chore(crypto): CRP-2978 Extend ic-signature-verification for v3 canister ranges#9277
chore(crypto): CRP-2978 Extend ic-signature-verification for v3 canister ranges#9277
Conversation
…ter ranges The interface specification has contained support for sharded canister ranges for some time, but this was not supported in ic-signature-verification.
|
I tried creating a testcase for this using I'll ping Hamish re the inputs he was using since that may be simpler and also more useful as a test than what I have anyway (in terms of testing something from mainnet or testnet rather than entirely synthetic data) |
| .list_paths() | ||
| .iter() | ||
| .filter(|path| !path.is_empty()) | ||
| .try_fold( |
There was a problem hiding this comment.
IIUC, this traverses the entire subtree to collect all labels, then iterate over all labels, deserializes all of them and accumulates all ranges into a vec. Then we do linear search on this vec afterwards.
I'm wondering if we can do this more efficiently, given that the new approach of the canister ranges was introduced precisely to allow for more efficiency through binary searches (see the very end of this: "This facilitates e.g., binary searching.").
Could we maybe do something similar to this?
Most likely the published ic-certification crate (which is different from our ic-certification crate in the monorepo 🤯) doesn't offer the necessary tooling currently, but maybe we could add it?
Given that the HashTreeNode is public and sorted (labels in left forks are always less than labels in right forks — see the lookup_label implementation), maybe could even write a custom traversal helper that finds the largest label (= the signing canister ID) directly in ic-signature-verification (but I guess extending ic-certification would be cleaner).
WDYT?
There was a problem hiding this comment.
Yeah that was pretty lazy. I'm hesitant to make things too complicated here since we do not have particularly thorough test cases at the moment. For now I just changed it to look at each leaf (without copying) and early exit.
2 participants
The interface specification has contained support for sharded canister ranges for some time, but this was not supported in ic-signature-verification.