[cryptography/certificate] make namespace a part of the scheme #2559
Conversation
Deploying monorepo with
|
| Latest commit: |
924dd81
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://50485770.monorepo-eu0.pages.dev |
| Branch Preview URL: | https://andre-consensus-avoid-namesp.monorepo-eu0.pages.dev |
andresilva
force-pushed
the
andre/consensus-avoid-namespace-recomputation
branch
from
399896d to
dee840b
Compare
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
commonware-mcp | 924dd81 | Jan 05 2026, 06:54 AM |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
patrick-ogrady
left a comment
patrick-ogrady
left a comment
There was a problem hiding this comment.
Things are looking pretty good, just making my way through!
| /// This type encapsulates the pre-computed namespace bytes used for signing and | ||
| /// verifying acks. | ||
| #[derive(Clone, Debug)] | ||
| pub struct Namespace(Vec<u8>); |
There was a problem hiding this comment.
Considered suggesting we enshrine this type in cryptography but think that is out of scope/separate PR-worthy)
| /// | ||
| /// This struct holds the pre-computed namespace bytes for each vote type. | ||
| #[derive(Clone, Debug)] | ||
| pub struct Namespace { |
There was a problem hiding this comment.
Ah, now I see why this isn't enshrined.
patrick-ogrady
left a comment
patrick-ogrady
left a comment
There was a problem hiding this comment.
Making some small tweaks in #2688 then should be g2g
patrick-ogrady
deleted the
andre/consensus-avoid-namespace-recomputation
branch
Codecov Report❌ Patch coverage is
@@ Coverage Diff @@
## main #2559 +/- ##
==========================================
- Coverage 92.77% 92.77% -0.01%
==========================================
Files 362 362
Lines 105115 106061 +946
==========================================
+ Hits 97525 98398 +873
- Misses 7590 7663 +73
... and 11 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
This PR refactors the certificate scheme API to store the namespace in the scheme at construction time rather than passing it on every sign/verify call. This avoids redundant namespace derivation and simplifies the signing API.
The previous API required passing namespace bytes to every
sign(),verify_attestation(), andverify_attestations()call. For protocols like simplex with multiple message types (notarize, nullify, finalize, seed), this meant recomputing derived namespace bytes on every operation.The new design introduces a
Namespacetrait for types that can derive themselves from a base namespace. TheSubjecttrait now has an associatedNamespacetype, and the scheme computes this namespace once at construction. Sign and verify methods no longer need the namespace parameter since it's already stored in the scheme.Closes #2521.