@reclaimprotocol/attestor-core 4.0.3 → 5.0.1-beta.2

package/lib/server/utils/tee-oprf-verification.js

@@ -0,0 +1,151 @@
+import bs58 from "bs58";
+import { AttestorError } from "../../utils/error.js";
+import { makeDefaultOPRFOperator } from "../../utils/zk.js";
+async function verifyOprfProofs(bundleData, logger) {
+  if (!bundleData.oprfVerifications || bundleData.oprfVerifications.length === 0) {
+    logger.debug("No OPRF verifications present in bundle");
+    return [];
+  }
+  const { tOutputPayload } = bundleData;
+  const consolidatedCiphertext = tOutputPayload.consolidatedResponseCiphertext;
+  if (!consolidatedCiphertext || consolidatedCiphertext.length === 0) {
+    throw new AttestorError("ERROR_INVALID_CLAIM", "No consolidated ciphertext for OPRF verification");
+  }
+  const results = [];
+  logger.info(`Verifying ${bundleData.oprfVerifications.length} OPRF proofs`);
+  for (const [idx, oprfData] of bundleData.oprfVerifications.entries()) {
+    try {
+      const result = await verifySingleOprfProof(
+        oprfData,
+        consolidatedCiphertext,
+        idx,
+        logger
+      );
+      results.push(result);
+    } catch (error) {
+      logger.error({ error, index: idx }, "OPRF proof verification failed");
+      throw new AttestorError(
+        "ERROR_INVALID_CLAIM",
+        `OPRF verification failed at index ${idx}: ${error.message}`
+      );
+    }
+  }
+  logger.info(`Successfully verified ${results.length} OPRF proofs`);
+  return results;
+}
+async function verifySingleOprfProof(oprfData, consolidatedCiphertext, index, logger) {
+  const publicSignalsJson = JSON.parse(new TextDecoder().decode(oprfData.publicSignalsJson));
+  const { proof, publicSignals, cipher } = publicSignalsJson;
+  if (!proof || !publicSignals) {
+    throw new Error("Missing proof or public signals in OPRF data");
+  }
+  const ciphertextChunk = consolidatedCiphertext.slice(
+    oprfData.streamPos,
+    oprfData.streamPos + oprfData.streamLength
+  );
+  const completePublicSignals = {
+    out: publicSignals.out || Uint8Array.from([]),
+    // Replace null input with extracted ciphertext
+    in: ciphertextChunk,
+    // Convert base64 nonces and counters
+    noncesAndCounters: publicSignals.blocks?.map((block) => ({
+      nonce: Buffer.from(block.nonce || "", "base64"),
+      counter: block.counter || 0,
+      boundary: block.boundary || ""
+    })) || [],
+    // Process TOPRF data
+    toprf: publicSignals.toprf ? {
+      ...publicSignals.toprf,
+      // Convert domain separator from base64
+      domainSeparator: publicSignals.toprf.domainSeparator ? Buffer.from(publicSignals.toprf.domainSeparator, "base64").toString("utf8") : "reclaim",
+      // Convert output from base64
+      output: publicSignals.toprf.output ? Buffer.from(publicSignals.toprf.output, "base64") : new Uint8Array(),
+      // Convert response fields from base64
+      responses: publicSignals.toprf.responses?.map((resp) => ({
+        publicKeyShare: Buffer.from(resp.publicKeyShare || "", "base64"),
+        evaluated: Buffer.from(resp.evaluated || "", "base64"),
+        c: Buffer.from(resp.c || "", "base64"),
+        r: Buffer.from(resp.r || "", "base64")
+      })) || [],
+      // Locations are already in correct format
+      locations: publicSignals.toprf.locations || []
+    } : void 0
+  };
+  const algorithm = cipher.replace("-toprf", "");
+  const zkEngine = "gnark";
+  const oprfOperator = makeDefaultOPRFOperator(algorithm, zkEngine, logger);
+  const proofBytes = Buffer.from(proof, "base64");
+  const isValid = await oprfOperator.groth16Verify(
+    completePublicSignals,
+    proofBytes,
+    logger
+  );
+  if (!isValid) {
+    throw new Error("OPRF proof verification failed");
+  }
+  logger.debug(`OPRF ${index}: Proof verified successfully`);
+  const oprfOutput = completePublicSignals.toprf?.output;
+  if (!oprfOutput || oprfOutput.length === 0) {
+    throw new Error("No OPRF output found in verified proof");
+  }
+  const oprfLocation = completePublicSignals.toprf?.locations?.[0];
+  if (!oprfLocation) {
+    throw new Error("No OPRF location found in public signals");
+  }
+  logger.info(`OPRF #${index}: streamPos=${oprfData.streamPos}, locationPos=${oprfLocation.pos}, finalPos=${oprfData.streamPos + oprfLocation.pos}, len=${oprfLocation.len}`);
+  return {
+    // The position in the plaintext where to replace (stream position + OPRF location within chunk)
+    position: oprfData.streamPos + oprfLocation.pos,
+    length: oprfLocation.len,
+    output: oprfOutput
+  };
+}
+function replaceOprfRanges(plaintext, oprfResults, logger) {
+  if (oprfResults.length === 0) {
+    return plaintext;
+  }
+  const replacements = oprfResults.map((result) => {
+    let outputBytes;
+    let encodedOutput;
+    if (result.isMPC) {
+      encodedOutput = bs58.encode(result.output);
+      outputBytes = new TextEncoder().encode(encodedOutput);
+    } else {
+      encodedOutput = Buffer.from(result.output).toString("base64");
+      const truncated = encodedOutput.substring(0, result.length);
+      outputBytes = new TextEncoder().encode(truncated);
+    }
+    return { result, outputBytes, encodedOutput };
+  });
+  replacements.sort((a, b) => a.result.position - b.result.position);
+  let newSize = plaintext.length;
+  for (const { result, outputBytes } of replacements) {
+    const sizeDiff = outputBytes.length - result.length;
+    newSize += sizeDiff;
+  }
+  logger.info(`Transcript size: ${plaintext.length} -> ${newSize} (${newSize - plaintext.length >= 0 ? "+" : ""}${newSize - plaintext.length} bytes)`);
+  const newPlaintext = new Uint8Array(newSize);
+  let srcPos = 0;
+  let dstPos = 0;
+  for (const [idx, { result, outputBytes, encodedOutput }] of replacements.entries()) {
+    const segmentLength = result.position - srcPos;
+    if (segmentLength > 0) {
+      newPlaintext.set(plaintext.slice(srcPos, result.position), dstPos);
+      dstPos += segmentLength;
+    }
+    const currentContent = plaintext.slice(result.position, result.position + result.length);
+    logger.info(`OPRF #${idx} at pos ${result.position}: "${Buffer.from(currentContent).toString("utf8")}" (${result.length}b) -> "${encodedOutput}" (${outputBytes.length}b)${result.isMPC ? " [MPC/base58]" : ""}`);
+    newPlaintext.set(outputBytes, dstPos);
+    dstPos += outputBytes.length;
+    srcPos = result.position + result.length;
+  }
+  if (srcPos < plaintext.length) {
+    newPlaintext.set(plaintext.slice(srcPos), dstPos);
+  }
+  logger.info(`Replaced ${oprfResults.length} OPRF ranges in plaintext`);
+  return newPlaintext;
+}
+export {
+  replaceOprfRanges,
+  verifyOprfProofs
+};

package/lib/server/utils/tee-transcript-reconstruction.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TLS Transcript Reconstruction from TEE data
+ */
+import type { CertificateInfo } from '#src/proto/tee-bundle.ts';
+import type { TeeBundleData } from '#src/server/utils/tee-verification.ts';
+import type { Logger } from '#src/types/general.ts';
+export interface TeeTranscriptData {
+    revealedRequest: Uint8Array;
+    reconstructedResponse: Uint8Array;
+    certificateInfo?: CertificateInfo;
+    responseTrimOffset?: number;
+}
+/**
+ * Reconstructs TLS transcript from TEE bundle data
+ * @param bundleData - Validated TEE bundle data
+ * @param logger - Logger instance
+ * @param oprfResults - Optional OPRF results to apply during reconstruction
+ * @returns Reconstructed transcript data
+ */
+export declare function reconstructTlsTranscript(bundleData: TeeBundleData, logger: Logger, oprfResults?: Array<{
+    position: number;
+    length: number;
+    output: Uint8Array;
+}>): Promise<TeeTranscriptData>;

package/lib/server/utils/tee-transcript-reconstruction.js

@@ -0,0 +1,140 @@
+import { AttestorError } from "../../utils/error.js";
+import { REDACTION_CHAR_CODE } from "../../utils/index.js";
+async function reconstructTlsTranscript(bundleData, logger, oprfResults) {
+  try {
+    const revealedRequest = reconstructRequest(bundleData, logger);
+    const reconstructedResponse = await reconstructConsolidatedResponse(bundleData, logger, oprfResults);
+    const certificateInfo = bundleData.kOutputPayload.certificateInfo;
+    logger.info("TLS transcript reconstruction completed successfully", {
+      requestSize: revealedRequest.length,
+      responseSize: reconstructedResponse.length,
+      hasCertificateInfo: !!certificateInfo
+    });
+    return {
+      revealedRequest,
+      reconstructedResponse,
+      certificateInfo
+    };
+  } catch (error) {
+    logger.error({ error }, "TLS transcript reconstruction failed");
+    throw new AttestorError("ERROR_INVALID_CLAIM", `Transcript reconstruction failed: ${error.message}`);
+  }
+}
+function reconstructRequest(bundleData, logger) {
+  const { kOutputPayload } = bundleData;
+  if (!kOutputPayload.requestRedactionRanges || kOutputPayload.requestRedactionRanges.length === 0) {
+    logger.warn("No request redaction ranges - using redacted request as-is");
+    return kOutputPayload.redactedRequest;
+  }
+  const revealedRequest = new Uint8Array(kOutputPayload.redactedRequest);
+  const prettyRequest = new Uint8Array(revealedRequest);
+  for (const range of kOutputPayload.requestRedactionRanges) {
+    if (!range.type.includes("proof")) {
+      const start = range.start;
+      const length = range.length;
+      for (let i = 0; i < length && start + i < prettyRequest.length; i++) {
+        prettyRequest[start + i] = REDACTION_CHAR_CODE;
+      }
+    }
+  }
+  return prettyRequest;
+}
+async function reconstructConsolidatedResponse(bundleData, logger, oprfResults) {
+  const { kOutputPayload, tOutputPayload } = bundleData;
+  const consolidatedKeystream = kOutputPayload.consolidatedResponseKeystream;
+  const consolidatedCiphertext = tOutputPayload.consolidatedResponseCiphertext;
+  if (!consolidatedKeystream || consolidatedKeystream.length === 0) {
+    throw new AttestorError("ERROR_INVALID_CLAIM", "No consolidated response keystream available");
+  }
+  if (!consolidatedCiphertext || consolidatedCiphertext.length === 0) {
+    throw new AttestorError("ERROR_INVALID_CLAIM", "No consolidated response ciphertext available");
+  }
+  if (consolidatedKeystream.length !== consolidatedCiphertext.length) {
+    logger.warn("Keystream and ciphertext length mismatch", {
+      keystreamLength: consolidatedKeystream.length,
+      ciphertextLength: consolidatedCiphertext.length
+    });
+  }
+  const minLength = Math.min(consolidatedKeystream.length, consolidatedCiphertext.length);
+  const reconstructedResponse = new Uint8Array(minLength);
+  for (let i = 0; i < minLength; i++) {
+    reconstructedResponse[i] = consolidatedKeystream[i] ^ consolidatedCiphertext[i];
+  }
+  logger.info(`Reconstructed response: ${reconstructedResponse.length} bytes, ${kOutputPayload.responseRedactionRanges?.length || 0} redaction ranges`);
+  let processedResponse = applyResponseRedactionRanges(reconstructedResponse, kOutputPayload.responseRedactionRanges, logger);
+  if (oprfResults && oprfResults.length > 0) {
+    logger.info(`Applying ${oprfResults.length} OPRF replacements before trimming`);
+    const { replaceOprfRanges } = await import("../../server/utils/tee-oprf-verification.js");
+    processedResponse = replaceOprfRanges(processedResponse, oprfResults, logger);
+  }
+  let leadingAsterisks = 0;
+  for (const element of processedResponse) {
+    if (element === REDACTION_CHAR_CODE) {
+      leadingAsterisks++;
+    } else {
+      break;
+    }
+  }
+  let trailingAsterisks = 0;
+  for (let i = processedResponse.length - 1; i >= leadingAsterisks; i--) {
+    if (processedResponse[i] === REDACTION_CHAR_CODE) {
+      trailingAsterisks++;
+    } else {
+      break;
+    }
+  }
+  const finalLength = processedResponse.length - leadingAsterisks - trailingAsterisks;
+  logger.info(`After processing: ${processedResponse.length} bytes, ${leadingAsterisks} leading and ${trailingAsterisks} trailing asterisks trimmed, final: ${finalLength} bytes`);
+  return processedResponse.slice(leadingAsterisks, processedResponse.length - trailingAsterisks);
+}
+function applyResponseRedactionRanges(response, redactionRanges, logger) {
+  if (!redactionRanges || redactionRanges.length === 0) {
+    return response;
+  }
+  const result = new Uint8Array(response);
+  const consolidatedRanges = consolidateRedactionRanges(redactionRanges);
+  if (logger) {
+    logger.info(`Applying ${consolidatedRanges.length} redaction ranges to ${response.length} byte response`);
+  }
+  for (const [idx, range] of consolidatedRanges.entries()) {
+    const rangeStart = range.start;
+    const rangeEnd = range.start + range.length;
+    if (rangeStart < 0 || rangeEnd > result.length) {
+      if (logger) {
+        logger.warn(`Redaction range #${idx} out of bounds: [${rangeStart}-${rangeEnd}] vs ${result.length}`);
+      }
+      continue;
+    }
+    if (logger && idx < 3) {
+      logger.info(`Redaction range #${idx}: [${rangeStart}-${rangeEnd}]`);
+    }
+    for (let i = rangeStart; i < rangeEnd; i++) {
+      result[i] = REDACTION_CHAR_CODE;
+    }
+  }
+  return result;
+}
+function consolidateRedactionRanges(ranges) {
+  if (ranges.length === 0) {
+    return [];
+  }
+  const sortedRanges = [...ranges].sort((a, b) => a.start - b.start);
+  const consolidated = [];
+  let current = { ...sortedRanges[0] };
+  for (let i = 1; i < sortedRanges.length; i++) {
+    const next = sortedRanges[i];
+    if (next.start <= current.start + current.length) {
+      const endCurrent = current.start + current.length;
+      const endNext = next.start + next.length;
+      current.length = Math.max(endCurrent, endNext) - current.start;
+    } else {
+      consolidated.push(current);
+      current = { ...next };
+    }
+  }
+  consolidated.push(current);
+  return consolidated;
+}
+export {
+  reconstructTlsTranscript
+};

package/lib/server/utils/tee-verification.d.ts

@@ -0,0 +1,28 @@
+/**
+ * TEE Bundle verification utilities
+ * Handles validation of TEE verification bundles including attestations and signatures
+ */
+import type { SignedMessage } from '#src/proto/tee-bundle.ts';
+import { KOutputPayload, TOutputPayload } from '#src/proto/tee-bundle.ts';
+import type { Logger } from '#src/types/general.ts';
+export interface TeeBundleData {
+    teekSigned: SignedMessage;
+    teetSigned: SignedMessage;
+    kOutputPayload: KOutputPayload;
+    tOutputPayload: TOutputPayload;
+    teekPcr0: string;
+    teetPcr0: string;
+    teeSessionId: string;
+}
+export interface TeeSignatureVerificationResult {
+    isValid: boolean;
+    errors: string[];
+    address?: string;
+}
+/**
+ * Verifies a complete TEE verification bundle
+ * @param bundleBytes - Raw protobuf-encoded verification bundle
+ * @param logger - Logger instance
+ * @returns Validated TEE bundle data
+ */
+export declare function verifyTeeBundle(bundleBytes: Uint8Array, logger: Logger): Promise<TeeBundleData>;