core/consensus: add message signing

core/consensus/msg.go

@@ -16,6 +16,9 @@
 package consensus
 
 import (
+	"crypto/ecdsa"
+
+	"github.com/ethereum/go-ethereum/crypto"
 	ssz "github.com/ferranbt/fastssz"
 	"google.golang.org/protobuf/proto"
 
@@ -131,4 +134,41 @@ func hashProto(msg proto.Message) ([32]byte, error) {
 	return hash, nil
 }
 
+// verifyMsgSig returns true if the message with signed by the pubkey.
+func verifyMsgSig(msg *pbv1.QBFTMsg, pubkey *ecdsa.PublicKey) (bool, error) {
+	clone := proto.Clone(msg).(*pbv1.QBFTMsg)
+	clone.Signature = nil
+
+	hash, err := hashProto(clone)
+	if err != nil {
+		return false, err
+	}
+
+	actual, err := crypto.SigToPub(hash[:], msg.Signature)
+	if err != nil {
+		return false, errors.Wrap(err, "sig to pub")
+	}
+
+	return pubkey.Equal(actual), nil
+}
+
+// signMsg signs the proto message with the private key.
+func signMsg(msg *pbv1.QBFTMsg, privkey *ecdsa.PrivateKey) (*pbv1.QBFTMsg, error) {
+	msg.Signature = nil
+
+	hash, err := hashProto(msg)
+	if err != nil {
+		return nil, err
+	}
+
+	sig, err := crypto.Sign(hash[:], privkey)
+	if err != nil {
+		return nil, errors.Wrap(err, "sign")
+	}
+
+	msg.Signature = sig
+
+	return msg, nil
+}
+
 var _ qbft.Msg[core.Duty, [32]byte] = msg{} // Interface assertion

core/consensus/msg_internal_test.go

@@ -20,29 +20,19 @@ import (
 	"math/rand"
 	"testing"
 
+	"github.com/ethereum/go-ethereum/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/obolnetwork/charon/core"
+	pbv1 "github.com/obolnetwork/charon/core/corepb/v1"
 	"github.com/obolnetwork/charon/testutil"
 )
 
 //go:generate go test . -update -clean
 
 func TestHashProto(t *testing.T) {
 	rand.Seed(0)
-
-	duty := testutil.RandomAttestationDuty(t)
-	data := testutil.RandomAttestationData()
-	unsigned, err := core.EncodeAttesterUnsignedData(&core.AttestationData{
-		Data: *data,
-		Duty: *duty,
-	})
-	require.NoError(t, err)
-
-	set := core.UnsignedDataSet{
-		testutil.RandomCorePubKey(t): unsigned,
-	}
-
+	set := testutil.RandomUnsignedDataSet(t)
 	testutil.RequireGoldenJSON(t, set)
 
 	setPB := core.UnsignedDataSetToProto(set)
@@ -54,3 +44,32 @@ func TestHashProto(t *testing.T) {
 		hex.EncodeToString(hash[:]),
 	)
 }
+
+func TestSigning(t *testing.T) {
+	privkey, err := crypto.GenerateKey()
+	require.NoError(t, err)
+
+	msg := &pbv1.QBFTMsg{
+		Type:          rand.Int63(),
+		Duty:          core.DutyToProto(core.Duty{Type: core.DutyType(rand.Int()), Slot: rand.Int63()}),
+		PeerIdx:       rand.Int63(),
+		Round:         rand.Int63(),
+		Value:         core.UnsignedDataSetToProto(testutil.RandomUnsignedDataSet(t)),
+		PreparedRound: rand.Int63(),
+		PreparedValue: core.UnsignedDataSetToProto(testutil.RandomUnsignedDataSet(t)),
+		Signature:     nil,
+	}
+
+	signed, err := signMsg(msg, privkey)
+	require.NoError(t, err)
+
+	ok, err := verifyMsgSig(signed, &privkey.PublicKey)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	privkey2, err := crypto.GenerateKey()
+	require.NoError(t, err)
+	ok, err = verifyMsgSig(signed, &privkey2.PublicKey)
+	require.NoError(t, err)
+	require.False(t, ok)
+}

core/corepb/v1/consensus.proto

@@ -14,6 +14,7 @@ message QBFTMsg {
   core.corepb.v1.UnsignedDataSet value          = 5;
   int64                          prepared_round = 6;
   core.corepb.v1.UnsignedDataSet prepared_value = 7;
+  bytes                          signature      = 8;
 }
 
 message ConsensusMsg {

testutil/random.go

@@ -360,3 +360,19 @@ func RandomENR(t *testing.T, random io.Reader) (*ecdsa.PrivateKey, enr.Record) {
 
 	return p2pKey, r
 }
+
+func RandomUnsignedDataSet(t *testing.T) core.UnsignedDataSet {
+	t.Helper()
+
+	duty := RandomAttestationDuty(t)
+	data := RandomAttestationData()
+	unsigned, err := core.EncodeAttesterUnsignedData(&core.AttestationData{
+		Data: *data,
+		Duty: *duty,
+	})
+	require.NoError(t, err)
+
+	return core.UnsignedDataSet{
+		RandomCorePubKey(t): unsigned,
+	}
+}