feat(common): add proof bound possession for Schnorr signing key by damrobi · Pull Request #3539 · IntersectMBO/mithril

damrobi · 2026-09-14T10:15:36Z

Content

This PR includes the addition of a proof of bound possession for the Schnorr signing key. This proof is added in mithril-common under the future_snark feature. It is computed by the Initializers and verified during the registration of the signers. This PR also includes a deduplication mechanism for the Schnorr verification key at the STM level.

Summary

Adds Proof of Bound Possession (PoBP) for the Schnorr/SNARK signer verification key, entirely behind future_snark.

Changes

Crypto core (mithril-stm): Schnorr signing/verification keys gain create_pobp/verify_pobp; Initializer/StmInitializerWrapper create and store the proof. KeyRegistration::register gains a deduplication of entries based on the Schnorr verification key.
Challenge encoding (mithril-common): new ProofOfBoundPossessionPrefix (stake || epoch || pool_id) feeding the Schnorr challenge; pool_id uses the raw fixed-length Blake2b-224 hash rather than the bech32 string, removing the need for a length-prefixed encoding.
Verification wiring (mithril-common, mithril-aggregator): KeyRegWrapper::register now verifies the PoBP alongside the existing KES check; SignerRegistrationVerifier/leader/follower services thread the registration epoch through to that verification.
Entities & messages: Signer/SignerWithStake gain proof_of_bound_possession_for_snark; mirrored into RegisterSignerMessage, message adapters, and DB persistence (new nullable column via migration) so it survives aggregator restarts and follower sync.
Epoch threading: the registration epoch is now plumbed end-to-end — signer runtime → aggregator services → SignerBuilder/fixture builders — since PoBP verification must use the exact epoch the proof was bound to.
Test infrastructure: MithrilFixtureBuilder/fake_data gain epoch-aware builders (build_at_epoch, signers_with_stakes_at_epoch) to replace the implicit "always epoch 0" fixtures that broke once epoch-bound verification was enforced; extensive unit and integration test fixes across mithril-common/mithril-aggregator (including the aggregator's follower/leader integration suite) to build fixtures at the epoch they're actually registered/re-registered at, including cases where stake is updated mid-test.

Notes

All changes are #[cfg(feature = "future_snark")]-gated; default builds are unaffected.

Pre-submit checklist

Branch
- Tests are provided (if possible)
- Crates versions are updated (if relevant)
- CHANGELOG file is updated (if relevant)
- Commit sequence broadly makes sense
- Key commits have useful messages
PR
- All check jobs of the CI have succeeded
- Self-reviewed the diff
- Useful pull request description
- Reviewer requested

Comments

Issue(s)

Closes #3537

github-actions · 2026-09-14T10:34:24Z

Test Results

5 files ± 0 221 suites ±0 31m 42s ⏱️ - 1h 31m 44s
3 652 tests - 33 3 652 ✅ - 33 0 💤 ±0 0 ❌ ±0
11 804 runs - 28 11 804 ✅ - 28 0 💤 ±0 0 ❌ ±0

Results for commit e7813b5. ± Comparison against base commit f7f05f6.

This pull request removes 58 and adds 25 tests. Note that renamed tests count towards both.

mithril-common ‑ crypto_helper::cardano::key_certification::test::test_initializer_wrapper_conversions
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
…

mithril-aggregator ‑ services::epoch_service::tests::precompute_epoch_data_excludes_the_higher_stake_signer_from_snark_registration_when_two_signers_share_a_snark_key
mithril-common ‑ crypto_helper::cardano::key_certification::test::register_fails_when_proof_of_bound_possession_for_snark_is_missing
mithril-common ‑ crypto_helper::cardano::key_certification::test::register_fails_when_proof_of_bound_possession_for_snark_was_signed_for_a_different_epoch
mithril-common ‑ crypto_helper::cardano::opcert::tests::compute_protocol_party_id_as_bytes_golden_value
mithril-common ‑ crypto_helper::cardano::opcert::tests::compute_protocol_party_id_as_hash_golden_value
mithril-common ‑ crypto_helper::cardano::opcert::tests::compute_protocol_party_id_golden_value
mithril-common ‑ crypto_helper::cardano::proof_of_bound_possession::tests::different_epochs_produce_different_bytes
mithril-common ‑ crypto_helper::cardano::proof_of_bound_possession::tests::different_pool_ids_produce_different_bytes
mithril-common ‑ crypto_helper::cardano::proof_of_bound_possession::tests::different_stakes_produce_different_bytes
mithril-common ‑ crypto_helper::cardano::proof_of_bound_possession::tests::to_prefix_bytes_handles_all_zero_pool_id
…

♻️ This comment has been updated with latest results.

jpraynaud · 2026-09-16T16:12:29Z

                .configuration_for_aggregation
                .protocol_parameters,
+            #[cfg(feature = "future_snark")]
+            data.epoch.offset_to_signer_retrieval_epoch_saturating(),


question(blocking): why did you choose to offset_to_signer_retrieval_epoch_saturating?

I chose those values because they match what is done in the inform_epoch() function to get the signer_retrieval_epoch and next_signer_retrieval_epoch that are used to get current_signers_with_stake and next_signers_with_stake. The same offset function is used in update_next_signers_with_stake to get next_signers_with_stake before calling precompute_epoch_data. It is possible that this is wrong but it looks consistent

jpraynaud · 2026-09-16T16:14:06Z

                .configuration_for_next_aggregation
                .protocol_parameters,
+            #[cfg(feature = "future_snark")]
+            data.epoch.offset_to_next_signer_retrieval_epoch(),


question(blocking): why did you choose to offset_to_next_signer_retrieval_epoch?

See the answer above

jpraynaud · 2026-09-16T16:36:10Z

+            if *entry < existing {
+                self.registered_keys_for_concatenation
+                    .remove(&existing.get_verification_key_for_concatenation());
+                self.registration_entries.remove(&existing);
+            } else {
+                return Ok(());
+            }


issue(blocking): if there is a collision with an existing Schnorr verification key, we keep the one with lower stake, but the BLS verification key is also removed. This could create a split in the effective computation of the AVK by the different versions of the signers and aggregators, and thus stop the certification. Only the Schnorr part should be impacted and not the BLS part with an update of the existing entry instead of a replace. Can you add a test that verifies the expected behavior first, make sure that it breaks and then make it green?

I update the registration to remove the snark key of entry when it is a duplicate with higher stake

the Schnorr signing key can create the proof by signing a DST, prefix and its verification key the verification key can verify the proof given the prefix

It stores the stake, epoch and pool id and can convert them into a prefix used in the PoBP

…izer and KeyReg - added creation of the pobp to the Initializer struct - added pobp field to StmInitializerWrapper, updated setup, to/from_bytes and added an accessor to the new field - StmInitializerWrapper strip_snark_keys now also removes pobp - updated KeyRegWrapper implementation and added wrapper for StandardSchnorrSignature - KeyRegWrapper now has a verify_proof_of_bound_possession_for_snark function that is called in register()

added proof_of_bound_possession_for_snark field and updated the implemented functions added proof of bound possession field to diverse entities in common, signer and aggregator

added an epoch field to MithrilFixtureBuilder/MithrilFixture and a build_at_epoch/with_epoch entrypoint threaded a real epoch through the test crypto_helper setup functions (previously stubbed to Epoch::default()) added fake_data::signers_with_stakes_at_epoch and the TEST-ONLY init_state_from_fixtures/init_state_from_fixtures_for_genesis container methods, needed when current/next signer sets require different PoBP epochs

…gator threaded the pobp and epoch parameters through signer, common and aggregator un-gated the verify epoch param so mockall automock derives correctly fixed epoch problems in tests and adopted the new build_at_epoch/signers_with_stakes_at_epoch/init_state_from_fixtures helpers across the test suite

…ration

for the correctness of the PoBP for the correctness of the deduplication

…ields

…snark values not just None

…d length

…n for the proof of bound possession

…sion and added an epoch field to KeyRegWrapper

…or epoch in test

and updated register function doc comment

…hash, id and bytes)

… for the correct epochs

Alenar · 2026-09-18T18:12:48Z

+    /// Set the epoch for which the signers' Proof of Bound Possession will be created.
+    #[cfg(feature = "future_snark")]
+    pub fn with_epoch(mut self, epoch: Epoch) -> Self {
+        self.epoch = epoch;
+        self
+    }
+
+    /// Transform the specified parameters to a [MithrilFixture], creating each signer's Proof of
+    /// Bound Possession (when applicable) for the given epoch.
+    pub fn build_at_epoch(self, epoch: Epoch) -> MithrilFixture {
+        #[cfg(not(feature = "future_snark"))]
+        let _epoch = epoch;
+        #[cfg(feature = "future_snark")]
+        let builder = self.with_epoch(epoch);
+        #[cfg(not(feature = "future_snark"))]
+        let builder = self;
+        builder.build()
+    }
+
    /// Transform the specified parameters to a [MithrilFixture].
    pub fn build(self) -> MithrilFixture {
        let protocol_stake_distribution = self.generate_stake_distribution();
        let signers = crypto_helper::setup_signers_from_stake_distribution(
            &protocol_stake_distribution,
            &self.protocol_parameters.clone().into(),
+            #[cfg(feature = "future_snark")]
+            self.epoch,
        );

        MithrilFixture::new(
            self.protocol_parameters,
            signers,
            protocol_stake_distribution,
+            #[cfg(feature = "future_snark")]
+            self.epoch,
        )


suggestion(blocking): I think you should reverse the method call order as it just simpler, and remove with_epoch and the associated epoch field since it will be mandatory in the future and is only used when building and prevent easy re-using (see next paragraph).

Another important change is that the build/build_at_epoch method should not consume self anymore, meaning you will be able to call it multiple times to produce signers for different epoch using the same options.

Suggested change

/// Set the epoch for which the signers' Proof of Bound Possession will be created.

#[cfg(feature = "future_snark")]

pub fn with_epoch(mut self, epoch: Epoch) -> Self {

self.epoch = epoch;

self

}

/// Transform the specified parameters to a [MithrilFixture], creating each signer's Proof of

/// Bound Possession (when applicable) for the given epoch.

pub fn build_at_epoch(self, epoch: Epoch) -> MithrilFixture {

#[cfg(not(feature = "future_snark"))]

let _epoch = epoch;

#[cfg(feature = "future_snark")]

let builder = self.with_epoch(epoch);

#[cfg(not(feature = "future_snark"))]

let builder = self;

builder.build()

}

/// Transform the specified parameters to a [MithrilFixture].

pub fn build(self) -> MithrilFixture {

let protocol_stake_distribution = self.generate_stake_distribution();

let signers = crypto_helper::setup_signers_from_stake_distribution(

&protocol_stake_distribution,

&self.protocol_parameters.clone().into(),

#[cfg(feature = "future_snark")]

self.epoch,

);

MithrilFixture::new(

self.protocol_parameters,

signers,

protocol_stake_distribution,

#[cfg(feature = "future_snark")]

self.epoch,

)

/// Transform the specified parameters to a [MithrilFixture], creating each signer's Proof of

/// Bound Possession (when applicable) for the given epoch.

pub fn build_at_epoch(&self, epoch: Epoch) -> MithrilFixture {

let protocol_stake_distribution = self.generate_stake_distribution();

let signers = crypto_helper::setup_signers_from_stake_distribution(

&protocol_stake_distribution,

&self.protocol_parameters.clone().into(),

#[cfg(feature = "future_snark")]

epoch,

);

MithrilFixture::new(

self.protocol_parameters.clone(),

signers,

protocol_stake_distribution,

#[cfg(feature = "future_snark")]

epoch,

)

}

/// Transform the specified parameters to a [MithrilFixture], creating each signer's Proof of

/// Bound Possession (when applicable) for the Epoch 1.

pub fn build(&self) -> MithrilFixture {

Self::build_at_epoch(Epoch(1))

}

Alenar · 2026-09-18T18:17:58Z

+            let current_fixture = MithrilFixtureBuilder::default()
+                .with_signers(signers_count)
+                .with_protocol_parameters(protocol_parameters.clone())
+                .build_at_epoch(current_retrieval_epoch);
+            let next_fixture = MithrilFixtureBuilder::default()
+                .with_signers(signers_count)
+                .with_protocol_parameters(protocol_parameters)
+                .build_at_epoch(time_point.epoch);


issue(blocking): you should not rebuild a fixture builder like this, since you may be missing parameters that were used when the fixture was built (e.g. the StakeDistributionGenerationMethod). This caller to use any other builder parameters than the three used here.

suggestion: pass the MithrilFixtureBuilder by reference and refactor it so the build methods does not consume self (see comment in mithril-common/src/test/builder/fixture_builder.rs).

important: this comment apply for all other cases where a builder is rebuilt from a fixture like this in the code base.

damrobi self-assigned this Sep 14, 2026

github-advanced-security Bot found potential problems Sep 14, 2026

View reviewed changes

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch 3 times, most recently from f50c0ea to e3cd4c0 Compare September 14, 2026 13:55

damrobi deployed to testing-preview September 14, 2026 14:22 — with GitHub Actions Active

damrobi deployed to testing-2-preview September 14, 2026 14:22 — with GitHub Actions Active

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch from e3cd4c0 to 2ce5e81 Compare September 14, 2026 15:06

damrobi deployed to testing-preview September 15, 2026 06:24 — with GitHub Actions Active

damrobi deployed to testing-2-preview September 15, 2026 06:24 — with GitHub Actions Active

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch 2 times, most recently from 34044ba to a3d540b Compare September 15, 2026 11:58

damrobi deployed to testing-preview September 15, 2026 12:16 — with GitHub Actions Active

damrobi deployed to testing-2-preview September 15, 2026 12:16 — with GitHub Actions Active

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch from a3d540b to 2f25caa Compare September 15, 2026 12:21

damrobi deployed to testing-2-preview September 15, 2026 12:47 — with GitHub Actions Active

damrobi deployed to testing-preview September 15, 2026 12:47 — with GitHub Actions Active

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch 2 times, most recently from 26449d5 to 9328dfd Compare September 15, 2026 14:45

damrobi marked this pull request as ready for review September 15, 2026 15:06

damrobi requested review from Alenar, curiecrypt, hjeljeli32, jpraynaud and turmelclem as code owners September 15, 2026 15:06

damrobi deployed to testing-preview September 15, 2026 15:11 — with GitHub Actions Active

damrobi deployed to testing-2-preview September 15, 2026 15:11 — with GitHub Actions Active

jpraynaud requested a lite review from Copilot September 15, 2026 15:37

Copilot started reviewing on behalf of jpraynaud September 15, 2026 15:37 View session

jpraynaud reviewed Sep 16, 2026

View reviewed changes

damrobi requested review from hjeljeli32 and jpraynaud September 17, 2026 14:51

damrobi deployed to testing-2-preview September 17, 2026 16:07 — with GitHub Actions Active

damrobi deployed to testing-preview September 17, 2026 16:07 — with GitHub Actions Active

damrobi added 21 commits September 18, 2026 08:30

feat(stm): added proof of bound possession to Schnorr keys

97f266b

the Schnorr signing key can create the proof by signing a DST, prefix and its verification key the verification key can verify the proof given the prefix

feat(common): added ProofOfBoundPossessionPrefix struct

15a11b7

It stores the stake, epoch and pool id and can convert them into a prefix used in the PoBP

feat: updated Signer and SignerWithStake entities

b9c3d2e

added proof_of_bound_possession_for_snark field and updated the implemented functions added proof of bound possession field to diverse entities in common, signer and aggregator

feat(aggregator): added PoBP persistence

77d43b7

refactor(stm): added a deduplication of the Schnorr key during regist…

ee78d32

…ration

feat(common,aggregator): added test helpers and tests

4afa170

for the correctness of the PoBP for the correctness of the deduplication

feat(common): added golden test for backward compatibility of snark f…

ed0ba1d

…ields

feat(common): updated the golden value functions to have real future_…

17158c8

…snark values not just None

fix(stm): fixed deduplication to not remove the concatenation entry

dd8e156

fix(stm,common): made the proof of bound possession prefix bytes fixe…

6fa7c62

…d length

fix(stm): added a common function to compute the field element to sig…

cc77458

…n for the proof of bound possession

fix(common): renamed ProtocolPartyIdHash to ProtocolPartyIdBytes

ba09d16

fix(common,aggregator): moved check for missing proof of bound posses…

ecf3d12

…sion and added an epoch field to KeyRegWrapper

fix(aggregator): removed unnecessary comment and fixed magic number f…

791e930

…or epoch in test

fix(stm): fixed potential panic in register function with an error

582757b

and updated register function doc comment

fix(common): added golden tests for the protocol party computations (…

ef4e6a8

…hash, id and bytes)

fix(aggregator): fixed test testing an outdated scenario

dd2060b

fix(end-to-end): Updated the end-to-end test so it generates the PoBP…

e7813b5

… for the correct epochs

damrobi force-pushed the damrobi/msnark/proof-bound-possession branch from ddab23d to e7813b5 Compare September 18, 2026 06:33

damrobi deployed to testing-preview September 18, 2026 07:00 — with GitHub Actions Active

damrobi deployed to testing-2-preview September 18, 2026 07:00 — with GitHub Actions Active

Alenar reviewed Sep 18, 2026

View reviewed changes

Conversation

damrobi commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Content

Summary

Changes

Notes

Pre-submit checklist

Comments

Issue(s)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

damrobi commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading