chore: Implement ErrorReproducibility for crypto errors occurring during IDKG payload validation

.github/CODEOWNERS

@@ -148,6 +148,7 @@ go_deps.bzl               @dfinity/idx
 /rs/interfaces/registry/                                @dfinity/governance-team
 /rs/interfaces/src/canister_http.rs                     @dfinity/consensus
 /rs/interfaces/src/consensus.rs                         @dfinity/consensus
+/rs/interfaces/src/consensus/                           @dfinity/consensus
 /rs/interfaces/src/consensus_pool.rs                    @dfinity/consensus
 /rs/interfaces/src/crypto.rs                            @dfinity/crypto-team
 /rs/interfaces/src/crypto/                              @dfinity/crypto-team

rs/consensus/idkg/src/payload_verifier.rs

@@ -78,18 +78,25 @@ use std::{collections::BTreeMap, convert::TryFrom};
 // The fields are only read by the `Debug` implementation.
 // The `dead_code` lint ignores `Debug` impls, see: https://github.com/rust-lang/rust/issues/88900.
 #[allow(dead_code)]
-/// Reasons for why an idkg payload might be invalid.
+/// Possible failures which could occur while validating an idkg payload. They don't imply that the
+/// payload is invalid.
 pub enum IDkgPayloadValidationFailure {
     RegistryClientError(RegistryClientError),
     StateManagerError(StateManagerError),
+    ThresholdEcdsaSigInputsError(ecdsa::ThresholdEcdsaSigInputsError),
+    ThresholdSchnorrSigInputsError(schnorr::ThresholdSchnorrSigInputsError),
+    TranscriptParamsError(idkg::TranscriptParamsError),
+    ThresholdEcdsaVerifyCombinedSignatureError(ThresholdEcdsaVerifyCombinedSignatureError),
+    ThresholdSchnorrVerifyCombinedSignatureError(ThresholdSchnorrVerifyCombinedSigError),
+    IDkgVerifyTranscriptError(IDkgVerifyTranscriptError),
+    IDkgVerifyInitialDealingsError(IDkgVerifyInitialDealingsError),
 }
 
 #[derive(Debug)]
 // The fields are only read by the `Debug` implementation.
 // The `dead_code` lint ignores `Debug` impls, see: https://github.com/rust-lang/rust/issues/88900.
 #[allow(dead_code)]
-/// Possible failures which could occur while validating an idkg payload. They don't imply that the
-/// payload is invalid.
+/// Reasons for why an idkg payload might be invalid.
 pub enum InvalidIDkgPayloadReason {
     // wrapper of other errors
     UnexpectedSummaryPayload(IDkgPayloadError),
@@ -145,30 +152,84 @@ impl From<ecdsa::ThresholdEcdsaSigInputsError> for InvalidIDkgPayloadReason {
     }
 }
 
+impl From<ecdsa::ThresholdEcdsaSigInputsError> for IDkgPayloadValidationFailure {
+    fn from(err: ecdsa::ThresholdEcdsaSigInputsError) -> Self {
+        IDkgPayloadValidationFailure::ThresholdEcdsaSigInputsError(err)
+    }
+}
+
 impl From<schnorr::ThresholdSchnorrSigInputsError> for InvalidIDkgPayloadReason {
     fn from(err: schnorr::ThresholdSchnorrSigInputsError) -> Self {
         InvalidIDkgPayloadReason::ThresholdSchnorrSigInputsError(err)
     }
 }
 
+impl From<schnorr::ThresholdSchnorrSigInputsError> for IDkgPayloadValidationFailure {
+    fn from(err: schnorr::ThresholdSchnorrSigInputsError) -> Self {
+        IDkgPayloadValidationFailure::ThresholdSchnorrSigInputsError(err)
+    }
+}
+
 impl From<idkg::TranscriptParamsError> for InvalidIDkgPayloadReason {
     fn from(err: idkg::TranscriptParamsError) -> Self {
         InvalidIDkgPayloadReason::TranscriptParamsError(err)
     }
 }
 
+impl From<idkg::TranscriptParamsError> for IDkgPayloadValidationFailure {
+    fn from(err: idkg::TranscriptParamsError) -> Self {
+        IDkgPayloadValidationFailure::TranscriptParamsError(err)
+    }
+}
+
 impl From<IDkgVerifyTranscriptError> for InvalidIDkgPayloadReason {
     fn from(err: IDkgVerifyTranscriptError) -> Self {
         InvalidIDkgPayloadReason::IDkgVerifyTranscriptError(err)
     }
 }
 
+impl From<IDkgVerifyTranscriptError> for IDkgPayloadValidationFailure {
+    fn from(err: IDkgVerifyTranscriptError) -> Self {
+        IDkgPayloadValidationFailure::IDkgVerifyTranscriptError(err)
+    }
+}
+
 impl From<IDkgVerifyInitialDealingsError> for InvalidIDkgPayloadReason {
     fn from(err: IDkgVerifyInitialDealingsError) -> Self {
         InvalidIDkgPayloadReason::IDkgVerifyInitialDealingsError(err)
     }
 }
 
+impl From<IDkgVerifyInitialDealingsError> for IDkgPayloadValidationFailure {
+    fn from(err: IDkgVerifyInitialDealingsError) -> Self {
+        IDkgPayloadValidationFailure::IDkgVerifyInitialDealingsError(err)
+    }
+}
+
+impl From<ThresholdEcdsaVerifyCombinedSignatureError> for InvalidIDkgPayloadReason {
+    fn from(err: ThresholdEcdsaVerifyCombinedSignatureError) -> Self {
+        InvalidIDkgPayloadReason::ThresholdEcdsaVerifyCombinedSignatureError(err)
+    }
+}
+
+impl From<ThresholdEcdsaVerifyCombinedSignatureError> for IDkgPayloadValidationFailure {
+    fn from(err: ThresholdEcdsaVerifyCombinedSignatureError) -> Self {
+        IDkgPayloadValidationFailure::ThresholdEcdsaVerifyCombinedSignatureError(err)
+    }
+}
+
+impl From<ThresholdSchnorrVerifyCombinedSigError> for InvalidIDkgPayloadReason {
+    fn from(err: ThresholdSchnorrVerifyCombinedSigError) -> Self {
+        InvalidIDkgPayloadReason::ThresholdSchnorrVerifyCombinedSignatureError(err)
+    }
+}
+
+impl From<ThresholdSchnorrVerifyCombinedSigError> for IDkgPayloadValidationFailure {
+    fn from(err: ThresholdSchnorrVerifyCombinedSigError) -> Self {
+        IDkgPayloadValidationFailure::ThresholdSchnorrVerifyCombinedSignatureError(err)
+    }
+}
+
 impl From<RegistryClientError> for IDkgPayloadValidationFailure {
     fn from(err: RegistryClientError) -> Self {
         IDkgPayloadValidationFailure::RegistryClientError(err)
@@ -393,7 +454,7 @@ fn validate_data_payload(
         signatures,
     };
 
-    let idkg_payload = create_data_payload_helper(
+    match create_data_payload_helper(
         subnet_id,
         context,
         parent_block,
@@ -405,13 +466,21 @@ fn validate_data_payload(
         registry_client,
         None,
         &ic_logger::replica_logger::no_op_logger(),
-    )
-    .map_err(|err| InvalidIDkgPayloadReason::UnexpectedDataPayload(Some(err)))?;
-
-    if idkg_payload.as_ref() == data_payload {
-        Ok(())
-    } else {
-        Err(InvalidIDkgPayloadReason::DataPayloadMismatch.into())
+    ) {
+        Ok(idkg_payload) => {
+            if idkg_payload.as_ref() == data_payload {
+                Ok(())
+            } else {
+                Err(InvalidIDkgPayloadReason::DataPayloadMismatch.into())
+            }
+        }
+        Err(IDkgPayloadError::RegistryClientError(err)) => {
+            Err(IDkgPayloadValidationFailure::RegistryClientError(err).into())
+        }
+        Err(IDkgPayloadError::StateManagerError(err)) => {
+            Err(IDkgPayloadValidationFailure::StateManagerError(err).into())
+        }
+        Err(err) => Err(InvalidIDkgPayloadReason::UnexpectedDataPayload(Some(err)).into()),
     }
 }
 
@@ -476,12 +545,8 @@ fn validate_transcript_refs(
                 let config = prev_configs
                     .get(transcript_id)
                     .ok_or(NewTranscriptMissingParams(*transcript_id))?;
-                let params = config
-                    .translate(block_reader)
-                    .map_err(TranscriptParamsError)?;
-                crypto
-                    .verify_transcript(&params, transcript)
-                    .map_err(IDkgVerifyTranscriptError)?;
+                let params = config.translate(block_reader)?;
+                crypto.verify_transcript(&params, transcript)?;
                 count += 1;
             } else {
                 return Err(NewTranscriptNotFound(*transcript_id).into());
@@ -520,14 +585,8 @@ fn validate_reshare_dealings(
                 if let ic_types::messages::Payload::Data(data) = &response.payload {
                     let initial_dealings = decode_initial_dealings(data)?;
                     let transcript_id = config.as_ref().transcript_id;
-                    let param = config
-                        .as_ref()
-                        .translate(block_reader)
-                        .map_err(InvalidIDkgPayloadReason::from)?;
-
-                    crypto
-                        .verify_initial_dealings(&param, &initial_dealings)
-                        .map_err(InvalidIDkgPayloadReason::from)?;
+                    let param = config.as_ref().translate(block_reader)?;
+                    crypto.verify_initial_dealings(&param, &initial_dealings)?;
                     new_dealings.insert(transcript_id, initial_dealings.dealings().clone());
                 }
             } else {
@@ -572,7 +631,6 @@ fn validate_new_signature_agreements(
     prev_payload: &idkg::IDkgPayload,
     curr_payload: &idkg::IDkgPayload,
 ) -> Result<BTreeMap<CallbackId, CombinedSignature>, IDkgValidationError> {
-    use InvalidIDkgPayloadReason::*;
     let mut new_signatures = BTreeMap::new();
     let context_map = state
         .signature_request_contexts()
@@ -595,23 +653,18 @@ fn validate_new_signature_agreements(
                     .map_err(InvalidIDkgPayloadReason::NewSignatureBuildInputsError)?;
                 match input_ref {
                     ThresholdSigInputsRef::Ecdsa(input_ref) => {
-                        let input = input_ref
-                            .translate(block_reader)
-                            .map_err(InvalidIDkgPayloadReason::from)?;
+                        let input = input_ref.translate(block_reader)?;
                         let reply = SignWithECDSAReply::decode(data).map_err(|err| {
                             InvalidIDkgPayloadReason::DecodingError(format!("{:?}", err))
                         })?;
                         let signature = ThresholdEcdsaCombinedSignature {
                             signature: reply.signature,
                         };
-                        ThresholdEcdsaSigVerifier::verify_combined_sig(crypto, &input, &signature)
-                            .map_err(ThresholdEcdsaVerifyCombinedSignatureError)?;
+                        ThresholdEcdsaSigVerifier::verify_combined_sig(crypto, &input, &signature)?;
                         new_signatures.insert(*id, CombinedSignature::Ecdsa(signature));
                     }
                     ThresholdSigInputsRef::Schnorr(input_ref) => {
-                        let input = input_ref
-                            .translate(block_reader)
-                            .map_err(InvalidIDkgPayloadReason::from)?;
+                        let input = input_ref.translate(block_reader)?;
                         let reply = SignWithSchnorrReply::decode(data).map_err(|err| {
                             InvalidIDkgPayloadReason::DecodingError(format!("{:?}", err))
                         })?;
@@ -620,8 +673,7 @@ fn validate_new_signature_agreements(
                         };
                         ThresholdSchnorrSigVerifier::verify_combined_sig(
                             crypto, &input, &signature,
-                        )
-                        .map_err(ThresholdSchnorrVerifyCombinedSignatureError)?;
+                        )?;
                         new_signatures.insert(*id, CombinedSignature::Schnorr(signature));
                     }
                     ThresholdSigInputsRef::VetKd(_) => {

rs/interfaces/src/consensus.rs

@@ -25,6 +25,8 @@ use ic_types::{
     Height, Time,
 };
 
+pub mod errors;
+
 /// The [`PayloadBuilder`] is responsible for creating and validating payload that
 /// is included in consensus blocks.
 pub trait PayloadBuilder: Send + Sync {

rs/interfaces/src/consensus/errors.rs

@@ -0,0 +1,69 @@
+use ic_types::consensus::idkg::{
+    common::TranscriptOperationError,
+    ecdsa::{PreSignatureQuadrupleError, ThresholdEcdsaSigInputsError},
+    schnorr::{PreSignatureTranscriptError, ThresholdSchnorrSigInputsError},
+    TranscriptParamsError,
+};
+
+use crate::crypto::ErrorReproducibility;
+
+impl ErrorReproducibility for ThresholdEcdsaSigInputsError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            ThresholdEcdsaSigInputsError::PreSignatureQuadruple(err) => err.is_reproducible(),
+            ThresholdEcdsaSigInputsError::KeyTranscript(_) => true,
+            ThresholdEcdsaSigInputsError::Failed(err) => err.is_reproducible(),
+        }
+    }
+}
+
+impl ErrorReproducibility for PreSignatureQuadrupleError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            PreSignatureQuadrupleError::KappaUnmasked(_) => true,
+            PreSignatureQuadrupleError::LambdaMasked(_) => true,
+            PreSignatureQuadrupleError::KappaTimesLambda(_) => true,
+            PreSignatureQuadrupleError::KeyTimesLambda(_) => true,
+            PreSignatureQuadrupleError::Failed(err) => err.is_reproducible(),
+        }
+    }
+}
+
+impl ErrorReproducibility for ThresholdSchnorrSigInputsError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            ThresholdSchnorrSigInputsError::PreSignatureTranscript(err) => err.is_reproducible(),
+            ThresholdSchnorrSigInputsError::KeyTranscript(_) => true,
+            ThresholdSchnorrSigInputsError::Failed(err) => err.is_reproducible(),
+        }
+    }
+}
+
+impl ErrorReproducibility for PreSignatureTranscriptError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            PreSignatureTranscriptError::BlinderUnmasked(_) => true,
+            PreSignatureTranscriptError::Failed(err) => err.is_reproducible(),
+        }
+    }
+}
+
+impl ErrorReproducibility for TranscriptParamsError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            TranscriptParamsError::OperationRef(err) => err.is_reproducible(),
+            TranscriptParamsError::ParamsValidation(err) => err.is_reproducible(),
+        }
+    }
+}
+
+impl ErrorReproducibility for TranscriptOperationError {
+    fn is_reproducible(&self) -> bool {
+        match self {
+            TranscriptOperationError::ReshareOfMasked(_) => true,
+            TranscriptOperationError::ReshareOfUnmasked(_) => true,
+            TranscriptOperationError::UnmaskedTimesMasked1(_) => true,
+            TranscriptOperationError::UnmaskedTimesMasked2(_) => true,
+        }
+    }
+}