fix(sdk-core): derive EdDSA retrofit data via real MPCv1 keyCombine

Replaces the hand-rolled scalar derivation (manual SHA-512 + clamp
with a zeroize try/finally, and reading a non-existent `pShare` field
off the raw decrypted keycard JSON) with a call to
`MPC.keyCombine(uShare, yShares)` — the same combine step every other
MPCv1 EdDSA code path already uses. The decrypted MPCv1 key share
(`SigningMaterial`) only ever contains `uShare` + `bitgoYShare` +
`backupYShare`/`userYShare`; it has no `pShare`, and `uShare.chaincode`
is only one party's additive contribution to the real BIP32 chain
code, not the combined value. Deriving `s_i_0`/`expectedPk`/`chainCode`
from the real `pShare.u`/`pShare.y`/`pShare.chaincode` output of
keyCombine fixes both issues at once and asserts user/backup agree on
the aggregate public key and chain code before returning.

Moves `EddsaRetrofitData` into `@bitgo/sdk-lib-mpc`'s
`tss/eddsa-mps/types.ts` (as `MPSTypes.EddsaRetrofitData`), mirroring
where DKLS keeps its `RetrofitData` type, instead of defining and
re-exporting it from sdk-core.

Rewrites tests to exercise real 3-party MPCv1 key shares generated via
`Eddsa.keyShare`/`keyCombine` instead of hand-built JSON fixtures with
a `pShare` field that never occurs in production data.

Ticket: WCI-1263

Author: Marzooqa

modules/sdk-core/src/bitgo/utils/tss/eddsa/eddsaMPCv2.ts

@@ -1,5 +1,4 @@
 import assert from 'assert';
-import crypto from 'crypto';
 import * as pgp from 'openpgp';
 import * as sjcl from '@bitgo/sjcl';
 import { NonEmptyString } from 'io-ts-types';
@@ -51,12 +50,8 @@ import { BaseEddsaUtils } from './base';
 import { resolveEffectiveTxParams } from '../recipientUtils';
 import { EddsaMPCv2KeyGenSendFn, KeyGenSenderForEnterprise } from './eddsaMPCv2KeyGenSender';
 import { EddsaMPCv2RecoveryKeyShares } from './types';
-
-export type EddsaRetrofitData = {
-  s_i_0: string;
-  expectedPk: string;
-  chainCode: string;
-};
+import { SigningMaterial } from '../../../tss';
+import { UShare, YShare } from '../../../../account-lib/mpc/tss';
 
 export class EddsaMPCv2Utils extends BaseEddsaUtils {
   private static readonly MPS_DSG_SIGNING_USER_GPG_KEY = 'MPS_DSG_SIGNING_USER_GPG_KEY';
@@ -1076,42 +1071,47 @@ export class EddsaMPCv2Utils extends BaseEddsaUtils {
 
   // #region retrofit
 
-  getMpcV2RetrofitDataFromMpcV1Keys(params: {
-    mpcv1UserKeyShare: string;
-    mpcv1BackupKeyShare: string;
-  }): {
-    userRetrofitData: EddsaRetrofitData;
-    backupRetrofitData: EddsaRetrofitData;
-  } {
-    const userKey = JSON.parse(params.mpcv1UserKeyShare);
-    assert(typeof userKey?.pShare?.y === 'string', 'MPCv1 user key missing pShare.y (aggregate public key)');
-    const expectedPk: string = userKey.pShare.y;
+  async getMpcV2RetrofitDataFromMpcV1Keys(params: { mpcv1UserKeyShare: string; mpcv1BackupKeyShare: string }): Promise<{
+    userRetrofitData: MPSTypes.EddsaRetrofitData;
+    backupRetrofitData: MPSTypes.EddsaRetrofitData;
+  }> {
+    const userSigningMaterial: SigningMaterial = JSON.parse(params.mpcv1UserKeyShare);
+    const backupSigningMaterial: SigningMaterial = JSON.parse(params.mpcv1BackupKeyShare);
+    assert(userSigningMaterial.backupYShare, 'MPCv1 user key missing backupYShare');
+    assert(backupSigningMaterial.userYShare, 'MPCv1 backup key missing userYShare');
+
+    const MPC = await getInitializedMpcInstance();
+    const userRetrofitData = EddsaMPCv2Utils.getMpcV2RetrofitDataFromMpcV1Key(MPC, userSigningMaterial.uShare, [
+      userSigningMaterial.bitgoYShare,
+      userSigningMaterial.backupYShare,
+    ]);
+    const backupRetrofitData = EddsaMPCv2Utils.getMpcV2RetrofitDataFromMpcV1Key(MPC, backupSigningMaterial.uShare, [
+      backupSigningMaterial.bitgoYShare,
+      backupSigningMaterial.userYShare,
+    ]);
 
-    return {
-      userRetrofitData: EddsaMPCv2Utils.getMpcV2RetrofitDataFromMpcV1Key(params.mpcv1UserKeyShare, expectedPk),
-      backupRetrofitData: EddsaMPCv2Utils.getMpcV2RetrofitDataFromMpcV1Key(params.mpcv1BackupKeyShare, expectedPk),
-    };
+    assert(
+      userRetrofitData.expectedPk === backupRetrofitData.expectedPk,
+      'MPCv1 user and backup keys combine to different aggregate public keys'
+    );
+    assert(
+      userRetrofitData.chainCode === backupRetrofitData.chainCode,
+      'MPCv1 user and backup keys combine to different chain codes'
+    );
+
+    return { userRetrofitData, backupRetrofitData };
   }
 
   private static getMpcV2RetrofitDataFromMpcV1Key(
-    decryptedKeyShare: string,
-    expectedPk: string
-  ): EddsaRetrofitData {
-    const key = JSON.parse(decryptedKeyShare);
-    assert(typeof key?.uShare?.seed === 'string', 'MPCv1 key missing uShare.seed');
-    assert(typeof key?.uShare?.chaincode === 'string', 'MPCv1 key missing uShare.chaincode');
-
-    const seedBytes = Buffer.from(key.uShare.seed, 'hex');
-    const hash = crypto.createHash('sha512').update(seedBytes).digest();
-    const scalar = Buffer.from(hash.subarray(0, 32));
-    scalar[0] &= 248;
-    scalar[31] &= 127;
-    scalar[31] |= 64;
-
+    mpc: Awaited<ReturnType<typeof getInitializedMpcInstance>>,
+    uShare: UShare,
+    yShares: YShare[]
+  ): MPSTypes.EddsaRetrofitData {
+    const { pShare } = mpc.keyCombine(uShare, yShares);
     return {
-      s_i_0: scalar.toString('hex'),
-      expectedPk,
-      chainCode: key.uShare.chaincode,
+      s_i_0: pShare.u,
+      expectedPk: pShare.y,
+      chainCode: pShare.chaincode,
     };
   }
 

modules/sdk-core/src/index.ts

@@ -29,8 +29,8 @@ import { EcdsaUtils } from './bitgo/utils/tss/ecdsa/ecdsa';
 export { EcdsaUtils };
 import { EcdsaMPCv2Utils } from './bitgo/utils/tss/ecdsa/ecdsaMPCv2';
 export { EcdsaMPCv2Utils };
-import { EddsaMPCv2Utils, EddsaRetrofitData } from './bitgo/utils/tss/eddsa/eddsaMPCv2';
-export { EddsaMPCv2Utils, EddsaRetrofitData };
+import { EddsaMPCv2Utils } from './bitgo/utils/tss/eddsa/eddsaMPCv2';
+export { EddsaMPCv2Utils };
 export { verifyEddsaTssWalletAddress, verifyMPCWalletAddress } from './bitgo/utils/tss/addressVerification';
 export { GShare, SignShare, YShare } from './account-lib/mpc/tss/eddsa/types';
 export { TssEcdsaStep1ReturnMessage, TssEcdsaStep2ReturnMessage } from './bitgo/tss/types';

modules/sdk-core/test/unit/bitgo/utils/tss/eddsa/eddsaMPCv2.ts

@@ -22,7 +22,6 @@ import {
   EDDSAUtils,
   EddsaMPCv2KeyGenCallbacks,
   EddsaMPCv2Utils,
-  EddsaRetrofitData,
   IBaseCoin,
   IWallet,
   RequestTracer,
@@ -2181,135 +2180,87 @@ describe('EddsaMPCv2Utils.createKeychainsWithExternalSigner', function () {
 });
 
 describe('EddsaMPCv2Utils.getMpcV2RetrofitDataFromMpcV1Keys', () => {
-  // 32-byte seed and chaincode values used across all tests
-  const userSeed = randomBytes(32).toString('hex');
-  const backupSeed = randomBytes(32).toString('hex');
-  const userChaincode = randomBytes(32).toString('hex');
-  const backupChaincode = randomBytes(32).toString('hex');
-  const aggregatePk = randomBytes(32).toString('hex');
-
-  const userMpcV1Key = JSON.stringify({
-    uShare: { i: 1, seed: userSeed, chaincode: userChaincode, y: randomBytes(32).toString('hex') },
-    pShare: { y: aggregatePk },
-    bitgoYShare: { u: randomBytes(32).toString('hex') },
-    backupYShare: { u: randomBytes(32).toString('hex') },
-  });
+  let utils: EddsaMPCv2Utils;
+  // Real 3-party MPCv1 EdDSA key shares: 1 = user, 2 = backup, 3 = bitgo.
+  let userSigningMaterial: Record<string, unknown>;
+  let backupSigningMaterial: Record<string, unknown>;
+  let expectedUserPShare: { y: string; u: string; chaincode: string };
+  let expectedBackupPShare: { y: string; u: string; chaincode: string };
 
-  const backupMpcV1Key = JSON.stringify({
-    uShare: { i: 2, seed: backupSeed, chaincode: backupChaincode, y: randomBytes(32).toString('hex') },
-    bitgoYShare: { u: randomBytes(32).toString('hex') },
-    userYShare: { u: randomBytes(32).toString('hex') },
+  before(async () => {
+    const MPC = await getInitializedMpcInstance();
+    const user = MPC.keyShare(1, 2, 3);
+    const backup = MPC.keyShare(2, 2, 3);
+    const bitgo = MPC.keyShare(3, 2, 3);
+
+    expectedUserPShare = MPC.keyCombine(user.uShare, [backup.yShares[1], bitgo.yShares[1]]).pShare;
+    expectedBackupPShare = MPC.keyCombine(backup.uShare, [user.yShares[2], bitgo.yShares[2]]).pShare;
+
+    userSigningMaterial = {
+      uShare: user.uShare,
+      bitgoYShare: bitgo.yShares[1],
+      backupYShare: backup.yShares[1],
+    };
+    backupSigningMaterial = {
+      uShare: backup.uShare,
+      bitgoYShare: bitgo.yShares[2],
+      userYShare: user.yShares[2],
+    };
   });
 
-  let utils: EddsaMPCv2Utils;
-
   beforeEach(() => {
     const mockBitGo = {} as unknown as BitGoBase;
     const mockCoin = {} as unknown as IBaseCoin;
     utils = new EddsaMPCv2Utils(mockBitGo, mockCoin);
   });
 
-  function deriveScalar(seedHex: string): string {
-    const { createHash } = require('crypto');
-    const seedBytes = Buffer.from(seedHex, 'hex');
-    const hash = createHash('sha512').update(seedBytes).digest();
-    const scalar = Buffer.from(hash.subarray(0, 32));
-    scalar[0] &= 248;
-    scalar[31] &= 127;
-    scalar[31] |= 64;
-    return scalar.toString('hex');
-  }
-
-  it('returns EddsaRetrofitData for user and backup with matching expectedPk', () => {
-    const result = utils.getMpcV2RetrofitDataFromMpcV1Keys({
-      mpcv1UserKeyShare: userMpcV1Key,
-      mpcv1BackupKeyShare: backupMpcV1Key,
+  it('derives matching expectedPk and chainCode for user and backup from real MPCv1 key combine', async () => {
+    const { userRetrofitData, backupRetrofitData } = await utils.getMpcV2RetrofitDataFromMpcV1Keys({
+      mpcv1UserKeyShare: JSON.stringify(userSigningMaterial),
+      mpcv1BackupKeyShare: JSON.stringify(backupSigningMaterial),
     });
 
-    const { userRetrofitData, backupRetrofitData } = result as {
-      userRetrofitData: EddsaRetrofitData;
-      backupRetrofitData: EddsaRetrofitData;
-    };
-
-    assert.strictEqual(userRetrofitData.expectedPk, aggregatePk);
-    assert.strictEqual(backupRetrofitData.expectedPk, aggregatePk);
-  });
-
-  it('returns correct chainCode per party', () => {
-    const { userRetrofitData, backupRetrofitData } = utils.getMpcV2RetrofitDataFromMpcV1Keys({
-      mpcv1UserKeyShare: userMpcV1Key,
-      mpcv1BackupKeyShare: backupMpcV1Key,
-    });
+    assert.strictEqual(userRetrofitData.expectedPk, expectedUserPShare.y);
+    assert.strictEqual(backupRetrofitData.expectedPk, expectedBackupPShare.y);
+    assert.strictEqual(userRetrofitData.expectedPk, backupRetrofitData.expectedPk);
 
-    assert.strictEqual(userRetrofitData.chainCode, userChaincode);
-    assert.strictEqual(backupRetrofitData.chainCode, backupChaincode);
+    assert.strictEqual(userRetrofitData.chainCode, expectedUserPShare.chaincode);
+    assert.strictEqual(backupRetrofitData.chainCode, expectedBackupPShare.chaincode);
+    assert.strictEqual(userRetrofitData.chainCode, backupRetrofitData.chainCode);
   });
 
-  it('returns correctly clamped s_i_0 scalars', () => {
-    const { userRetrofitData, backupRetrofitData } = utils.getMpcV2RetrofitDataFromMpcV1Keys({
-      mpcv1UserKeyShare: userMpcV1Key,
-      mpcv1BackupKeyShare: backupMpcV1Key,
+  it('derives s_i_0 as the combined pShare.u (clamped scalar) for each party', async () => {
+    const { userRetrofitData, backupRetrofitData } = await utils.getMpcV2RetrofitDataFromMpcV1Keys({
+      mpcv1UserKeyShare: JSON.stringify(userSigningMaterial),
+      mpcv1BackupKeyShare: JSON.stringify(backupSigningMaterial),
     });
 
-    assert.strictEqual(userRetrofitData.s_i_0, deriveScalar(userSeed));
-    assert.strictEqual(backupRetrofitData.s_i_0, deriveScalar(backupSeed));
+    assert.strictEqual(userRetrofitData.s_i_0, expectedUserPShare.u);
+    assert.strictEqual(backupRetrofitData.s_i_0, expectedBackupPShare.u);
+    assert.notStrictEqual(userRetrofitData.s_i_0, backupRetrofitData.s_i_0);
   });
 
-  it('scalar byte[0] has low 3 bits cleared, byte[31] has bit7 cleared and bit6 set', () => {
-    const { userRetrofitData } = utils.getMpcV2RetrofitDataFromMpcV1Keys({
-      mpcv1UserKeyShare: userMpcV1Key,
-      mpcv1BackupKeyShare: backupMpcV1Key,
-    });
-
-    const scalarBytes = Buffer.from(userRetrofitData.s_i_0, 'hex');
-    assert.strictEqual(scalarBytes[0] & 0b111, 0, 'byte[0] low 3 bits should be cleared');
-    assert.strictEqual(scalarBytes[31] & 0b10000000, 0, 'byte[31] bit7 should be cleared');
-    assert.strictEqual(scalarBytes[31] & 0b01000000, 0b01000000, 'byte[31] bit6 should be set');
-  });
-
-  it('throws if user key is missing pShare.y', () => {
-    const keyNoPShare = JSON.stringify({
-      uShare: { i: 1, seed: userSeed, chaincode: userChaincode },
-      bitgoYShare: { u: 'x' },
-    });
-    assert.throws(
-      () =>
-        utils.getMpcV2RetrofitDataFromMpcV1Keys({
-          mpcv1UserKeyShare: keyNoPShare,
-          mpcv1BackupKeyShare: backupMpcV1Key,
-        }),
-      /MPCv1 user key missing pShare\.y/
-    );
-  });
-
-  it('throws if user key is missing uShare.seed', () => {
-    const keyNoSeed = JSON.stringify({
-      uShare: { i: 1, chaincode: userChaincode },
-      pShare: { y: aggregatePk },
-      bitgoYShare: { u: 'x' },
-    });
-    assert.throws(
+  it('throws if user key is missing backupYShare', async () => {
+    const keyNoBackupYShare = JSON.stringify({ uShare: userSigningMaterial.uShare });
+    await assert.rejects(
       () =>
         utils.getMpcV2RetrofitDataFromMpcV1Keys({
-          mpcv1UserKeyShare: keyNoSeed,
-          mpcv1BackupKeyShare: backupMpcV1Key,
+          mpcv1UserKeyShare: keyNoBackupYShare,
+          mpcv1BackupKeyShare: JSON.stringify(backupSigningMaterial),
         }),
-      /MPCv1 key missing uShare\.seed/
+      /MPCv1 user key missing backupYShare/
     );
   });
 
-  it('throws if backup key is missing uShare.seed', () => {
-    const backupNoSeed = JSON.stringify({
-      uShare: { i: 2, chaincode: backupChaincode },
-      bitgoYShare: { u: 'x' },
-    });
-    assert.throws(
+  it('throws if backup key is missing userYShare', async () => {
+    const keyNoUserYShare = JSON.stringify({ uShare: backupSigningMaterial.uShare });
+    await assert.rejects(
       () =>
         utils.getMpcV2RetrofitDataFromMpcV1Keys({
-          mpcv1UserKeyShare: userMpcV1Key,
-          mpcv1BackupKeyShare: backupNoSeed,
+          mpcv1UserKeyShare: JSON.stringify(userSigningMaterial),
+          mpcv1BackupKeyShare: keyNoUserYShare,
         }),
-      /MPCv1 key missing uShare\.seed/
+      /MPCv1 backup key missing userYShare/
     );
   });
 });

modules/sdk-lib-mpc/src/tss/eddsa-mps/types.ts

@@ -2,6 +2,20 @@ import { decode } from 'cbor-x';
 import { isLeft } from 'fp-ts/Either';
 import * as t from 'io-ts';
 
+/**
+ * Retrofit data derived from an existing MPCv1 EdDSA key share, used to seed
+ * an MPCv2 (MPS) DKG retrofit ceremony (`ed25519_dkg_round0_import`).
+ *
+ * @property s_i_0 - Party's clamped additive scalar (pShare.u), 32 bytes LE hex.
+ * @property expectedPk - Aggregate Ed25519 public key (pShare.y), 32 bytes hex.
+ * @property chainCode - Combined 32-byte BIP32 chain code (pShare.chaincode), hex.
+ */
+export type EddsaRetrofitData = {
+  s_i_0: string;
+  expectedPk: string;
+  chainCode: string;
+};
+
 export const ReducedKeyShareType = t.type({
   keyShare: t.array(t.number),
   pub: t.array(t.number),