Enforce encrypted transaction inputs on submission

bin/benchmark/Cargo.toml

@@ -20,6 +20,7 @@ workspace = true
 anyhow           = { workspace = true }
 clap             = { features = ["env", "string"], workspace = true }
 fs-err           = { workspace = true }
+hex              = { workspace = true }
 miden-node-proto = { workspace = true }
 miden-node-utils = { workspace = true }
 miden-protocol   = { features = ["std", "testing"], workspace = true }

bin/benchmark/README.md

@@ -47,11 +47,15 @@ Writes the bundle to `./benchmark-proofs/`:
 
 ```sh
 miden-benchmark run-benchmark \
-  --rpc-url http://127.0.0.1:57291 \
-  --concurrency 32 \
-  --wait-blocks 3
+  --rpc-url                      http://127.0.0.1:57291 \
+  --validator-signing-public-key <HEX> \
+  --concurrency                  32 \
+  --wait-blocks                  3
 ```
 
+The signing public key must match the validator key that signs transaction encryption key attestations. The benchmark
+will not submit transactions unless it can verify the advertised encryption key.
+
 Mints go in sequentially, then consumes with the requested concurrency, then the run waits `--wait-blocks` blocks before
 scanning for inclusion. Per-phase ack rate, RPC latency percentiles, inclusion rate, and inclusion TPS are printed at
 the end.

bin/benchmark/src/main.rs

@@ -11,8 +11,15 @@ use std::time::Duration;
 use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
 use miden_node_proto::clients::{Builder, RpcClient};
+use miden_node_proto::domain::encryption::{
+    TransactionInputsSealer,
+    TrustedTransactionEncryptionState,
+    verify_transaction_encryption_key,
+};
 use miden_node_proto::generated::rpc::BlockHeaderByNumberRequest;
+use miden_protocol::Word;
 use miden_protocol::block::{BlockHeader, BlockNumber};
+use miden_protocol::crypto::dsa::ecdsa_k256_keccak::PublicKey as ValidatorPublicKey;
 use miden_protocol::utils::serde::{Deserializable, Serializable};
 use url::Url;
 
@@ -80,6 +87,10 @@ pub enum Command {
         /// many blocks to fully include.
         #[arg(long, default_value_t = 30)]
         wait_blocks: u32,
+        /// Hex-encoded validator signing public key trusted to attest the transaction encryption
+        /// key.
+        #[arg(long)]
+        validator_signing_public_key: String,
     },
 }
 
@@ -104,8 +115,16 @@ impl Cli {
                 concurrency,
                 connections,
                 wait_blocks,
+                validator_signing_public_key,
             } => {
-                submit::run(rpc_url, concurrency, connections, wait_blocks).await;
+                submit::run(
+                    rpc_url,
+                    concurrency,
+                    connections,
+                    wait_blocks,
+                    validator_signing_public_key,
+                )
+                .await;
             },
         }
     }
@@ -119,7 +138,7 @@ impl Cli {
 async fn build_rpc_client(
     rpc_url: &Url,
     timeout: Duration,
-    genesis: Option<String>,
+    genesis: Option<Word>,
 ) -> Result<RpcClient> {
     let use_tls = rpc_url.scheme() == "https";
 
@@ -141,9 +160,9 @@ async fn build_rpc_client(
         .context("Failed to connect to RPC server")
 }
 
-/// Discover the genesis commitment (hex) of the node at `rpc_url`. This is the value write RPCs
-/// such as `SubmitProvenTransaction` expect echoed back in request metadata.
-async fn discover_genesis(rpc_url: &Url, timeout: Duration) -> Result<String> {
+/// Discover the genesis commitment of the node at `rpc_url`. This is the value write RPCs such as
+/// `SubmitProvenTransaction` expect echoed back in request metadata.
+async fn discover_genesis(rpc_url: &Url, timeout: Duration) -> Result<Word> {
     let mut rpc = build_rpc_client(rpc_url, timeout, None)
         .await
         .context("Failed to create RPC client for genesis discovery")?;
@@ -161,7 +180,7 @@ async fn discover_genesis(rpc_url: &Url, timeout: Duration) -> Result<String> {
     let genesis_header: BlockHeader =
         genesis_block_header.try_into().context("Failed to convert block header")?;
 
-    Ok(genesis_header.commitment().to_hex())
+    Ok(genesis_header.commitment())
 }
 
 /// Create an RPC client configured with the correct genesis metadata in the `Accept` header so that
@@ -179,18 +198,35 @@ pub(crate) async fn create_genesis_aware_rpc_client(
 /// Genesis is discovered once and reused. Because every client owns a distinct channel, concurrent
 /// submissions spread across this pool ride separate HTTP/2 sockets (and, behind a load balancer,
 /// separate backend replicas) instead of multiplexing over a single connection.
+///
+/// The discovered genesis commitment is returned alongside the pool because submissions need it to
+/// seal their transaction inputs.
 pub(crate) async fn create_genesis_aware_rpc_client_pool(
     rpc_url: &Url,
     timeout: Duration,
     size: usize,
-) -> Result<Vec<RpcClient>> {
+    trusted_validator_signing_key: ValidatorPublicKey,
+) -> Result<(Vec<RpcClient>, TransactionInputsSealer)> {
     let size = size.max(1);
     let genesis = discover_genesis(rpc_url, timeout).await?;
     let mut pool = Vec::with_capacity(size);
     for _ in 0..size {
-        pool.push(build_rpc_client(rpc_url, timeout, Some(genesis.clone())).await?);
+        pool.push(build_rpc_client(rpc_url, timeout, Some(genesis)).await?);
     }
-    Ok(pool)
+    let key = pool[0]
+        .clone()
+        .get_transaction_encryption_key(())
+        .await
+        .context("Failed to fetch the transaction encryption key")?
+        .into_inner();
+    let trusted_keys = [trusted_validator_signing_key];
+    let verified = verify_transaction_encryption_key(
+        key,
+        TrustedTransactionEncryptionState::new(genesis, &trusted_keys),
+    )
+    .context("Untrusted transaction encryption key")?;
+
+    Ok((pool, TransactionInputsSealer::new(verified)))
 }
 
 pub(crate) fn get_genesis_header_request() -> BlockHeaderByNumberRequest {

bin/benchmark/src/submit.rs

@@ -18,9 +18,11 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{Duration, Instant, SystemTime};
 
 use miden_node_proto::clients::RpcClient;
+use miden_node_proto::domain::encryption::TransactionInputsSealer;
 use miden_node_proto::generated as proto;
+use miden_protocol::crypto::dsa::ecdsa_k256_keccak::PublicKey as ValidatorPublicKey;
 use miden_protocol::transaction::{ProvenTransaction, TransactionId};
-use miden_protocol::utils::serde::Serializable;
+use miden_protocol::utils::serde::{Deserializable, Serializable};
 use tokio::sync::Semaphore;
 use url::Url;
 
@@ -31,7 +33,13 @@ use crate::{PROOFS_DIR, create_genesis_aware_rpc_client_pool, read_from_file};
 // ORCHESTRATOR
 // ================================================================================================
 
-pub(crate) async fn run(rpc_url: Url, concurrency: usize, connections: usize, wait_blocks: u32) {
+pub(crate) async fn run(
+    rpc_url: Url,
+    concurrency: usize,
+    connections: usize,
+    wait_blocks: u32,
+    validator_signing_public_key: String,
+) {
     let in_dir = PathBuf::from(PROOFS_DIR);
 
     println!("Loading mint txs from {}", in_dir.join("mint_txs.bin").display());
@@ -49,10 +57,21 @@ pub(crate) async fn run(rpc_url: Url, concurrency: usize, connections: usize, wa
     let consume_ids: Vec<TransactionId> = consume_txs.iter().map(ProvenTransaction::id).collect();
 
     println!("Connecting to {rpc_url} ({connections} connection(s))...");
-    let pool = create_genesis_aware_rpc_client_pool(&rpc_url, Duration::from_secs(30), connections)
-        .await
-        .expect("failed to create RPC client pool");
+    let trusted_validator_signing_key = ValidatorPublicKey::read_from_bytes(
+        &hex::decode(validator_signing_public_key)
+            .expect("validator signing public key must be a hex-encoded K256 public key"),
+    )
+    .expect("validator signing public key must be a valid K256 public key");
+    let (pool, sealer) = create_genesis_aware_rpc_client_pool(
+        &rpc_url,
+        Duration::from_secs(30),
+        connections,
+        trusted_validator_signing_key,
+    )
+    .await
+    .expect("failed to create RPC client pool");
     let pool = Arc::new(pool);
+    let sealer = Arc::new(sealer);
 
     let h_start = current_block_height(pool[0].clone()).await;
     println!("Chain height at start: {h_start}");
@@ -62,15 +81,16 @@ pub(crate) async fn run(rpc_url: Url, concurrency: usize, connections: usize, wa
          submits must be serialized for the mempool to chain them)...",
         mint_txs.len()
     );
-    let mint_stats = submit_sequential(pool[0].clone(), mint_txs, mint_tx_inputs).await;
+    let mint_stats = submit_sequential(pool[0].clone(), mint_txs, mint_tx_inputs, &sealer).await;
     print_phase_progress("mint", &mint_stats);
 
     println!(
         "Submitting {} consume txs with concurrency={concurrency} across {} connection(s)...",
         consume_txs.len(),
         pool.len(),
     );
-    let consume_stats = submit_all(pool.clone(), consume_txs, consume_tx_inputs, concurrency).await;
+    let consume_stats =
+        submit_all(pool.clone(), consume_txs, consume_tx_inputs, concurrency, &sealer).await;
     print_phase_progress("consume", &consume_stats);
 
     let ack_by_id = build_ack_map(&consume_ids, &consume_stats);
@@ -142,6 +162,7 @@ async fn submit_all(
     txs: Vec<ProvenTransaction>,
     tx_inputs: Vec<Vec<u8>>,
     concurrency: usize,
+    sealer: &Arc<TransactionInputsSealer>,
 ) -> PhaseStats {
     /// How many distinct error messages to surface to the console as they happen. The full failure
     /// breakdown still appears in the summary.
@@ -162,10 +183,13 @@ async fn submit_all(
         // sockets instead of multiplexing over one channel.
         let mut client = pool[i % pool.len()].clone();
         let printed = printed.clone();
+        let sealer = sealer.clone();
         set.spawn(async move {
+            let sealed_inputs =
+                sealer.seal(tx.id(), &inputs).expect("failed to seal transaction inputs");
             let request = proto::transaction::ProvenTransaction {
                 transaction: tx.to_bytes(),
-                transaction_inputs: Some(inputs),
+                sealed_transaction_inputs: Some(sealed_inputs),
             };
             let t0 = Instant::now();
             let outcome = match client.submit_proven_tx(request).await {
@@ -213,15 +237,18 @@ async fn submit_sequential(
     mut client: RpcClient,
     txs: Vec<ProvenTransaction>,
     tx_inputs: Vec<Vec<u8>>,
+    sealer: &Arc<TransactionInputsSealer>,
 ) -> PhaseStats {
     let start = Instant::now();
     let total = txs.len();
     let mut outcomes = Vec::with_capacity(total);
 
     for (i, (tx, inputs)) in txs.into_iter().zip(tx_inputs).enumerate() {
+        let sealed_inputs =
+            sealer.seal(tx.id(), &inputs).expect("failed to seal transaction inputs");
         let request = proto::transaction::ProvenTransaction {
             transaction: tx.to_bytes(),
-            transaction_inputs: Some(inputs),
+            sealed_transaction_inputs: Some(sealed_inputs),
         };
 
         let t0 = Instant::now();

bin/network-monitor/README.md

@@ -24,6 +24,10 @@ configured.
 The monitor is an observer and test client, not a node component required for block production. Its network transaction
 checks create fresh in-memory accounts on startup and do not persist account state to disk.
 
+Network transaction checks also require `MIDEN_MONITOR_VALIDATOR_SIGNING_PUBLIC_KEY`. It must contain the hex-encoded
+validator key that signs transaction encryption key attestations. The monitor will not submit a transaction unless it
+can verify the advertised encryption key.
+
 Use the binary help output for the current command and configuration surface. The help output is the source of truth for
 flags and environment variables.
 

bin/network-monitor/src/config.rs

@@ -5,7 +5,10 @@
 
 use std::time::Duration;
 
+use anyhow::{Context, Result};
 use clap::Parser;
+use miden_protocol::crypto::dsa::ecdsa_k256_keccak::PublicKey as ValidatorPublicKey;
+use miden_protocol::utils::serde::Deserializable;
 use url::Url;
 
 // MONITOR CONFIGURATION CONSTANTS
@@ -108,6 +111,16 @@ pub struct MonitorConfig {
     )]
     pub disable_ntx_service: bool,
 
+    /// Hex-encoded validator signing public key trusted to attest the transaction encryption key.
+    ///
+    /// Required when network transaction checks are enabled.
+    #[arg(
+        long = "validator-signing-public-key",
+        env = "MIDEN_MONITOR_VALIDATOR_SIGNING_PUBLIC_KEY",
+        value_name = "HEX"
+    )]
+    pub validator_signing_public_key: Option<String>,
+
     /// The interval at which to send the increment counter transaction.
     #[arg(
         long = "counter-increment-interval",
@@ -187,3 +200,16 @@ pub struct MonitorConfig {
     )]
     pub stale_chain_tip_threshold: Duration,
 }
+
+impl MonitorConfig {
+    /// Decodes the validator signing key required by transaction submission checks.
+    pub fn trusted_validator_signing_key(&self) -> Result<ValidatorPublicKey> {
+        let encoded = self.validator_signing_public_key.as_deref().context(
+            "--validator-signing-public-key is required when network transaction checks are enabled",
+        )?;
+        let bytes =
+            hex::decode(encoded).context("validator signing public key must be hex encoded")?;
+        ValidatorPublicKey::read_from_bytes(&bytes)
+            .context("validator signing public key must be a valid K256 public key")
+    }
+}