ResetDimensionsMode = 'inner' | 'finalTail' | 'finalTailToPublic';
 
 export function findPrivateKernelResetDimensions(
   requestedDimensions: PrivateKernelResetDimensions,
   config: PrivateKernelResetDimensionsConfig,
-  isInner = false,
+  mode: ResetDimensionsMode,
   allowRemainder = false,
 ) {
-  const requestedValues = requestedDimensions.toValues();
-  const isEnough = allowRemainder
-    ? () => true
-    : (dimensions: PrivateKernelResetDimensions) => dimensions.toValues().every((v, i) => v >= requestedValues[i]);
-
-  const isQualified = !isInner
-    ? isEnough
-    : // If isInner is true, it's a reset to prevent overflow. The following must be zero because siloing can't be done at the moment.
-      (dimensions: PrivateKernelResetDimensions) =>
-        dimensions.NOTE_HASH_SILOING === 0 &&
-        dimensions.NULLIFIER_SILOING === 0 &&
-        dimensions.PRIVATE_LOG_SILOING === 0 &&
-        isEnough(dimensions);
-
-  const options = [
-    findVariant(requestedDimensions, config, isQualified),
-    findStandalone(requestedDimensions, config, isQualified),
-    findSpecialCase(requestedDimensions, config, isQualified),
-  ].filter(isDefined);
+  const catalog = config[mode];
+  const options = catalog
+    .map(entry => buildOption(entry, requestedDimensions))
+    .filter(option => allowRemainder || !option.remainder);
 
   if (!options.length) {
     throw new Error(`Cannot find an option for dimension: ${requestedDimensions.toValues()}`);

package/src/kernel/index.ts

@@ -14,7 +14,7 @@ export * from './private_kernel_inner_2_circuit_private_inputs.js';
 export * from './private_kernel_inner_3_circuit_private_inputs.js';
 export * from './private_kernel_reset_circuit_private_inputs.js';
 export * from './private_kernel_reset_dimensions.js';
-export * from './private_kernel_tail_circuit_private_inputs.js';
+export * from './private_kernel_reset_tail_circuit_private_inputs.js';
 export * from './private_kernel_tail_circuit_public_inputs.js';
 export * from './private_to_avm_accumulated_data.js';
 export * from './private_to_public_accumulated_data.js';

package/src/kernel/private_circuit_public_inputs.ts

@@ -144,6 +144,11 @@ export class PrivateCircuitPublicInputs {
      * Hash of the contract class logs emitted in this function call.
      */
     public contractClassLogsHashes: ClaimedLengthArray<CountedLogHash, typeof MAX_CONTRACT_CLASS_LOGS_PER_CALL>,
+    /**
+     * The tx request's salt. Keeps `tx_request.hash()` (the protocol nullifier) unpredictable, and lets the init
+     * kernel bind this proof to a specific tx request (it asserts this equals `tx_request.salt`).
+     */
+    public txRequestSalt: Fr,
   ) {}
 
   /**
@@ -188,6 +193,7 @@ export class PrivateCircuitPublicInputs {
       reader.readObject(ClaimedLengthArrayFromBuffer(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromBuffer(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromBuffer(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL)),
+      reader.readObject(Fr),
     );
   }
 
@@ -219,6 +225,7 @@ export class PrivateCircuitPublicInputs {
       reader.readObject(ClaimedLengthArrayFromFields(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromFields(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL)),
       reader.readObject(ClaimedLengthArrayFromFields(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL)),
+      reader.readField(),
     );
   }
 
@@ -251,6 +258,7 @@ export class PrivateCircuitPublicInputs {
       ClaimedLengthArray.empty(CountedL2ToL1Message, MAX_L2_TO_L1_MSGS_PER_CALL),
       ClaimedLengthArray.empty(PrivateLogData, MAX_PRIVATE_LOGS_PER_CALL),
       ClaimedLengthArray.empty(CountedLogHash, MAX_CONTRACT_CLASS_LOGS_PER_CALL),
+      Fr.ZERO,
     );
   }
 
@@ -278,7 +286,8 @@ export class PrivateCircuitPublicInputs {
       this.nullifiers.isEmpty() &&
       this.l2ToL1Msgs.isEmpty() &&
       this.privateLogs.isEmpty() &&
-      this.contractClassLogsHashes.isEmpty()
+      this.contractClassLogsHashes.isEmpty() &&
+      this.txRequestSalt.isZero()
     );
   }
 
@@ -312,6 +321,7 @@ export class PrivateCircuitPublicInputs {
       fields.l2ToL1Msgs,
       fields.privateLogs,
       fields.contractClassLogsHashes,
+      fields.txRequestSalt,
     ] as const;
   }
 
@@ -346,6 +356,7 @@ export class PrivateCircuitPublicInputs {
       this.l2ToL1Msgs,
       this.privateLogs,
       this.contractClassLogsHashes,
+      this.txRequestSalt,
     ]);
   }
 

package/src/kernel/private_context_inputs.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/curves/bn254';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import { serializeToFields } from '@aztec/foundation/serialize';
 
 import { BlockHeader } from '../tx/block_header.js';
@@ -11,13 +11,20 @@ export class PrivateContextInputs {
     public anchorBlockHeader: BlockHeader,
     public txContext: TxContext,
     public startSideEffectCounter: number,
+    public txRequestSalt: Fr,
   ) {}
 
   public static empty(): PrivateContextInputs {
-    return new PrivateContextInputs(CallContext.empty(), BlockHeader.empty(), TxContext.empty(), 0);
+    return new PrivateContextInputs(CallContext.empty(), BlockHeader.empty(), TxContext.empty(), 0, Fr.ZERO);
   }
 
   public toFields(): Fr[] {
-    return serializeToFields([this.callContext, this.anchorBlockHeader, this.txContext, this.startSideEffectCounter]);
+    return serializeToFields([
+      this.callContext,
+      this.anchorBlockHeader,
+      this.txContext,
+      this.startSideEffectCounter,
+      this.txRequestSalt,
+    ]);
   }
 }

package/src/kernel/private_kernel_circuit_public_inputs.ts

@@ -115,3 +115,12 @@ export class PrivateKernelCircuitPublicInputs {
     );
   }
 }
+
+/**
+ * Returns true iff the tx requires the public-bound terminal path: it has either un-processed
+ * public-call requests in the side-effect stream or a pending public-teardown call request. Every
+ * site picking between the rollup-bound and public-bound terminal artifact must route through this.
+ */
+export function kernelStateIsForPublic(publicInputs: PrivateKernelCircuitPublicInputs): boolean {
+  return publicInputs.end.publicCallRequests.claimedLength > 0 || !publicInputs.publicTeardownCallRequest.isEmpty();
+}

package/src/kernel/private_kernel_init_2_circuit_private_inputs.ts

@@ -17,7 +17,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
     public privateCall0: PrivateCallData,
     public privateCall1: PrivateCallData,
     public isPrivateOnly: boolean,
-    public firstNullifierHint: Fr,
     public revertibleCounterHint: number,
   ) {}
 
@@ -28,7 +27,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
       this.protocolContracts,
       this.privateCall0,
       this.privateCall1,
-      this.firstNullifierHint,
       this.revertibleCounterHint,
     );
   }
@@ -42,7 +40,6 @@ export class PrivateKernelInit2CircuitPrivateInputs {
       reader.readObject(PrivateCallData),
       reader.readObject(PrivateCallData),
       reader.readBoolean(),
-      Fr.fromBuffer(reader),
       reader.readNumber(),
     );
   }

package/src/kernel/private_kernel_init_3_circuit_private_inputs.ts

@@ -18,7 +18,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
     public privateCall1: PrivateCallData,
     public privateCall2: PrivateCallData,
     public isPrivateOnly: boolean,
-    public firstNullifierHint: Fr,
     public revertibleCounterHint: number,
   ) {}
 
@@ -30,7 +29,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
       this.privateCall0,
       this.privateCall1,
       this.privateCall2,
-      this.firstNullifierHint,
       this.revertibleCounterHint,
     );
   }
@@ -45,7 +43,6 @@ export class PrivateKernelInit3CircuitPrivateInputs {
       reader.readObject(PrivateCallData),
       reader.readObject(PrivateCallData),
       reader.readBoolean(),
-      Fr.fromBuffer(reader),
       reader.readNumber(),
     );
   }

package/src/kernel/private_kernel_init_circuit_private_inputs.ts

@@ -30,10 +30,6 @@ export class PrivateKernelInitCircuitPrivateInputs {
      * Wether this tx will make public calls or not.
      */
     public isPrivateOnly: boolean,
-    /**
-     * A hint to what will be the first nullifier of the transaction, used for nonce generation.
-     */
-    public firstNullifierHint: Fr,
     /**
      * A claim to the final min revertible side effect counter of a tx.
      */
@@ -50,7 +46,6 @@ export class PrivateKernelInitCircuitPrivateInputs {
       this.vkTreeRoot,
       this.protocolContracts,
       this.privateCall,
-      this.firstNullifierHint,
       this.revertibleCounterHint,
     );
   }
@@ -68,7 +63,6 @@ export class PrivateKernelInitCircuitPrivateInputs {
       reader.readObject(ProtocolContracts),
       reader.readObject(PrivateCallData),
       reader.readBoolean(),
-      Fr.fromBuffer(reader),
       reader.readNumber(),
     );
   }

package/src/kernel/private_kernel_reset_dimensions.ts

@@ -68,14 +68,24 @@ export const privateKernelResetDimensionNames: DimensionName[] = [
   'PRIVATE_LOG_SILOING',
 ];
 
-export interface DimensionConfig {
-  variants: number[];
-  standalone: number[];
+export interface ResetCatalogEntry {
+  name: string;
+  dimensions: number[];
+  // Measured gate count (circuit_size) of the compiled variant. Used by the selector to pick the
+  // cheapest variant that covers the requested dimensions, e.g. if the required dimensions are
+  // `6 - 2 - 2` then a variant with capacity `8 - 2 - 2` might be cheaper than one with capacity
+  // `6 - 4 - 4`.
   cost: number;
 }
 
 // Must match the config in noir-projects/noir-protocol-circuits/private_kernel_reset_config.json
 export interface PrivateKernelResetDimensionsConfig {
-  dimensions: { [K in DimensionName]: DimensionConfig };
-  specialCases: number[][];
+  // Variants used for mid-tx resets that prevent overflow. Never the last kernel in the chain.
+  inner: ResetCatalogEntry[];
+  // Variants used as the terminal kernel for the rollup-bound private-only path. Each runs
+  // final-reset siloing and tail finalisation in one proof.
+  finalTail: ResetCatalogEntry[];
+  // Terminal variants for the public-bound path (transactions with public function calls). Runs
+  // final-reset siloing and tail-to-public partitioning by revertibility in one proof.
+  finalTailToPublic: ResetCatalogEntry[];
 }

package/src/kernel/private_kernel_reset_tail_circuit_private_inputs.ts

@@ -0,0 +1,69 @@
+import type {
+  MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+  MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+  MAX_NULLIFIERS_PER_TX,
+  MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+} from '@aztec/constants';
+import { bigintToUInt64BE, serializeToBuffer } from '@aztec/foundation/serialize';
+
+import type { UInt64 } from '../types/shared.js';
+import type { PrivateKernelResetHints } from './hints/private_kernel_reset_hints.js';
+import type { PaddedSideEffectAmounts, PaddedSideEffects } from './padded_side_effects.js';
+import { kernelStateIsForPublic } from './private_kernel_circuit_public_inputs.js';
+import type { PrivateKernelData } from './private_kernel_data.js';
+import { PrivateKernelResetCircuitPrivateInputsVariants } from './private_kernel_reset_circuit_private_inputs.js';
+import type { PrivateKernelResetDimensions } from './private_kernel_reset_dimensions.js';
+
+/**
+ * Input to a terminal reset+tail circuit. `isForPublic()` selects the rollup-bound (`reset_tail`)
+ * or public-bound (`reset_tail_to_public`) family.
+ */
+export class PrivateKernelResetTailCircuitPrivateInputs {
+  constructor(
+    public previousKernel: PrivateKernelData,
+    public paddedSideEffects: PaddedSideEffects,
+    public hints: PrivateKernelResetHints<
+      typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+      typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+      typeof MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIERS_PER_TX
+    >,
+    public dimensions: PrivateKernelResetDimensions,
+    public paddedSideEffectAmounts: PaddedSideEffectAmounts,
+    public expirationTimestampUpperBound: UInt64,
+  ) {}
+
+  isForPublic() {
+    return kernelStateIsForPublic(this.previousKernel.publicInputs);
+  }
+
+  /**
+   * Returns a dimension-trimmed view of the reset portion of these inputs (without the tail
+   * fields). The prover uses this to feed witness generation of the variant matching the chosen
+   * dimensions.
+   */
+  trimResetToSizes() {
+    const hints = this.hints.trimToSizes(
+      this.dimensions.NOTE_HASH_PENDING_READ,
+      this.dimensions.NOTE_HASH_SETTLED_READ,
+      this.dimensions.NULLIFIER_PENDING_READ,
+      this.dimensions.NULLIFIER_SETTLED_READ,
+      this.dimensions.KEY_VALIDATION,
+      this.dimensions.TRANSIENT_DATA_SQUASHING,
+    );
+    return new PrivateKernelResetCircuitPrivateInputsVariants(this.previousKernel, this.paddedSideEffects, hints);
+  }
+
+  toBuffer() {
+    return serializeToBuffer(
+      this.previousKernel,
+      this.paddedSideEffects,
+      this.hints,
+      this.dimensions,
+      this.paddedSideEffectAmounts,
+      bigintToUInt64BE(this.expirationTimestampUpperBound),
+    );
+  }
+}

package/src/keys/derivation.ts

@@ -1,4 +1,4 @@
-import { DEFAULT_FBPK_M_HASH, DEFAULT_MSPK_M_HASH, DomainSeparator } from '@aztec/constants';
+import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha512ToGrumpkinScalar } from '@aztec/foundation/crypto/sha512';
@@ -11,8 +11,11 @@ import { PublicKey, hashPublicKey } from './public_key.js';
 import { PublicKeys } from './public_keys.js';
 import { getKeyGenerator } from './utils.js';
 
-export function computeAppNullifierHidingKey(masterNullifierHidingKey: GrumpkinScalar, app: AztecAddress): Promise<Fr> {
-  return computeAppSecretKey(masterNullifierHidingKey, app, 'n'); // 'n' is the key prefix for nullifier hiding key
+export function computeAppNullifierHidingKey(
+  masterNullifierHidingSecretKey: GrumpkinScalar,
+  app: AztecAddress,
+): Promise<Fr> {
+  return computeAppSecretKey(masterNullifierHidingSecretKey, app, 'n'); // 'n' is the key prefix for nullifier hiding key
 }
 
 export function computeAppSecretKey(skM: GrumpkinScalar, app: AztecAddress, keyPrefix: KeyPrefix): Promise<Fr> {
@@ -27,7 +30,7 @@ export async function computeOvskApp(ovsk: GrumpkinScalar, app: AztecAddress): P
   return GrumpkinScalar.fromBuffer(ovskAppFr.toBuffer());
 }
 
-export function deriveMasterNullifierHidingKey(secretKey: Fr): GrumpkinScalar {
+export function deriveMasterNullifierHidingSecretKey(secretKey: Fr): GrumpkinScalar {
   return sha512ToGrumpkinScalar([secretKey, DomainSeparator.NHK_M]);
 }
 
@@ -39,9 +42,12 @@ export function deriveMasterOutgoingViewingSecretKey(secretKey: Fr): GrumpkinSca
   return sha512ToGrumpkinScalar([secretKey, DomainSeparator.OVSK_M]);
 }
 
-export function deriveSigningKey(secretKey: Fr): GrumpkinScalar {
-  // TODO(#5837): come up with a standard signing key derivation scheme instead of using ivsk_m as signing keys here
-  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.IVSK_M]);
+export function deriveMasterMessageSigningSecretKey(secretKey: Fr): GrumpkinScalar {
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.MSSK_M]);
+}
+
+export function deriveMasterFallbackSecretKey(secretKey: Fr): GrumpkinScalar {
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.FBSK_M]);
 }
 
 export function computePreaddress(publicKeysHash: Fr, partialAddress: Fr) {
@@ -85,52 +91,91 @@ export async function computeAddressSecret(preaddress: Fr, ivsk: Fq) {
 }
 
 export function derivePublicKeyFromSecretKey(secretKey: Fq): Promise<PublicKey> {
+  // 0 * G is the point at infinity. The WASM encodes infinity with an out-of-field x coordinate that Point cannot
+  // deserialize, so return the point directly instead of calling into it.
+  if (secretKey.isZero()) {
+    return Promise.resolve(PublicKey.INFINITY);
+  }
   return Grumpkin.mul(Grumpkin.generator, secretKey);
 }
 
+/**
+ * The six master secret keys that fully define an account's privacy keys.
+ */
+export type MasterSecretKeys = {
+  masterNullifierHidingSecretKey: GrumpkinScalar;
+  masterIncomingViewingSecretKey: GrumpkinScalar;
+  masterOutgoingViewingSecretKey: GrumpkinScalar;
+  masterTaggingSecretKey: GrumpkinScalar;
+  masterMessageSigningSecretKey: GrumpkinScalar;
+  masterFallbackSecretKey: GrumpkinScalar;
+};
+
 /**
  * Computes secret and public keys and public keys hash from a secret key.
  * @param secretKey - The secret key to derive keys from.
  * @returns The derived keys.
  */
-export async function deriveKeys(secretKey: Fr) {
+export function deriveKeys(secretKey: Fr) {
   // First we derive master secret/hiding keys -  we use sha512 here because this derivation will never take place
   // in a circuit
-  const masterNullifierHidingKey = deriveMasterNullifierHidingKey(secretKey);
-  const masterIncomingViewingSecretKey = deriveMasterIncomingViewingSecretKey(secretKey);
-  const masterOutgoingViewingSecretKey = deriveMasterOutgoingViewingSecretKey(secretKey);
-  const masterTaggingSecretKey = sha512ToGrumpkinScalar([secretKey, DomainSeparator.TSK_M]);
+  return deriveKeysFromMasterSecretKeys({
+    masterNullifierHidingSecretKey: deriveMasterNullifierHidingSecretKey(secretKey),
+    masterIncomingViewingSecretKey: deriveMasterIncomingViewingSecretKey(secretKey),
+    masterOutgoingViewingSecretKey: deriveMasterOutgoingViewingSecretKey(secretKey),
+    masterTaggingSecretKey: sha512ToGrumpkinScalar([secretKey, DomainSeparator.TSK_M]),
+    masterMessageSigningSecretKey: deriveMasterMessageSigningSecretKey(secretKey),
+    masterFallbackSecretKey: deriveMasterFallbackSecretKey(secretKey),
+  });
+}
 
-  // Then we derive master public keys
-  const masterNullifierPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingKey);
+/**
+ * Derives the master public keys and the {@link PublicKeys} struct from a set of master secret keys.
+ * @param secretKeys - The master secret keys to derive public keys from.
+ * @returns The provided secret keys alongside the derived public keys.
+ */
+export async function deriveKeysFromMasterSecretKeys(secretKeys: MasterSecretKeys) {
+  const {
+    masterNullifierHidingSecretKey,
+    masterIncomingViewingSecretKey,
+    masterOutgoingViewingSecretKey,
+    masterTaggingSecretKey,
+    masterMessageSigningSecretKey,
+    masterFallbackSecretKey,
+  } = secretKeys;
+
+  const masterNullifierHidingPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingSecretKey);
   const masterIncomingViewingPublicKey = await derivePublicKeyFromSecretKey(masterIncomingViewingSecretKey);
   const masterOutgoingViewingPublicKey = await derivePublicKeyFromSecretKey(masterOutgoingViewingSecretKey);
   const masterTaggingPublicKey = await derivePublicKeyFromSecretKey(masterTaggingSecretKey);
+  const masterMessageSigningPublicKey = await derivePublicKeyFromSecretKey(masterMessageSigningSecretKey);
+  const masterFallbackPublicKey = await derivePublicKeyFromSecretKey(masterFallbackSecretKey);
 
   // The non-owner-visible PublicKeys carries hashes for npk/ovpk/tpk/mspk/fbpk and the raw
-  // point only for ivpk_m. The npk/ovpk/tpk raw points are also returned alongside so the key
-  // store can persist them under `${account}-{n|ov|t}pk_m` (only their hashes live in publicKeys).
+  // point only for ivpk_m. The npk/ovpk/tpk/mspk/fbpk raw points are also returned alongside so the key
+  // store can persist them under `${account}-{n|ov|t|ms|fb}pk_m` (only their hashes live in publicKeys).
   // The ivpk_m point isn't returned separately because it already lives in publicKeys.ivpkM.
-  //
-  // TODO: There isn't a derivation path for the message signing(msk) and fallback(fbk) keys yet. So we just use the the
-  // default values for now.
   const publicKeys = new PublicKeys(
-    await hashPublicKey(masterNullifierPublicKey),
+    await hashPublicKey(masterNullifierHidingPublicKey),
     masterIncomingViewingPublicKey,
     await hashPublicKey(masterOutgoingViewingPublicKey),
     await hashPublicKey(masterTaggingPublicKey),
-    new Fr(DEFAULT_MSPK_M_HASH),
-    new Fr(DEFAULT_FBPK_M_HASH),
+    await hashPublicKey(masterMessageSigningPublicKey),
+    await hashPublicKey(masterFallbackPublicKey),
   );
 
   return {
-    masterNullifierHidingKey,
+    masterNullifierHidingSecretKey,
     masterIncomingViewingSecretKey,
     masterOutgoingViewingSecretKey,
     masterTaggingSecretKey,
-    masterNullifierPublicKey,
+    masterMessageSigningSecretKey,
+    masterFallbackSecretKey,
+    masterNullifierHidingPublicKey,
     masterOutgoingViewingPublicKey,
     masterTaggingPublicKey,
+    masterMessageSigningPublicKey,
+    masterFallbackPublicKey,
     publicKeys,
   };
 }