Sign/verify implementations using OpenSSL library.

.clang-tidy-ignore

@@ -3,5 +3,6 @@
 
 # Ignore all protobuf/gRPC generated source files
 *.pb.cc
-# ignore test as it tests moved obkects
-*lru_cache_test.cpp
+# ignore test as it tests moved objects
+*lru_cache_test.cpp
+*BenchmarkThreshsign.cpp

.github/workflows/asan.yml

@@ -34,7 +34,8 @@ jobs:
           run: |
               script -q -e -c "make pull"
               sudo df -h
-              script -q -e -c "CONCORD_BFT_CMAKE_OMIT_TEST_OUTPUT=TRUE CONCORD_BFT_CMAKE_KEEP_APOLLO_LOGS=FALSE CONCORD_BFT_CMAKE_ASAN=TRUE CONCORD_BFT_CMAKE_USE_FAKE_CLOCK_IN_TIME_SERVICE=TRUE make build" \
+              script -q -e -c "CONCORD_BFT_CMAKE_OMIT_TEST_OUTPUT=TRUE CONCORD_BFT_CMAKE_KEEP_APOLLO_LOGS=FALSE CONCORD_BFT_CMAKE_ASAN=TRUE CONCORD_BFT_CMAKE_USE_FAKE_CLOCK_IN_TIME_SERVICE=TRUE \
+              make build" \
               && script -q -e -c "make test"
         - name: Check if ASAN passed
           if: always()

.github/workflows/codecoverage.yml

@@ -29,7 +29,8 @@ jobs:
           script -q -e -c "make pull"
           sudo df -h
           script -q -e -c "CONCORD_BFT_CONTAINER_CC=clang CONCORD_BFT_CONTAINER_CXX=clang++ \
-          CONCORD_BFT_CMAKE_CODECOVERAGE=TRUE CONCORD_BFT_CMAKE_TRANSPORT=UDP make build" && script -q -e -c "make test"
+          CONCORD_BFT_CMAKE_CODECOVERAGE=TRUE CONCORD_BFT_CMAKE_TRANSPORT=UDP \
+          make build" && script -q -e -c "make test"
         continue-on-error: true
 
       - name: Generate code coverage report for apollo tests

.github/workflows/tsan.yml

@@ -34,7 +34,8 @@ jobs:
           run: |
               script -q -e -c "make pull"
               sudo df -h
-              script -q -e -c "CONCORD_BFT_CMAKE_OMIT_TEST_OUTPUT=TRUE CONCORD_BFT_CMAKE_KEEP_APOLLO_LOGS=FALSE CONCORD_BFT_CMAKE_TSAN=TRUE CONCORD_BFT_CMAKE_USE_FAKE_CLOCK_IN_TIME_SERVICE=TRUE make build" \
+              script -q -e -c "CONCORD_BFT_CMAKE_OMIT_TEST_OUTPUT=TRUE CONCORD_BFT_CMAKE_KEEP_APOLLO_LOGS=FALSE CONCORD_BFT_CMAKE_TSAN=TRUE CONCORD_BFT_CMAKE_USE_FAKE_CLOCK_IN_TIME_SERVICE=TRUE \
+              make build" \
               && script -q -e -c "make test"
         - name: Check if TSAN passed
           if: always()

CMakeLists.txt

@@ -19,10 +19,13 @@ if(NOT CMAKE_BUILD_TYPE)
     set(CMAKE_BUILD_TYPE "Debug" CACHE STRING "Enable debug or release builds" FORCE)
 endif()
 
-if (NOT DEFINED USE_LOG4CPP)
-  option(USE_LOG4CPP "Enable LOG4CPP" ON)
+if(NOT DEFINED USE_LOG4CPP)
+    option(USE_LOG4CPP "Enable LOG4CPP" ON)
 endif()
 
+option(USE_RELIC "Enable usage of Relic library for BLS threshold signature generation/verification" OFF)
+option(USE_CRYPTOPP_RSA "Enable usage of Crypto++ library for RSA/ECDSA signature generation/verification" OFF)
+option(USE_EDDSA_SINGLE_SIGN "Enable usage of OpenSSL library for EdDSA signature generation/verification" ON)
 option(RUN_APOLLO_TESTS "Enable Apollo tests run" ON)
 option(KEEP_APOLLO_LOGS "Retains logs from replicas in separate folder for each test in build/tests/apollo/logs" ON)
 option(TXN_SIGNING_ENABLED "Enable External concord client transcattion signing" ON)
@@ -42,11 +45,17 @@ option(USE_JSON "Enable use of JSON library" ON)
 option(USE_HTTPLIB "Enable use of httplib" ON)
 option(USE_GRPC "Enable GRPC and Protobuf" ON)
 option(USE_OPENSSL "Enable use of OpenSSL" ON)
+option(USE_EDDSA_OPENSSL "Enable use of EdDSA's OpenSSL implementation for signature generation and verification" ON)
 option(BUILD_THIRDPARTY "Wheter to build third party librarie or use preinstalled ones" OFF)
 option(CODECOVERAGE "Enable Code Coverage Metrics in Clang" OFF)
 option(ENABLE_RESTART_RECOVERY_TESTS "Enable tests for restart recovery" OFF)
 
-if(USE_OPENSSL AND NOT BUILD_THIRDPARTY)
+if(NOT (USE_EDDSA_OPENSSL OR USE_RELIC))
+    message(FATAL_ERROR "At least one threshold/multisig implementation needs to be chosen, "
+            "Define at least one of the following cmake options: [USE_EDDSA_OPENSSL, USE_RELIC]")
+endif()
+
+if((USE_OPENSSL OR USE_EDDSA_OPENSSL) AND NOT BUILD_THIRDPARTY)
     set(OPENSSL_ROOT_DIR /usr/local/ssl) # not to confuse with system ssl libs
 endif()
 
@@ -59,6 +68,11 @@ if(BUILD_COMM_TCP_TLS)
     math(EXPR COMM_MODULES "${COMM_MODULES}+1")
 endif()
 
+if ((NOT USE_CRYPTOPP_RSA) AND (NOT USE_EDDSA_SINGLE_SIGN))
+    message(FATAL_ERROR "At least one signature/verification algorithm implementation must be chosen. "
+            "Choose at least one of the following cmake options: [USE_EDDSA_SINGLE_SIGN, USE_CRYPTOPP_RSA]")
+endif()
+
 # UDP module is not part of the CMake configuration, it will be used by default
 # if neither of plain TCP or TLS will be chosen
 if(${COMM_MODULES} GREATER 1)

Makefile

@@ -1,6 +1,6 @@
 CONCORD_BFT_DOCKER_REPO?=concordbft/
 CONCORD_BFT_DOCKER_IMAGE?=concord-bft
-CONCORD_BFT_DOCKER_IMAGE_VERSION?=0.42
+CONCORD_BFT_DOCKER_IMAGE_VERSION?=0.45
 CONCORD_BFT_DOCKER_CONTAINER?=concord-bft
 
 CONCORD_BFT_DOCKERFILE?=Dockerfile
@@ -58,6 +58,7 @@ CONCORD_BFT_CMAKE_TSAN?=FALSE
 CONCORD_BFT_CMAKE_CODECOVERAGE?=FALSE
 CONCORD_BFT_CMAKE_USE_FAKE_CLOCK_IN_TIME_SERVICE?=FALSE
 ENABLE_RESTART_RECOVERY_TESTS?=FALSE
+
 ifeq (${CONCORD_BFT_CMAKE_ASAN},TRUE)
 	CONCORD_BFT_CMAKE_CXX_FLAGS_RELEASE='-O0 -g'
 else ifeq (${CONCORD_BFT_CMAKE_TSAN},TRUE)
@@ -93,7 +94,6 @@ CONCORD_BFT_CMAKE_FLAGS?= \
 			-DTXN_SIGNING_ENABLED=${CONCORD_BFT_CMAKE_TRANSACTION_SIGNING_ENABLED} \
 			-DENABLE_RESTART_RECOVERY_TESTS=${ENABLE_RESTART_RECOVERY_TESTS}
 
-
 # The consistency parameter makes sense only at MacOS.
 # It is ignored at all other platforms.
 CONCORD_BFT_CONTAINER_MOUNT_CONSISTENCY?=,consistency=cached
@@ -201,7 +201,8 @@ tidy-check: gen_cmake ## Run clang-tidy
 		make -C ${CONCORD_BFT_CLIENT_PROTO_PATH} &> /dev/null && \
 		make -C ${CONCORD_BFT_THIN_REPLICA_PROTO_PATH} &> /dev/null && \
 		make -C ${CONCORD_BFT_KVBC_PROTO_PATH} &> /dev/null && \
-		${CONCORD_BFT_CLANG_TIDY} -ignore ../.clang-tidy-ignore 2>&1 | tee clang-tidy-report.txt | ( ! grep 'error:\|note:' ) && \
+		${CONCORD_BFT_CLANG_TIDY} -ignore ../.clang-tidy-ignore 2>&1 | tee clang-tidy-report.txt && \
+		cat clang-tidy-report.txt | ( ! grep 'error:\|note:' ) && \
 		../scripts/check-forbidden-usage.sh .." \
 		&& (echo "\nClang-tidy finished successfully.") \
 		|| ( echo "\nClang-tidy failed. The full report is in ${CURDIR}/${CONCORD_BFT_BUILD_DIR}/clang-tidy-report.txt. \

bftengine/include/bcstatetransfer/SimpleBCStateTransfer.hpp

@@ -21,9 +21,8 @@
 #include "bftengine/IStateTransfer.hpp"
 #include "Metrics.hpp"
 #include "kvstream.h"
-#include "Digest.hpp"
+#include "digest.hpp"
 
-using concord::util::digest::Digest;
 using concord::util::digest::BlockDigest;
 
 namespace concord {
@@ -48,7 +47,7 @@ namespace bcst {
 // blocks.
 // Blocks are numbered. The first block should be block number 1.
 
-// represnts a digest
+// represents a digest
 #pragma pack(push, 1)
 struct StateTransferDigest {
   char content[DIGEST_SIZE];

bftengine/include/bftengine/IKeyExchanger.hpp

@@ -10,7 +10,7 @@
 // file.
 
 #pragma once
-#include "crypto_utils.hpp"
+#include "cryptopp_utils.hpp"
 #include <string>
 #include <cstdint>
 

bftengine/include/bftengine/KeyExchangeManager.hpp

@@ -18,7 +18,7 @@
 #include "Metrics.hpp"
 #include "secrets_manager_impl.h"
 #include "SysConsts.hpp"
-#include "crypto_utils.hpp"
+#include "cryptopp_utils.hpp"
 #include <future>
 namespace bftEngine::impl {
 

bftengine/src/bcstatetransfer/AsyncStateTransferCRE.cpp

@@ -71,12 +71,12 @@ class Communication : public ICommunication {
   uint16_t repId_;
 };
 
-class InternalSigner : public concord::util::crypto::ISigner {
+class InternalSigner : public concord::crypto::ISigner {
  public:
   std::string sign(const std::string& data) override {
     std::string out;
     out.resize(bftEngine::impl::SigManager::instance()->getMySigLength());
-    bftEngine::impl::SigManager::instance()->sign(data.data(), data.size(), out.data(), signatureLength());
+    bftEngine::impl::SigManager::instance()->sign(data.data(), data.size(), out.data());
     return out;
   }
   uint32_t signatureLength() const override { return bftEngine::impl::SigManager::instance()->getMySigLength(); }

bftengine/src/bcstatetransfer/BCStateTran.cpp

@@ -23,7 +23,6 @@
 #include "assertUtils.hpp"
 #include "hex_tools.h"
 #include "BCStateTran.hpp"
-#include "Digest.hpp"
 #include "InMemoryDataStore.hpp"
 #include "json_output.hpp"
 #include "ReservedPagesClient.hpp"
@@ -39,7 +38,7 @@ using std::tie;
 using namespace std::placeholders;
 using namespace concord::diagnostics;
 using namespace concord::util;
-using concord::util::digest::DigestUtil;
+using concord::util::digest::DigestGenerator;
 
 // uncomment to add debug prints
 // #define BCSTATETRAN_DO_DEBUG
@@ -603,7 +602,7 @@ const Digest &BCStateTran::computeDefaultRvbDataDigest() const {
 
   std::call_once(calculate_once, [&] {
     static constexpr int kDefaultInputRvbDataDigest = 1;
-    concord::util::digest::DigestUtil::Context ctx;
+    DigestGenerator ctx;
     ctx.update(reinterpret_cast<const char *>(&kDefaultInputRvbDataDigest), sizeof(kDefaultInputRvbDataDigest));
     ctx.writeDigest(defaultRvbDataDigest.getForUpdate());
     LOG_INFO(logging::getLogger("concord.bft"), KVLOG(defaultRvbDataDigest));
@@ -636,7 +635,7 @@ void BCStateTran::getDigestOfCheckpointImpl(uint64_t checkpointNumber,
 
   if (rvbDataSize != 0) {
     // RVB data exists: calculate a digest bases on the checkpoint desc.rvbData and it's size
-    DigestUtil::Context digestCtx;
+    DigestGenerator digestCtx;
     digestCtx.update(reinterpret_cast<const char *>(desc.rvbData.data()), rvbDataSize);
     digestCtx.update(reinterpret_cast<const char *>(&rvbDataSize), sizeof(rvbDataSize));
     digestCtx.writeDigest(rvbDataDigest.getForUpdate());
@@ -3856,17 +3855,19 @@ void BCStateTran::checkStoredCheckpoints(uint64_t firstStoredCheckpoint, uint64_
 
 void BCStateTran::computeDigestOfPage(
     const uint32_t pageId, const uint64_t checkpointNumber, const char *page, uint32_t pageSize, Digest &outDigest) {
-  DigestUtil::Context c;
-  c.update(reinterpret_cast<const char *>(&pageId), sizeof(pageId));
-  c.update(reinterpret_cast<const char *>(&checkpointNumber), sizeof(checkpointNumber));
-  if (checkpointNumber > 0) c.update(page, pageSize);
-  c.writeDigest(outDigest.getForUpdate());
+  DigestGenerator digestGenerator;
+  digestGenerator.update(reinterpret_cast<const char *>(&pageId), sizeof(pageId));
+  digestGenerator.update(reinterpret_cast<const char *>(&checkpointNumber), sizeof(checkpointNumber));
+  if (checkpointNumber > 0) {
+    digestGenerator.update(page, pageSize);
+  }
+  digestGenerator.writeDigest(reinterpret_cast<char *>(&outDigest));
 }
 
 void BCStateTran::computeDigestOfPagesDescriptor(const DataStore::ResPagesDescriptor *pagesDesc, Digest &outDigest) {
-  DigestUtil::Context c;
-  c.update(reinterpret_cast<const char *>(pagesDesc), pagesDesc->size());
-  c.writeDigest(outDigest.getForUpdate());
+  DigestGenerator digestGenerator;
+  digestGenerator.update(reinterpret_cast<const char *>(pagesDesc), pagesDesc->size());
+  digestGenerator.writeDigest(reinterpret_cast<char *>(&outDigest));
 }
 
 void BCStateTran::computeDigestOfBlockImpl(const uint64_t blockNum,
@@ -3875,10 +3876,10 @@ void BCStateTran::computeDigestOfBlockImpl(const uint64_t blockNum,
                                            char *outDigest) {
   ConcordAssertGT(blockNum, 0);
   ConcordAssertGT(blockSize, 0);
-  DigestUtil::Context c;
-  c.update(reinterpret_cast<const char *>(&blockNum), sizeof(blockNum));
-  c.update(block, blockSize);
-  c.writeDigest(outDigest);
+  DigestGenerator digestGenerator;
+  digestGenerator.update(reinterpret_cast<const char *>(&blockNum), sizeof(blockNum));
+  digestGenerator.update(block, blockSize);
+  digestGenerator.writeDigest(outDigest);
 }
 
 void BCStateTran::computeDigestOfBlock(const uint64_t blockNum,

bftengine/src/bcstatetransfer/DataStore.hpp

@@ -18,7 +18,7 @@
 #include <set>
 #include "assertUtils.hpp"
 #include "storage/db_interface.h"
-#include "Digest.hpp"
+#include "digest.hpp"
 #include "Logger.hpp"
 
 using std::set;

bftengine/src/bcstatetransfer/RVBManager.cpp

@@ -15,7 +15,7 @@
 #include "RVBManager.hpp"
 #include "throughput.hpp"
 
-using concord::util::digest::DigestUtil;
+using concord::util::digest::DigestGenerator;
 using namespace std;
 using namespace concord::util;
 
@@ -629,10 +629,10 @@ void RVBManager::computeDigestOfBlock(const uint64_t block_id,
                                       char* out_digest) const {
   ConcordAssertGT(block_id, 0);
   ConcordAssertGT(block_size, 0);
-  DigestUtil::Context c;
-  c.update(reinterpret_cast<const char*>(&block_id), sizeof(block_id));
-  c.update(block, block_size);
-  c.writeDigest(out_digest);
+  DigestGenerator digest_generator;
+  digest_generator.update(reinterpret_cast<const char*>(&block_id), sizeof(block_id));
+  digest_generator.update(block, block_size);
+  digest_generator.writeDigest(out_digest);
 }
 
 // TODO - BCStateTran has a similar function + computeDigestOfBlock.

bftengine/src/bcstatetransfer/RangeValidationTree.cpp

@@ -15,11 +15,11 @@
 #include <algorithm>
 
 #include "RangeValidationTree.hpp"
-#include "Digest.hpp"
+#include "digest.hpp"
 #include "type_traits"
 #include "throughput.hpp"
 
-using concord::util::digest::DigestUtil;
+using concord::util::digest::DigestGenerator;
 
 using namespace std;
 using namespace concord::serialize;
@@ -150,13 +150,13 @@ uint64_t NodeInfo::prevRvbIndex(uint64_t rvb_index, uint8_t level) {
 // This requires us to write our own DigestContext
 const shared_ptr<char[]> RVBNode::computeNodeInitialValue(NodeInfo& node_info, const char* data, size_t data_size) {
   ConcordAssertGT(node_info.id(), 0);
-  DigestUtil::Context c;
+  DigestGenerator digest_generator;
 
-  c.update(reinterpret_cast<const char*>(&node_info.id_data_), sizeof(node_info.id_data_));
-  c.update(data, data_size);
+  digest_generator.update(reinterpret_cast<const char*>(&node_info.id_data_), sizeof(node_info.id_data_));
+  digest_generator.update(data, data_size);
   // TODO - Use default_delete in case memleak is reported by ASAN
   static std::shared_ptr<char[]> out_digest_buff(new char[NodeVal::kDigestContextOutputSize]);
-  c.writeDigest(out_digest_buff.get());
+  digest_generator.writeDigest(out_digest_buff.get());
   return out_digest_buff;
 }
 

bftengine/src/bcstatetransfer/RangeValidationTree.hpp

@@ -24,7 +24,7 @@
 
 #include <cryptopp/integer.h>
 
-#include "Digest.hpp"
+#include "digest.hpp"
 #include "Serializable.h"
 #include "Logger.hpp"
 #include "Metrics.hpp"

bftengine/src/bftengine/BFTEngine.cpp

@@ -25,22 +25,13 @@
 #include "ReservedPagesClient.hpp"
 #include "bftengine/EpochManager.hpp"
 #include "bcstatetransfer/AsyncStateTransferCRE.hpp"
+#include "util/filesystem.hpp"
 #include <condition_variable>
 #include <memory>
 #include <mutex>
 #include <cstdio>
 #include <utility>
 
-#if __has_include(<filesystem>)
-#include <filesystem>
-namespace fs = std::filesystem;
-#elif __has_include(<experimental/filesystem>)
-#include <experimental/filesystem>
-namespace fs = std::experimental::filesystem;
-#else
-#error "Missing filesystem support"
-#endif
-
 #include <ccron/ticks_generator.hpp>
 
 bftEngine::IReservedPages *bftEngine::ReservedPagesClientBase::res_pages_ = nullptr;