ver: curve25519-dalek update to 4.1.2; sha3 workspace

Cargo.toml

@@ -186,7 +186,7 @@ criterion-stats = "0.3.0"
 crossbeam-channel = "0.5.12"
 csv = "1.3.0"
 ctrlc = "3.4.4"
-curve25519-dalek = "3.2.1"
+curve25519-dalek = {  version = "4.1", features = [ "rand_core", "digest" ] }
 dashmap = "5.5.3"
 derivation-path = { version = "0.2.0", default-features = false }
 derivative = "2.2.0"
@@ -196,8 +196,8 @@ dir-diff = "0.3.3"
 dirs-next = "2.0.0"
 dlopen2 = "0.5.0"
 eager = "0.1.0"
-ed25519-dalek = "=1.0.1"
-ed25519-dalek-bip32 = "0.2.0"
+ed25519-dalek = "2.1.1"
+ed25519-dalek-bip32 = "0.3.0"
 either = "1.10.0"
 enum-iterator = "1.5.0"
 env_logger = "0.9.3"
@@ -279,6 +279,7 @@ quinn = "0.10.2"
 quinn-proto = "0.10.6"
 quote = "1.0"
 rand = "0.8.5"
+rand_core = "0.6.4"
 rand_chacha = "0.3.1"
 raptorq = "1.8.1"
 rayon = "1.9.0"
@@ -515,39 +516,6 @@ solana-zk-token-sdk = { path = "zk-token-sdk" }
 git = "https://github.com/RustCrypto/AEADs"
 rev = "6105d7a5591aefa646a95d12b5e8d3f55a9214ef"
 
-# Our dependency tree has `curve25519-dalek` v3.2.1.  They have removed the
-# constraint in the next major release. The commit that removes the `zeroize`
-# constraint was added to multiple release branches, but not to the 3.2 branch.
-#
-# `curve25519-dalek` maintainers are saying they do not want to invest any more
-# time in the 3.2 release:
-#
-# https://github.com/dalek-cryptography/curve25519-dalek/issues/452#issuecomment-1749809428
-#
-# So we have to fork and create our own release, based on v3.2.1, with the
-# commit that removed `zeroize` constraint on the `main` branch cherry-picked on
-# top.
-#
-# `curve25519-dalek` v3.2.1 release:
-#
-# https://github.com/dalek-cryptography/curve25519-dalek/releases/tag/3.2.1
-#
-# Corresponds to commit
-#
-# https://github.com/dalek-cryptography/curve25519-dalek/commit/29e5c29b0e5c6821e4586af58b0d0891dd2ec639
-#
-# Comparison with `b500cdc2a920cd5bff9e2dd974d7b97349d61464`:
-#
-# https://github.com/dalek-cryptography/curve25519-dalek/compare/3.2.1...solana-labs:curve25519-dalek:b500cdc2a920cd5bff9e2dd974d7b97349d61464
-#
-# Or, using the branch name instead of the hash:
-#
-# https://github.com/dalek-cryptography/curve25519-dalek/compare/3.2.1...solana-labs:curve25519-dalek:3.2.1-unpin-zeroize
-#
-[patch.crates-io.curve25519-dalek]
-git = "https://github.com/solana-labs/curve25519-dalek.git"
-rev = "b500cdc2a920cd5bff9e2dd974d7b97349d61464"
-
 # Solana RPC nodes experience stalls when running with `tokio` containing this
 # commit:
 # https://github.com/tokio-rs/tokio/commit/4eed411519783ef6f58cbf74f886f91142b5cfa6

cli-output/src/display.rs

@@ -727,6 +727,7 @@ pub fn unix_timestamp_to_string(unix_timestamp: UnixTimestamp) -> String {
 mod test {
     use {
         super::*,
+        console::Key,
         solana_sdk::{
             message::{
                 v0::{self, LoadedAddresses},
@@ -742,10 +743,7 @@ mod test {
     };
 
     fn new_test_keypair() -> Keypair {
-        let secret = ed25519_dalek::SecretKey::from_bytes(&[0u8; 32]).unwrap();
-        let public = ed25519_dalek::PublicKey::from(&secret);
-        let keypair = ed25519_dalek::Keypair { secret, public };
-        Keypair::from_bytes(&keypair.to_bytes()).unwrap()
+        Keypair::new()
     }
 
     fn new_test_v0_transaction() -> VersionedTransaction {

ledger/src/sigverify_shreds.rs

@@ -336,7 +336,7 @@ pub fn sign_shreds_cpu(thread_pool: &ThreadPool, keypair: &Keypair, batches: &mu
 pub fn sign_shreds_gpu_pinned_keypair(keypair: &Keypair, cache: &RecyclerCache) -> PinnedVec<u8> {
     let mut vec = cache.buffer().allocate("pinned_keypair");
     let pubkey = keypair.pubkey().to_bytes();
-    let secret = keypair.secret().to_bytes();
+    let secret = keypair.secret();
     let mut hasher = Sha512::default();
     hasher.update(secret);
     let mut result = hasher.finalize();

perf/src/sigverify.rs

@@ -1281,9 +1281,9 @@ mod tests {
                 thread_rng().fill(&mut input);
                 let ans = get_checked_scalar(&input);
                 let ref_ans = Scalar::from_canonical_bytes(input);
-                if let Some(ref_ans) = ref_ans {
+                if ref_ans.is_some().into() {
                     passed += 1;
-                    assert_eq!(ans.unwrap(), ref_ans.to_bytes());
+                    assert_eq!(ans.unwrap(), ref_ans.unwrap().to_bytes());
                 } else {
                     failed += 1;
                     assert!(ans.is_err());
@@ -1316,7 +1316,7 @@ mod tests {
                 thread_rng().fill(&mut input);
                 let ans = check_packed_ge_small_order(&input);
                 let ref_ge = CompressedEdwardsY::from_slice(&input);
-                if let Some(ref_element) = ref_ge.decompress() {
+                if let Some(ref_element) = ref_ge.unwrap().decompress() {
                     if ref_element.is_small_order() {
                         assert!(!ans);
                     } else {

programs/ed25519-tests/tests/process_transaction.rs

@@ -1,3 +1,5 @@
+use ed25519_dalek::SigningKey;
+use rand::rngs::OsRng;
 use {
     assert_matches::assert_matches,
     solana_program_test::*,
@@ -8,18 +10,8 @@ use {
     },
 };
 
-// Since ed25519_dalek is still using the old version of rand, this test
-// copies the `generate` implementation at:
-// https://docs.rs/ed25519-dalek/1.0.1/src/ed25519_dalek/secret.rs.html#167
-fn generate_keypair() -> ed25519_dalek::Keypair {
-    use rand::RngCore;
-    let mut rng = rand::thread_rng();
-    let mut seed = [0u8; ed25519_dalek::SECRET_KEY_LENGTH];
-    rng.fill_bytes(&mut seed);
-    let secret =
-        ed25519_dalek::SecretKey::from_bytes(&seed[..ed25519_dalek::SECRET_KEY_LENGTH]).unwrap();
-    let public = ed25519_dalek::PublicKey::from(&secret);
-    ed25519_dalek::Keypair { secret, public }
+fn generate_keypair() -> SigningKey {
+    SigningKey::generate(&mut OsRng)
 }
 
 #[tokio::test]

runtime/src/bank/tests.rs

@@ -1,4 +1,5 @@
 #![cfg(test)]
+use rand::rngs::OsRng;
 #[allow(deprecated)]
 use solana_sdk::sysvar::fees::Fees;
 use {
@@ -10030,17 +10031,7 @@ fn test_call_precomiled_program() {
     // Since ed25519_dalek is still using the old version of rand, this test
     // copies the `generate` implementation at:
     // https://docs.rs/ed25519-dalek/1.0.1/src/ed25519_dalek/secret.rs.html#167
-    let privkey = {
-        use rand::RngCore;
-        let mut rng = rand::thread_rng();
-        let mut seed = [0u8; ed25519_dalek::SECRET_KEY_LENGTH];
-        rng.fill_bytes(&mut seed);
-        let secret =
-            ed25519_dalek::SecretKey::from_bytes(&seed[..ed25519_dalek::SECRET_KEY_LENGTH])
-                .unwrap();
-        let public = ed25519_dalek::PublicKey::from(&secret);
-        ed25519_dalek::Keypair { secret, public }
-    };
+    let privkey = ed25519_dalek::SigningKey::generate(&mut OsRng);
     let message_arr = b"hello";
     let instruction =
         solana_sdk::ed25519_instruction::new_ed25519_instruction(&privkey, message_arr);

sdk/program/src/pubkey.rs

@@ -168,8 +168,7 @@ pub fn bytes_are_curve_point<T: AsRef<[u8]>>(_bytes: T) -> bool {
     #[cfg(not(target_os = "solana"))]
     {
         curve25519_dalek::edwards::CompressedEdwardsY::from_slice(_bytes.as_ref())
-            .decompress()
-            .is_some()
+            .is_ok_and(|compressed| compressed.decompress().is_some())
     }
     #[cfg(target_os = "solana")]
     unimplemented!();
@@ -948,8 +947,7 @@ mod tests {
                 let is_on_curve = curve25519_dalek::edwards::CompressedEdwardsY::from_slice(
                     &program_address.to_bytes(),
                 )
-                .decompress()
-                .is_some();
+                .is_ok_and(|compressed| compressed.decompress().is_some());
                 assert!(!is_on_curve);
                 assert!(!addresses.contains(&program_address));
                 addresses.push(program_address);

sdk/src/ed25519_instruction.rs

@@ -7,7 +7,7 @@
 use {
     crate::{feature_set::FeatureSet, instruction::Instruction, precompiles::PrecompileError},
     bytemuck::{bytes_of, Pod, Zeroable},
-    ed25519_dalek::{ed25519::signature::Signature, Signer, Verifier},
+    ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey},
 };
 
 pub const PUBKEY_SERIALIZED_SIZE: usize = 32;
@@ -29,9 +29,9 @@ pub struct Ed25519SignatureOffsets {
     message_instruction_index: u16,    // index of instruction data to get message data
 }
 
-pub fn new_ed25519_instruction(keypair: &ed25519_dalek::Keypair, message: &[u8]) -> Instruction {
+pub fn new_ed25519_instruction(keypair: &SigningKey, message: &[u8]) -> Instruction {
     let signature = keypair.sign(message).to_bytes();
-    let pubkey = keypair.public.to_bytes();
+    let pubkey = keypair.verifying_key().to_bytes();
 
     assert_eq!(pubkey.len(), PUBKEY_SERIALIZED_SIZE);
     assert_eq!(signature.len(), SIGNATURE_SERIALIZED_SIZE);
@@ -120,8 +120,10 @@ pub fn verify(
             SIGNATURE_SERIALIZED_SIZE,
         )?;
 
-        let signature =
-            Signature::from_bytes(signature).map_err(|_| PrecompileError::InvalidSignature)?;
+        let mut signature_sized = [0u8; 64];
+        signature_sized.copy_from_slice(signature);
+
+        let signature = Signature::from_bytes(&signature_sized);
 
         // Parse out pubkey
         let pubkey = get_data_slice(
@@ -132,7 +134,10 @@ pub fn verify(
             PUBKEY_SERIALIZED_SIZE,
         )?;
 
-        let publickey = ed25519_dalek::PublicKey::from_bytes(pubkey)
+        let mut pubkey_sized = [0u8; 32];
+        pubkey_sized.copy_from_slice(pubkey);
+
+        let publickey = VerifyingKey::from_bytes(&pubkey_sized)
             .map_err(|_| PrecompileError::InvalidPublicKey)?;
 
         // Parse out message
@@ -188,6 +193,7 @@ pub mod test {
             signature::{Keypair, Signer},
             transaction::Transaction,
         },
+        rand::rngs::OsRng,
         rand0_7::{thread_rng, Rng},
     };
 
@@ -347,7 +353,7 @@ pub mod test {
     fn test_ed25519() {
         solana_logger::setup();
 
-        let privkey = ed25519_dalek::Keypair::generate(&mut thread_rng());
+        let privkey = ed25519_dalek::SigningKey::generate(&mut OsRng);
         let message_arr = b"hello";
         let mut instruction = new_ed25519_instruction(&privkey, message_arr);
         let mint_keypair = Keypair::new();

sdk/src/signature.rs

@@ -1,6 +1,8 @@
 //! Functionality for public and private keys.
 #![cfg(feature = "full")]
 
+use ed25519_dalek::PUBLIC_KEY_LENGTH;
+
 // legacy module paths
 pub use crate::signer::{keypair::*, null_signer::*, presigner::*, *};
 use {
@@ -46,7 +48,12 @@ impl Signature {
         pubkey_bytes: &[u8],
         message_bytes: &[u8],
     ) -> Result<(), ed25519_dalek::SignatureError> {
-        let publickey = ed25519_dalek::PublicKey::from_bytes(pubkey_bytes)?;
+        if pubkey_bytes.len() != PUBLIC_KEY_LENGTH {
+            return Err(ed25519_dalek::SignatureError::new());
+        }
+        let mut pubkey_bytes_sized = [0u8; PUBLIC_KEY_LENGTH];
+        pubkey_bytes_sized.copy_from_slice(pubkey_bytes);
+        let publickey = ed25519_dalek::VerifyingKey::from_bytes(&pubkey_bytes_sized)?;
         let signature = self.0.as_slice().try_into()?;
         publickey.verify_strict(message_bytes, &signature)
     }