feat: private authwit with static call

[LHerskind]

Updates the private authwit to use static calls instead. Without this, it is possible to re-enter using the authwits which is horrible.

---

The private authwit validation is now making a static call to the account contract instead of passing over control flow. This is to ensure that it cannot be used for re-entry.

To make this change however, we cannot allow emitting a nullifying from the account contract, since that would break the static call. Instead, we will be changing the verify_private_authwit to a verify_private_authwit and in the auth library emit the nullifier. This means that the "calling" contract will now be emitting the nullifier, and not the account. For example, for a token contract, the nullifier is now emitted by the token contract. However, as this is done inside the auth library, the token contract don't need to change much.

The biggest difference is related to "cancelling" an authwit. Since it is no longer in the account contract, you cannot just emit a nullifier from it anymore. Instead it must rely on the token contract providing functionality for cancelling.

There are also a few general changes to how authwits are generated, namely to more easily support the data required for a validity lookup now. Previously we could lookup the message_hash directly at the account contract, now we instead need to use the inner_hash and the contract of the consumer to figure out if it have already been emitted.

A minor extension have been made to the authwit creations to make it easier specific a hash that needs to be signed with a specific caller, e.g., the inner_hash can be provided as {consumer, inner_hash} to the createAuthWit where it previously needed to do a couple of manual steps to compute the outer hash. The computeOuterAuthWitHash have been amde internal and the computeAuthWitMessageHash can instead be used to compute the values similarly to other authwit computations.

const innerHash = computeInnerAuthWitHash([Fr.ZERO, functionSelector.toField(), entrypointPackedArgs.hash]);
-const outerHash = computeOuterAuthWitHash(
-    this.dappEntrypointAddress,
-    new Fr(this.chainId),
-    new Fr(this.version),
-    innerHash,
-);
+const outerHash = computeAuthWitMessageHash(
+    { consumer: this.dappEntrypointAddress, innerHash },
+    { chainId: new Fr(this.chainId), version: new Fr(this.version) },
+);

If the wallet is used to compute the authwit, it will populate the chain id and version instead of requiring it to be provided by tha actor.

const innerHash = computeInnerAuthWitHash([Fr.fromString('0xdead')]);
-const outerHash = computeOuterAuthWitHash(wallets[1].getAddress(), chainId, version, innerHash);
-const witness = await wallets[0].createAuthWit(outerHash);
+ const witness = await wallets[0].createAuthWit({ comsumer: accounts[1].address, inner_hash });

[LHerskind]

• feat: private authwit with static call #7073 👈
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @LHerskind and the rest of your teammates on Graphite

[AztecBot]

Benchmark results

Metrics with a significant change:

• avm_simulation_time_ms (Token:mint_public): 623 (+741%)
• avm_simulation_time_ms (Token:assert_minter_and_mint): 74.5 (-66%)
• protocol_circuit_witness_generation_time_in_ms (private-kernel-reset-small): 2,485 (+16%)

Detailed results

All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.

This benchmark source data is available in JSON format on S3 here.

Proof generation

Each column represents the number of threads used in proof generation.

Metric	1 threads	4 threads	16 threads	32 threads	64 threads
proof_construction_time_sha256_30_ms	11,493 (+1%)	3,113 (+1%)	1,702 (+8%)	1,426 (-10%)	1,455
proof_construction_time_sha256_100_ms	45,416 (+2%)	12,168 (+1%)	5,657 (-1%)	5,561	5,492
proof_construction_time_poseidon_hash_ms	79.0 (+1%)	34.0	34.0	57.0 (-2%)	87.0
proof_construction_time_poseidon_hash_30_ms	1,536 (+2%)	424 (+2%)	202	226 (+2%)	269 (+1%)
proof_construction_time_poseidon_hash_100_ms	5,815 (+2%)	1,592 (+1%)	728 (+1%)	775	805 (+1%)

L2 block published to L1

Each column represents the number of txs on an L2 block published to L1.

Metric	4 txs	8 txs	16 txs
l1_rollup_calldata_size_in_bytes	1,412	1,412	1,412
l1_rollup_calldata_gas	9,476	9,466	9,464
l1_rollup_execution_gas	610,297	610,287	610,285
l2_block_processing_time_in_ms	751 (+1%)	1,402 (+1%)	2,677 (+1%)
l2_block_building_time_in_ms	25,583 (+1%)	51,149 (+1%)	100,065 (+1%)
l2_block_rollup_simulation_time_in_ms	25,488 (+1%)	50,845 (+1%)	99,712 (+1%)
l2_block_public_tx_process_time_in_ms	21,887 (+1%)	47,060	95,982 (+1%)

L2 chain processing

Each column represents the number of blocks on the L2 chain where each block has 8 txs.

Metric	3 blocks	5 blocks
node_history_sync_time_in_ms	6,960	9,785
node_database_size_in_bytes	12,161,104	16,089,168
pxe_database_size_in_bytes	16,254	26,813

Circuits stats

Stats on running time and I/O sizes collected for every kernel circuit run across all benchmarks.

Circuit	simulation_time_in_ms	witness_generation_time_in_ms	proving_time_in_ms	input_size_in_bytes	output_size_in_bytes	proof_size_in_bytes	num_public_inputs	size_in_gates
private-kernel-init	130 (+1%)	501	12,379 (+3%)	20,634	67,190	92,352	2,819	524,288
private-kernel-inner	394 (+1%)	1,028 (-14%)	44,907	94,902	67,190	92,352	2,819	2,097,152
private-kernel-tail	371	1,856	45,960	99,121	71,733	14,912	399	2,097,152
base-parity	6.19 (-2%)	1,930 (-4%)	2,539 (-3%)	128	64.0	2,208	2.00	131,072
root-parity	49.3	47.8 (+1%)	33,570 (-2%)	27,100	64.0	2,720	18.0	2,097,152
base-rollup	7,923	4,384	71,978	170,330	756	3,648	47.0	4,194,304
root-rollup	112	62.6 (-3%)	19,361 (-1%)	25,309	620	3,456	41.0	1,048,576
public-kernel-setup	721 (-1%)	3,131 (-1%)	38,595 (-1%)	116,905	93,334	125,344	3,850	2,097,152
public-kernel-app-logic	615	4,189 (+1%)	40,259 (+1%)	116,905	93,334	125,344	3,850	2,097,152
public-kernel-tail	1,418	32,708 (+8%)	166,943 (+1%)	511,910	10,014	14,912	399	8,388,608
private-kernel-reset-small	595 (+1%)	⚠️ 2,485 (+16%)	41,634 (+2%)	123,313	67,190	92,352	2,819	2,097,152
public-kernel-teardown	616	4,206 (+1%)	40,534	116,905	93,334	125,344	3,850	2,097,152
merge-rollup	28.8	N/A	N/A	16,542	756	N/A	N/A	N/A
private-kernel-tail-to-public	N/A	7,172 (-1%)	84,650	N/A	N/A	125,344	3,850	4,194,304

Stats on running time collected for app circuits

Function	input_size_in_bytes	output_size_in_bytes	witness_generation_time_in_ms	proof_size_in_bytes	proving_time_in_ms	size_in_gates	num_public_inputs
ContractClassRegisterer:register	1,344	9,944	405	N/A	N/A	N/A	N/A
ContractInstanceDeployer:deploy	1,408	9,944	40.7	N/A	N/A	N/A	N/A
MultiCallEntrypoint:entrypoint	1,920	9,944	1,805 (+1%)	N/A	N/A	N/A	N/A
GasToken:deploy	1,376	9,944	980	N/A	N/A	N/A	N/A
SchnorrAccount:constructor	1,312	9,944	1,463 (+1%)	N/A	N/A	N/A	N/A
SchnorrAccount:entrypoint	2,304	9,944	2,833	16,768	51,026	2,097,152	457
Token:privately_mint_private_note	1,280	9,944	1,736	N/A	N/A	N/A	N/A
FPC:fee_entrypoint_public	1,344	9,944	374 (-6%)	16,768	10,619 (+3%)	524,288	457
Token:transfer	1,312	9,944	4,512 (-2%)	16,768	41,875	2,097,152	457
AuthRegistry:set_authorized (avm)	21,043	N/A	N/A	87,200	1,720 (+7%)	N/A	N/A
Token:transfer_public (avm)	44,971	N/A	N/A	87,865	4,120 (+1%)	N/A	N/A
AuthRegistry:consume (avm)	34,973	N/A	N/A	87,616	2,864	N/A	N/A
Benchmarking:create_note	1,344	9,944	1,400 (+1%)	N/A	N/A	N/A	N/A
SchnorrAccount:verify_private_authwit	1,280	9,944	73.6	N/A	N/A	N/A	N/A
Token:unshield	1,376	9,944	3,584	N/A	N/A	N/A	N/A
FPC:fee_entrypoint_private	1,376	9,944	4,521	N/A	N/A	N/A	N/A

AVM Simulation

Time to simulate various public functions in the AVM.

Function	time_ms	bytecode_size_in_bytes
GasToken:_increase_public_balance	68.6 (+1%)	13,873
GasToken:set_portal	16.1 (-4%)	3,495
Token:constructor	93.2 (-3%)	24,207
FPC:constructor	62.8 (-1%)	13,893
GasToken:mint_public	53.3 (+1%)	10,241
Token:mint_public	⚠️ 623 (+741%)	19,216
Token:assert_minter_and_mint	⚠️ 74.5 (-66%)	13,034
AuthRegistry:set_authorized	32.8	7,869
FPC:prepare_fee	179 (+21%)	15,187
Token:transfer_public	37.7 (-8%)	31,425
FPC:pay_refund	123 (-6%)	20,080
Benchmarking:increment_balance	2,688 (+1%)	15,465
Token:_increase_public_balance	55.7 (-2%)	15,089
FPC:pay_refund_with_shielded_rebate	144 (+1%)	21,167

Public DB Access

Time to access various public DBs.

Function	time_ms
get-nullifier-index	0.183 (+3%)

Tree insertion stats

The duration to insert a fixed batch of leaves into each tree type.

Metric	1 leaves	16 leaves	64 leaves	128 leaves	256 leaves	512 leaves	1024 leaves
batch_insert_into_append_only_tree_16_depth_ms	10.3	16.7	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_count	16.8	31.7	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_ms	0.598	0.515	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_32_depth_ms	N/A	N/A	48.6 (+1%)	75.5	131 (+2%)	244	470 (+2%)
batch_insert_into_append_only_tree_32_depth_hash_count	N/A	N/A	95.9	159	287	543	1,055
batch_insert_into_append_only_tree_32_depth_hash_ms	N/A	N/A	0.497 (+1%)	0.464	0.449 (+1%)	0.442	0.439 (+2%)
batch_insert_into_indexed_tree_20_depth_ms	N/A	N/A	59.4 (-2%)	111 (+1%)	181 (+1%)	351	690 (+1%)
batch_insert_into_indexed_tree_20_depth_hash_count	N/A	N/A	109	207	355	691	1,363
batch_insert_into_indexed_tree_20_depth_hash_ms	N/A	N/A	0.503 (-2%)	0.499 (+1%)	0.481 (+1%)	0.475	0.474 (+1%)
batch_insert_into_indexed_tree_40_depth_ms	N/A	N/A	72.6	N/A	N/A	N/A	N/A
batch_insert_into_indexed_tree_40_depth_hash_count	N/A	N/A	133	N/A	N/A	N/A	N/A
batch_insert_into_indexed_tree_40_depth_hash_ms	N/A	N/A	0.518 (+1%)	N/A	N/A	N/A	N/A

Miscellaneous

Transaction sizes based on how many contract classes are registered in the tx.

Metric	0 registered classes	1 registered classes
tx_size_in_bytes	85,672	670,983

Transaction size based on fee payment method

| Metric | |
| - | |

[AztecBot]

Docs Preview

Hey there! 👋 You can check your preview at https://66754c4eedf85b5e85ad5b87--aztec-docs-dev.netlify.app

[benesjan]

Looks good. Feel free to merge once you address my nits

[benesjan]

stale import

[benesjan]

Suggested change

	This function will then make a to `on_behalf_of` to execute the `verify_private_authwit` function which validates that the call is authenticated.
	This function will then make a call to `on_behalf_of` to execute the `verify_private_authwit` function which validates that the call is authenticated.

[benesjan]

Suggested change

To make this change however, we cannot allow emitting a nullifying from the account contract, since that would break the static call. Instead, we will be changing the `verify_private_authwit` to a `verify_private_authwit` and in the `auth` library emit the nullifier. This means that the "calling" contract will now be emitting the nullifier, and not the account. For example, for a token contract, the nullifier is now emitted by the token contract. However, as this is done inside the `auth` library, the token contract don't need to change much.

To make this change however, we cannot allow emitting a nullifier from the account contract, since that would break the static call. Instead, we will be changing the `spend_private_authwit` to a `verify_private_authwit` and in the `auth` library emit the nullifier. This means that the "calling" contract will now be emitting the nullifier, and not the account. For example, for a token contract, the nullifier is now emitted by the token contract. However, as this is done inside the `auth` library, the token contract doesn't need to change much.

[benesjan]

"to make it easier specific a hash that needs to be signed"

broken english here

[benesjan]

This does not seem to support the intent anymore given that the accepted type is Fr or Buffer.

[LHerskind]

Ah yes. This was the pain of needing both the wallet and the authwit provider to be happy 💀 Will fix.

[benesjan]

stale code?

[benesjan]

What was the reason that this had to be changed?

[LHerskind]

Needed an extra generator for the authwit nullifier, and to make sure that it was nicely "aligned" I needed to shift other generator indexes by 1.

[benesjan]

Suggested change

	// 2. We then compute the other, which is binding it to a "caller", here the "auth" contract
	// 2. We then compute the outer hash, which is binding it to a "caller" (here the "auth" contract)

[benesjan]

Suggested change

	// Consume the inner hash using the wallets[0] as the on behalf of.
	// Consume the inner hash using the wallets[0] as the "on behalf of".

[benesjan]

Not having the compute the message hash here "manually" is nice 👍