Merge pull request #1011 from openmina/fix-panic

Include the encrypted private key in `failed_block_proof_*.binprot`

Author: sebastiencs

Cargo.lock

@@ -90,6 +90,7 @@ reqwest = { version = "0.11.24", features = ["blocking"] }
 rand_pcg = "0.3"
 rand_seeder = "0.2"
 tuple-map = "0.4.0"
+rsa = "0.9"
 
 [target.'cfg(target_family = "wasm")'.dev-dependencies]
 wasm-bindgen-test = "0.3.0"

ledger/Cargo.toml

@@ -4142,6 +4142,7 @@ pub(super) mod tests {
     use mina_p2p_messages::binprot::{
         self,
         macros::{BinProtRead, BinProtWrite},
+        BinProtRead,
     };
 
     use crate::{
@@ -4721,6 +4722,67 @@ pub(super) mod tests {
         let _sum = dbg!(sha256_sum(&proof_json));
     }
 
+    #[test]
+    #[ignore]
+    fn make_rsa_key() {
+        use rsa::pkcs1::{EncodeRsaPrivateKey, EncodeRsaPublicKey};
+        use rsa::pkcs8::LineEnding::LF;
+        use rsa::{RsaPrivateKey, RsaPublicKey};
+
+        let mut rng = rand::thread_rng();
+        let bits = 2048;
+        let priv_key = RsaPrivateKey::new(&mut rng, bits).expect("failed to generate a key");
+        let pub_key = RsaPublicKey::from(&priv_key);
+
+        let priv_key = priv_key.to_pkcs1_pem(LF).unwrap();
+        let priv_key: &str = priv_key.as_ref();
+        println!("private:\n{}", priv_key);
+
+        let pub_key = pub_key.to_pkcs1_pem(LF).unwrap();
+        println!("public:\n{}", pub_key);
+    }
+
+    #[test]
+    fn add_private_key_to_block_proof_input() {
+        use mina_p2p_messages::binprot::BinProtWrite;
+        use rsa::pkcs1::DecodeRsaPrivateKey;
+        use rsa::Pkcs1v15Encrypt;
+
+        #[derive(binprot::macros::BinProtRead)]
+        struct DumpBlockProof {
+            input: Box<v2::ProverExtendBlockchainInputStableV2>,
+            key: Vec<u8>,
+        }
+
+        let rsa_private_key = {
+            let Ok(string) = std::fs::read_to_string("~/.openmina/debug/rsa.priv") else {
+                eprintln!("Missing private key");
+                return;
+            };
+            rsa::RsaPrivateKey::from_pkcs1_pem(&string).unwrap()
+        };
+
+        let DumpBlockProof { mut input, key } = {
+            let Ok(data) = std::fs::read("/tmp/block_proof.binprot") else {
+                eprintln!("Missing block proof");
+                return;
+            };
+            DumpBlockProof::binprot_read(&mut data.as_slice()).unwrap()
+        };
+
+        let producer_private_key = {
+            let producer_private_key = rsa_private_key.decrypt(Pkcs1v15Encrypt, &key).unwrap();
+            v2::SignatureLibPrivateKeyStableV1::binprot_read(&mut producer_private_key.as_slice())
+                .unwrap()
+        };
+
+        input.prover_state.producer_private_key = producer_private_key;
+
+        let mut file = std::fs::File::create("/tmp/block_proof_with_key.binprot").unwrap();
+        input.binprot_write(&mut file).unwrap();
+        file.sync_all().unwrap();
+    }
+
     #[test]
     fn test_proofs() {
         let base_dir = Path::new(env!("CARGO_MANIFEST_DIR"))

ledger/src/proofs/transaction.rs

@@ -132,6 +132,12 @@ impl From<AccountSecretKey> for Keypair {
     }
 }
 
+impl From<&AccountSecretKey> for SignatureLibPrivateKeyStableV1 {
+    fn from(value: &AccountSecretKey) -> Self {
+        Self(BigInt::from_bytes(value.to_bytes()))
+    }
+}
+
 impl From<AccountSecretKey> for SignatureLibPrivateKeyStableV1 {
     fn from(value: AccountSecretKey) -> Self {
         Self(BigInt::from_bytes(value.to_bytes()))

node/account/src/secret_key.rs

@@ -22,6 +22,7 @@ ark-ff = { workspace = true }
 
 node = { path = "../../node", features = ["replay"] }
 openmina-core = { path = "../../core" }
+rsa = "0.9"
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 redux = { workspace = true }

node/common/Cargo.toml

@@ -6,14 +6,16 @@ use ledger::proofs::{
     block::BlockParams, generate_block_proof, provers::BlockProver, transaction::ProofError,
 };
 use mina_p2p_messages::{
-    binprot::BinProtWrite,
-    v2::{MinaBaseProofStableV2, ProverExtendBlockchainInputStableV2, StateHash},
+    bigint::BigInt,
+    binprot::{self, BinProtWrite},
+    v2::{self, MinaBaseProofStableV2, ProverExtendBlockchainInputStableV2, StateHash},
 };
 use node::{
     account::AccountSecretKey,
     block_producer::{vrf_evaluator::VrfEvaluatorInput, BlockProducerEvent},
     core::{channels::mpsc, constants::constraint_constants, thread},
 };
+use rsa::pkcs1::DecodeRsaPublicKey;
 
 use crate::EventSender;
 
@@ -91,12 +93,9 @@ fn prover_loop(
         Box<ProverExtendBlockchainInputStableV2>,
     )>,
 ) {
-    while let Some((provers, block_hash, input)) = rx.blocking_recv() {
-        let res =
-            prove(provers, input.clone(), keypair.clone(), false).map_err(|err| format!("{err:?}"));
+    while let Some((provers, block_hash, mut input)) = rx.blocking_recv() {
+        let res = prove(provers, &mut input, &keypair, false).map_err(|err| format!("{err:?}"));
         if res.is_err() {
-            // IMPORTANT: Make sure that `input` here is a copy from before `prove` is called, we don't
-            // want to leak the private key.
             if let Err(error) = dump_failed_block_proof_input(block_hash.clone(), input) {
                 openmina_core::error!(
                         openmina_core::log::system_time();
@@ -109,8 +108,8 @@ fn prover_loop(
 
 pub fn prove(
     provers: BlockProver,
-    mut input: Box<ProverExtendBlockchainInputStableV2>,
-    keypair: AccountSecretKey,
+    input: &mut ProverExtendBlockchainInputStableV2,
+    keypair: &AccountSecretKey,
     only_verify_constraints: bool,
 ) -> Result<Arc<MinaBaseProofStableV2>, ProofError> {
     let height = input
@@ -129,7 +128,7 @@ pub fn prove(
     }
 
     let res = generate_block_proof(BlockParams {
-        input: &input,
+        input,
         block_step_prover: &provers.block_step_prover,
         block_wrap_prover: &provers.block_wrap_prover,
         tx_wrap_prover: &provers.tx_wrap_prover,
@@ -167,18 +166,57 @@ impl node::service::BlockProducerService for crate::NodeService {
 
 fn dump_failed_block_proof_input(
     block_hash: StateHash,
-    input: Box<ProverExtendBlockchainInputStableV2>,
+    mut input: Box<ProverExtendBlockchainInputStableV2>,
 ) -> std::io::Result<()> {
+    use rsa::Pkcs1v15Encrypt;
+
+    const PUBLIC_KEY: &str = "-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEAqVZJX+m/xMB32rMAb9CSh9M4+TGzV037/R7yLCYuLm6VgX0HBtvE
+wC7IpZeSQKsc7gx0EVn9+u24nw7ep0TJlJb7bWolRdelnOQK0t9KMn20n8QKYPvA
+5zmUXBUI/4Hja+Nck5sErut/PAamzoUK1SeYdbsLRM70GiPALe+buSBb3qEEOgm8
+6EYqichDSd1yry2hLy/1EvKm51Va+D92/1SB1TNLFLpUJ6PuSelfYC95wJ+/g+1+
+kGqG7QLzSPjAtP/YbUponwaD+t+A0kBg0hV4hhcJOkPeA2NOi04K93bz3HuYCVRe
+1fvtAVOmYJ3s4CfRCC3SudYc8ZVvERcylwIDAQAB
+-----END RSA PUBLIC KEY-----";
+
+    #[derive(binprot::macros::BinProtWrite)]
+    struct DumpBlockProof {
+        input: Box<ProverExtendBlockchainInputStableV2>,
+        key: Vec<u8>,
+    }
+
+    let producer_private_key = {
+        let mut buffer = Vec::with_capacity(1024);
+        input
+            .prover_state
+            .producer_private_key
+            .binprot_write(&mut buffer)
+            .unwrap();
+        buffer
+    };
+
+    let encrypted_producer_private_key = {
+        let mut rng = rand::thread_rng();
+        let public_key = rsa::RsaPublicKey::from_pkcs1_pem(PUBLIC_KEY).unwrap();
+        public_key
+            .encrypt(&mut rng, Pkcs1v15Encrypt, &producer_private_key)
+            .unwrap()
+    };
+
+    // IMPORTANT: Make sure that `input` doesn't leak the private key.
+    input.prover_state.producer_private_key = v2::SignatureLibPrivateKeyStableV1(BigInt::one());
+
+    let input = DumpBlockProof {
+        input,
+        key: encrypted_producer_private_key,
+    };
+
     let debug_dir = openmina_core::get_debug_dir();
     let filename = debug_dir
         .join(format!("failed_block_proof_input_{block_hash}.binprot"))
         .to_string_lossy()
         .to_string();
-    openmina_core::warn!(
-        openmina_core::log::system_time();
-        message = "Dumping failed block proof.",
-        filename = filename
-    );
+    openmina_core::warn!(message = "Dumping failed block proof.", filename = filename);
     std::fs::create_dir_all(&debug_dir)?;
     let mut file = std::fs::File::create(&filename)?;
     input.binprot_write(&mut file)?;

node/common/src/service/block_producer/mod.rs

@@ -509,7 +509,11 @@ impl BlockProducerService for NodeTestingService {
         self.real.provers()
     }
 
-    fn prove(&mut self, block_hash: StateHash, input: Box<ProverExtendBlockchainInputStableV2>) {
+    fn prove(
+        &mut self,
+        block_hash: StateHash,
+        mut input: Box<ProverExtendBlockchainInputStableV2>,
+    ) {
         fn dummy_proof_event(block_hash: StateHash) -> Event {
             let dummy_proof = (*ledger::dummy::dummy_blockchain_proof()).clone();
             BlockProducerEvent::BlockProve(block_hash, Ok(dummy_proof.into())).into()
@@ -523,8 +527,8 @@ impl BlockProducerService for NodeTestingService {
             ProofKind::ConstraintsChecked => {
                 match openmina_node_native::block_producer::prove(
                     self.provers(),
-                    input,
-                    keypair,
+                    &mut input,
+                    &keypair,
                     true,
                 ) {
                     Err(ProofError::ConstraintsOk) => {
@@ -552,8 +556,8 @@ impl BlockProducerService for NodeTestingService {
                     } else {
                         openmina_node_native::block_producer::prove(
                             self.provers(),
-                            input,
-                            keypair,
+                            &mut input,
+                            &keypair,
                             false,
                         )
                         .map_err(|err| format!("{err:?}"))