feat: move opensslbytes to own package

BREAKING CHANGE: clients using challenge
generation & TSS Recovery functions must now
install @bitgo/sdk-opensslbytes separately &
provide the openSSLBytes WASM themselves.

Ticket: CE-4329

Author: bitgoAaron

modules/abstract-cosmos/src/cosmosCoin.ts

@@ -136,7 +136,7 @@ export class CosmosCoin extends BaseCoin {
    * @returns {CosmosLikeCoinRecoveryOutput} the serialized transaction hex string and index
    * of the address being swept
    */
-  async recover(params: RecoveryOptions): Promise<CosmosLikeCoinRecoveryOutput> {
+  async recover(params: RecoveryOptions, openSSLBytes: Uint8Array): Promise<CosmosLikeCoinRecoveryOutput> {
     // Step 1: Check if params contains the required parameters
     if (!params.bitgoKey) {
       throw new Error('missing bitgoKey');
@@ -157,6 +157,9 @@ export class CosmosCoin extends BaseCoin {
     if (!params.walletPassphrase) {
       throw new Error('missing wallet passphrase');
     }
+    if (!openSSLBytes) {
+      throw new Error('missing openSSLBytes');
+    }
 
     // Step 2: Fetch the bitgo key from params
     const userKey = params.userKey.replace(/\s/g, '');
@@ -233,7 +236,7 @@ export class CosmosCoin extends BaseCoin {
       }
 
       // Step 7: Sign the tx
-      signature = await this.signRecoveryTSS(userKeyCombined, backupKeyCombined, signableHex);
+      signature = await this.signRecoveryTSS(userKeyCombined, backupKeyCombined, signableHex, openSSLBytes);
     } else {
       // DKLS
       const { userKeyShare, backupKeyShare, commonKeyChain } = await ECDSAUtils.getMpcV2RecoveryKeyShares(
@@ -275,7 +278,8 @@ export class CosmosCoin extends BaseCoin {
       validatorSrcAddress: string;
       validatorDstAddress: string;
       amountToRedelegate: string;
-    }
+    },
+    openSSLBytes: Uint8Array
   ): Promise<CosmosLikeCoinRecoveryOutput> {
     if (!params.bitgoKey) {
       throw new Error('missing bitgoKey');
@@ -304,7 +308,9 @@ export class CosmosCoin extends BaseCoin {
     if (!params.amountToRedelegate) {
       throw new Error('missing amountToRedelegate');
     }
-
+    if (!openSSLBytes) {
+      throw new Error('missing openSSLBytes');
+    }
     const bitgoKey = params.bitgoKey.replace(/\s/g, '');
 
     const MPC = new Ecdsa();
@@ -362,7 +368,7 @@ export class CosmosCoin extends BaseCoin {
       throw new Error('Missing combined key shares for user or backup');
     }
 
-    const signature = await this.signRecoveryTSS(userKeyCombined, backupKeyCombined, signableHex);
+    const signature = await this.signRecoveryTSS(userKeyCombined, backupKeyCombined, signableHex, openSSLBytes);
     const signableBuffer = Buffer.from(signableHex, 'hex');
     MPC.verify(signableBuffer, signature, this.getHashFunction());
     const cosmosKeyPair = this.getKeyPair(publicKey);
@@ -442,6 +448,7 @@ export class CosmosCoin extends BaseCoin {
     userKeyCombined: ECDSA.KeyCombined,
     backupKeyCombined: ECDSA.KeyCombined,
     txHex: string,
+    openSSLBytes: Uint8Array,
     {
       rangeProofChallenge,
     }: {
@@ -454,7 +461,7 @@ export class CosmosCoin extends BaseCoin {
 
     // Since this is a user <> backup signing, we will reuse the same range proof challenge
     rangeProofChallenge =
-      rangeProofChallenge ?? EcdsaTypes.serializeNtildeWithProofs(await EcdsaRangeProof.generateNtilde());
+      rangeProofChallenge ?? EcdsaTypes.serializeNtildeWithProofs(await EcdsaRangeProof.generateNtilde(openSSLBytes));
 
     const userToBackupPaillierChallenge = await EcdsaPaillierProof.generateP(
       hexToBigInt(userKeyCombined.yShares[signerTwoIndex].n)

modules/abstract-eth/src/abstractEthLikeNewCoins.ts

@@ -202,7 +202,17 @@ interface UnformattedTxInfo {
   recipient: Recipient;
 }
 
-export interface RecoverOptions {
+export type RecoverOptionsWithBytes = {
+  isTss: true;
+  openSSLBytes: Uint8Array;
+};
+export type NonTSSRecoverOptions = {
+  isTss?: false | undefined;
+};
+
+export type TSSRecoverOptions = RecoverOptionsWithBytes | NonTSSRecoverOptions;
+
+export type RecoverOptions = {
   userKey: string;
   backupKey: string;
   walletPassphrase?: string;
@@ -213,13 +223,12 @@ export interface RecoverOptions {
   gasLimit?: number;
   eip1559?: EIP1559;
   replayProtectionOptions?: ReplayProtectionOptions;
-  isTss?: boolean;
   bitgoFeeAddress?: string;
   bitgoDestinationAddress?: string;
   tokenContractAddress?: string;
   intendedChain?: string;
   common?: EthLikeCommon.default;
-}
+} & TSSRecoverOptions;
 
 export type GetBatchExecutionInfoRT = {
   values: [string[], string[]];
@@ -1055,6 +1064,7 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
     userKeyCombined: ECDSA.KeyCombined,
     backupKeyCombined: ECDSA.KeyCombined,
     txHex: string,
+    openSSLBytes: Uint8Array,
     {
       rangeProofChallenge,
     }: {
@@ -1070,7 +1080,7 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
     const signerTwoIndex = backupKeyCombined.xShare.i;
 
     rangeProofChallenge =
-      rangeProofChallenge ?? EcdsaTypes.serializeNtildeWithProofs(await EcdsaRangeProof.generateNtilde());
+      rangeProofChallenge ?? EcdsaTypes.serializeNtildeWithProofs(await EcdsaRangeProof.generateNtilde(openSSLBytes));
 
     const userToBackupPaillierChallenge = await EcdsaPaillierProof.generateP(
       hexToBigInt(userKeyCombined.yShares[signerTwoIndex].n)
@@ -1273,8 +1283,8 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
    * @param {string} params.bitgoDestinationAddress - target bitgo address where fee will be sent for evm based cross chain recovery txn
    */
   async recover(params: RecoverOptions): Promise<RecoveryInfo | OfflineVaultTxInfo> {
-    if (params.isTss) {
-      return this.recoverTSS(params);
+    if (params.isTss === true) {
+      return this.recoverTSS(params, params.openSSLBytes);
     }
     return this.recoverEthLike(params);
   }
@@ -1929,7 +1939,10 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
    * Recovers a tx with TSS key shares
    * same expected arguments as recover method, but with TSS key shares
    */
-  protected async recoverTSS(params: RecoverOptions): Promise<RecoveryInfo | OfflineVaultTxInfo> {
+  protected async recoverTSS(
+    params: RecoverOptions,
+    openSSLBytes: Uint8Array
+  ): Promise<RecoveryInfo | OfflineVaultTxInfo> {
     this.validateRecoveryParams(params);
     // Clean up whitespace from entered values
     const userPublicOrPrivateKeyShare = params.userKey.replace(/\s/g, '');
@@ -1982,7 +1995,8 @@ export abstract class AbstractEthLikeNewCoins extends AbstractEthLikeCoin {
         signature = await this.signRecoveryTSS(
           userKeyCombined,
           backupKeyCombined,
-          unsignedTx.getMessageToSign(false).toString('hex')
+          unsignedTx.getMessageToSign(false).toString('hex'),
+          openSSLBytes
         );
       } else {
         const { userKeyShare, backupKeyShare, commonKeyChain } = await ECDSAUtils.getMpcV2RecoveryKeyShares(

modules/bitgo/package.json

@@ -117,6 +117,7 @@
   },
   "devDependencies": {
     "@bitgo/public-types": "2.33.4",
+    "@bitgo/sdk-opensslbytes": "^1.0.0",
     "@bitgo/sdk-test": "^8.0.34",
     "@openpgp/web-stream-tools": "0.0.14",
     "@types/create-hmac": "^1.1.0",

modules/bitgo/test/v2/unit/internal/tssUtils/ecdsa.ts

@@ -46,6 +46,10 @@ import { bip32, ecc } from '@bitgo/utxo-lib';
 import { Hash } from 'crypto';
 import { mockChallengeA, mockChallengeB, mockChallengeC } from './mocks/ecdsaNtilde';
 
+import { loadWebAssembly } from '@bitgo/sdk-opensslbytes';
+
+const openSSLBytes = loadWebAssembly().buffer;
+
 const createKeccakHash = require('keccak');
 
 const encryptNShare = ECDSAMethods.encryptNShare;
@@ -1590,6 +1594,7 @@ describe('TSS Ecdsa Utils:', async function () {
         userPassword,
         signedInstChallenge,
         signedNitroChallenge,
+        openSSLBytes,
         deserializedEntChallenge
       ).should.not.be.rejected();
       stubUploadChallenge.should.be.calledWith(
@@ -1628,7 +1633,8 @@ describe('TSS Ecdsa Utils:', async function () {
         'ent_id',
         userPassword,
         signedInstChallenge,
-        signedNitroChallenge
+        signedNitroChallenge,
+        openSSLBytes
       ).should.not.be.rejected();
       stubUploadChallenge.should.be.calledWith(
         bitgo,

modules/sdk-coin-atom/package.json

@@ -52,6 +52,7 @@
   "devDependencies": {
     "@bitgo/sdk-api": "^1.51.3",
     "@bitgo/sdk-test": "^8.0.34",
+    "@bitgo/sdk-opensslbytes": "^1.0.0",
     "@types/lodash": "^4.14.183",
     "axios": "^1.3.4"
   }

modules/sdk-coin-atom/test/unit/atom.ts

@@ -21,6 +21,10 @@ import {
 } from '../resources/atom';
 import should = require('should');
 
+import { loadWebAssembly } from '@bitgo/sdk-opensslbytes';
+
+const openSSLBytes = loadWebAssembly().buffer;
+
 describe('ATOM', function () {
   let bitgo: TestBitGoAPI;
   let basecoin;
@@ -429,13 +433,16 @@ describe('ATOM', function () {
     });
 
     it('should recover funds for non-bitgo recoveries', async function () {
-      const res = await basecoin.recover({
-        userKey: wrwUser.userKey,
-        backupKey: wrwUser.backupKey,
-        bitgoKey: wrwUser.bitgoKey,
-        walletPassphrase: wrwUser.walletPassphrase,
-        recoveryDestination: destinationAddress,
-      });
+      const res = await basecoin.recover(
+        {
+          userKey: wrwUser.userKey,
+          backupKey: wrwUser.backupKey,
+          bitgoKey: wrwUser.bitgoKey,
+          walletPassphrase: wrwUser.walletPassphrase,
+          recoveryDestination: destinationAddress,
+        },
+        openSSLBytes
+      );
       res.should.not.be.empty();
       res.should.hasOwnProperty('serializedTx');
       sandBox.assert.calledOnce(basecoin.getAccountBalance);
@@ -453,13 +460,16 @@ describe('ATOM', function () {
     });
 
     it('should recover funds for non-bitgo recoveries - DKLS type', async function () {
-      const res = await basecoin.recover({
-        userKey: wrwUserDkls.userKey,
-        backupKey: wrwUserDkls.backupKey,
-        bitgoKey: wrwUserDkls.bitgoKey,
-        walletPassphrase: wrwUserDkls.walletPassphrase,
-        recoveryDestination: wrwUserDkls.destinationAddress,
-      });
+      const res = await basecoin.recover(
+        {
+          userKey: wrwUserDkls.userKey,
+          backupKey: wrwUserDkls.backupKey,
+          bitgoKey: wrwUserDkls.bitgoKey,
+          walletPassphrase: wrwUserDkls.walletPassphrase,
+          recoveryDestination: wrwUserDkls.destinationAddress,
+        },
+        openSSLBytes
+      );
       res.should.not.be.empty();
       res.should.hasOwnProperty('serializedTx');
       sandBox.assert.calledOnce(basecoin.getAccountBalance);
@@ -477,15 +487,18 @@ describe('ATOM', function () {
     });
 
     it('should redelegate funds to new validator', async function () {
-      const res = await basecoin.redelegate({
-        userKey: wrwUser.userKey,
-        backupKey: wrwUser.backupKey,
-        bitgoKey: wrwUser.bitgoKey,
-        walletPassphrase: wrwUser.walletPassphrase,
-        amountToRedelegate: '10000000000000000',
-        validatorSrcAddress: 'cosmosvaloper1409te27da74uahh6hn0040x7l272hjs2padjuz',
-        validatorDstAddress: 'cosmosvaloper183aycgtstp67r6s4vd7ts2npp2ckk4xah7rxj6',
-      });
+      const res = await basecoin.redelegate(
+        {
+          userKey: wrwUser.userKey,
+          backupKey: wrwUser.backupKey,
+          bitgoKey: wrwUser.bitgoKey,
+          walletPassphrase: wrwUser.walletPassphrase,
+          amountToRedelegate: '10000000000000000',
+          validatorSrcAddress: 'cosmosvaloper1409te27da74uahh6hn0040x7l272hjs2padjuz',
+          validatorDstAddress: 'cosmosvaloper183aycgtstp67r6s4vd7ts2npp2ckk4xah7rxj6',
+        },
+        openSSLBytes
+      );
 
       res.should.not.be.empty();
       res.should.hasOwnProperty('serializedTx');
@@ -561,7 +574,7 @@ describe('ATOM', function () {
         .should.rejectedWith('missing wallet passphrase');
     });
 
-    it('should throw error if there is no balance', async function () {
+    it('should throw error if openSSLBytes is not present', async function () {
       await basecoin
         .recover({
           userKey: wrwUser.userKey,
@@ -570,6 +583,21 @@ describe('ATOM', function () {
           walletPassphrase: wrwUser.walletPassphrase,
           recoveryDestination: destinationAddress,
         })
+        .should.rejectedWith('missing openSSLBytes');
+    });
+
+    it('should throw error if there is no balance', async function () {
+      await basecoin
+        .recover(
+          {
+            userKey: wrwUser.userKey,
+            backupKey: wrwUser.backupKey,
+            bitgoKey: wrwUser.bitgoKey,
+            walletPassphrase: wrwUser.walletPassphrase,
+            recoveryDestination: destinationAddress,
+          },
+          openSSLBytes
+        )
         .should.rejectedWith('Did not have enough funds to recover');
     });
   });

modules/sdk-coin-bld/package.json

@@ -51,6 +51,7 @@
   },
   "devDependencies": {
     "@bitgo/sdk-api": "^1.51.3",
+    "@bitgo/sdk-opensslbytes": "^1.0.0",
     "@bitgo/sdk-test": "^8.0.34",
     "@types/lodash": "^4.14.183"
   }