chore: handle backup security findings

backward-compatibility/generate-v0.14.0/Cargo.toml

@@ -9,19 +9,19 @@ license = "BSD-3-Clause-Clear"
 [dependencies]
 # Import the base backward-compatibility crate for shared types and utilities
 backward-compatibility = { path = ".." }
-bc2wrap = { git = "https://github.com/zama-ai/kms.git", package = "bc2wrap", rev = "3eb3862" }
+bc2wrap = { git = "https://github.com/zama-ai/kms.git", package = "bc2wrap", rev = "865e4091da5d663dec82c62cca3f2a0aad83939a" }
 
 # NOTE: Some dependencies below are duplicated from ../Cargo.toml
 # This is intentional - these crates are excluded from the workspace for isolation.
 # Each generator may need different versions to match its target KMS version.
 
 # All dependencies below target tag v0.14.0-0 (for now just using a commit from main until tag is made).
-kms_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "kms", rev = "3eb3862"}
-kms_grpc_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "kms-grpc", rev = "3eb3862"}
-algebra_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-algebra", default-features = false, rev = "3eb3862" }
-threshold_execution_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-execution", default-features = false, rev = "3eb3862", features = ["testing"] }
-threshold_networking_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-networking", default-features = false, rev = "3eb3862" }
-threshold_types_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-types", default-features = false, rev = "3eb3862" }
+kms_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "kms", rev = "865e4091da5d663dec82c62cca3f2a0aad83939a"}
+kms_grpc_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "kms-grpc", rev = "865e4091da5d663dec82c62cca3f2a0aad83939a"}
+algebra_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-algebra", default-features = false, rev = "865e4091da5d663dec82c62cca3f2a0aad83939a" }
+threshold_execution_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-execution", default-features = false, rev = "865e4091da5d663dec82c62cca3f2a0aad83939a", features = ["testing"] }
+threshold_networking_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-networking", default-features = false, rev = "865e4091da5d663dec82c62cca3f2a0aad83939a" }
+threshold_types_0_14_0 = { git = "https://github.com/zama-ai/kms.git", package = "threshold-types", default-features = false, rev = "865e4091da5d663dec82c62cca3f2a0aad83939a" }
 #error-utils_0_14_0 = { path = "./core/error-utils", default-features = false }
 #thread-handles_0_14_0 = { path = "./core/thread-handles" }
 

backward-compatibility/generate-v0.14.0/src/data_0_14.rs

@@ -1033,6 +1033,7 @@ impl KmsV0_14_0 {
             let (custodian_pk, _) = gen_sig_keys(&mut rng);
             let backup_material = BackupMaterial {
                 backup_id,
+                mpc_context_id: kms_grpc_0_14_0::ContextId::from_bytes([9u8; 32]),
                 custodian_pk,
                 custodian_role: cus_role,
                 operator_pk: operator_pk.clone(),
@@ -1109,10 +1110,8 @@ impl KmsV0_14_0 {
 
     fn gen_internal_recovery_request(dir: &PathBuf) -> TestMetadataKMS {
         let mut rng = AesRng::seed_from_u64(INTERNAL_RECOVERY_REQUEST_TEST.state);
-        let backup_id: RequestId = RequestId::new_random(&mut rng);
         let mut encryption = Encryption::new(PkeSchemeType::MlKem512, &mut rng);
         let (_dec_key, enc_key) = encryption.keygen().unwrap();
-        let (verf_key, _) = gen_sig_keys(&mut rng);
         let mut cts = BTreeMap::new();
         for role_j in 1..=INTERNAL_RECOVERY_REQUEST_TEST.amount {
             let cur_role = Role::indexed_from_one(role_j as usize);
@@ -1125,8 +1124,7 @@ impl KmsV0_14_0 {
             };
             cts.insert(cur_role, InnerOperatorBackupOutput { signcryption });
         }
-        let recovery_material =
-            InternalRecoveryRequest::new(enc_key, cts, backup_id, verf_key).unwrap();
+        let recovery_material = InternalRecoveryRequest::new(enc_key, cts).unwrap();
         store_versioned_test!(
             &recovery_material,
             dir,
@@ -1380,7 +1378,6 @@ impl KmsV0_14_0 {
 
     fn gen_internal_cus_rec_out(dir: &PathBuf) -> TestMetadataKMS {
         let mut rng = AesRng::seed_from_u64(INTERNAL_CUS_REC_OUT_TEST.state);
-        let (operator_verification_key, _) = gen_sig_keys(&mut rng);
         let mut buf = [0u8; 100];
         rng.fill_bytes(&mut buf);
         let signcryption = UnifiedSigncryption {
@@ -1391,8 +1388,6 @@ impl KmsV0_14_0 {
         let icro = InternalCustodianRecoveryOutput {
             signcryption,
             custodian_role: Role::indexed_from_one(2),
-            operator_verification_key,
-            mpc_context_id: RequestId::from_bytes(INTERNAL_CUS_REC_OUT_TEST.mpc_context_id),
         };
         store_versioned_test!(&icro, dir, &INTERNAL_CUS_REC_OUT_TEST.test_filename);
         TestMetadataKMS::InternalCustodianRecoveryOutput(INTERNAL_CUS_REC_OUT_TEST)
@@ -1439,6 +1434,7 @@ impl KmsV0_14_0 {
                 &mut rng,
                 &OPERATOR_BACKUP_OUTPUT_TEST.plaintext,
                 RequestId::from_bytes(OPERATOR_BACKUP_OUTPUT_TEST.backup_id),
+                kms_grpc_0_14_0::ContextId::from_bytes([9u8; 32]),
             )
             .unwrap()
             .ct_shares[&Role::indexed_from_one(1)];