flwr-nightly 1.9.0.dev20240502__tar.gz → 1.9.0.dev20240503__tar.gz

{flwr_nightly-1.9.0.dev20240502 → flwr_nightly-1.9.0.dev20240503}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flwr-nightly
-Version: 1.9.0.dev20240502
+Version: 1.9.0.dev20240503
 Summary: Flower: A Friendly Federated Learning Framework
 Home-page: https://flower.ai
 License: Apache-2.0

{flwr_nightly-1.9.0.dev20240502 → flwr_nightly-1.9.0.dev20240503}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "flwr-nightly"
-version = "1.9.0.dev20240502"
+version = "1.9.0.dev20240503"
 description = "Flower: A Friendly Federated Learning Framework"
 license = "Apache-2.0"
 authors = ["The Flower Authors <hello@flower.ai>"]

{flwr_nightly-1.9.0.dev20240502 → flwr_nightly-1.9.0.dev20240503}/src/py/flwr/server/app.py

@@ -43,6 +43,7 @@ from flwr.common.constant import (
 from flwr.common.exit_handlers import register_exit_handlers
 from flwr.common.logger import log
 from flwr.common.secure_aggregation.crypto.symmetric_encryption import (
+    private_key_to_bytes,
     public_key_to_bytes,
     ssh_types_to_elliptic_curve,
 )
@@ -374,13 +375,18 @@ def run_superlink() -> None:
                 server_private_key,
                 server_public_key,
             ) = maybe_keys
-            interceptors = [
-                AuthenticateServerInterceptor(
-                    client_public_keys,
-                    server_private_key,
-                    server_public_key,
-                )
-            ]
+            state = state_factory.state()
+            state.store_client_public_keys(client_public_keys)
+            state.store_server_private_public_key(
+                private_key_to_bytes(server_private_key),
+                public_key_to_bytes(server_public_key),
+            )
+            log(
+                INFO,
+                "Client authentication enabled with %d known public keys",
+                len(client_public_keys),
+            )
+            interceptors = [AuthenticateServerInterceptor(state)]
 
         fleet_server = _run_fleet_api_grpc_rere(
             address=address,

{flwr_nightly-1.9.0.dev20240502 → flwr_nightly-1.9.0.dev20240503}/src/py/flwr/server/superlink/fleet/grpc_rere/server_interceptor.py

@@ -16,17 +16,16 @@
 
 
 import base64
-from logging import INFO
-from typing import Any, Callable, Sequence, Set, Tuple, Union
+from logging import WARNING
+from typing import Any, Callable, Sequence, Tuple, Union
 
 import grpc
-from cryptography.hazmat.primitives.asymmetric import ec
 
 from flwr.common.logger import log
 from flwr.common.secure_aggregation.crypto.symmetric_encryption import (
+    bytes_to_private_key,
     bytes_to_public_key,
     generate_shared_key,
-    public_key_to_bytes,
     verify_hmac,
 )
 from flwr.proto.fleet_pb2 import (  # pylint: disable=E0611
@@ -43,6 +42,7 @@ from flwr.proto.fleet_pb2 import (  # pylint: disable=E0611
     PushTaskResRequest,
     PushTaskResResponse,
 )
+from flwr.server.superlink.state import State
 
 _PUBLIC_KEY_HEADER = "public-key"
 _AUTH_TOKEN_HEADER = "auth-token"
@@ -79,22 +79,21 @@ def _get_value_from_tuples(
 class AuthenticateServerInterceptor(grpc.ServerInterceptor):  # type: ignore
     """Server interceptor for client authentication."""
 
-    def __init__(
-        self,
-        client_public_keys: Set[bytes],
-        private_key: ec.EllipticCurvePrivateKey,
-        public_key: ec.EllipticCurvePublicKey,
-    ):
-        self.server_private_key = private_key
-        self.client_public_keys = client_public_keys
-        self.encoded_server_public_key = base64.urlsafe_b64encode(
-            public_key_to_bytes(public_key)
-        )
-        log(
-            INFO,
-            "Client authentication enabled with %d known public keys",
-            len(client_public_keys),
-        )
+    def __init__(self, state: State):
+        self.state = state
+
+        self.client_public_keys = state.get_client_public_keys()
+        if len(self.client_public_keys) == 0:
+            log(WARNING, "Authentication enabled, but no known public keys configured")
+
+        private_key = self.state.get_server_private_key()
+        public_key = self.state.get_server_public_key()
+
+        if private_key is None or public_key is None:
+            raise ValueError("Error loading authentication keys")
+
+        self.server_private_key = bytes_to_private_key(private_key)
+        self.encoded_server_public_key = base64.urlsafe_b64encode(public_key)
 
     def intercept_service(
         self,