rebase changes

.github/workflows/ci.yml

@@ -18,11 +18,10 @@ env:
   # We need a higher number of parallel rayon tasks than the default (which is 4)
   # in order to prevent a deadlock, c.f.
   #   - https://github.com/tlsnotary/tlsn/issues/548
-  #   - https://github.com/privacy-ethereum/mpz/issues/178
+  #   - https://github.com/privacy-scaling-explorations/mpz/issues/178
   # 32 seems to be big enough for the foreseeable future
   RAYON_NUM_THREADS: 32
-  RUST_VERSION: 1.92.0
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  RUST_VERSION: 1.89.0
 
 jobs:
   clippy:
@@ -33,7 +32,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install rust toolchain
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: clippy
@@ -42,7 +41,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.7.7
 
       - name: Clippy
-        run: cargo clippy --keep-going --all-features --all-targets --locked
+        run: cargo clippy --keep-going --all-features --all-targets --locked -- -D warnings
 
   fmt:
     name: Check formatting

.github/workflows/releng.yml

@@ -6,7 +6,7 @@ on:
       tag:
         description: 'Tag to publish to NPM'
         required: true
-        default: 'v0.1.0-alpha.14-pre'
+        default: 'v0.1.0-alpha.13-pre'
 
 jobs:
   release:

.github/workflows/rustdoc.yml

@@ -23,6 +23,7 @@ jobs:
       - name: "rustdoc"
         run: crates/wasm/build-docs.sh
 
+
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
         if: ${{ github.ref == 'refs/heads/dev' }}

.github/workflows/updatemain.yml

@@ -1,7 +1,6 @@
 name: Fast-forward main branch to published release tag
 
 on:
-  workflow_dispatch:
   release:
     types: [published]
 

Cargo.toml

@@ -66,29 +66,26 @@ tlsn-harness-runner = { path = "crates/harness/runner" }
 tlsn-wasm = { path = "crates/wasm" }
 tlsn = { path = "crates/tlsn" }
 
-mpz-circuits = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-circuits-data = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-memory-core = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-common = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-core = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-vm-core = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-garble = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-garble-core = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-ole = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-ot = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-share-conversion = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-fields = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-zk = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-hash = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
-mpz-ideal-vm = { git = "https://github.com/privacy-ethereum/mpz", rev = "9c343f8" }
+mpz-circuits = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-memory-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-common = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-vm-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-garble = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-garble-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-ole = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-ot = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-share-conversion = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-fields = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-zk = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-hash = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
 
-rangeset = { version = "0.4" }
+rangeset = { version = "0.2" }
 serio = { version = "0.2" }
-spansy = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6f1a934" }
+spansy = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6168663" }
 uid-mux = { version = "0.2" }
-websocket-relay = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6f1a934" }
+websocket-relay = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6168663" }
 
-aead = { version = "0.4" }
 aes = { version = "0.8" }
 aes-gcm = { version = "0.9" }
 anyhow = { version = "1.0" }
@@ -112,7 +109,7 @@ elliptic-curve = { version = "0.13" }
 enum-try-as-inner = { version = "0.1" }
 env_logger = { version = "0.10" }
 futures = { version = "0.3" }
-futures-rustls = { version = "0.25" }
+futures-rustls = { version = "0.26" }
 generic-array = { version = "0.14" }
 ghash = { version = "0.5" }
 hex = { version = "0.4" }

crates/attestation/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-attestation"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2024"
 
 [features]
@@ -9,7 +9,7 @@ fixtures = ["tlsn-core/fixtures", "dep:tlsn-data-fixtures"]
 
 [dependencies]
 tlsn-tls-core = { workspace = true }
-tlsn-core = { workspace = true, features = ["mozilla-certs"] }
+tlsn-core = { workspace = true }
 tlsn-data-fixtures = { workspace = true, optional = true }
 
 bcs = { workspace = true }
@@ -23,9 +23,9 @@ thiserror = { workspace = true }
 tiny-keccak = { workspace = true, features = ["keccak"] }
 
 [dev-dependencies]
-alloy-primitives = { version = "1.3.1", default-features = false }
-alloy-signer = { version = "1.0", default-features = false }
-alloy-signer-local = { version = "1.0", default-features = false }
+alloy-primitives = { version = "0.8.22", default-features = false }
+alloy-signer = { version = "0.12", default-features = false }
+alloy-signer-local = { version = "0.12", default-features = false }
 rand06-compat = { workspace = true }
 rstest = { workspace = true }
 tlsn-core = { workspace = true, features = ["fixtures"] }

crates/attestation/src/builder.rs

@@ -5,7 +5,7 @@ use rand::{Rng, rng};
 use tlsn_core::{
     connection::{ConnectionInfo, ServerEphemKey},
     hash::HashAlgId,
-    transcript::{TranscriptCommitment, encoding::EncoderSecret},
+    transcript::TranscriptCommitment,
 };
 
 use crate::{
@@ -25,7 +25,6 @@ pub struct Sign {
     connection_info: Option<ConnectionInfo>,
     server_ephemeral_key: Option<ServerEphemKey>,
     cert_commitment: ServerCertCommitment,
-    encoder_secret: Option<EncoderSecret>,
     extensions: Vec<Extension>,
     transcript_commitments: Vec<TranscriptCommitment>,
 }
@@ -87,7 +86,6 @@ impl<'a> AttestationBuilder<'a, Accept> {
                 connection_info: None,
                 server_ephemeral_key: None,
                 cert_commitment,
-                encoder_secret: None,
                 transcript_commitments: Vec::new(),
                 extensions,
             },
@@ -108,12 +106,6 @@ impl AttestationBuilder<'_, Sign> {
         self
     }
 
-    /// Sets the secret for encoding commitments.
-    pub fn encoder_secret(&mut self, secret: EncoderSecret) -> &mut Self {
-        self.state.encoder_secret = Some(secret);
-        self
-    }
-
     /// Adds an extension to the attestation.
     pub fn extension(&mut self, extension: Extension) -> &mut Self {
         self.state.extensions.push(extension);
@@ -137,7 +129,6 @@ impl AttestationBuilder<'_, Sign> {
             connection_info,
             server_ephemeral_key,
             cert_commitment,
-            encoder_secret,
             extensions,
             transcript_commitments,
         } = self.state;
@@ -168,7 +159,6 @@ impl AttestationBuilder<'_, Sign> {
                 AttestationBuilderError::new(ErrorKind::Field, "handshake data was not set")
             })?),
             cert_commitment: field_id.next(cert_commitment),
-            encoder_secret: encoder_secret.map(|secret| field_id.next(secret)),
             extensions: extensions
                 .into_iter()
                 .map(|extension| field_id.next(extension))

crates/attestation/src/fixtures.rs

@@ -1,4 +1,5 @@
 //! Attestation fixtures.
+
 use tlsn_core::{
     connection::{CertBinding, CertBindingV1_2},
     fixtures::ConnectionFixture,
@@ -12,10 +13,7 @@ use tlsn_core::{
 use crate::{
     Attestation, AttestationConfig, CryptoProvider, Extension,
     request::{Request, RequestConfig},
-    signing::{
-        KeyAlgId, SignatureAlgId, SignatureVerifier, SignatureVerifierProvider, Signer,
-        SignerProvider,
-    },
+    signing::SignatureAlgId,
 };
 
 /// A Request fixture used for testing.
@@ -104,8 +102,7 @@ pub fn attestation_fixture(
     let mut provider = CryptoProvider::default();
     match signature_alg {
         SignatureAlgId::SECP256K1 => provider.signer.set_secp256k1(&[42u8; 32]).unwrap(),
-        SignatureAlgId::SECP256K1ETH => provider.signer.set_secp256k1eth(&[43u8; 32]).unwrap(),
-        SignatureAlgId::SECP256R1 => provider.signer.set_secp256r1(&[44u8; 32]).unwrap(),
+        SignatureAlgId::SECP256R1 => provider.signer.set_secp256r1(&[42u8; 32]).unwrap(),
         _ => unimplemented!(),
     };
 
@@ -125,68 +122,3 @@ pub fn attestation_fixture(
 
     attestation_builder.build(&provider).unwrap()
 }
-
-/// Returns a crypto provider which supports only a custom signature alg.
-pub fn custom_provider_fixture() -> CryptoProvider {
-    const CUSTOM_SIG_ALG_ID: SignatureAlgId = SignatureAlgId::new(128);
-
-    // A dummy signer.
-    struct DummySigner {}
-    impl Signer for DummySigner {
-        fn alg_id(&self) -> SignatureAlgId {
-            CUSTOM_SIG_ALG_ID
-        }
-
-        fn sign(
-            &self,
-            msg: &[u8],
-        ) -> Result<crate::signing::Signature, crate::signing::SignatureError> {
-            Ok(crate::signing::Signature {
-                alg: CUSTOM_SIG_ALG_ID,
-                data: msg.to_vec(),
-            })
-        }
-
-        fn verifying_key(&self) -> crate::signing::VerifyingKey {
-            crate::signing::VerifyingKey {
-                alg: KeyAlgId::new(128),
-                data: vec![1, 2, 3, 4],
-            }
-        }
-    }
-
-    // A dummy verifier.
-    struct DummyVerifier {}
-    impl SignatureVerifier for DummyVerifier {
-        fn alg_id(&self) -> SignatureAlgId {
-            CUSTOM_SIG_ALG_ID
-        }
-
-        fn verify(
-            &self,
-            _key: &crate::signing::VerifyingKey,
-            msg: &[u8],
-            sig: &[u8],
-        ) -> Result<(), crate::signing::SignatureError> {
-            if msg == sig {
-                Ok(())
-            } else {
-                Err(crate::signing::SignatureError::from_str(
-                    "invalid signature",
-                ))
-            }
-        }
-    }
-
-    let mut provider = CryptoProvider::default();
-
-    let mut signer_provider = SignerProvider::default();
-    signer_provider.set_signer(Box::new(DummySigner {}));
-    provider.signer = signer_provider;
-
-    let mut verifier_provider = SignatureVerifierProvider::empty();
-    verifier_provider.set_verifier(Box::new(DummyVerifier {}));
-    provider.signature = verifier_provider;
-
-    provider
-}

crates/attestation/src/lib.rs

@@ -219,7 +219,7 @@ use tlsn_core::{
     connection::{ConnectionInfo, ServerEphemKey},
     hash::{Hash, HashAlgorithm, TypedHash},
     merkle::MerkleTree,
-    transcript::{TranscriptCommitment, encoding::EncoderSecret},
+    transcript::TranscriptCommitment,
 };
 
 use crate::{
@@ -327,7 +327,6 @@ pub struct Body {
     connection_info: Field<ConnectionInfo>,
     server_ephemeral_key: Field<ServerEphemKey>,
     cert_commitment: Field<ServerCertCommitment>,
-    encoder_secret: Option<Field<EncoderSecret>>,
     extensions: Vec<Field<Extension>>,
     transcript_commitments: Vec<Field<TranscriptCommitment>>,
 }
@@ -373,7 +372,6 @@ impl Body {
             connection_info: conn_info,
             server_ephemeral_key,
             cert_commitment,
-            encoder_secret,
             extensions,
             transcript_commitments,
         } = self;
@@ -391,13 +389,6 @@ impl Body {
             ),
         ];
 
-        if let Some(encoder_secret) = encoder_secret {
-            fields.push((
-                encoder_secret.id,
-                hasher.hash_separated(&encoder_secret.data),
-            ));
-        }
-
         for field in extensions.iter() {
             fields.push((field.id, hasher.hash_separated(&field.data)));
         }

crates/attestation/src/presentation.rs

@@ -91,11 +91,6 @@ impl Presentation {
                 transcript.verify_with_provider(
                     &provider.hash,
                     &attestation.body.connection_info().transcript_length,
-                    attestation
-                        .body
-                        .encoder_secret
-                        .as_ref()
-                        .map(|field| &field.data),
                     attestation.body.transcript_commitments(),
                 )
             })

crates/attestation/src/request.rs

@@ -20,10 +20,7 @@ use serde::{Deserialize, Serialize};
 
 use tlsn_core::hash::HashAlgId;
 
-use crate::{
-    Attestation, CryptoProvider, Extension, connection::ServerCertCommitment,
-    serialize::CanonicalSerialize, signing::SignatureAlgId,
-};
+use crate::{Attestation, Extension, connection::ServerCertCommitment, signing::SignatureAlgId};
 
 pub use builder::{RequestBuilder, RequestBuilderError};
 pub use config::{RequestConfig, RequestConfigBuilder, RequestConfigBuilderError};
@@ -44,102 +41,44 @@ impl Request {
     }
 
     /// Validates the content of the attestation against this request.
-    pub fn validate(
-        &self,
-        attestation: &Attestation,
-        provider: &CryptoProvider,
-    ) -> Result<(), AttestationValidationError> {
+    pub fn validate(&self, attestation: &Attestation) -> Result<(), InconsistentAttestation> {
         if attestation.signature.alg != self.signature_alg {
-            return Err(AttestationValidationError::inconsistent(format!(
+            return Err(InconsistentAttestation(format!(
                 "signature algorithm: expected {:?}, got {:?}",
                 self.signature_alg, attestation.signature.alg
             )));
         }
 
         if attestation.header.root.alg != self.hash_alg {
-            return Err(AttestationValidationError::inconsistent(format!(
+            return Err(InconsistentAttestation(format!(
                 "hash algorithm: expected {:?}, got {:?}",
                 self.hash_alg, attestation.header.root.alg
             )));
         }
 
         if attestation.body.cert_commitment() != &self.server_cert_commitment {
-            return Err(AttestationValidationError::inconsistent(
-                "server certificate commitment does not match",
+            return Err(InconsistentAttestation(
+                "server certificate commitment does not match".to_string(),
             ));
         }
 
         // TODO: improve the O(M*N) complexity of this check.
         for extension in &self.extensions {
             if !attestation.body.extensions().any(|e| e == extension) {
-                return Err(AttestationValidationError::inconsistent(
-                    "extension is missing from the attestation",
+                return Err(InconsistentAttestation(
+                    "extension is missing from the attestation".to_string(),
                 ));
             }
         }
 
-        let verifier = provider
-            .signature
-            .get(&attestation.signature.alg)
-            .map_err(|_| {
-                AttestationValidationError::provider(format!(
-                    "provider not configured for signature algorithm id {:?}",
-                    attestation.signature.alg,
-                ))
-            })?;
-
-        verifier
-            .verify(
-                &attestation.body.verifying_key.data,
-                &CanonicalSerialize::serialize(&attestation.header),
-                &attestation.signature.data,
-            )
-            .map_err(|_| {
-                AttestationValidationError::inconsistent("failed to verify the signature")
-            })?;
-
         Ok(())
     }
 }
 
 /// Error for [`Request::validate`].
 #[derive(Debug, thiserror::Error)]
-#[error("attestation validation error: {kind}: {message}")]
-pub struct AttestationValidationError {
-    kind: ErrorKind,
-    message: String,
-}
-
-impl AttestationValidationError {
-    fn inconsistent(msg: impl Into<String>) -> Self {
-        Self {
-            kind: ErrorKind::Inconsistent,
-            message: msg.into(),
-        }
-    }
-
-    fn provider(msg: impl Into<String>) -> Self {
-        Self {
-            kind: ErrorKind::Provider,
-            message: msg.into(),
-        }
-    }
-}
-
-#[derive(Debug)]
-enum ErrorKind {
-    Inconsistent,
-    Provider,
-}
-
-impl std::fmt::Display for ErrorKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            ErrorKind::Inconsistent => write!(f, "inconsistent"),
-            ErrorKind::Provider => write!(f, "provider"),
-        }
-    }
-}
+#[error("inconsistent attestation: {0}")]
+pub struct InconsistentAttestation(String);
 
 #[cfg(test)]
 mod test {
@@ -154,8 +93,7 @@ mod test {
     use crate::{
         CryptoProvider,
         connection::ServerCertOpening,
-        fixtures::{RequestFixture, attestation_fixture, custom_provider_fixture, request_fixture},
-        request::{AttestationValidationError, ErrorKind},
+        fixtures::{RequestFixture, attestation_fixture, request_fixture},
         signing::SignatureAlgId,
     };
 
@@ -175,9 +113,7 @@ mod test {
         let attestation =
             attestation_fixture(request.clone(), connection, SignatureAlgId::SECP256K1, &[]);
 
-        let provider = CryptoProvider::default();
-
-        assert!(request.validate(&attestation, &provider).is_ok())
+        assert!(request.validate(&attestation).is_ok())
     }
 
     #[test]
@@ -198,9 +134,7 @@ mod test {
 
         request.signature_alg = SignatureAlgId::SECP256R1;
 
-        let provider = CryptoProvider::default();
-
-        let res = request.validate(&attestation, &provider);
+        let res = request.validate(&attestation);
         assert!(res.is_err());
     }
 
@@ -222,9 +156,7 @@ mod test {
 
         request.hash_alg = HashAlgId::SHA256;
 
-        let provider = CryptoProvider::default();
-
-        let res = request.validate(&attestation, &provider);
+        let res = request.validate(&attestation);
         assert!(res.is_err())
     }
 
@@ -252,62 +184,11 @@ mod test {
         });
         let opening = ServerCertOpening::new(server_cert_data);
 
-        let provider = CryptoProvider::default();
+        let crypto_provider = CryptoProvider::default();
         request.server_cert_commitment =
-            opening.commit(provider.hash.get(&HashAlgId::BLAKE3).unwrap());
+            opening.commit(crypto_provider.hash.get(&HashAlgId::BLAKE3).unwrap());
 
-        let res = request.validate(&attestation, &provider);
+        let res = request.validate(&attestation);
         assert!(res.is_err())
     }
-
-    #[test]
-    fn test_wrong_sig() {
-        let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
-        let connection = ConnectionFixture::tlsnotary(transcript.length());
-
-        let RequestFixture { request, .. } = request_fixture(
-            transcript,
-            encoding_provider(GET_WITH_HEADER, OK_JSON),
-            connection.clone(),
-            Blake3::default(),
-            Vec::new(),
-        );
-
-        let mut attestation =
-            attestation_fixture(request.clone(), connection, SignatureAlgId::SECP256K1, &[]);
-
-        // Corrupt the signature.
-        attestation.signature.data[1] = attestation.signature.data[1].wrapping_add(1);
-
-        let provider = CryptoProvider::default();
-
-        assert!(request.validate(&attestation, &provider).is_err())
-    }
-
-    #[test]
-    fn test_wrong_provider() {
-        let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
-        let connection = ConnectionFixture::tlsnotary(transcript.length());
-
-        let RequestFixture { request, .. } = request_fixture(
-            transcript,
-            encoding_provider(GET_WITH_HEADER, OK_JSON),
-            connection.clone(),
-            Blake3::default(),
-            Vec::new(),
-        );
-
-        let attestation =
-            attestation_fixture(request.clone(), connection, SignatureAlgId::SECP256K1, &[]);
-
-        let provider = custom_provider_fixture();
-
-        assert!(matches!(
-            request.validate(&attestation, &provider),
-            Err(AttestationValidationError {
-                kind: ErrorKind::Provider,
-                ..
-            })
-        ))
-    }
 }

crates/attestation/src/serialize.rs

@@ -49,6 +49,5 @@ impl_domain_separator!(tlsn_core::connection::ConnectionInfo);
 impl_domain_separator!(tlsn_core::connection::CertBinding);
 impl_domain_separator!(tlsn_core::transcript::TranscriptCommitment);
 impl_domain_separator!(tlsn_core::transcript::TranscriptSecret);
-impl_domain_separator!(tlsn_core::transcript::encoding::EncoderSecret);
 impl_domain_separator!(tlsn_core::transcript::encoding::EncodingCommitment);
 impl_domain_separator!(tlsn_core::transcript::hash::PlaintextHash);

crates/attestation/src/signing.rs

@@ -202,14 +202,6 @@ impl SignatureVerifierProvider {
             .map(|s| &**s)
             .ok_or(UnknownSignatureAlgId(*alg))
     }
-
-    /// Returns am empty provider.
-    #[cfg(any(test, feature = "fixtures"))]
-    pub fn empty() -> Self {
-        Self {
-            verifiers: HashMap::default(),
-        }
-    }
 }
 
 /// Signature verifier.
@@ -237,14 +229,6 @@ impl_domain_separator!(VerifyingKey);
 #[error("signature verification failed: {0}")]
 pub struct SignatureError(String);
 
-impl SignatureError {
-    /// Creates a new error with the given message.
-    #[allow(clippy::should_implement_trait)]
-    pub fn from_str(msg: &str) -> Self {
-        Self(msg.to_string())
-    }
-}
-
 /// A signature.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct Signature {

crates/attestation/tests/api.rs

@@ -64,6 +64,7 @@ fn test_api() {
 
     let encoding_commitment = EncodingCommitment {
         root: encoding_tree.root(),
+        secret: encoder_secret(),
     };
 
     let request_config = RequestConfig::default();
@@ -95,13 +96,12 @@ fn test_api() {
         .connection_info(connection_info.clone())
         // Server key Notary received during handshake
         .server_ephemeral_key(server_ephemeral_key)
-        .encoder_secret(encoder_secret())
         .transcript_commitments(vec![TranscriptCommitment::Encoding(encoding_commitment)]);
 
     let attestation = attestation_builder.build(&provider).unwrap();
 
     // Prover validates the attestation is consistent with its request.
-    request.validate(&attestation, &provider).unwrap();
+    request.validate(&attestation).unwrap();
 
     let mut transcript_proof_builder = secrets.transcript_proof_builder();
 

crates/components/cipher/Cargo.toml

@@ -5,7 +5,7 @@ description = "This crate provides implementations of ciphers for two parties"
 keywords = ["tls", "mpc", "2pc", "aes"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]
@@ -15,7 +15,7 @@ workspace = true
 name = "cipher"
 
 [dependencies]
-mpz-circuits = { workspace = true, features = ["aes"] }
+mpz-circuits = { workspace = true }
 mpz-vm-core = { workspace = true }
 mpz-memory-core = { workspace = true }
 
@@ -24,9 +24,11 @@ thiserror = { workspace = true }
 aes = { workspace = true }
 
 [dev-dependencies]
-mpz-common = { workspace = true, features = ["test-utils"] }
-mpz-ideal-vm = { workspace = true }
+mpz-garble = { workspace = true }
+mpz-common = { workspace = true }
+mpz-ot = { workspace = true }
 
 tokio = { version = "1", features = ["macros", "rt", "rt-multi-thread"] }
+rand = { workspace = true }
 ctr = { workspace = true }
 cipher = { workspace = true }

crates/components/cipher/src/aes/mod.rs

@@ -2,7 +2,7 @@
 
 use crate::{Cipher, CtrBlock, Keystream};
 use async_trait::async_trait;
-use mpz_circuits::{AES128_KS, AES128_POST_KS};
+use mpz_circuits::circuits::AES128;
 use mpz_memory_core::binary::{Binary, U8};
 use mpz_vm_core::{prelude::*, Call, Vm};
 use std::fmt::Debug;
@@ -12,35 +12,13 @@ mod error;
 pub use error::AesError;
 use error::ErrorKind;
 
-/// AES key schedule: 11 round keys, 16 bytes each.
-type KeySchedule = Array<U8, 176>;
-
 /// Computes AES-128.
 #[derive(Default, Debug)]
 pub struct Aes128 {
     key: Option<Array<U8, 16>>,
-    key_schedule: Option<KeySchedule>,
     iv: Option<Array<U8, 4>>,
 }
 
-impl Aes128 {
-    // Allocates key schedule.
-    //
-    // Expects the key to be already set.
-    fn alloc_key_schedule(&self, vm: &mut dyn Vm<Binary>) -> Result<KeySchedule, AesError> {
-        let ks: KeySchedule = vm
-            .call(
-                Call::builder(AES128_KS.clone())
-                    .arg(self.key.expect("key is set"))
-                    .build()
-                    .expect("call should be valid"),
-            )
-            .map_err(|err| AesError::new(ErrorKind::Vm, err))?;
-
-        Ok(ks)
-    }
-}
-
 #[async_trait]
 impl Cipher for Aes128 {
     type Error = AesError;
@@ -67,22 +45,18 @@ impl Cipher for Aes128 {
     }
 
     fn alloc_block(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
         input: Array<U8, 16>,
     ) -> Result<Self::Block, Self::Error> {
-        self.key
+        let key = self
+            .key
             .ok_or_else(|| AesError::new(ErrorKind::Key, "key not set"))?;
 
-        if self.key_schedule.is_none() {
-            self.key_schedule = Some(self.alloc_key_schedule(vm)?);
-        }
-        let ks = *self.key_schedule.as_ref().expect("key schedule was set");
-
         let output = vm
             .call(
-                Call::builder(AES128_POST_KS.clone())
-                    .arg(ks)
+                Call::builder(AES128.clone())
+                    .arg(key)
                     .arg(input)
                     .build()
                     .expect("call should be valid"),
@@ -93,10 +67,11 @@ impl Cipher for Aes128 {
     }
 
     fn alloc_ctr_block(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
     ) -> Result<CtrBlock<Self::Nonce, Self::Counter, Self::Block>, Self::Error> {
-        self.key
+        let key = self
+            .key
             .ok_or_else(|| AesError::new(ErrorKind::Key, "key not set"))?;
         let iv = self
             .iv
@@ -114,15 +89,10 @@ impl Cipher for Aes128 {
         vm.mark_public(counter)
             .map_err(|err| AesError::new(ErrorKind::Vm, err))?;
 
-        if self.key_schedule.is_none() {
-            self.key_schedule = Some(self.alloc_key_schedule(vm)?);
-        }
-        let ks = *self.key_schedule.as_ref().expect("key schedule was set");
-
         let output = vm
             .call(
-                Call::builder(AES128_POST_KS.clone())
-                    .arg(ks)
+                Call::builder(AES128.clone())
+                    .arg(key)
                     .arg(iv)
                     .arg(explicit_nonce)
                     .arg(counter)
@@ -139,11 +109,12 @@ impl Cipher for Aes128 {
     }
 
     fn alloc_keystream(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
         len: usize,
     ) -> Result<Keystream<Self::Nonce, Self::Counter, Self::Block>, Self::Error> {
-        self.key
+        let key = self
+            .key
             .ok_or_else(|| AesError::new(ErrorKind::Key, "key not set"))?;
         let iv = self
             .iv
@@ -172,15 +143,10 @@ impl Cipher for Aes128 {
         let blocks = inputs
             .into_iter()
             .map(|(explicit_nonce, counter)| {
-                if self.key_schedule.is_none() {
-                    self.key_schedule = Some(self.alloc_key_schedule(vm)?);
-                }
-                let ks = *self.key_schedule.as_ref().expect("key schedule was set");
-
                 let output = vm
                     .call(
-                        Call::builder(AES128_POST_KS.clone())
-                            .arg(ks)
+                        Call::builder(AES128.clone())
+                            .arg(key)
                             .arg(iv)
                             .arg(explicit_nonce)
                             .arg(counter)
@@ -206,12 +172,15 @@ mod tests {
     use super::*;
     use crate::Cipher;
     use mpz_common::context::test_st_context;
-    use mpz_ideal_vm::IdealVm;
+    use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
     use mpz_memory_core::{
         binary::{Binary, U8},
+        correlated::Delta,
         Array, MemoryExt, Vector, ViewExt,
     };
+    use mpz_ot::ideal::cot::ideal_cot;
     use mpz_vm_core::{Execute, Vm};
+    use rand::{rngs::StdRng, SeedableRng};
 
     #[tokio::test]
     async fn test_aes_ctr() {
@@ -221,11 +190,10 @@ mod tests {
         let start_counter = 3u32;
 
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut gen = IdealVm::new();
-        let mut ev = IdealVm::new();
+        let (mut gen, mut ev) = mock_vm();
 
-        let mut aes_gen = setup_ctr(key, iv, &mut gen);
-        let mut aes_ev = setup_ctr(key, iv, &mut ev);
+        let aes_gen = setup_ctr(key, iv, &mut gen);
+        let aes_ev = setup_ctr(key, iv, &mut ev);
 
         let msg = vec![42u8; 128];
 
@@ -284,11 +252,10 @@ mod tests {
         let input = [5_u8; 16];
 
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut gen = IdealVm::new();
-        let mut ev = IdealVm::new();
+        let (mut gen, mut ev) = mock_vm();
 
-        let mut aes_gen = setup_block(key, &mut gen);
-        let mut aes_ev = setup_block(key, &mut ev);
+        let aes_gen = setup_block(key, &mut gen);
+        let aes_ev = setup_block(key, &mut ev);
 
         let block_ref_gen: Array<U8, 16> = gen.alloc().unwrap();
         gen.mark_public(block_ref_gen).unwrap();
@@ -327,6 +294,18 @@ mod tests {
         assert_eq!(ciphertext_gen, expected);
     }
 
+    fn mock_vm() -> (impl Vm<Binary>, impl Vm<Binary>) {
+        let mut rng = StdRng::seed_from_u64(0);
+        let delta = Delta::random(&mut rng);
+
+        let (cot_send, cot_recv) = ideal_cot(delta.into_inner());
+
+        let gen = Garbler::new(cot_send, [0u8; 16], delta);
+        let ev = Evaluator::new(cot_recv);
+
+        (gen, ev)
+    }
+
     fn setup_ctr(key: [u8; 16], iv: [u8; 4], vm: &mut dyn Vm<Binary>) -> Aes128 {
         let key_ref: Array<U8, 16> = vm.alloc().unwrap();
         vm.mark_public(key_ref).unwrap();

crates/components/cipher/src/lib.rs

@@ -55,7 +55,7 @@ pub trait Cipher {
 
     /// Allocates a single block in ECB mode.
     fn alloc_block(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
         input: Self::Block,
     ) -> Result<Self::Block, Self::Error>;
@@ -63,7 +63,7 @@ pub trait Cipher {
     /// Allocates a single block in counter mode.
     #[allow(clippy::type_complexity)]
     fn alloc_ctr_block(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
     ) -> Result<CtrBlock<Self::Nonce, Self::Counter, Self::Block>, Self::Error>;
 
@@ -75,7 +75,7 @@ pub trait Cipher {
     /// * `len` - Length of the stream in bytes.
     #[allow(clippy::type_complexity)]
     fn alloc_keystream(
-        &mut self,
+        &self,
         vm: &mut dyn Vm<Binary>,
         len: usize,
     ) -> Result<Keystream<Self::Nonce, Self::Counter, Self::Block>, Self::Error>;

crates/components/deap/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-deap"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]
@@ -19,8 +19,11 @@ futures = { workspace = true }
 tokio = { workspace = true, features = ["sync"] }
 
 [dev-dependencies]
-mpz-circuits = { workspace = true, features = ["aes"] }
-mpz-common = { workspace = true, features = ["test-utils"] }
-mpz-ideal-vm = { workspace = true }
+mpz-circuits = { workspace = true }
+mpz-garble = { workspace = true }
+mpz-ot = { workspace = true }
+mpz-zk = { workspace = true }
 
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread"] }
+rand = { workspace = true }
+rand06-compat = { workspace = true }

crates/components/deap/src/lib.rs

@@ -15,7 +15,7 @@ use mpz_vm_core::{
     memory::{binary::Binary, DecodeFuture, Memory, Repr, Slice, View},
     Call, Callable, Execute, Vm, VmError,
 };
-use rangeset::{ops::Set, set::RangeSet};
+use rangeset::{Difference, RangeSet, UnionMut};
 use tokio::sync::{Mutex, MutexGuard, OwnedMutexGuard};
 
 type Error = DeapError;
@@ -210,12 +210,10 @@ where
     }
 
     fn commit_raw(&mut self, slice: Slice) -> Result<(), VmError> {
-        let slice_range = slice.to_range();
-
         // Follower's private inputs are not committed in the ZK VM until finalization.
-        let input_minus_follower = slice_range.difference(&self.follower_input_ranges);
+        let input_minus_follower = slice.to_range().difference(&self.follower_input_ranges);
         let mut zk = self.zk.try_lock().unwrap();
-        for input in input_minus_follower {
+        for input in input_minus_follower.iter_ranges() {
             zk.commit_raw(
                 self.memory_map
                     .try_get(Slice::from_range_unchecked(input))?,
@@ -268,7 +266,7 @@ where
                 mpc.mark_private_raw(slice)?;
                 // Follower's private inputs will become public during finalization.
                 zk.mark_public_raw(self.memory_map.try_get(slice)?)?;
-                self.follower_input_ranges.union_mut(slice.to_range());
+                self.follower_input_ranges.union_mut(&slice.to_range());
                 self.follower_inputs.push(slice);
             }
         }
@@ -284,7 +282,7 @@ where
                 mpc.mark_blind_raw(slice)?;
                 // Follower's private inputs will become public during finalization.
                 zk.mark_public_raw(self.memory_map.try_get(slice)?)?;
-                self.follower_input_ranges.union_mut(slice.to_range());
+                self.follower_input_ranges.union_mut(&slice.to_range());
                 self.follower_inputs.push(slice);
             }
             Role::Follower => {
@@ -384,27 +382,37 @@ enum ErrorRepr {
 
 #[cfg(test)]
 mod tests {
-    use mpz_circuits::AES128;
+    use mpz_circuits::circuits::AES128;
     use mpz_common::context::test_st_context;
-    use mpz_ideal_vm::IdealVm;
+    use mpz_core::Block;
+    use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
+    use mpz_ot::ideal::{cot::ideal_cot, rcot::ideal_rcot};
     use mpz_vm_core::{
-        memory::{binary::U8, Array},
+        memory::{binary::U8, correlated::Delta, Array},
         prelude::*,
     };
+    use mpz_zk::{Prover, ProverConfig, Verifier, VerifierConfig};
+    use rand::{rngs::StdRng, SeedableRng};
 
     use super::*;
 
     #[tokio::test]
     async fn test_deap() {
+        let mut rng = StdRng::seed_from_u64(0);
+        let delta_mpc = Delta::random(&mut rng);
+        let delta_zk = Delta::random(&mut rng);
+
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
+        let (rcot_send, rcot_recv) = ideal_rcot(Block::ZERO, delta_zk.into_inner());
+        let (cot_send, cot_recv) = ideal_cot(delta_mpc.into_inner());
 
-        let leader_mpc = IdealVm::new();
-        let leader_zk = IdealVm::new();
-        let follower_mpc = IdealVm::new();
-        let follower_zk = IdealVm::new();
+        let gb = Garbler::new(cot_send, [0u8; 16], delta_mpc);
+        let ev = Evaluator::new(cot_recv);
+        let prover = Prover::new(ProverConfig::default(), rcot_recv);
+        let verifier = Verifier::new(VerifierConfig::default(), delta_zk, rcot_send);
 
-        let mut leader = Deap::new(Role::Leader, leader_mpc, leader_zk);
-        let mut follower = Deap::new(Role::Follower, follower_mpc, follower_zk);
+        let mut leader = Deap::new(Role::Leader, gb, prover);
+        let mut follower = Deap::new(Role::Follower, ev, verifier);
 
         let (ct_leader, ct_follower) = futures::join!(
             async {
@@ -470,15 +478,21 @@ mod tests {
 
     #[tokio::test]
     async fn test_deap_desync_memory() {
+        let mut rng = StdRng::seed_from_u64(0);
+        let delta_mpc = Delta::random(&mut rng);
+        let delta_zk = Delta::random(&mut rng);
+
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
+        let (rcot_send, rcot_recv) = ideal_rcot(Block::ZERO, delta_zk.into_inner());
+        let (cot_send, cot_recv) = ideal_cot(delta_mpc.into_inner());
 
-        let leader_mpc = IdealVm::new();
-        let leader_zk = IdealVm::new();
-        let follower_mpc = IdealVm::new();
-        let follower_zk = IdealVm::new();
+        let gb = Garbler::new(cot_send, [0u8; 16], delta_mpc);
+        let ev = Evaluator::new(cot_recv);
+        let prover = Prover::new(ProverConfig::default(), rcot_recv);
+        let verifier = Verifier::new(VerifierConfig::default(), delta_zk, rcot_send);
 
-        let mut leader = Deap::new(Role::Leader, leader_mpc, leader_zk);
-        let mut follower = Deap::new(Role::Follower, follower_mpc, follower_zk);
+        let mut leader = Deap::new(Role::Leader, gb, prover);
+        let mut follower = Deap::new(Role::Follower, ev, verifier);
 
         // Desynchronize the memories.
         let _ = leader.zk().alloc_raw(1).unwrap();
@@ -550,15 +564,21 @@ mod tests {
     // detection by the follower.
     #[tokio::test]
     async fn test_malicious() {
+        let mut rng = StdRng::seed_from_u64(0);
+        let delta_mpc = Delta::random(&mut rng);
+        let delta_zk = Delta::random(&mut rng);
+
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
+        let (rcot_send, rcot_recv) = ideal_rcot(Block::ZERO, delta_zk.into_inner());
+        let (cot_send, cot_recv) = ideal_cot(delta_mpc.into_inner());
 
-        let leader_mpc = IdealVm::new();
-        let leader_zk = IdealVm::new();
-        let follower_mpc = IdealVm::new();
-        let follower_zk = IdealVm::new();
+        let gb = Garbler::new(cot_send, [1u8; 16], delta_mpc);
+        let ev = Evaluator::new(cot_recv);
+        let prover = Prover::new(ProverConfig::default(), rcot_recv);
+        let verifier = Verifier::new(VerifierConfig::default(), delta_zk, rcot_send);
 
-        let mut leader = Deap::new(Role::Leader, leader_mpc, leader_zk);
-        let mut follower = Deap::new(Role::Follower, follower_mpc, follower_zk);
+        let mut leader = Deap::new(Role::Leader, gb, prover);
+        let mut follower = Deap::new(Role::Follower, ev, verifier);
 
         let (_, follower_res) = futures::join!(
             async {

crates/components/deap/src/map.rs

@@ -1,7 +1,7 @@
 use std::ops::Range;
 
 use mpz_vm_core::{memory::Slice, VmError};
-use rangeset::ops::Set;
+use rangeset::Subset;
 
 /// A mapping between the memories of the MPC and ZK VMs.
 #[derive(Debug, Default)]

crates/components/hmac-sha256/Cargo.toml

@@ -5,7 +5,7 @@ description = "A 2PC implementation of TLS HMAC-SHA256 PRF"
 keywords = ["tls", "mpc", "2pc", "hmac", "sha256"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]
@@ -20,13 +20,14 @@ mpz-core = { workspace = true }
 mpz-circuits = { workspace = true }
 mpz-hash = { workspace = true }
 
-sha2 = { workspace = true, features = ["compress"] }
 thiserror = { workspace = true }
 tracing = { workspace = true }
+sha2 = { workspace = true }
 
 [dev-dependencies]
+mpz-ot = { workspace = true, features = ["ideal"] }
+mpz-garble = { workspace = true }
 mpz-common = { workspace = true, features = ["test-utils"] }
-mpz-ideal-vm = { workspace = true }
 
 criterion = { workspace = true, features = ["async_tokio"] }
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread"] }

crates/components/hmac-sha256/benches/prf.rs

@@ -4,12 +4,14 @@ use criterion::{criterion_group, criterion_main, Criterion};
 
 use hmac_sha256::{Mode, MpcPrf};
 use mpz_common::context::test_mt_context;
-use mpz_ideal_vm::IdealVm;
+use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
+use mpz_ot::ideal::cot::ideal_cot;
 use mpz_vm_core::{
-    memory::{binary::U8, Array},
+    memory::{binary::U8, correlated::Delta, Array},
     prelude::*,
     Execute,
 };
+use rand::{rngs::StdRng, SeedableRng};
 
 #[allow(clippy::unit_arg)]
 fn criterion_benchmark(c: &mut Criterion) {
@@ -27,6 +29,8 @@ criterion_group!(benches, criterion_benchmark);
 criterion_main!(benches);
 
 async fn prf(mode: Mode) {
+    let mut rng = StdRng::seed_from_u64(0);
+
     let pms = [42u8; 32];
     let client_random = [69u8; 32];
     let server_random: [u8; 32] = [96u8; 32];
@@ -35,8 +39,11 @@ async fn prf(mode: Mode) {
     let mut leader_ctx = leader_exec.new_context().await.unwrap();
     let mut follower_ctx = follower_exec.new_context().await.unwrap();
 
-    let mut leader_vm = IdealVm::new();
-    let mut follower_vm = IdealVm::new();
+    let delta = Delta::random(&mut rng);
+    let (ot_send, ot_recv) = ideal_cot(delta.into_inner());
+
+    let mut leader_vm = Garbler::new(ot_send, [0u8; 16], delta);
+    let mut follower_vm = Evaluator::new(ot_recv);
 
     let leader_pms: Array<U8, 32> = leader_vm.alloc().unwrap();
     leader_vm.mark_public(leader_pms).unwrap();

crates/components/hmac-sha256/src/hmac.rs

@@ -54,11 +54,10 @@ mod tests {
     use crate::{
         hmac::hmac_sha256,
         sha256, state_to_bytes,
-        test_utils::{compute_inner_local, compute_outer_partial},
+        test_utils::{compute_inner_local, compute_outer_partial, mock_vm},
     };
     use mpz_common::context::test_st_context;
     use mpz_hash::sha256::Sha256;
-    use mpz_ideal_vm::IdealVm;
     use mpz_vm_core::{
         memory::{
             binary::{U32, U8},
@@ -84,8 +83,7 @@ mod tests {
     #[tokio::test]
     async fn test_hmac_circuit() {
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut leader = IdealVm::new();
-        let mut follower = IdealVm::new();
+        let (mut leader, mut follower) = mock_vm();
 
         let (inputs, references) = test_fixtures();
         for (input, &reference) in inputs.iter().zip(references.iter()) {

crates/components/hmac-sha256/src/lib.rs

@@ -72,11 +72,10 @@ fn state_to_bytes(input: [u32; 8]) -> [u8; 32] {
 #[cfg(test)]
 mod tests {
     use crate::{
-        test_utils::{prf_cf_vd, prf_keys, prf_ms, prf_sf_vd},
+        test_utils::{mock_vm, prf_cf_vd, prf_keys, prf_ms, prf_sf_vd},
         Mode, MpcPrf, SessionKeys,
     };
     use mpz_common::context::test_st_context;
-    use mpz_ideal_vm::IdealVm;
     use mpz_vm_core::{
         memory::{binary::U8, Array, MemoryExt, ViewExt},
         Execute,
@@ -124,8 +123,7 @@ mod tests {
 
         // Set up vm and prf
         let (mut ctx_a, mut ctx_b) = test_st_context(128);
-        let mut leader = IdealVm::new();
-        let mut follower = IdealVm::new();
+        let (mut leader, mut follower) = mock_vm();
 
         let leader_pms: Array<U8, 32> = leader.alloc().unwrap();
         leader.mark_public(leader_pms).unwrap();

crates/components/hmac-sha256/src/prf.rs

@@ -339,9 +339,8 @@ fn gen_merge_circ(size: usize) -> Arc<Circuit> {
 
 #[cfg(test)]
 mod tests {
-    use crate::prf::merge_outputs;
+    use crate::{prf::merge_outputs, test_utils::mock_vm};
     use mpz_common::context::test_st_context;
-    use mpz_ideal_vm::IdealVm;
     use mpz_vm_core::{
         memory::{binary::U8, Array, MemoryExt, ViewExt},
         Execute,
@@ -350,8 +349,7 @@ mod tests {
     #[tokio::test]
     async fn test_merge_outputs() {
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut leader = IdealVm::new();
-        let mut follower = IdealVm::new();
+        let (mut leader, mut follower) = mock_vm();
 
         let input1: [u8; 32] = std::array::from_fn(|i| i as u8);
         let input2: [u8; 32] = std::array::from_fn(|i| i as u8 + 32);

crates/components/hmac-sha256/src/prf/function.rs

@@ -137,11 +137,10 @@ impl Prf {
 mod tests {
     use crate::{
         prf::{compute_partial, function::Prf},
-        test_utils::phash,
+        test_utils::{mock_vm, phash},
         Mode,
     };
     use mpz_common::context::test_st_context;
-    use mpz_ideal_vm::IdealVm;
     use mpz_vm_core::{
         memory::{binary::U8, Array, MemoryExt, ViewExt},
         Execute,
@@ -167,8 +166,7 @@ mod tests {
         let mut rng = ThreadRng::default();
 
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut leader = IdealVm::new();
-        let mut follower = IdealVm::new();
+        let (mut leader, mut follower) = mock_vm();
 
         let key: [u8; 32] = rng.random();
         let start_seed: Vec<u8> = vec![42; 64];

crates/components/hmac-sha256/src/test_utils.rs

@@ -1,10 +1,25 @@
 use crate::{sha256, state_to_bytes};
+use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
+use mpz_ot::ideal::cot::{ideal_cot, IdealCOTReceiver, IdealCOTSender};
+use mpz_vm_core::memory::correlated::Delta;
 use rand::{rngs::StdRng, Rng, SeedableRng};
 
 pub(crate) const SHA256_IV: [u32; 8] = [
     0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
 ];
 
+pub(crate) fn mock_vm() -> (Garbler<IdealCOTSender>, Evaluator<IdealCOTReceiver>) {
+    let mut rng = StdRng::seed_from_u64(0);
+    let delta = Delta::random(&mut rng);
+
+    let (cot_send, cot_recv) = ideal_cot(delta.into_inner());
+
+    let gen = Garbler::new(cot_send, [0u8; 16], delta);
+    let ev = Evaluator::new(cot_recv);
+
+    (gen, ev)
+}
+
 pub(crate) fn prf_ms(pms: [u8; 32], client_random: [u8; 32], server_random: [u8; 32]) -> [u8; 48] {
     let mut label_start_seed = b"master secret".to_vec();
     label_start_seed.extend_from_slice(&client_random);

crates/components/key-exchange/Cargo.toml

@@ -5,7 +5,7 @@ description = "Implementation of the 3-party key-exchange protocol"
 keywords = ["tls", "mpc", "2pc", "pms", "key-exchange"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]
@@ -40,7 +40,6 @@ tokio = { workspace = true, features = ["sync"] }
 [dev-dependencies]
 mpz-ot = { workspace = true, features = ["ideal"] }
 mpz-garble = { workspace = true }
-mpz-ideal-vm = { workspace = true }
 
 rand_core = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread"] }

crates/components/key-exchange/src/exchange.rs

@@ -459,7 +459,9 @@ mod tests {
     use mpz_common::context::test_st_context;
     use mpz_core::Block;
     use mpz_fields::UniformRand;
-    use mpz_ideal_vm::IdealVm;
+    use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
+    use mpz_memory_core::correlated::Delta;
+    use mpz_ot::ideal::cot::{ideal_cot, IdealCOTReceiver, IdealCOTSender};
     use mpz_share_conversion::ideal::{
         ideal_share_convert, IdealShareConvertReceiver, IdealShareConvertSender,
     };
@@ -482,8 +484,7 @@ mod tests {
     async fn test_key_exchange() {
         let mut rng = StdRng::seed_from_u64(0).compat();
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut gen = IdealVm::new();
-        let mut ev = IdealVm::new();
+        let (mut gen, mut ev) = mock_vm();
 
         let leader_private_key = SecretKey::random(&mut rng);
         let follower_private_key = SecretKey::random(&mut rng);
@@ -624,8 +625,7 @@ mod tests {
     async fn test_malicious_key_exchange(#[case] malicious: Malicious) {
         let mut rng = StdRng::seed_from_u64(0);
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let mut gen = IdealVm::new();
-        let mut ev = IdealVm::new();
+        let (mut gen, mut ev) = mock_vm();
 
         let leader_private_key = SecretKey::random(&mut rng.compat_by_ref());
         let follower_private_key = SecretKey::random(&mut rng.compat_by_ref());
@@ -704,8 +704,7 @@ mod tests {
     #[tokio::test]
     async fn test_circuit() {
         let (mut ctx_a, mut ctx_b) = test_st_context(8);
-        let gen = IdealVm::new();
-        let ev = IdealVm::new();
+        let (gen, ev) = mock_vm();
 
         let share_a0_bytes = [5_u8; 32];
         let share_a1_bytes = [2_u8; 32];
@@ -835,4 +834,16 @@ mod tests {
 
         (leader, follower)
     }
+
+    fn mock_vm() -> (Garbler<IdealCOTSender>, Evaluator<IdealCOTReceiver>) {
+        let mut rng = StdRng::seed_from_u64(0);
+        let delta = Delta::random(&mut rng);
+
+        let (cot_send, cot_recv) = ideal_cot(delta.into_inner());
+
+        let gen = Garbler::new(cot_send, [0u8; 16], delta);
+        let ev = Evaluator::new(cot_recv);
+
+        (gen, ev)
+    }
 }

crates/components/key-exchange/src/lib.rs

@@ -8,7 +8,7 @@
 //! with the server alone and forward all messages from and to the follower.
 //!
 //! A detailed description of this protocol can be found in our documentation
-//! <https://tlsnotary.org/docs/mpc/key_exchange>.
+//! <https://docs.tlsnotary.org/protocol/notarization/key_exchange.html>.
 
 #![deny(missing_docs, unreachable_pub, unused_must_use)]
 #![deny(clippy::all)]

crates/components/key-exchange/src/mock.rs

@@ -26,7 +26,8 @@ pub fn create_mock_key_exchange_pair() -> (MockKeyExchange, MockKeyExchange) {
 
 #[cfg(test)]
 mod tests {
-    use mpz_ideal_vm::IdealVm;
+    use mpz_garble::protocol::semihonest::{Evaluator, Garbler};
+    use mpz_ot::ideal::cot::{IdealCOTReceiver, IdealCOTSender};
 
     use super::*;
     use crate::KeyExchange;
@@ -39,12 +40,12 @@ mod tests {
 
         is_key_exchange::<
             MpcKeyExchange<IdealShareConvertSender<P256>, IdealShareConvertReceiver<P256>>,
-            IdealVm,
+            Garbler<IdealCOTSender>,
         >(leader);
 
         is_key_exchange::<
             MpcKeyExchange<IdealShareConvertSender<P256>, IdealShareConvertReceiver<P256>>,
-            IdealVm,
+            Evaluator<IdealCOTReceiver>,
         >(follower);
     }
 }

crates/components/key-exchange/src/point_addition.rs

@@ -4,7 +4,7 @@
 //! protocol has semi-honest security.
 //!
 //! The protocol is described in
-//! <https://tlsnotary.org/docs/mpc/key_exchange>
+//! <https://docs.tlsnotary.org/protocol/notarization/key_exchange.html>
 
 use crate::{KeyExchangeError, Role};
 use mpz_common::{Context, Flush};

crates/core/Cargo.toml

@@ -5,7 +5,7 @@ description = "Core types for TLSNotary"
 keywords = ["tls", "mpc", "2pc", "types"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]
@@ -13,14 +13,7 @@ workspace = true
 
 [features]
 default = []
-mozilla-certs = ["dep:webpki-root-certs", "dep:webpki-roots"]
-fixtures = [
-    "dep:hex",
-    "dep:tlsn-data-fixtures",
-    "dep:aead",
-    "dep:aes-gcm",
-    "dep:generic-array",
-]
+fixtures = ["dep:hex", "dep:tlsn-data-fixtures"]
 
 [dependencies]
 tlsn-data-fixtures = { workspace = true, optional = true }
@@ -28,9 +21,6 @@ tlsn-tls-core = { workspace = true, features = ["serde"] }
 tlsn-utils = { workspace = true }
 rangeset = { workspace = true, features = ["serde"] }
 
-aead = { workspace = true, features = ["alloc"], optional = true }
-aes-gcm = { workspace = true, optional = true }
-generic-array = { workspace = true, optional = true }
 bimap = { version = "0.6", features = ["serde"] }
 blake3 = { workspace = true }
 hex = { workspace = true, optional = true }
@@ -45,21 +35,15 @@ sha2 = { workspace = true }
 thiserror = { workspace = true }
 tiny-keccak = { workspace = true, features = ["keccak"] }
 web-time = { workspace = true }
-webpki-roots = { workspace = true, optional = true }
-webpki-root-certs = { workspace = true, optional = true }
+webpki-roots = { workspace = true }
 rustls-webpki = { workspace = true, features = ["ring"] }
 rustls-pki-types = { workspace = true }
 itybity = { workspace = true }
-zeroize = { workspace = true, features = ["zeroize_derive"] }
+zeroize = { workspace = true }
 
 [dev-dependencies]
-aead = { workspace = true, features = ["alloc"] }
-aes-gcm = { workspace = true }
-generic-array = { workspace = true }
 bincode = { workspace = true }
 hex = { workspace = true }
 rstest = { workspace = true }
-tlsn-core = { workspace = true, features = ["fixtures"] }
-tlsn-attestation = { workspace = true, features = ["fixtures"] }
 tlsn-data-fixtures = { workspace = true }
 webpki-root-certs = { workspace = true }

crates/core/src/config.rs

@@ -1,7 +0,0 @@
-//! Configuration types.
-
-pub mod prove;
-pub mod prover;
-pub mod tls;
-pub mod tls_commit;
-pub mod verifier;

crates/core/src/config/prove.rs

@@ -1,189 +0,0 @@
-//! Proving configuration.
-
-use rangeset::set::{RangeSet, ToRangeSet};
-use serde::{Deserialize, Serialize};
-
-use crate::transcript::{Direction, Transcript, TranscriptCommitConfig, TranscriptCommitRequest};
-
-/// Configuration to prove information to the verifier.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ProveConfig {
-    server_identity: bool,
-    reveal: Option<(RangeSet<usize>, RangeSet<usize>)>,
-    transcript_commit: Option<TranscriptCommitConfig>,
-}
-
-impl ProveConfig {
-    /// Creates a new builder.
-    pub fn builder(transcript: &Transcript) -> ProveConfigBuilder<'_> {
-        ProveConfigBuilder::new(transcript)
-    }
-
-    /// Returns `true` if the server identity is to be proven.
-    pub fn server_identity(&self) -> bool {
-        self.server_identity
-    }
-
-    /// Returns the sent and received ranges of the transcript to be revealed,
-    /// respectively.
-    pub fn reveal(&self) -> Option<&(RangeSet<usize>, RangeSet<usize>)> {
-        self.reveal.as_ref()
-    }
-
-    /// Returns the transcript commitment configuration.
-    pub fn transcript_commit(&self) -> Option<&TranscriptCommitConfig> {
-        self.transcript_commit.as_ref()
-    }
-
-    /// Returns a request.
-    pub fn to_request(&self) -> ProveRequest {
-        ProveRequest {
-            server_identity: self.server_identity,
-            reveal: self.reveal.clone(),
-            transcript_commit: self
-                .transcript_commit
-                .clone()
-                .map(|config| config.to_request()),
-        }
-    }
-}
-
-/// Builder for [`ProveConfig`].
-#[derive(Debug)]
-pub struct ProveConfigBuilder<'a> {
-    transcript: &'a Transcript,
-    server_identity: bool,
-    reveal: Option<(RangeSet<usize>, RangeSet<usize>)>,
-    transcript_commit: Option<TranscriptCommitConfig>,
-}
-
-impl<'a> ProveConfigBuilder<'a> {
-    /// Creates a new builder.
-    pub fn new(transcript: &'a Transcript) -> Self {
-        Self {
-            transcript,
-            server_identity: false,
-            reveal: None,
-            transcript_commit: None,
-        }
-    }
-
-    /// Proves the server identity.
-    pub fn server_identity(&mut self) -> &mut Self {
-        self.server_identity = true;
-        self
-    }
-
-    /// Configures transcript commitments.
-    pub fn transcript_commit(&mut self, transcript_commit: TranscriptCommitConfig) -> &mut Self {
-        self.transcript_commit = Some(transcript_commit);
-        self
-    }
-
-    /// Reveals the given ranges of the transcript.
-    pub fn reveal(
-        &mut self,
-        direction: Direction,
-        ranges: &dyn ToRangeSet<usize>,
-    ) -> Result<&mut Self, ProveConfigError> {
-        let idx = ranges.to_range_set();
-
-        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
-            return Err(ProveConfigError(ErrorRepr::IndexOutOfBounds {
-                direction,
-                actual: idx.end().unwrap_or(0),
-                len: self.transcript.len_of_direction(direction),
-            }));
-        }
-
-        let (sent, recv) = self.reveal.get_or_insert_default();
-        match direction {
-            Direction::Sent => sent.union_mut(&idx),
-            Direction::Received => recv.union_mut(&idx),
-        }
-
-        Ok(self)
-    }
-
-    /// Reveals the given ranges of the sent data transcript.
-    pub fn reveal_sent(
-        &mut self,
-        ranges: &dyn ToRangeSet<usize>,
-    ) -> Result<&mut Self, ProveConfigError> {
-        self.reveal(Direction::Sent, ranges)
-    }
-
-    /// Reveals all of the sent data transcript.
-    pub fn reveal_sent_all(&mut self) -> Result<&mut Self, ProveConfigError> {
-        let len = self.transcript.len_of_direction(Direction::Sent);
-        let (sent, _) = self.reveal.get_or_insert_default();
-        sent.union_mut(&(0..len));
-        Ok(self)
-    }
-
-    /// Reveals the given ranges of the received data transcript.
-    pub fn reveal_recv(
-        &mut self,
-        ranges: &dyn ToRangeSet<usize>,
-    ) -> Result<&mut Self, ProveConfigError> {
-        self.reveal(Direction::Received, ranges)
-    }
-
-    /// Reveals all of the received data transcript.
-    pub fn reveal_recv_all(&mut self) -> Result<&mut Self, ProveConfigError> {
-        let len = self.transcript.len_of_direction(Direction::Received);
-        let (_, recv) = self.reveal.get_or_insert_default();
-        recv.union_mut(&(0..len));
-        Ok(self)
-    }
-
-    /// Builds the configuration.
-    pub fn build(self) -> Result<ProveConfig, ProveConfigError> {
-        Ok(ProveConfig {
-            server_identity: self.server_identity,
-            reveal: self.reveal,
-            transcript_commit: self.transcript_commit,
-        })
-    }
-}
-
-/// Request to prove statements about the connection.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ProveRequest {
-    server_identity: bool,
-    reveal: Option<(RangeSet<usize>, RangeSet<usize>)>,
-    transcript_commit: Option<TranscriptCommitRequest>,
-}
-
-impl ProveRequest {
-    /// Returns `true` if the server identity is to be proven.
-    pub fn server_identity(&self) -> bool {
-        self.server_identity
-    }
-
-    /// Returns the sent and received ranges of the transcript to be revealed,
-    /// respectively.
-    pub fn reveal(&self) -> Option<&(RangeSet<usize>, RangeSet<usize>)> {
-        self.reveal.as_ref()
-    }
-
-    /// Returns the transcript commitment configuration.
-    pub fn transcript_commit(&self) -> Option<&TranscriptCommitRequest> {
-        self.transcript_commit.as_ref()
-    }
-}
-
-/// Error for [`ProveConfig`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct ProveConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-enum ErrorRepr {
-    #[error("range is out of bounds of the transcript ({direction}): {actual} > {len}")]
-    IndexOutOfBounds {
-        direction: Direction,
-        actual: usize,
-        len: usize,
-    },
-}

crates/core/src/config/prover.rs

@@ -1,33 +0,0 @@
-//! Prover configuration.
-
-use serde::{Deserialize, Serialize};
-
-/// Prover configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ProverConfig {}
-
-impl ProverConfig {
-    /// Creates a new builder.
-    pub fn builder() -> ProverConfigBuilder {
-        ProverConfigBuilder::default()
-    }
-}
-
-/// Builder for [`ProverConfig`].
-#[derive(Debug, Default)]
-pub struct ProverConfigBuilder {}
-
-impl ProverConfigBuilder {
-    /// Builds the configuration.
-    pub fn build(self) -> Result<ProverConfig, ProverConfigError> {
-        Ok(ProverConfig {})
-    }
-}
-
-/// Error for [`ProverConfig`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct ProverConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-enum ErrorRepr {}

crates/core/src/config/tls.rs

@@ -1,111 +0,0 @@
-//! TLS client configuration.
-
-use serde::{Deserialize, Serialize};
-
-use crate::{
-    connection::ServerName,
-    webpki::{CertificateDer, PrivateKeyDer, RootCertStore},
-};
-
-/// TLS client configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TlsClientConfig {
-    server_name: ServerName,
-    /// Root certificates.
-    root_store: RootCertStore,
-    /// Certificate chain and a matching private key for client
-    /// authentication.
-    client_auth: Option<(Vec<CertificateDer>, PrivateKeyDer)>,
-}
-
-impl TlsClientConfig {
-    /// Creates a new builder.
-    pub fn builder() -> TlsConfigBuilder {
-        TlsConfigBuilder::default()
-    }
-
-    /// Returns the server name.
-    pub fn server_name(&self) -> &ServerName {
-        &self.server_name
-    }
-
-    /// Returns the root certificates.
-    pub fn root_store(&self) -> &RootCertStore {
-        &self.root_store
-    }
-
-    /// Returns a certificate chain and a matching private key for client
-    /// authentication.
-    pub fn client_auth(&self) -> Option<&(Vec<CertificateDer>, PrivateKeyDer)> {
-        self.client_auth.as_ref()
-    }
-}
-
-/// Builder for [`TlsClientConfig`].
-#[derive(Debug, Default)]
-pub struct TlsConfigBuilder {
-    server_name: Option<ServerName>,
-    root_store: Option<RootCertStore>,
-    client_auth: Option<(Vec<CertificateDer>, PrivateKeyDer)>,
-}
-
-impl TlsConfigBuilder {
-    /// Sets the server name.
-    pub fn server_name(mut self, server_name: ServerName) -> Self {
-        self.server_name = Some(server_name);
-        self
-    }
-
-    /// Sets the root certificates to use for verifying the server's
-    /// certificate.
-    pub fn root_store(mut self, store: RootCertStore) -> Self {
-        self.root_store = Some(store);
-        self
-    }
-
-    /// Sets a DER-encoded certificate chain and a matching private key for
-    /// client authentication.
-    ///
-    /// Often the chain will consist of a single end-entity certificate.
-    ///
-    /// # Arguments
-    ///
-    /// * `cert_key` - A tuple containing the certificate chain and the private
-    ///   key.
-    ///
-    ///   - Each certificate in the chain must be in the X.509 format.
-    ///   - The key must be in the ASN.1 format (either PKCS#8 or PKCS#1).
-    pub fn client_auth(mut self, cert_key: (Vec<CertificateDer>, PrivateKeyDer)) -> Self {
-        self.client_auth = Some(cert_key);
-        self
-    }
-
-    /// Builds the TLS configuration.
-    pub fn build(self) -> Result<TlsClientConfig, TlsConfigError> {
-        let server_name = self.server_name.ok_or(ErrorRepr::MissingField {
-            field: "server_name",
-        })?;
-
-        let root_store = self.root_store.ok_or(ErrorRepr::MissingField {
-            field: "root_store",
-        })?;
-
-        Ok(TlsClientConfig {
-            server_name,
-            root_store,
-            client_auth: self.client_auth,
-        })
-    }
-}
-
-/// TLS configuration error.
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct TlsConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-#[error("tls config error")]
-enum ErrorRepr {
-    #[error("missing required field: {field}")]
-    MissingField { field: &'static str },
-}

crates/core/src/config/tls_commit.rs

@@ -1,94 +0,0 @@
-//! TLS commitment configuration.
-
-pub mod mpc;
-
-use serde::{Deserialize, Serialize};
-
-/// TLS commitment configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TlsCommitConfig {
-    protocol: TlsCommitProtocolConfig,
-}
-
-impl TlsCommitConfig {
-    /// Creates a new builder.
-    pub fn builder() -> TlsCommitConfigBuilder {
-        TlsCommitConfigBuilder::default()
-    }
-
-    /// Returns the protocol configuration.
-    pub fn protocol(&self) -> &TlsCommitProtocolConfig {
-        &self.protocol
-    }
-
-    /// Returns a TLS commitment request.
-    pub fn to_request(&self) -> TlsCommitRequest {
-        TlsCommitRequest {
-            config: self.protocol.clone(),
-        }
-    }
-}
-
-/// Builder for [`TlsCommitConfig`].
-#[derive(Debug, Default, Clone, Serialize, Deserialize)]
-pub struct TlsCommitConfigBuilder {
-    protocol: Option<TlsCommitProtocolConfig>,
-}
-
-impl TlsCommitConfigBuilder {
-    /// Sets the protocol configuration.
-    pub fn protocol<C>(mut self, protocol: C) -> Self
-    where
-        C: Into<TlsCommitProtocolConfig>,
-    {
-        self.protocol = Some(protocol.into());
-        self
-    }
-
-    /// Builds the configuration.
-    pub fn build(self) -> Result<TlsCommitConfig, TlsCommitConfigError> {
-        let protocol = self
-            .protocol
-            .ok_or(ErrorRepr::MissingField { name: "protocol" })?;
-
-        Ok(TlsCommitConfig { protocol })
-    }
-}
-
-/// TLS commitment protocol configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[non_exhaustive]
-pub enum TlsCommitProtocolConfig {
-    /// MPC-TLS configuration.
-    Mpc(mpc::MpcTlsConfig),
-}
-
-impl From<mpc::MpcTlsConfig> for TlsCommitProtocolConfig {
-    fn from(config: mpc::MpcTlsConfig) -> Self {
-        Self::Mpc(config)
-    }
-}
-
-/// TLS commitment request.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct TlsCommitRequest {
-    config: TlsCommitProtocolConfig,
-}
-
-impl TlsCommitRequest {
-    /// Returns the protocol configuration.
-    pub fn protocol(&self) -> &TlsCommitProtocolConfig {
-        &self.config
-    }
-}
-
-/// Error for [`TlsCommitConfig`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct TlsCommitConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-enum ErrorRepr {
-    #[error("missing field: {name}")]
-    MissingField { name: &'static str },
-}

crates/core/src/config/tls_commit/mpc.rs

@@ -1,241 +0,0 @@
-//! MPC-TLS commitment protocol configuration.
-
-use serde::{Deserialize, Serialize};
-
-// Default is 32 bytes to decrypt the TLS protocol messages.
-const DEFAULT_MAX_RECV_ONLINE: usize = 32;
-
-/// MPC-TLS commitment protocol configuration.
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(try_from = "unchecked::MpcTlsConfigUnchecked")]
-pub struct MpcTlsConfig {
-    /// Maximum number of bytes that can be sent.
-    max_sent_data: usize,
-    /// Maximum number of application data records that can be sent.
-    max_sent_records: Option<usize>,
-    /// Maximum number of bytes that can be decrypted online, i.e. while the
-    /// MPC-TLS connection is active.
-    max_recv_data_online: usize,
-    /// Maximum number of bytes that can be received.
-    max_recv_data: usize,
-    /// Maximum number of received application data records that can be
-    /// decrypted online, i.e. while the MPC-TLS connection is active.
-    max_recv_records_online: Option<usize>,
-    /// Whether the `deferred decryption` feature is toggled on from the start
-    /// of the MPC-TLS connection.
-    defer_decryption_from_start: bool,
-    /// Network settings.
-    network: NetworkSetting,
-}
-
-impl MpcTlsConfig {
-    /// Creates a new builder.
-    pub fn builder() -> MpcTlsConfigBuilder {
-        MpcTlsConfigBuilder::default()
-    }
-
-    /// Returns the maximum number of bytes that can be sent.
-    pub fn max_sent_data(&self) -> usize {
-        self.max_sent_data
-    }
-
-    /// Returns the maximum number of application data records that can
-    /// be sent.
-    pub fn max_sent_records(&self) -> Option<usize> {
-        self.max_sent_records
-    }
-
-    /// Returns the maximum number of bytes that can be decrypted online.
-    pub fn max_recv_data_online(&self) -> usize {
-        self.max_recv_data_online
-    }
-
-    /// Returns the maximum number of bytes that can be received.
-    pub fn max_recv_data(&self) -> usize {
-        self.max_recv_data
-    }
-
-    /// Returns the maximum number of received application data records that
-    /// can be decrypted online.
-    pub fn max_recv_records_online(&self) -> Option<usize> {
-        self.max_recv_records_online
-    }
-
-    /// Returns whether the `deferred decryption` feature is toggled on from the
-    /// start of the MPC-TLS connection.
-    pub fn defer_decryption_from_start(&self) -> bool {
-        self.defer_decryption_from_start
-    }
-
-    /// Returns the network settings.
-    pub fn network(&self) -> NetworkSetting {
-        self.network
-    }
-}
-
-fn validate(config: MpcTlsConfig) -> Result<MpcTlsConfig, MpcTlsConfigError> {
-    if config.max_recv_data_online > config.max_recv_data {
-        return Err(ErrorRepr::InvalidValue {
-            name: "max_recv_data_online",
-            reason: format!(
-                "must be <= max_recv_data ({} > {})",
-                config.max_recv_data_online, config.max_recv_data
-            ),
-        }
-        .into());
-    }
-
-    Ok(config)
-}
-
-/// Builder for [`MpcTlsConfig`].
-#[derive(Debug, Default)]
-pub struct MpcTlsConfigBuilder {
-    max_sent_data: Option<usize>,
-    max_sent_records: Option<usize>,
-    max_recv_data_online: Option<usize>,
-    max_recv_data: Option<usize>,
-    max_recv_records_online: Option<usize>,
-    defer_decryption_from_start: Option<bool>,
-    network: Option<NetworkSetting>,
-}
-
-impl MpcTlsConfigBuilder {
-    /// Sets the maximum number of bytes that can be sent.
-    pub fn max_sent_data(mut self, max_sent_data: usize) -> Self {
-        self.max_sent_data = Some(max_sent_data);
-        self
-    }
-
-    /// Sets the maximum number of application data records that can be sent.
-    pub fn max_sent_records(mut self, max_sent_records: usize) -> Self {
-        self.max_sent_records = Some(max_sent_records);
-        self
-    }
-
-    /// Sets the maximum number of bytes that can be decrypted online.
-    pub fn max_recv_data_online(mut self, max_recv_data_online: usize) -> Self {
-        self.max_recv_data_online = Some(max_recv_data_online);
-        self
-    }
-
-    /// Sets the maximum number of bytes that can be received.
-    pub fn max_recv_data(mut self, max_recv_data: usize) -> Self {
-        self.max_recv_data = Some(max_recv_data);
-        self
-    }
-
-    /// Sets the maximum number of received application data records that can
-    /// be decrypted online.
-    pub fn max_recv_records_online(mut self, max_recv_records_online: usize) -> Self {
-        self.max_recv_records_online = Some(max_recv_records_online);
-        self
-    }
-
-    /// Sets whether the `deferred decryption` feature is toggled on from the
-    /// start of the MPC-TLS connection.
-    pub fn defer_decryption_from_start(mut self, defer_decryption_from_start: bool) -> Self {
-        self.defer_decryption_from_start = Some(defer_decryption_from_start);
-        self
-    }
-
-    /// Sets the network settings.
-    pub fn network(mut self, network: NetworkSetting) -> Self {
-        self.network = Some(network);
-        self
-    }
-
-    /// Builds the configuration.
-    pub fn build(self) -> Result<MpcTlsConfig, MpcTlsConfigError> {
-        let Self {
-            max_sent_data,
-            max_sent_records,
-            max_recv_data_online,
-            max_recv_data,
-            max_recv_records_online,
-            defer_decryption_from_start,
-            network,
-        } = self;
-
-        let max_sent_data = max_sent_data.ok_or(ErrorRepr::MissingField {
-            name: "max_sent_data",
-        })?;
-
-        let max_recv_data_online = max_recv_data_online.unwrap_or(DEFAULT_MAX_RECV_ONLINE);
-        let max_recv_data = max_recv_data.ok_or(ErrorRepr::MissingField {
-            name: "max_recv_data",
-        })?;
-
-        let defer_decryption_from_start = defer_decryption_from_start.unwrap_or(true);
-        let network = network.unwrap_or_default();
-
-        validate(MpcTlsConfig {
-            max_sent_data,
-            max_sent_records,
-            max_recv_data_online,
-            max_recv_data,
-            max_recv_records_online,
-            defer_decryption_from_start,
-            network,
-        })
-    }
-}
-
-/// Settings for the network environment.
-///
-/// Provides optimization options to adapt the protocol to different network
-/// situations.
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, Default)]
-pub enum NetworkSetting {
-    /// Reduces network round-trips at the expense of consuming more network
-    /// bandwidth.
-    Bandwidth,
-    /// Reduces network bandwidth utilization at the expense of more network
-    /// round-trips.
-    #[default]
-    Latency,
-}
-
-/// Error for [`MpcTlsConfig`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct MpcTlsConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-enum ErrorRepr {
-    #[error("missing field: {name}")]
-    MissingField { name: &'static str },
-    #[error("invalid value for field({name}): {reason}")]
-    InvalidValue { name: &'static str, reason: String },
-}
-
-mod unchecked {
-    use super::*;
-
-    #[derive(Deserialize)]
-    pub(super) struct MpcTlsConfigUnchecked {
-        max_sent_data: usize,
-        max_sent_records: Option<usize>,
-        max_recv_data_online: usize,
-        max_recv_data: usize,
-        max_recv_records_online: Option<usize>,
-        defer_decryption_from_start: bool,
-        network: NetworkSetting,
-    }
-
-    impl TryFrom<MpcTlsConfigUnchecked> for MpcTlsConfig {
-        type Error = MpcTlsConfigError;
-
-        fn try_from(value: MpcTlsConfigUnchecked) -> Result<Self, Self::Error> {
-            validate(MpcTlsConfig {
-                max_sent_data: value.max_sent_data,
-                max_sent_records: value.max_sent_records,
-                max_recv_data_online: value.max_recv_data_online,
-                max_recv_data: value.max_recv_data,
-                max_recv_records_online: value.max_recv_records_online,
-                defer_decryption_from_start: value.defer_decryption_from_start,
-                network: value.network,
-            })
-        }
-    }
-}

crates/core/src/config/verifier.rs

@@ -1,56 +0,0 @@
-//! Verifier configuration.
-
-use serde::{Deserialize, Serialize};
-
-use crate::webpki::RootCertStore;
-
-/// Verifier configuration.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct VerifierConfig {
-    root_store: RootCertStore,
-}
-
-impl VerifierConfig {
-    /// Creates a new builder.
-    pub fn builder() -> VerifierConfigBuilder {
-        VerifierConfigBuilder::default()
-    }
-
-    /// Returns the root certificate store.
-    pub fn root_store(&self) -> &RootCertStore {
-        &self.root_store
-    }
-}
-
-/// Builder for [`VerifierConfig`].
-#[derive(Debug, Default)]
-pub struct VerifierConfigBuilder {
-    root_store: Option<RootCertStore>,
-}
-
-impl VerifierConfigBuilder {
-    /// Sets the root certificate store.
-    pub fn root_store(mut self, root_store: RootCertStore) -> Self {
-        self.root_store = Some(root_store);
-        self
-    }
-
-    /// Builds the configuration.
-    pub fn build(self) -> Result<VerifierConfig, VerifierConfigError> {
-        let root_store = self
-            .root_store
-            .ok_or(ErrorRepr::MissingField { name: "root_store" })?;
-        Ok(VerifierConfig { root_store })
-    }
-}
-
-/// Error for [`VerifierConfig`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct VerifierConfigError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-enum ErrorRepr {
-    #[error("missing field: {name}")]
-    MissingField { name: &'static str },
-}

crates/core/src/connection.rs

@@ -116,75 +116,84 @@ pub enum KeyType {
     SECP256R1 = 0x0017,
 }
 
-/// Signature algorithm used on the key exchange parameters.
+/// Signature scheme on the key exchange parameters.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 #[allow(non_camel_case_types, missing_docs)]
-pub enum SignatureAlgorithm {
-    ECDSA_NISTP256_SHA256,
-    ECDSA_NISTP256_SHA384,
-    ECDSA_NISTP384_SHA256,
-    ECDSA_NISTP384_SHA384,
-    ED25519,
-    RSA_PKCS1_2048_8192_SHA256,
-    RSA_PKCS1_2048_8192_SHA384,
-    RSA_PKCS1_2048_8192_SHA512,
-    RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
-    RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
-    RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
+pub enum SignatureScheme {
+    RSA_PKCS1_SHA1 = 0x0201,
+    ECDSA_SHA1_Legacy = 0x0203,
+    RSA_PKCS1_SHA256 = 0x0401,
+    ECDSA_NISTP256_SHA256 = 0x0403,
+    RSA_PKCS1_SHA384 = 0x0501,
+    ECDSA_NISTP384_SHA384 = 0x0503,
+    RSA_PKCS1_SHA512 = 0x0601,
+    ECDSA_NISTP521_SHA512 = 0x0603,
+    RSA_PSS_SHA256 = 0x0804,
+    RSA_PSS_SHA384 = 0x0805,
+    RSA_PSS_SHA512 = 0x0806,
+    ED25519 = 0x0807,
 }
 
-impl fmt::Display for SignatureAlgorithm {
+impl fmt::Display for SignatureScheme {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            SignatureAlgorithm::ECDSA_NISTP256_SHA256 => write!(f, "ECDSA_NISTP256_SHA256"),
-            SignatureAlgorithm::ECDSA_NISTP256_SHA384 => write!(f, "ECDSA_NISTP256_SHA384"),
-            SignatureAlgorithm::ECDSA_NISTP384_SHA256 => write!(f, "ECDSA_NISTP384_SHA256"),
-            SignatureAlgorithm::ECDSA_NISTP384_SHA384 => write!(f, "ECDSA_NISTP384_SHA384"),
-            SignatureAlgorithm::ED25519 => write!(f, "ED25519"),
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256 => {
-                write!(f, "RSA_PKCS1_2048_8192_SHA256")
-            }
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384 => {
-                write!(f, "RSA_PKCS1_2048_8192_SHA384")
-            }
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512 => {
-                write!(f, "RSA_PKCS1_2048_8192_SHA512")
-            }
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
-                write!(f, "RSA_PSS_2048_8192_SHA256_LEGACY_KEY")
-            }
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
-                write!(f, "RSA_PSS_2048_8192_SHA384_LEGACY_KEY")
-            }
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
-                write!(f, "RSA_PSS_2048_8192_SHA512_LEGACY_KEY")
-            }
+            SignatureScheme::RSA_PKCS1_SHA1 => write!(f, "RSA_PKCS1_SHA1"),
+            SignatureScheme::ECDSA_SHA1_Legacy => write!(f, "ECDSA_SHA1_Legacy"),
+            SignatureScheme::RSA_PKCS1_SHA256 => write!(f, "RSA_PKCS1_SHA256"),
+            SignatureScheme::ECDSA_NISTP256_SHA256 => write!(f, "ECDSA_NISTP256_SHA256"),
+            SignatureScheme::RSA_PKCS1_SHA384 => write!(f, "RSA_PKCS1_SHA384"),
+            SignatureScheme::ECDSA_NISTP384_SHA384 => write!(f, "ECDSA_NISTP384_SHA384"),
+            SignatureScheme::RSA_PKCS1_SHA512 => write!(f, "RSA_PKCS1_SHA512"),
+            SignatureScheme::ECDSA_NISTP521_SHA512 => write!(f, "ECDSA_NISTP521_SHA512"),
+            SignatureScheme::RSA_PSS_SHA256 => write!(f, "RSA_PSS_SHA256"),
+            SignatureScheme::RSA_PSS_SHA384 => write!(f, "RSA_PSS_SHA384"),
+            SignatureScheme::RSA_PSS_SHA512 => write!(f, "RSA_PSS_SHA512"),
+            SignatureScheme::ED25519 => write!(f, "ED25519"),
         }
     }
 }
 
-impl From<tls_core::verify::SignatureAlgorithm> for SignatureAlgorithm {
-    fn from(value: tls_core::verify::SignatureAlgorithm) -> Self {
-        use tls_core::verify::SignatureAlgorithm as Core;
+impl TryFrom<tls_core::msgs::enums::SignatureScheme> for SignatureScheme {
+    type Error = &'static str;
+
+    fn try_from(value: tls_core::msgs::enums::SignatureScheme) -> Result<Self, Self::Error> {
+        use tls_core::msgs::enums::SignatureScheme as Core;
+        use SignatureScheme::*;
+        Ok(match value {
+            Core::RSA_PKCS1_SHA1 => RSA_PKCS1_SHA1,
+            Core::ECDSA_SHA1_Legacy => ECDSA_SHA1_Legacy,
+            Core::RSA_PKCS1_SHA256 => RSA_PKCS1_SHA256,
+            Core::ECDSA_NISTP256_SHA256 => ECDSA_NISTP256_SHA256,
+            Core::RSA_PKCS1_SHA384 => RSA_PKCS1_SHA384,
+            Core::ECDSA_NISTP384_SHA384 => ECDSA_NISTP384_SHA384,
+            Core::RSA_PKCS1_SHA512 => RSA_PKCS1_SHA512,
+            Core::ECDSA_NISTP521_SHA512 => ECDSA_NISTP521_SHA512,
+            Core::RSA_PSS_SHA256 => RSA_PSS_SHA256,
+            Core::RSA_PSS_SHA384 => RSA_PSS_SHA384,
+            Core::RSA_PSS_SHA512 => RSA_PSS_SHA512,
+            Core::ED25519 => ED25519,
+            _ => return Err("unsupported signature scheme"),
+        })
+    }
+}
+
+impl From<SignatureScheme> for tls_core::msgs::enums::SignatureScheme {
+    fn from(value: SignatureScheme) -> Self {
+        use tls_core::msgs::enums::SignatureScheme::*;
         match value {
-            Core::ECDSA_NISTP256_SHA256 => SignatureAlgorithm::ECDSA_NISTP256_SHA256,
-            Core::ECDSA_NISTP256_SHA384 => SignatureAlgorithm::ECDSA_NISTP256_SHA384,
-            Core::ECDSA_NISTP384_SHA256 => SignatureAlgorithm::ECDSA_NISTP384_SHA256,
-            Core::ECDSA_NISTP384_SHA384 => SignatureAlgorithm::ECDSA_NISTP384_SHA384,
-            Core::ED25519 => SignatureAlgorithm::ED25519,
-            Core::RSA_PKCS1_2048_8192_SHA256 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256,
-            Core::RSA_PKCS1_2048_8192_SHA384 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384,
-            Core::RSA_PKCS1_2048_8192_SHA512 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512,
-            Core::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
-                SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY
-            }
-            Core::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
-                SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY
-            }
-            Core::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
-                SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY
-            }
+            SignatureScheme::RSA_PKCS1_SHA1 => RSA_PKCS1_SHA1,
+            SignatureScheme::ECDSA_SHA1_Legacy => ECDSA_SHA1_Legacy,
+            SignatureScheme::RSA_PKCS1_SHA256 => RSA_PKCS1_SHA256,
+            SignatureScheme::ECDSA_NISTP256_SHA256 => ECDSA_NISTP256_SHA256,
+            SignatureScheme::RSA_PKCS1_SHA384 => RSA_PKCS1_SHA384,
+            SignatureScheme::ECDSA_NISTP384_SHA384 => ECDSA_NISTP384_SHA384,
+            SignatureScheme::RSA_PKCS1_SHA512 => RSA_PKCS1_SHA512,
+            SignatureScheme::ECDSA_NISTP521_SHA512 => ECDSA_NISTP521_SHA512,
+            SignatureScheme::RSA_PSS_SHA256 => RSA_PSS_SHA256,
+            SignatureScheme::RSA_PSS_SHA384 => RSA_PSS_SHA384,
+            SignatureScheme::RSA_PSS_SHA512 => RSA_PSS_SHA512,
+            SignatureScheme::ED25519 => ED25519,
         }
     }
 }
@@ -192,8 +201,8 @@ impl From<tls_core::verify::SignatureAlgorithm> for SignatureAlgorithm {
 /// Server's signature of the key exchange parameters.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServerSignature {
-    /// Signature algorithm.
-    pub alg: SignatureAlgorithm,
+    /// Signature scheme.
+    pub scheme: SignatureScheme,
     /// Signature data.
     pub sig: Vec<u8>,
 }
@@ -350,23 +359,20 @@ impl HandshakeData {
         message.extend_from_slice(&server_ephemeral_key.kx_params());
 
         use webpki::ring as alg;
-        let sig_alg = match self.sig.alg {
-            SignatureAlgorithm::ECDSA_NISTP256_SHA256 => alg::ECDSA_P256_SHA256,
-            SignatureAlgorithm::ECDSA_NISTP256_SHA384 => alg::ECDSA_P256_SHA384,
-            SignatureAlgorithm::ECDSA_NISTP384_SHA256 => alg::ECDSA_P384_SHA256,
-            SignatureAlgorithm::ECDSA_NISTP384_SHA384 => alg::ECDSA_P384_SHA384,
-            SignatureAlgorithm::ED25519 => alg::ED25519,
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256 => alg::RSA_PKCS1_2048_8192_SHA256,
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384 => alg::RSA_PKCS1_2048_8192_SHA384,
-            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512 => alg::RSA_PKCS1_2048_8192_SHA512,
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
-                alg::RSA_PSS_2048_8192_SHA256_LEGACY_KEY
-            }
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
-                alg::RSA_PSS_2048_8192_SHA384_LEGACY_KEY
-            }
-            SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
-                alg::RSA_PSS_2048_8192_SHA512_LEGACY_KEY
+        let sig_alg = match self.sig.scheme {
+            SignatureScheme::RSA_PKCS1_SHA256 => alg::RSA_PKCS1_2048_8192_SHA256,
+            SignatureScheme::RSA_PKCS1_SHA384 => alg::RSA_PKCS1_2048_8192_SHA384,
+            SignatureScheme::RSA_PKCS1_SHA512 => alg::RSA_PKCS1_2048_8192_SHA512,
+            SignatureScheme::RSA_PSS_SHA256 => alg::RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
+            SignatureScheme::RSA_PSS_SHA384 => alg::RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
+            SignatureScheme::RSA_PSS_SHA512 => alg::RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
+            SignatureScheme::ECDSA_NISTP256_SHA256 => alg::ECDSA_P256_SHA256,
+            SignatureScheme::ECDSA_NISTP384_SHA384 => alg::ECDSA_P384_SHA384,
+            SignatureScheme::ED25519 => alg::ED25519,
+            scheme => {
+                return Err(HandshakeVerificationError::UnsupportedSignatureScheme(
+                    scheme,
+                ))
             }
         };
 
@@ -396,6 +402,8 @@ pub enum HandshakeVerificationError {
     InvalidServerEphemeralKey,
     #[error("server certificate verification failed: {0}")]
     ServerCert(ServerCertVerifierError),
+    #[error("unsupported signature scheme: {0}")]
+    UnsupportedSignatureScheme(SignatureScheme),
 }
 
 #[cfg(test)]

crates/core/src/display.rs

@@ -1,16 +0,0 @@
-use rangeset::set::RangeSet;
-
-pub(crate) struct FmtRangeSet<'a>(pub &'a RangeSet<usize>);
-
-impl<'a> std::fmt::Display for FmtRangeSet<'a> {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str("{")?;
-        for range in self.0.iter() {
-            write!(f, "{}..{}", range.start, range.end)?;
-            if range.end < self.0.end().unwrap_or(0) {
-                f.write_str(", ")?;
-            }
-        }
-        f.write_str("}")
-    }
-}

crates/core/src/fixtures.rs

@@ -1,7 +1,6 @@
 //! Fixtures for testing
 
 mod provider;
-pub mod transcript;
 
 pub use provider::FixtureEncodingProvider;
 
@@ -10,8 +9,7 @@ use hex::FromHex;
 use crate::{
     connection::{
         CertBinding, CertBindingV1_2, ConnectionInfo, DnsName, HandshakeData, KeyType,
-        ServerEphemKey, ServerName, ServerSignature, SignatureAlgorithm, TlsVersion,
-        TranscriptLength,
+        ServerEphemKey, ServerName, ServerSignature, SignatureScheme, TlsVersion, TranscriptLength,
     },
     transcript::{
         encoding::{EncoderSecret, EncodingProvider},
@@ -48,7 +46,7 @@ impl ConnectionFixture {
                     CertificateDer(include_bytes!("fixtures/data/tlsnotary.org/ca.der").to_vec()),
                 ],
                 sig: ServerSignature {
-                    alg: SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256,
+                    scheme: SignatureScheme::RSA_PKCS1_SHA256,
                     sig: Vec::<u8>::from_hex(include_bytes!(
                         "fixtures/data/tlsnotary.org/signature"
                     ))
@@ -93,7 +91,7 @@ impl ConnectionFixture {
                     CertificateDer(include_bytes!("fixtures/data/appliedzkp.org/ca.der").to_vec()),
                 ],
                 sig: ServerSignature {
-                    alg: SignatureAlgorithm::ECDSA_NISTP256_SHA256,
+                    scheme: SignatureScheme::ECDSA_NISTP256_SHA256,
                     sig: Vec::<u8>::from_hex(include_bytes!(
                         "fixtures/data/appliedzkp.org/signature"
                     ))

crates/core/src/fixtures/transcript.rs

@@ -1,201 +0,0 @@
-//! Transcript fixtures for testing.
-
-use aead::Payload as AeadPayload;
-use aes_gcm::{aead::Aead, Aes128Gcm, NewAead};
-#[allow(deprecated)]
-use generic_array::GenericArray;
-use rand::{rngs::StdRng, Rng, SeedableRng};
-use tls_core::msgs::{
-    base::Payload,
-    codec::Codec,
-    enums::{HandshakeType, ProtocolVersion},
-    handshake::{HandshakeMessagePayload, HandshakePayload},
-    message::{OpaqueMessage, PlainMessage},
-};
-
-use crate::{
-    connection::{TranscriptLength, VerifyData},
-    fixtures::ConnectionFixture,
-    transcript::{ContentType, Record, TlsTranscript},
-};
-
-/// The key used for encryption of the sent and received transcript.
-pub const KEY: [u8; 16] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
-
-/// The iv used for encryption of the sent and received transcript.
-pub const IV: [u8; 4] = [1, 3, 3, 7];
-
-/// The record size in bytes.
-pub const RECORD_SIZE: usize = 512;
-
-/// Creates a transript fixture for testing.
-pub fn transcript_fixture(sent: &[u8], recv: &[u8]) -> TlsTranscript {
-    TranscriptGenerator::new(KEY, IV).generate(sent, recv)
-}
-
-struct TranscriptGenerator {
-    key: [u8; 16],
-    iv: [u8; 4],
-}
-
-impl TranscriptGenerator {
-    fn new(key: [u8; 16], iv: [u8; 4]) -> Self {
-        Self { key, iv }
-    }
-
-    fn generate(&self, sent: &[u8], recv: &[u8]) -> TlsTranscript {
-        let mut rng = StdRng::from_seed([1; 32]);
-
-        let transcript_len = TranscriptLength {
-            sent: sent.len() as u32,
-            received: recv.len() as u32,
-        };
-        let tlsn = ConnectionFixture::tlsnotary(transcript_len);
-
-        let time = tlsn.connection_info.time;
-        let version = tlsn.connection_info.version;
-        let server_cert_chain = tlsn.server_cert_data.certs;
-        let server_signature = tlsn.server_cert_data.sig;
-        let cert_binding = tlsn.server_cert_data.binding;
-
-        let cf_vd: [u8; 12] = rng.random();
-        let sf_vd: [u8; 12] = rng.random();
-
-        let verify_data = VerifyData {
-            client_finished: cf_vd.to_vec(),
-            server_finished: sf_vd.to_vec(),
-        };
-
-        let sent = self.gen_records(cf_vd, sent);
-        let recv = self.gen_records(sf_vd, recv);
-
-        TlsTranscript::new(
-            time,
-            version,
-            Some(server_cert_chain),
-            Some(server_signature),
-            cert_binding,
-            verify_data,
-            sent,
-            recv,
-        )
-        .unwrap()
-    }
-
-    fn gen_records(&self, vd: [u8; 12], plaintext: &[u8]) -> Vec<Record> {
-        let mut records = Vec::new();
-
-        let handshake = self.gen_handshake(vd);
-        records.push(handshake);
-
-        for (seq, msg) in (1_u64..).zip(plaintext.chunks(RECORD_SIZE)) {
-            let record = self.gen_app_data(seq, msg);
-            records.push(record);
-        }
-
-        records
-    }
-
-    fn gen_app_data(&self, seq: u64, plaintext: &[u8]) -> Record {
-        assert!(
-            plaintext.len() <= 1 << 14,
-            "plaintext len per record must be smaller than 2^14 bytes"
-        );
-
-        let explicit_nonce: [u8; 8] = seq.to_be_bytes();
-        let msg = PlainMessage {
-            typ: ContentType::ApplicationData.into(),
-            version: ProtocolVersion::TLSv1_2,
-            payload: Payload::new(plaintext),
-        };
-        let opaque = aes_gcm_encrypt(self.key, self.iv, seq, explicit_nonce, &msg);
-
-        let mut payload = opaque.payload.0;
-        let mut ciphertext = payload.split_off(8);
-        let tag = ciphertext.split_off(ciphertext.len() - 16);
-
-        Record {
-            seq,
-            typ: ContentType::ApplicationData,
-            plaintext: Some(plaintext.to_vec()),
-            explicit_nonce: explicit_nonce.to_vec(),
-            ciphertext,
-            tag: Some(tag),
-        }
-    }
-
-    fn gen_handshake(&self, vd: [u8; 12]) -> Record {
-        let seq = 0_u64;
-        let explicit_nonce = seq.to_be_bytes();
-
-        let mut plaintext = Vec::new();
-
-        let payload = Payload(vd.to_vec());
-        let hs_payload = HandshakePayload::Finished(payload);
-        let handshake_message = HandshakeMessagePayload {
-            typ: HandshakeType::Finished,
-            payload: hs_payload,
-        };
-        handshake_message.encode(&mut plaintext);
-
-        let msg = PlainMessage {
-            typ: ContentType::Handshake.into(),
-            version: ProtocolVersion::TLSv1_2,
-            payload: Payload::new(plaintext.clone()),
-        };
-
-        let opaque = aes_gcm_encrypt(self.key, self.iv, seq, explicit_nonce, &msg);
-        let mut payload = opaque.payload.0;
-        let mut ciphertext = payload.split_off(8);
-        let tag = ciphertext.split_off(ciphertext.len() - 16);
-
-        Record {
-            seq,
-            typ: ContentType::Handshake,
-            plaintext: Some(plaintext),
-            explicit_nonce: explicit_nonce.to_vec(),
-            ciphertext,
-            tag: Some(tag),
-        }
-    }
-}
-
-fn aes_gcm_encrypt(
-    key: [u8; 16],
-    iv: [u8; 4],
-    seq: u64,
-    explicit_nonce: [u8; 8],
-    msg: &PlainMessage,
-) -> OpaqueMessage {
-    let mut aad = [0u8; 13];
-
-    aad[..8].copy_from_slice(&seq.to_be_bytes());
-    aad[8] = msg.typ.get_u8();
-    aad[9..11].copy_from_slice(&msg.version.get_u16().to_be_bytes());
-    aad[11..13].copy_from_slice(&(msg.payload.0.len() as u16).to_be_bytes());
-    let payload = AeadPayload {
-        msg: &msg.payload.0,
-        aad: &aad,
-    };
-
-    let mut nonce = [0u8; 12];
-    nonce[..4].copy_from_slice(&iv);
-    nonce[4..].copy_from_slice(&explicit_nonce);
-    #[allow(deprecated)]
-    let nonce = GenericArray::from_slice(&nonce);
-    let cipher = Aes128Gcm::new_from_slice(&key).unwrap();
-
-    // ciphertext will have the MAC appended
-    let ciphertext = cipher.encrypt(nonce, payload).unwrap();
-
-    // prepend the explicit nonce
-    let mut nonce_ct_mac = vec![0u8; 0];
-    nonce_ct_mac.extend(explicit_nonce.iter());
-    nonce_ct_mac.extend(ciphertext.iter());
-
-    OpaqueMessage {
-        typ: msg.typ,
-        version: msg.version,
-        payload: Payload::new(nonce_ct_mac),
-    }
-}

crates/core/src/hash.rs

@@ -191,11 +191,6 @@ impl Hash {
             len: value.len(),
         }
     }
-
-    /// Returns a byte slice of the hash value.
-    pub fn as_bytes(&self) -> &[u8] {
-        &self.value[..self.len]
-    }
 }
 
 impl rs_merkle::Hash for Hash {
@@ -296,14 +291,14 @@ mod sha2 {
         fn hash(&self, data: &[u8]) -> super::Hash {
             let mut hasher = ::sha2::Sha256::default();
             hasher.update(data);
-            super::Hash::new(hasher.finalize().as_ref())
+            super::Hash::new(hasher.finalize().as_slice())
         }
 
         fn hash_prefixed(&self, prefix: &[u8], data: &[u8]) -> super::Hash {
             let mut hasher = ::sha2::Sha256::default();
             hasher.update(prefix);
             hasher.update(data);
-            super::Hash::new(hasher.finalize().as_ref())
+            super::Hash::new(hasher.finalize().as_slice())
         }
     }
 }

crates/core/src/lib.rs

@@ -11,19 +11,204 @@ pub mod hash;
 pub mod merkle;
 pub mod transcript;
 pub mod webpki;
-pub use rangeset;
-pub mod config;
-pub(crate) mod display;
 
+use rangeset::ToRangeSet;
 use serde::{Deserialize, Serialize};
 
 use crate::{
-    connection::ServerName,
+    connection::{HandshakeData, ServerName},
     transcript::{
-        encoding::EncoderSecret, PartialTranscript, TranscriptCommitment, TranscriptSecret,
+        Direction, Idx, PartialTranscript, Transcript, TranscriptCommitConfig,
+        TranscriptCommitRequest, TranscriptCommitment, TranscriptSecret,
     },
 };
 
+/// Configuration to prove information to the verifier.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ProveConfig {
+    server_identity: bool,
+    transcript: Option<PartialTranscript>,
+    transcript_commit: Option<TranscriptCommitConfig>,
+}
+
+impl ProveConfig {
+    /// Creates a new builder.
+    pub fn builder(transcript: &Transcript) -> ProveConfigBuilder<'_> {
+        ProveConfigBuilder::new(transcript)
+    }
+
+    /// Returns `true` if the server identity is to be proven.
+    pub fn server_identity(&self) -> bool {
+        self.server_identity
+    }
+
+    /// Returns the transcript to be proven.
+    pub fn transcript(&self) -> Option<&PartialTranscript> {
+        self.transcript.as_ref()
+    }
+
+    /// Returns the transcript commitment configuration.
+    pub fn transcript_commit(&self) -> Option<&TranscriptCommitConfig> {
+        self.transcript_commit.as_ref()
+    }
+}
+
+/// Builder for [`ProveConfig`].
+#[derive(Debug)]
+pub struct ProveConfigBuilder<'a> {
+    transcript: &'a Transcript,
+    server_identity: bool,
+    reveal_sent: Idx,
+    reveal_recv: Idx,
+    transcript_commit: Option<TranscriptCommitConfig>,
+}
+
+impl<'a> ProveConfigBuilder<'a> {
+    /// Creates a new builder.
+    pub fn new(transcript: &'a Transcript) -> Self {
+        Self {
+            transcript,
+            server_identity: false,
+            reveal_sent: Idx::default(),
+            reveal_recv: Idx::default(),
+            transcript_commit: None,
+        }
+    }
+
+    /// Proves the server identity.
+    pub fn server_identity(&mut self) -> &mut Self {
+        self.server_identity = true;
+        self
+    }
+
+    /// Configures transcript commitments.
+    pub fn transcript_commit(&mut self, transcript_commit: TranscriptCommitConfig) -> &mut Self {
+        self.transcript_commit = Some(transcript_commit);
+        self
+    }
+
+    /// Reveals the given ranges of the transcript.
+    pub fn reveal(
+        &mut self,
+        direction: Direction,
+        ranges: &dyn ToRangeSet<usize>,
+    ) -> Result<&mut Self, ProveConfigBuilderError> {
+        let idx = Idx::new(ranges.to_range_set());
+
+        if idx.end() > self.transcript.len_of_direction(direction) {
+            return Err(ProveConfigBuilderError(
+                ProveConfigBuilderErrorRepr::IndexOutOfBounds {
+                    direction,
+                    actual: idx.end(),
+                    len: self.transcript.len_of_direction(direction),
+                },
+            ));
+        }
+
+        match direction {
+            Direction::Sent => self.reveal_sent.union_mut(&idx),
+            Direction::Received => self.reveal_recv.union_mut(&idx),
+        }
+        Ok(self)
+    }
+
+    /// Reveals the given ranges of the sent data transcript.
+    pub fn reveal_sent(
+        &mut self,
+        ranges: &dyn ToRangeSet<usize>,
+    ) -> Result<&mut Self, ProveConfigBuilderError> {
+        self.reveal(Direction::Sent, ranges)
+    }
+
+    /// Reveals the given ranges of the received data transcript.
+    pub fn reveal_recv(
+        &mut self,
+        ranges: &dyn ToRangeSet<usize>,
+    ) -> Result<&mut Self, ProveConfigBuilderError> {
+        self.reveal(Direction::Received, ranges)
+    }
+
+    /// Builds the configuration.
+    pub fn build(self) -> Result<ProveConfig, ProveConfigBuilderError> {
+        let transcript = if !self.reveal_sent.is_empty() || !self.reveal_recv.is_empty() {
+            Some(
+                self.transcript
+                    .to_partial(self.reveal_sent, self.reveal_recv),
+            )
+        } else {
+            None
+        };
+
+        Ok(ProveConfig {
+            server_identity: self.server_identity,
+            transcript,
+            transcript_commit: self.transcript_commit,
+        })
+    }
+}
+
+/// Error for [`ProveConfigBuilder`].
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct ProveConfigBuilderError(#[from] ProveConfigBuilderErrorRepr);
+
+#[derive(Debug, thiserror::Error)]
+enum ProveConfigBuilderErrorRepr {
+    #[error("range is out of bounds of the transcript ({direction}): {actual} > {len}")]
+    IndexOutOfBounds {
+        direction: Direction,
+        actual: usize,
+        len: usize,
+    },
+}
+
+/// Configuration to verify information from the prover.
+#[derive(Debug, Default, Clone, Serialize, Deserialize)]
+pub struct VerifyConfig {}
+
+impl VerifyConfig {
+    /// Creates a new builder.
+    pub fn builder() -> VerifyConfigBuilder {
+        VerifyConfigBuilder::new()
+    }
+}
+
+/// Builder for [`VerifyConfig`].
+#[derive(Debug, Default)]
+pub struct VerifyConfigBuilder {}
+
+impl VerifyConfigBuilder {
+    /// Creates a new builder.
+    pub fn new() -> Self {
+        Self {}
+    }
+
+    /// Builds the configuration.
+    pub fn build(self) -> Result<VerifyConfig, VerifyConfigBuilderError> {
+        Ok(VerifyConfig {})
+    }
+}
+
+/// Error for [`VerifyConfigBuilder`].
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct VerifyConfigBuilderError(#[from] VerifyConfigBuilderErrorRepr);
+
+#[derive(Debug, thiserror::Error)]
+enum VerifyConfigBuilderErrorRepr {}
+
+/// Payload sent to the verifier.
+#[doc(hidden)]
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ProvePayload {
+    /// Handshake data.
+    pub handshake: Option<(ServerName, HandshakeData)>,
+    /// Transcript data.
+    pub transcript: Option<PartialTranscript>,
+    /// Transcript commitment configuration.
+    pub transcript_commit: Option<TranscriptCommitRequest>,
+}
+
 /// Prover output.
 #[derive(Serialize, Deserialize)]
 pub struct ProverOutput {
@@ -42,8 +227,6 @@ pub struct VerifierOutput {
     pub server_name: Option<ServerName>,
     /// Transcript data.
     pub transcript: Option<PartialTranscript>,
-    /// Encoding commitment secret.
-    pub encoder_secret: Option<EncoderSecret>,
     /// Transcript commitments.
     pub transcript_commitments: Vec<TranscriptCommitment>,
 }

crates/core/src/transcript.rs

@@ -26,11 +26,7 @@ mod tls;
 
 use std::{fmt, ops::Range};
 
-use rangeset::{
-    iter::RangeIterator,
-    ops::{Index, Set},
-    set::RangeSet,
-};
+use rangeset::{Difference, IndexRanges, RangeSet, Subset, ToRangeSet, Union, UnionMut};
 use serde::{Deserialize, Serialize};
 
 use crate::connection::TranscriptLength;
@@ -42,7 +38,7 @@ pub use commit::{
 pub use proof::{
     TranscriptProof, TranscriptProofBuilder, TranscriptProofBuilderError, TranscriptProofError,
 };
-pub use tls::{ContentType, Record, TlsTranscript};
+pub use tls::{Record, TlsTranscript};
 
 /// A transcript contains the plaintext of all application data communicated
 /// between the Prover and the Server.
@@ -99,25 +95,19 @@ impl Transcript {
 
     /// Returns the subsequence of the transcript with the provided index,
     /// returning `None` if the index is out of bounds.
-    pub fn get(&self, direction: Direction, idx: &RangeSet<usize>) -> Option<Subsequence> {
+    pub fn get(&self, direction: Direction, idx: &Idx) -> Option<Subsequence> {
         let data = match direction {
             Direction::Sent => &self.sent,
             Direction::Received => &self.received,
         };
 
-        if idx.end().unwrap_or(0) > data.len() {
+        if idx.end() > data.len() {
             return None;
         }
 
         Some(
-            Subsequence::new(
-                idx.clone(),
-                data.index(idx).fold(Vec::new(), |mut acc, s| {
-                    acc.extend_from_slice(s);
-                    acc
-                }),
-            )
-            .expect("data is same length as index"),
+            Subsequence::new(idx.clone(), data.index_ranges(&idx.0))
+                .expect("data is same length as index"),
         )
     }
 
@@ -131,19 +121,15 @@ impl Transcript {
     ///
     /// * `sent_idx` - The indices of the sent data to include.
     /// * `recv_idx` - The indices of the received data to include.
-    pub fn to_partial(
-        &self,
-        sent_idx: RangeSet<usize>,
-        recv_idx: RangeSet<usize>,
-    ) -> PartialTranscript {
+    pub fn to_partial(&self, sent_idx: Idx, recv_idx: Idx) -> PartialTranscript {
         let mut sent = vec![0; self.sent.len()];
         let mut received = vec![0; self.received.len()];
 
-        for range in sent_idx.iter() {
+        for range in sent_idx.iter_ranges() {
             sent[range.clone()].copy_from_slice(&self.sent[range]);
         }
 
-        for range in recv_idx.iter() {
+        for range in recv_idx.iter_ranges() {
             received[range.clone()].copy_from_slice(&self.received[range]);
         }
 
@@ -170,9 +156,9 @@ pub struct PartialTranscript {
     /// Data received by the Prover from the Server.
     received: Vec<u8>,
     /// Index of `sent` which have been authenticated.
-    sent_authed_idx: RangeSet<usize>,
+    sent_authed_idx: Idx,
     /// Index of `received` which have been authenticated.
-    received_authed_idx: RangeSet<usize>,
+    received_authed_idx: Idx,
 }
 
 /// `PartialTranscript` in a compressed form.
@@ -184,9 +170,9 @@ pub struct CompressedPartialTranscript {
     /// Received data which has been authenticated.
     received_authed: Vec<u8>,
     /// Index of `sent_authed`.
-    sent_idx: RangeSet<usize>,
+    sent_idx: Idx,
     /// Index of `received_authed`.
-    recv_idx: RangeSet<usize>,
+    recv_idx: Idx,
     /// Total bytelength of sent data in the original partial transcript.
     sent_total: usize,
     /// Total bytelength of received data in the original partial transcript.
@@ -196,20 +182,12 @@ pub struct CompressedPartialTranscript {
 impl From<PartialTranscript> for CompressedPartialTranscript {
     fn from(uncompressed: PartialTranscript) -> Self {
         Self {
-            sent_authed: uncompressed.sent.index(&uncompressed.sent_authed_idx).fold(
-                Vec::new(),
-                |mut acc, s| {
-                    acc.extend_from_slice(s);
-                    acc
-                },
-            ),
+            sent_authed: uncompressed
+                .sent
+                .index_ranges(&uncompressed.sent_authed_idx.0),
             received_authed: uncompressed
                 .received
-                .index(&uncompressed.received_authed_idx)
-                .fold(Vec::new(), |mut acc, s| {
-                    acc.extend_from_slice(s);
-                    acc
-                }),
+                .index_ranges(&uncompressed.received_authed_idx.0),
             sent_idx: uncompressed.sent_authed_idx,
             recv_idx: uncompressed.received_authed_idx,
             sent_total: uncompressed.sent.len(),
@@ -225,7 +203,7 @@ impl From<CompressedPartialTranscript> for PartialTranscript {
 
         let mut offset = 0;
 
-        for range in compressed.sent_idx.iter() {
+        for range in compressed.sent_idx.iter_ranges() {
             sent[range.clone()]
                 .copy_from_slice(&compressed.sent_authed[offset..offset + range.len()]);
             offset += range.len();
@@ -233,7 +211,7 @@ impl From<CompressedPartialTranscript> for PartialTranscript {
 
         let mut offset = 0;
 
-        for range in compressed.recv_idx.iter() {
+        for range in compressed.recv_idx.iter_ranges() {
             received[range.clone()]
                 .copy_from_slice(&compressed.received_authed[offset..offset + range.len()]);
             offset += range.len();
@@ -259,8 +237,8 @@ impl PartialTranscript {
         Self {
             sent: vec![0; sent_len],
             received: vec![0; received_len],
-            sent_authed_idx: RangeSet::default(),
-            received_authed_idx: RangeSet::default(),
+            sent_authed_idx: Idx::default(),
+            received_authed_idx: Idx::default(),
         }
     }
 
@@ -281,10 +259,10 @@ impl PartialTranscript {
     }
 
     /// Returns whether the index is in bounds of the transcript.
-    pub fn contains(&self, direction: Direction, idx: &RangeSet<usize>) -> bool {
+    pub fn contains(&self, direction: Direction, idx: &Idx) -> bool {
         match direction {
-            Direction::Sent => idx.end().unwrap_or(0) <= self.sent.len(),
-            Direction::Received => idx.end().unwrap_or(0) <= self.received.len(),
+            Direction::Sent => idx.end() <= self.sent.len(),
+            Direction::Received => idx.end() <= self.received.len(),
         }
     }
 
@@ -311,27 +289,23 @@ impl PartialTranscript {
     }
 
     /// Returns the index of sent data which have been authenticated.
-    pub fn sent_authed(&self) -> &RangeSet<usize> {
+    pub fn sent_authed(&self) -> &Idx {
         &self.sent_authed_idx
     }
 
     /// Returns the index of received data which have been authenticated.
-    pub fn received_authed(&self) -> &RangeSet<usize> {
+    pub fn received_authed(&self) -> &Idx {
         &self.received_authed_idx
     }
 
     /// Returns the index of sent data which haven't been authenticated.
-    pub fn sent_unauthed(&self) -> RangeSet<usize> {
-        (0..self.sent.len())
-            .difference(&self.sent_authed_idx)
-            .into_set()
+    pub fn sent_unauthed(&self) -> Idx {
+        Idx(RangeSet::from(0..self.sent.len()).difference(&self.sent_authed_idx.0))
     }
 
     /// Returns the index of received data which haven't been authenticated.
-    pub fn received_unauthed(&self) -> RangeSet<usize> {
-        (0..self.received.len())
-            .difference(&self.received_authed_idx)
-            .into_set()
+    pub fn received_unauthed(&self) -> Idx {
+        Idx(RangeSet::from(0..self.received.len()).difference(&self.received_authed_idx.0))
     }
 
     /// Returns an iterator over the authenticated data in the transcript.
@@ -341,7 +315,7 @@ impl PartialTranscript {
             Direction::Received => (&self.received, &self.received_authed_idx),
         };
 
-        authed.iter_values().map(move |i| data[i])
+        authed.0.iter().map(|i| data[i])
     }
 
     /// Unions the authenticated data of this transcript with another.
@@ -361,20 +335,26 @@ impl PartialTranscript {
             "received data are not the same length"
         );
 
-        for range in other.sent_authed_idx.difference(&self.sent_authed_idx) {
+        for range in other
+            .sent_authed_idx
+            .0
+            .difference(&self.sent_authed_idx.0)
+            .iter_ranges()
+        {
             self.sent[range.clone()].copy_from_slice(&other.sent[range]);
         }
 
         for range in other
             .received_authed_idx
-            .difference(&self.received_authed_idx)
+            .0
+            .difference(&self.received_authed_idx.0)
+            .iter_ranges()
         {
             self.received[range.clone()].copy_from_slice(&other.received[range]);
         }
 
-        self.sent_authed_idx.union_mut(&other.sent_authed_idx);
-        self.received_authed_idx
-            .union_mut(&other.received_authed_idx);
+        self.sent_authed_idx = self.sent_authed_idx.union(&other.sent_authed_idx);
+        self.received_authed_idx = self.received_authed_idx.union(&other.received_authed_idx);
     }
 
     /// Unions an authenticated subsequence into this transcript.
@@ -386,11 +366,11 @@ impl PartialTranscript {
         match direction {
             Direction::Sent => {
                 seq.copy_to(&mut self.sent);
-                self.sent_authed_idx.union_mut(&seq.idx);
+                self.sent_authed_idx = self.sent_authed_idx.union(&seq.idx);
             }
             Direction::Received => {
                 seq.copy_to(&mut self.received);
-                self.received_authed_idx.union_mut(&seq.idx);
+                self.received_authed_idx = self.received_authed_idx.union(&seq.idx);
             }
         }
     }
@@ -401,10 +381,10 @@ impl PartialTranscript {
     ///
     /// * `value` - The value to set the unauthenticated bytes to
     pub fn set_unauthed(&mut self, value: u8) {
-        for range in self.sent_unauthed().iter() {
+        for range in self.sent_unauthed().iter_ranges() {
             self.sent[range].fill(value);
         }
-        for range in self.received_unauthed().iter() {
+        for range in self.received_unauthed().iter_ranges() {
             self.received[range].fill(value);
         }
     }
@@ -419,13 +399,13 @@ impl PartialTranscript {
     pub fn set_unauthed_range(&mut self, value: u8, direction: Direction, range: Range<usize>) {
         match direction {
             Direction::Sent => {
-                for r in range.difference(&self.sent_authed_idx) {
-                    self.sent[r].fill(value);
+                for range in range.difference(&self.sent_authed_idx.0).iter_ranges() {
+                    self.sent[range].fill(value);
                 }
             }
             Direction::Received => {
-                for r in range.difference(&self.received_authed_idx) {
-                    self.received[r].fill(value);
+                for range in range.difference(&self.received_authed_idx.0).iter_ranges() {
+                    self.received[range].fill(value);
                 }
             }
         }
@@ -453,19 +433,130 @@ impl fmt::Display for Direction {
     }
 }
 
+/// Transcript index.
+#[derive(Debug, Default, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct Idx(RangeSet<usize>);
+
+impl Idx {
+    /// Creates a new index builder.
+    pub fn builder() -> IdxBuilder {
+        IdxBuilder::default()
+    }
+
+    /// Creates an empty index.
+    pub fn empty() -> Self {
+        Self(RangeSet::default())
+    }
+
+    /// Creates a new transcript index.
+    pub fn new(ranges: impl Into<RangeSet<usize>>) -> Self {
+        Self(ranges.into())
+    }
+
+    /// Returns the start of the index.
+    pub fn start(&self) -> usize {
+        self.0.min().unwrap_or_default()
+    }
+
+    /// Returns the end of the index, non-inclusive.
+    pub fn end(&self) -> usize {
+        self.0.end().unwrap_or_default()
+    }
+
+    /// Returns an iterator over the values in the index.
+    pub fn iter(&self) -> impl Iterator<Item = usize> + '_ {
+        self.0.iter()
+    }
+
+    /// Returns an iterator over the ranges of the index.
+    pub fn iter_ranges(&self) -> impl Iterator<Item = Range<usize>> + '_ {
+        self.0.iter_ranges()
+    }
+
+    /// Returns the number of values in the index.
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    /// Returns whether the index is empty.
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    /// Returns the number of disjoint ranges in the index.
+    pub fn count(&self) -> usize {
+        self.0.len_ranges()
+    }
+
+    pub(crate) fn as_range_set(&self) -> &RangeSet<usize> {
+        &self.0
+    }
+
+    /// Returns the union of this index with another.
+    pub(crate) fn union(&self, other: &Idx) -> Idx {
+        Idx(self.0.union(&other.0))
+    }
+
+    /// Unions this index with another.
+    pub(crate) fn union_mut(&mut self, other: &Idx) {
+        self.0.union_mut(&other.0);
+    }
+
+    /// Returns the difference between `self` and `other`.
+    pub(crate) fn difference(&self, other: &Idx) -> Idx {
+        Idx(self.0.difference(&other.0))
+    }
+
+    /// Returns `true` if `self` is a subset of `other`.
+    pub(crate) fn is_subset(&self, other: &Idx) -> bool {
+        self.0.is_subset(&other.0)
+    }
+}
+
+impl std::fmt::Display for Idx {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Idx([")?;
+        let count = self.0.len_ranges();
+        for (i, range) in self.0.iter_ranges().enumerate() {
+            write!(f, "{}..{}", range.start, range.end)?;
+            if i < count - 1 {
+                write!(f, ", ")?;
+            }
+        }
+        f.write_str("])")?;
+        Ok(())
+    }
+}
+
+/// Builder for [`Idx`].
+#[derive(Debug, Default)]
+pub struct IdxBuilder(RangeSet<usize>);
+
+impl IdxBuilder {
+    /// Unions ranges.
+    pub fn union(self, ranges: &dyn ToRangeSet<usize>) -> Self {
+        IdxBuilder(self.0.union(&ranges.to_range_set()))
+    }
+
+    /// Builds the index.
+    pub fn build(self) -> Idx {
+        Idx(self.0)
+    }
+}
+
 /// Transcript subsequence.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(try_from = "validation::SubsequenceUnchecked")]
 pub struct Subsequence {
     /// Index of the subsequence.
-    idx: RangeSet<usize>,
+    idx: Idx,
     /// Data of the subsequence.
     data: Vec<u8>,
 }
 
 impl Subsequence {
     /// Creates a new subsequence.
-    pub fn new(idx: RangeSet<usize>, data: Vec<u8>) -> Result<Self, InvalidSubsequence> {
+    pub fn new(idx: Idx, data: Vec<u8>) -> Result<Self, InvalidSubsequence> {
         if idx.len() != data.len() {
             return Err(InvalidSubsequence(
                 "index length does not match data length",
@@ -476,7 +567,7 @@ impl Subsequence {
     }
 
     /// Returns the index of the subsequence.
-    pub fn index(&self) -> &RangeSet<usize> {
+    pub fn index(&self) -> &Idx {
         &self.idx
     }
 
@@ -492,7 +583,7 @@ impl Subsequence {
     }
 
     /// Returns the inner parts of the subsequence.
-    pub fn into_parts(self) -> (RangeSet<usize>, Vec<u8>) {
+    pub fn into_parts(self) -> (Idx, Vec<u8>) {
         (self.idx, self.data)
     }
 
@@ -503,7 +594,7 @@ impl Subsequence {
     /// Panics if the subsequence ranges are out of bounds.
     pub(crate) fn copy_to(&self, dest: &mut [u8]) {
         let mut offset = 0;
-        for range in self.idx.iter() {
+        for range in self.idx.iter_ranges() {
             dest[range.clone()].copy_from_slice(&self.data[offset..offset + range.len()]);
             offset += range.len();
         }
@@ -520,7 +611,7 @@ mod validation {
 
     #[derive(Debug, Deserialize)]
     pub(super) struct SubsequenceUnchecked {
-        idx: RangeSet<usize>,
+        idx: Idx,
         data: Vec<u8>,
     }
 
@@ -542,8 +633,8 @@ mod validation {
     pub(super) struct CompressedPartialTranscriptUnchecked {
         sent_authed: Vec<u8>,
         received_authed: Vec<u8>,
-        sent_idx: RangeSet<usize>,
-        recv_idx: RangeSet<usize>,
+        sent_idx: Idx,
+        recv_idx: Idx,
         sent_total: usize,
         recv_total: usize,
     }
@@ -560,8 +651,8 @@ mod validation {
                 ));
             }
 
-            if unchecked.sent_idx.end().unwrap_or(0) > unchecked.sent_total
-                || unchecked.recv_idx.end().unwrap_or(0) > unchecked.recv_total
+            if unchecked.sent_idx.end() > unchecked.sent_total
+                || unchecked.recv_idx.end() > unchecked.recv_total
             {
                 return Err(InvalidCompressedPartialTranscript(
                     "ranges are not in bounds of the data",
@@ -590,8 +681,8 @@ mod validation {
             CompressedPartialTranscriptUnchecked {
                 received_authed: vec![1, 2, 3, 11, 12, 13],
                 sent_authed: vec![4, 5, 6, 14, 15, 16],
-                recv_idx: RangeSet::from([1..4, 11..14]),
-                sent_idx: RangeSet::from([4..7, 14..17]),
+                recv_idx: Idx(RangeSet::new(&[1..4, 11..14])),
+                sent_idx: Idx(RangeSet::new(&[4..7, 14..17])),
                 sent_total: 20,
                 recv_total: 20,
             }
@@ -628,7 +719,13 @@ mod validation {
             mut partial_transcript: CompressedPartialTranscriptUnchecked,
         ) {
             // Change the total to be less than the last range's end bound.
-            let end = partial_transcript.sent_idx.iter().next_back().unwrap().end;
+            let end = partial_transcript
+                .sent_idx
+                .0
+                .iter_ranges()
+                .next_back()
+                .unwrap()
+                .end;
 
             partial_transcript.sent_total = end - 1;
 
@@ -656,25 +753,31 @@ mod tests {
 
     #[fixture]
     fn partial_transcript() -> PartialTranscript {
-        transcript().to_partial(RangeSet::from([1..4, 6..9]), RangeSet::from([2..5, 7..10]))
+        transcript().to_partial(
+            Idx::new(RangeSet::new(&[1..4, 6..9])),
+            Idx::new(RangeSet::new(&[2..5, 7..10])),
+        )
     }
 
     #[rstest]
     fn test_transcript_get_subsequence(transcript: Transcript) {
         let subseq = transcript
-            .get(Direction::Received, &RangeSet::from([0..4, 7..10]))
+            .get(Direction::Received, &Idx(RangeSet::from([0..4, 7..10])))
             .unwrap();
         assert_eq!(subseq.data, vec![0, 1, 2, 3, 7, 8, 9]);
 
         let subseq = transcript
-            .get(Direction::Sent, &RangeSet::from([0..4, 9..12]))
+            .get(Direction::Sent, &Idx(RangeSet::from([0..4, 9..12])))
             .unwrap();
         assert_eq!(subseq.data, vec![0, 1, 2, 3, 9, 10, 11]);
 
-        let subseq = transcript.get(Direction::Received, &RangeSet::from([0..4, 7..10, 11..13]));
+        let subseq = transcript.get(
+            Direction::Received,
+            &Idx(RangeSet::from([0..4, 7..10, 11..13])),
+        );
         assert_eq!(subseq, None);
 
-        let subseq = transcript.get(Direction::Sent, &RangeSet::from([0..4, 7..10, 11..13]));
+        let subseq = transcript.get(Direction::Sent, &Idx(RangeSet::from([0..4, 7..10, 11..13])));
         assert_eq!(subseq, None);
     }
 
@@ -687,7 +790,7 @@ mod tests {
 
     #[rstest]
     fn test_transcript_to_partial_success(transcript: Transcript) {
-        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
+        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
         assert_eq!(partial.sent_unsafe(), [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
         assert_eq!(
             partial.received_unsafe(),
@@ -698,30 +801,29 @@ mod tests {
     #[rstest]
     #[should_panic]
     fn test_transcript_to_partial_failure(transcript: Transcript) {
-        let _ = transcript.to_partial(RangeSet::from(0..14), RangeSet::from(3..7));
+        let _ = transcript.to_partial(Idx::new(0..14), Idx::new(3..7));
     }
 
     #[rstest]
     fn test_partial_transcript_contains(transcript: Transcript) {
-        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
-        assert!(partial.contains(Direction::Sent, &RangeSet::from([0..5, 7..10])));
-        assert!(!partial.contains(Direction::Received, &RangeSet::from([4..6, 7..13])))
+        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
+        assert!(partial.contains(Direction::Sent, &Idx::new([0..5, 7..10])));
+        assert!(!partial.contains(Direction::Received, &Idx::new([4..6, 7..13])))
     }
 
     #[rstest]
     fn test_partial_transcript_unauthed(transcript: Transcript) {
-        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
-        assert_eq!(partial.sent_unauthed(), RangeSet::from(2..12));
-        assert_eq!(partial.received_unauthed(), RangeSet::from([0..3, 7..12]));
+        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
+        assert_eq!(partial.sent_unauthed(), Idx::new(2..12));
+        assert_eq!(partial.received_unauthed(), Idx::new([0..3, 7..12]));
     }
 
     #[rstest]
     fn test_partial_transcript_union_success(transcript: Transcript) {
         // Non overlapping ranges.
-        let mut simple_partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
+        let mut simple_partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
 
-        let other_simple_partial =
-            transcript.to_partial(RangeSet::from(3..5), RangeSet::from(1..2));
+        let other_simple_partial = transcript.to_partial(Idx::new(3..5), Idx::new(1..2));
 
         simple_partial.union_transcript(&other_simple_partial);
 
@@ -733,16 +835,12 @@ mod tests {
             simple_partial.received_unsafe(),
             [0, 1, 0, 3, 4, 5, 6, 0, 0, 0, 0, 0]
         );
-        assert_eq!(simple_partial.sent_authed(), &RangeSet::from([0..2, 3..5]));
-        assert_eq!(
-            simple_partial.received_authed(),
-            &RangeSet::from([1..2, 3..7])
-        );
+        assert_eq!(simple_partial.sent_authed(), &Idx::new([0..2, 3..5]));
+        assert_eq!(simple_partial.received_authed(), &Idx::new([1..2, 3..7]));
 
         // Overwrite with another partial transcript.
 
-        let another_simple_partial =
-            transcript.to_partial(RangeSet::from(1..4), RangeSet::from(6..9));
+        let another_simple_partial = transcript.to_partial(Idx::new(1..4), Idx::new(6..9));
 
         simple_partial.union_transcript(&another_simple_partial);
 
@@ -754,17 +852,13 @@ mod tests {
             simple_partial.received_unsafe(),
             [0, 1, 0, 3, 4, 5, 6, 7, 8, 0, 0, 0]
         );
-        assert_eq!(simple_partial.sent_authed(), &RangeSet::from(0..5));
-        assert_eq!(
-            simple_partial.received_authed(),
-            &RangeSet::from([1..2, 3..9])
-        );
+        assert_eq!(simple_partial.sent_authed(), &Idx::new(0..5));
+        assert_eq!(simple_partial.received_authed(), &Idx::new([1..2, 3..9]));
 
         // Overlapping ranges.
-        let mut overlap_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
+        let mut overlap_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
 
-        let other_overlap_partial =
-            transcript.to_partial(RangeSet::from(3..5), RangeSet::from(5..9));
+        let other_overlap_partial = transcript.to_partial(Idx::new(3..5), Idx::new(5..9));
 
         overlap_partial.union_transcript(&other_overlap_partial);
 
@@ -776,16 +870,13 @@ mod tests {
             overlap_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 7, 8, 0, 0, 0]
         );
-        assert_eq!(overlap_partial.sent_authed(), &RangeSet::from([3..5, 4..6]));
-        assert_eq!(
-            overlap_partial.received_authed(),
-            &RangeSet::from([3..7, 5..9])
-        );
+        assert_eq!(overlap_partial.sent_authed(), &Idx::new([3..5, 4..6]));
+        assert_eq!(overlap_partial.received_authed(), &Idx::new([3..7, 5..9]));
 
         // Equal ranges.
-        let mut equal_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
+        let mut equal_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
 
-        let other_equal_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
+        let other_equal_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
 
         equal_partial.union_transcript(&other_equal_partial);
 
@@ -797,15 +888,13 @@ mod tests {
             equal_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 0, 0, 0, 0, 0]
         );
-        assert_eq!(equal_partial.sent_authed(), &RangeSet::from(4..6));
-        assert_eq!(equal_partial.received_authed(), &RangeSet::from(3..7));
+        assert_eq!(equal_partial.sent_authed(), &Idx::new(4..6));
+        assert_eq!(equal_partial.received_authed(), &Idx::new(3..7));
 
         // Subset ranges.
-        let mut subset_partial =
-            transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
+        let mut subset_partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
 
-        let other_subset_partial =
-            transcript.to_partial(RangeSet::from(6..9), RangeSet::from(5..6));
+        let other_subset_partial = transcript.to_partial(Idx::new(6..9), Idx::new(5..6));
 
         subset_partial.union_transcript(&other_subset_partial);
 
@@ -817,32 +906,30 @@ mod tests {
             subset_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 7, 8, 9, 10, 0]
         );
-        assert_eq!(subset_partial.sent_authed(), &RangeSet::from(4..10));
-        assert_eq!(subset_partial.received_authed(), &RangeSet::from(3..11));
+        assert_eq!(subset_partial.sent_authed(), &Idx::new(4..10));
+        assert_eq!(subset_partial.received_authed(), &Idx::new(3..11));
     }
 
     #[rstest]
     #[should_panic]
     fn test_partial_transcript_union_failure(transcript: Transcript) {
-        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
+        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
 
         let other_transcript = Transcript::new(
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
         );
 
-        let other_partial = other_transcript.to_partial(RangeSet::from(6..9), RangeSet::from(5..6));
+        let other_partial = other_transcript.to_partial(Idx::new(6..9), Idx::new(5..6));
 
         partial.union_transcript(&other_partial);
     }
 
     #[rstest]
     fn test_partial_transcript_union_subseq_success(transcript: Transcript) {
-        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
-        let sent_seq =
-            Subsequence::new(RangeSet::from([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
-        let recv_seq =
-            Subsequence::new(RangeSet::from([0..4, 5..7]), [0, 1, 2, 3, 5, 6].into()).unwrap();
+        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
+        let sent_seq = Subsequence::new(Idx::new([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
+        let recv_seq = Subsequence::new(Idx::new([0..4, 5..7]), [0, 1, 2, 3, 5, 6].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &sent_seq);
         partial.union_subsequence(Direction::Received, &recv_seq);
@@ -852,31 +939,30 @@ mod tests {
             partial.received_unsafe(),
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0]
         );
-        assert_eq!(partial.sent_authed(), &RangeSet::from([0..3, 4..10]));
-        assert_eq!(partial.received_authed(), &RangeSet::from(0..11));
+        assert_eq!(partial.sent_authed(), &Idx::new([0..3, 4..10]));
+        assert_eq!(partial.received_authed(), &Idx::new(0..11));
 
         // Overwrite with another subseq.
-        let other_sent_seq = Subsequence::new(RangeSet::from(0..3), [3, 2, 1].into()).unwrap();
+        let other_sent_seq = Subsequence::new(Idx::new(0..3), [3, 2, 1].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &other_sent_seq);
         assert_eq!(partial.sent_unsafe(), [3, 2, 1, 0, 4, 5, 6, 7, 8, 9, 0, 0]);
-        assert_eq!(partial.sent_authed(), &RangeSet::from([0..3, 4..10]));
+        assert_eq!(partial.sent_authed(), &Idx::new([0..3, 4..10]));
     }
 
     #[rstest]
     #[should_panic]
     fn test_partial_transcript_union_subseq_failure(transcript: Transcript) {
-        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
+        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
 
-        let sent_seq =
-            Subsequence::new(RangeSet::from([0..3, 13..15]), [0, 1, 2, 5, 6].into()).unwrap();
+        let sent_seq = Subsequence::new(Idx::new([0..3, 13..15]), [0, 1, 2, 5, 6].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &sent_seq);
     }
 
     #[rstest]
     fn test_partial_transcript_set_unauthed_range(transcript: Transcript) {
-        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..7));
+        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..7));
 
         partial.set_unauthed_range(7, Direction::Sent, 2..5);
         partial.set_unauthed_range(5, Direction::Sent, 0..2);
@@ -893,13 +979,13 @@ mod tests {
     #[rstest]
     #[should_panic]
     fn test_subsequence_new_invalid_len() {
-        let _ = Subsequence::new(RangeSet::from([0..3, 5..8]), [0, 1, 2, 5, 6].into()).unwrap();
+        let _ = Subsequence::new(Idx::new([0..3, 5..8]), [0, 1, 2, 5, 6].into()).unwrap();
     }
 
     #[rstest]
     #[should_panic]
     fn test_subsequence_copy_to_invalid_len() {
-        let seq = Subsequence::new(RangeSet::from([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
+        let seq = Subsequence::new(Idx::new([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
 
         let mut data: [u8; 3] = [0, 1, 2];
         seq.copy_to(&mut data);

crates/core/src/transcript/commit.rs

@@ -2,7 +2,7 @@
 
 use std::{collections::HashSet, fmt};
 
-use rangeset::set::ToRangeSet;
+use rangeset::ToRangeSet;
 use serde::{Deserialize, Serialize};
 
 use crate::{
@@ -10,7 +10,7 @@ use crate::{
     transcript::{
         encoding::{EncodingCommitment, EncodingTree},
         hash::{PlaintextHash, PlaintextHashSecret},
-        Direction, RangeSet, Transcript,
+        Direction, Idx, Transcript,
     },
 };
 
@@ -71,7 +71,7 @@ pub struct TranscriptCommitConfig {
     encoding_hash_alg: HashAlgId,
     has_encoding: bool,
     has_hash: bool,
-    commits: Vec<((Direction, RangeSet<usize>), TranscriptCommitmentKind)>,
+    commits: Vec<((Direction, Idx), TranscriptCommitmentKind)>,
 }
 
 impl TranscriptCommitConfig {
@@ -96,7 +96,7 @@ impl TranscriptCommitConfig {
     }
 
     /// Returns an iterator over the encoding commitment indices.
-    pub fn iter_encoding(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>)> {
+    pub fn iter_encoding(&self) -> impl Iterator<Item = &(Direction, Idx)> {
         self.commits.iter().filter_map(|(idx, kind)| match kind {
             TranscriptCommitmentKind::Encoding => Some(idx),
             _ => None,
@@ -104,7 +104,7 @@ impl TranscriptCommitConfig {
     }
 
     /// Returns an iterator over the hash commitment indices.
-    pub fn iter_hash(&self) -> impl Iterator<Item = (&(Direction, RangeSet<usize>), &HashAlgId)> {
+    pub fn iter_hash(&self) -> impl Iterator<Item = (&(Direction, Idx), &HashAlgId)> {
         self.commits.iter().filter_map(|(idx, kind)| match kind {
             TranscriptCommitmentKind::Hash { alg } => Some((idx, alg)),
             _ => None,
@@ -114,19 +114,7 @@ impl TranscriptCommitConfig {
     /// Returns a request for the transcript commitments.
     pub fn to_request(&self) -> TranscriptCommitRequest {
         TranscriptCommitRequest {
-            encoding: self.has_encoding.then(|| {
-                let mut sent = RangeSet::default();
-                let mut recv = RangeSet::default();
-
-                for (dir, idx) in self.iter_encoding() {
-                    match dir {
-                        Direction::Sent => sent.union_mut(idx),
-                        Direction::Received => recv.union_mut(idx),
-                    }
-                }
-
-                (sent, recv)
-            }),
+            encoding: self.has_encoding,
             hash: self
                 .iter_hash()
                 .map(|((dir, idx), alg)| (*dir, idx.clone(), *alg))
@@ -146,7 +134,7 @@ pub struct TranscriptCommitConfigBuilder<'a> {
     has_encoding: bool,
     has_hash: bool,
     default_kind: TranscriptCommitmentKind,
-    commits: HashSet<((Direction, RangeSet<usize>), TranscriptCommitmentKind)>,
+    commits: HashSet<((Direction, Idx), TranscriptCommitmentKind)>,
 }
 
 impl<'a> TranscriptCommitConfigBuilder<'a> {
@@ -187,15 +175,15 @@ impl<'a> TranscriptCommitConfigBuilder<'a> {
         direction: Direction,
         kind: TranscriptCommitmentKind,
     ) -> Result<&mut Self, TranscriptCommitConfigBuilderError> {
-        let idx = ranges.to_range_set();
+        let idx = Idx::new(ranges.to_range_set());
 
-        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
+        if idx.end() > self.transcript.len_of_direction(direction) {
             return Err(TranscriptCommitConfigBuilderError::new(
                 ErrorKind::Index,
                 format!(
                     "range is out of bounds of the transcript ({}): {} > {}",
                     direction,
-                    idx.end().unwrap_or(0),
+                    idx.end(),
                     self.transcript.len_of_direction(direction)
                 ),
             ));
@@ -301,14 +289,14 @@ impl fmt::Display for TranscriptCommitConfigBuilderError {
 /// Request to compute transcript commitments.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TranscriptCommitRequest {
-    encoding: Option<(RangeSet<usize>, RangeSet<usize>)>,
-    hash: Vec<(Direction, RangeSet<usize>, HashAlgId)>,
+    encoding: bool,
+    hash: Vec<(Direction, Idx, HashAlgId)>,
 }
 
 impl TranscriptCommitRequest {
     /// Returns `true` if an encoding commitment is requested.
-    pub fn has_encoding(&self) -> bool {
-        self.encoding.is_some()
+    pub fn encoding(&self) -> bool {
+        self.encoding
     }
 
     /// Returns `true` if a hash commitment is requested.
@@ -317,14 +305,9 @@ impl TranscriptCommitRequest {
     }
 
     /// Returns an iterator over the hash commitments.
-    pub fn iter_hash(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>, HashAlgId)> {
+    pub fn iter_hash(&self) -> impl Iterator<Item = &(Direction, Idx, HashAlgId)> {
         self.hash.iter()
     }
-
-    /// Returns the ranges of the encoding commitments.
-    pub fn encoding(&self) -> Option<&(RangeSet<usize>, RangeSet<usize>)> {
-        self.encoding.as_ref()
-    }
 }
 
 #[cfg(test)]

crates/core/src/transcript/encoding.rs

@@ -19,4 +19,6 @@ use crate::hash::TypedHash;
 pub struct EncodingCommitment {
     /// Merkle root of the encoding commitments.
     pub root: TypedHash,
+    /// Seed used to generate the encodings.
+    pub secret: EncoderSecret,
 }

crates/core/src/transcript/encoding/proof.rs

@@ -1,6 +1,6 @@
 use std::{collections::HashMap, fmt};
 
-use rangeset::set::RangeSet;
+use rangeset::{RangeSet, UnionMut};
 use serde::{Deserialize, Serialize};
 
 use crate::{
@@ -8,8 +8,8 @@ use crate::{
     merkle::{MerkleError, MerkleProof},
     transcript::{
         commit::MAX_TOTAL_COMMITTED_DATA,
-        encoding::{new_encoder, Encoder, EncoderSecret, EncodingCommitment},
-        Direction,
+        encoding::{new_encoder, Encoder, EncodingCommitment},
+        Direction, Idx,
     },
 };
 
@@ -17,7 +17,7 @@ use crate::{
 #[derive(Clone, Serialize, Deserialize)]
 pub(super) struct Opening {
     pub(super) direction: Direction,
-    pub(super) idx: RangeSet<usize>,
+    pub(super) idx: Idx,
     pub(super) blinder: Blinder,
 }
 
@@ -48,14 +48,13 @@ impl EncodingProof {
     pub fn verify_with_provider(
         &self,
         provider: &HashProvider,
-        secret: &EncoderSecret,
         commitment: &EncodingCommitment,
         sent: &[u8],
         recv: &[u8],
-    ) -> Result<(RangeSet<usize>, RangeSet<usize>), EncodingProofError> {
+    ) -> Result<(Idx, Idx), EncodingProofError> {
         let hasher = provider.get(&commitment.root.alg)?;
 
-        let encoder = new_encoder(secret);
+        let encoder = new_encoder(&commitment.secret);
         let Self {
             inclusion_proof,
             openings,
@@ -90,20 +89,20 @@ impl EncodingProof {
             };
 
             // Make sure the ranges are within the bounds of the transcript.
-            if idx.end().unwrap_or(0) > data.len() {
+            if idx.end() > data.len() {
                 return Err(EncodingProofError::new(
                     ErrorKind::Proof,
                     format!(
                         "index out of bounds of the transcript ({}): {} > {}",
                         direction,
-                        idx.end().unwrap_or(0),
+                        idx.end(),
                         data.len()
                     ),
                 ));
             }
 
             expected_leaf.clear();
-            for range in idx.iter() {
+            for range in idx.iter_ranges() {
                 encoder.encode_data(*direction, range.clone(), &data[range], &mut expected_leaf);
             }
             expected_leaf.extend_from_slice(blinder.as_bytes());
@@ -112,7 +111,7 @@ impl EncodingProof {
             // present in the merkle tree.
             leaves.push((*id, hasher.hash(&expected_leaf)));
 
-            auth.union_mut(idx);
+            auth.union_mut(idx.as_range_set());
         }
 
         // Verify that the expected hashes are present in the merkle tree.
@@ -122,7 +121,7 @@ impl EncodingProof {
         // data is authentic.
         inclusion_proof.verify(hasher, &commitment.root, leaves)?;
 
-        Ok((auth_sent, auth_recv))
+        Ok((Idx(auth_sent), Idx(auth_recv)))
     }
 }
 
@@ -233,7 +232,10 @@ mod test {
     use crate::{
         fixtures::{encoder_secret, encoder_secret_tampered_seed, encoding_provider},
         hash::Blake3,
-        transcript::{encoding::EncodingTree, Transcript},
+        transcript::{
+            encoding::{EncoderSecret, EncodingTree},
+            Idx, Transcript,
+        },
     };
 
     use super::*;
@@ -244,18 +246,21 @@ mod test {
         commitment: EncodingCommitment,
     }
 
-    fn new_encoding_fixture() -> EncodingFixture {
+    fn new_encoding_fixture(secret: EncoderSecret) -> EncodingFixture {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len()));
 
         let provider = encoding_provider(transcript.sent(), transcript.received());
         let tree = EncodingTree::new(&Blake3::default(), [&idx_0, &idx_1], &provider).unwrap();
 
         let proof = tree.proof([&idx_0, &idx_1].into_iter()).unwrap();
 
-        let commitment = EncodingCommitment { root: tree.root() };
+        let commitment = EncodingCommitment {
+            root: tree.root(),
+            secret,
+        };
 
         EncodingFixture {
             transcript,
@@ -270,12 +275,11 @@ mod test {
             transcript,
             proof,
             commitment,
-        } = new_encoding_fixture();
+        } = new_encoding_fixture(encoder_secret_tampered_seed());
 
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
-                &encoder_secret_tampered_seed(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -291,19 +295,13 @@ mod test {
             transcript,
             proof,
             commitment,
-        } = new_encoding_fixture();
+        } = new_encoding_fixture(encoder_secret());
 
         let sent = &transcript.sent()[transcript.sent().len() - 1..];
         let recv = &transcript.received()[transcript.received().len() - 2..];
 
         let err = proof
-            .verify_with_provider(
-                &HashProvider::default(),
-                &encoder_secret(),
-                &commitment,
-                sent,
-                recv,
-            )
+            .verify_with_provider(&HashProvider::default(), &commitment, sent, recv)
             .unwrap_err();
 
         assert!(matches!(err.kind, ErrorKind::Proof));
@@ -315,16 +313,15 @@ mod test {
             transcript,
             mut proof,
             commitment,
-        } = new_encoding_fixture();
+        } = new_encoding_fixture(encoder_secret());
 
         let Opening { idx, .. } = proof.openings.values_mut().next().unwrap();
 
-        *idx = RangeSet::from([0..3, 13..15]);
+        *idx = Idx::new([0..3, 13..15]);
 
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
-                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -340,7 +337,7 @@ mod test {
             transcript,
             mut proof,
             commitment,
-        } = new_encoding_fixture();
+        } = new_encoding_fixture(encoder_secret());
 
         let Opening { blinder, .. } = proof.openings.values_mut().next().unwrap();
 
@@ -349,7 +346,6 @@ mod test {
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
-                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),

crates/core/src/transcript/encoding/tree.rs

@@ -1,7 +1,6 @@
 use std::collections::HashMap;
 
 use bimap::BiMap;
-use rangeset::set::RangeSet;
 use serde::{Deserialize, Serialize};
 
 use crate::{
@@ -12,7 +11,7 @@ use crate::{
             proof::{EncodingProof, Opening},
             EncodingProvider,
         },
-        Direction,
+        Direction, Idx,
     },
 };
 
@@ -23,7 +22,7 @@ pub enum EncodingTreeError {
     #[error("index is out of bounds of the transcript")]
     OutOfBounds {
         /// The index.
-        index: RangeSet<usize>,
+        index: Idx,
         /// The transcript length.
         transcript_length: usize,
     },
@@ -31,13 +30,13 @@ pub enum EncodingTreeError {
     #[error("encoding provider is missing an encoding for an index")]
     MissingEncoding {
         /// The index which is missing.
-        index: RangeSet<usize>,
+        index: Idx,
     },
     /// Index is missing from the tree.
     #[error("index is missing from the tree")]
     MissingLeaf {
         /// The index which is missing.
-        index: RangeSet<usize>,
+        index: Idx,
     },
 }
 
@@ -50,11 +49,11 @@ pub struct EncodingTree {
     blinders: Vec<Blinder>,
     /// Mapping between the index of a leaf and the transcript index it
     /// corresponds to.
-    idxs: BiMap<usize, (Direction, RangeSet<usize>)>,
+    idxs: BiMap<usize, (Direction, Idx)>,
     /// Union of all transcript indices in the sent direction.
-    sent_idx: RangeSet<usize>,
+    sent_idx: Idx,
     /// Union of all transcript indices in the received direction.
-    received_idx: RangeSet<usize>,
+    received_idx: Idx,
 }
 
 opaque_debug::implement!(EncodingTree);
@@ -69,15 +68,15 @@ impl EncodingTree {
     /// * `provider` - The encoding provider.
     pub fn new<'idx>(
         hasher: &dyn HashAlgorithm,
-        idxs: impl IntoIterator<Item = &'idx (Direction, RangeSet<usize>)>,
+        idxs: impl IntoIterator<Item = &'idx (Direction, Idx)>,
         provider: &dyn EncodingProvider,
     ) -> Result<Self, EncodingTreeError> {
         let mut this = Self {
             tree: MerkleTree::new(hasher.id()),
             blinders: Vec::new(),
             idxs: BiMap::new(),
-            sent_idx: RangeSet::default(),
-            received_idx: RangeSet::default(),
+            sent_idx: Idx::empty(),
+            received_idx: Idx::empty(),
         };
 
         let mut leaves = Vec::new();
@@ -99,7 +98,7 @@ impl EncodingTree {
             let blinder: Blinder = rand::random();
 
             encoding.clear();
-            for range in idx.iter() {
+            for range in idx.iter_ranges() {
                 provider
                     .provide_encoding(direction, range, &mut encoding)
                     .map_err(|_| EncodingTreeError::MissingEncoding { index: idx.clone() })?;
@@ -139,7 +138,7 @@ impl EncodingTree {
     /// * `idxs` - The transcript indices to prove.
     pub fn proof<'idx>(
         &self,
-        idxs: impl Iterator<Item = &'idx (Direction, RangeSet<usize>)>,
+        idxs: impl Iterator<Item = &'idx (Direction, Idx)>,
     ) -> Result<EncodingProof, EncodingTreeError> {
         let mut openings = HashMap::new();
         for dir_idx in idxs {
@@ -172,11 +171,11 @@ impl EncodingTree {
     }
 
     /// Returns whether the tree contains the given transcript index.
-    pub fn contains(&self, idx: &(Direction, RangeSet<usize>)) -> bool {
+    pub fn contains(&self, idx: &(Direction, Idx)) -> bool {
         self.idxs.contains_right(idx)
     }
 
-    pub(crate) fn idx(&self, direction: Direction) -> &RangeSet<usize> {
+    pub(crate) fn idx(&self, direction: Direction) -> &Idx {
         match direction {
             Direction::Sent => &self.sent_idx,
             Direction::Received => &self.received_idx,
@@ -184,7 +183,7 @@ impl EncodingTree {
     }
 
     /// Returns the committed transcript indices.
-    pub(crate) fn transcript_indices(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>)> {
+    pub(crate) fn transcript_indices(&self) -> impl Iterator<Item = &(Direction, Idx)> {
         self.idxs.right_values()
     }
 }
@@ -201,7 +200,7 @@ mod tests {
 
     fn new_tree<'seq>(
         transcript: &Transcript,
-        idxs: impl Iterator<Item = &'seq (Direction, RangeSet<usize>)>,
+        idxs: impl Iterator<Item = &'seq (Direction, Idx)>,
     ) -> Result<EncodingTree, EncodingTreeError> {
         let provider = encoding_provider(transcript.sent(), transcript.received());
 
@@ -212,8 +211,8 @@ mod tests {
     fn test_encoding_tree() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1].into_iter()).unwrap();
 
@@ -222,12 +221,14 @@ mod tests {
 
         let proof = tree.proof([&idx_0, &idx_1].into_iter()).unwrap();
 
-        let commitment = EncodingCommitment { root: tree.root() };
+        let commitment = EncodingCommitment {
+            root: tree.root(),
+            secret: encoder_secret(),
+        };
 
         let (auth_sent, auth_recv) = proof
             .verify_with_provider(
                 &HashProvider::default(),
-                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -242,10 +243,10 @@ mod tests {
     fn test_encoding_tree_multiple_ranges() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, RangeSet::from(0..1));
-        let idx_1 = (Direction::Sent, RangeSet::from(1..POST_JSON.len()));
-        let idx_2 = (Direction::Received, RangeSet::from(0..1));
-        let idx_3 = (Direction::Received, RangeSet::from(1..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, Idx::new(0..1));
+        let idx_1 = (Direction::Sent, Idx::new(1..POST_JSON.len()));
+        let idx_2 = (Direction::Received, Idx::new(0..1));
+        let idx_3 = (Direction::Received, Idx::new(1..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1, &idx_2, &idx_3].into_iter()).unwrap();
 
@@ -258,23 +259,25 @@ mod tests {
             .proof([&idx_0, &idx_1, &idx_2, &idx_3].into_iter())
             .unwrap();
 
-        let commitment = EncodingCommitment { root: tree.root() };
+        let commitment = EncodingCommitment {
+            root: tree.root(),
+            secret: encoder_secret(),
+        };
 
         let (auth_sent, auth_recv) = proof
             .verify_with_provider(
                 &HashProvider::default(),
-                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
             )
             .unwrap();
 
-        let mut expected_auth_sent = RangeSet::default();
+        let mut expected_auth_sent = Idx::default();
         expected_auth_sent.union_mut(&idx_0.1);
         expected_auth_sent.union_mut(&idx_1.1);
 
-        let mut expected_auth_recv = RangeSet::default();
+        let mut expected_auth_recv = Idx::default();
         expected_auth_recv.union_mut(&idx_2.1);
         expected_auth_recv.union_mut(&idx_3.1);
 
@@ -286,9 +289,9 @@ mod tests {
     fn test_encoding_tree_proof_missing_leaf() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, RangeSet::from(0..4));
-        let idx_2 = (Direction::Received, RangeSet::from(4..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, Idx::new(0..4));
+        let idx_2 = (Direction::Received, Idx::new(4..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1].into_iter()).unwrap();
 
@@ -302,8 +305,8 @@ mod tests {
     fn test_encoding_tree_out_of_bounds() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len() + 1));
-        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len() + 1));
+        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len() + 1));
+        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len() + 1));
 
         let result = new_tree(&transcript, [&idx_0].into_iter()).unwrap_err();
         assert!(matches!(result, EncodingTreeError::MissingEncoding { .. }));
@@ -318,7 +321,7 @@ mod tests {
 
         let result = EncodingTree::new(
             &Blake3::default(),
-            [(Direction::Sent, RangeSet::from(0..8))].iter(),
+            [(Direction::Sent, Idx::new(0..8))].iter(),
             &provider,
         )
         .unwrap_err();

crates/core/src/transcript/hash.rs

@@ -4,7 +4,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     hash::{Blinder, HashAlgId, HashAlgorithm, TypedHash},
-    transcript::{Direction, RangeSet},
+    transcript::{Direction, Idx},
 };
 
 /// Hashes plaintext with a blinder.
@@ -23,7 +23,7 @@ pub struct PlaintextHash {
     /// Direction of the plaintext.
     pub direction: Direction,
     /// Index of plaintext.
-    pub idx: RangeSet<usize>,
+    pub idx: Idx,
     /// The hash of the data.
     pub hash: TypedHash,
 }
@@ -34,7 +34,7 @@ pub struct PlaintextHashSecret {
     /// Direction of the plaintext.
     pub direction: Direction,
     /// Index of plaintext.
-    pub idx: RangeSet<usize>,
+    pub idx: Idx,
     /// The algorithm of the hash.
     pub alg: HashAlgId,
     /// Blinder for the hash.

crates/core/src/transcript/proof.rs

@@ -1,22 +1,17 @@
 //! Transcript proofs.
 
-use rangeset::{
-    iter::RangeIterator,
-    ops::{Cover, Set},
-    set::ToRangeSet,
-};
+use rangeset::{Cover, ToRangeSet};
 use serde::{Deserialize, Serialize};
 use std::{collections::HashSet, fmt};
 
 use crate::{
     connection::TranscriptLength,
-    display::FmtRangeSet,
     hash::{HashAlgId, HashProvider},
     transcript::{
         commit::{TranscriptCommitment, TranscriptCommitmentKind},
-        encoding::{EncoderSecret, EncodingProof, EncodingProofError, EncodingTree},
+        encoding::{EncodingProof, EncodingProofError, EncodingTree},
         hash::{hash_plaintext, PlaintextHash, PlaintextHashSecret},
-        Direction, PartialTranscript, RangeSet, Transcript, TranscriptSecret,
+        Direction, Idx, PartialTranscript, Transcript, TranscriptSecret,
     },
 };
 
@@ -26,12 +21,6 @@ const DEFAULT_COMMITMENT_KINDS: &[TranscriptCommitmentKind] = &[
     TranscriptCommitmentKind::Hash {
         alg: HashAlgId::SHA256,
     },
-    TranscriptCommitmentKind::Hash {
-        alg: HashAlgId::BLAKE3,
-    },
-    TranscriptCommitmentKind::Hash {
-        alg: HashAlgId::KECCAK256,
-    },
     TranscriptCommitmentKind::Encoding,
 ];
 
@@ -58,7 +47,6 @@ impl TranscriptProof {
         self,
         provider: &HashProvider,
         length: &TranscriptLength,
-        encoder_secret: Option<&EncoderSecret>,
         commitments: impl IntoIterator<Item = &'a TranscriptCommitment>,
     ) -> Result<PartialTranscript, TranscriptProofError> {
         let mut encoding_commitment = None;
@@ -89,18 +77,11 @@ impl TranscriptProof {
             ));
         }
 
-        let mut total_auth_sent = RangeSet::default();
-        let mut total_auth_recv = RangeSet::default();
+        let mut total_auth_sent = Idx::default();
+        let mut total_auth_recv = Idx::default();
 
         // Verify encoding proof.
         if let Some(proof) = self.encoding_proof {
-            let secret = encoder_secret.ok_or_else(|| {
-                TranscriptProofError::new(
-                    ErrorKind::Encoding,
-                    "contains an encoding proof but missing encoder secret",
-                )
-            })?;
-
             let commitment = encoding_commitment.ok_or_else(|| {
                 TranscriptProofError::new(
                     ErrorKind::Encoding,
@@ -110,7 +91,6 @@ impl TranscriptProof {
 
             let (auth_sent, auth_recv) = proof.verify_with_provider(
                 provider,
-                secret,
                 commitment,
                 self.transcript.sent_unsafe(),
                 self.transcript.received_unsafe(),
@@ -140,7 +120,7 @@ impl TranscriptProof {
                 Direction::Received => (self.transcript.received_unsafe(), &mut total_auth_recv),
             };
 
-            if idx.end().unwrap_or(0) > plaintext.len() {
+            if idx.end() > plaintext.len() {
                 return Err(TranscriptProofError::new(
                     ErrorKind::Hash,
                     "hash opening index is out of bounds",
@@ -148,7 +128,7 @@ impl TranscriptProof {
             }
 
             buffer.clear();
-            for range in idx.iter() {
+            for range in idx.iter_ranges() {
                 buffer.extend_from_slice(&plaintext[range]);
             }
 
@@ -235,15 +215,15 @@ impl From<EncodingProofError> for TranscriptProofError {
 /// Union of ranges to reveal.
 #[derive(Clone, Debug, PartialEq)]
 struct QueryIdx {
-    sent: RangeSet<usize>,
-    recv: RangeSet<usize>,
+    sent: Idx,
+    recv: Idx,
 }
 
 impl QueryIdx {
     fn new() -> Self {
         Self {
-            sent: RangeSet::default(),
-            recv: RangeSet::default(),
+            sent: Idx::empty(),
+            recv: Idx::empty(),
         }
     }
 
@@ -251,7 +231,7 @@ impl QueryIdx {
         self.sent.is_empty() && self.recv.is_empty()
     }
 
-    fn union(&mut self, direction: &Direction, other: &RangeSet<usize>) {
+    fn union(&mut self, direction: &Direction, other: &Idx) {
         match direction {
             Direction::Sent => self.sent.union_mut(other),
             Direction::Received => self.recv.union_mut(other),
@@ -261,12 +241,7 @@ impl QueryIdx {
 
 impl std::fmt::Display for QueryIdx {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(
-            f,
-            "sent: {}, received: {}",
-            FmtRangeSet(&self.sent),
-            FmtRangeSet(&self.recv)
-        )
+        write!(f, "sent: {}, received: {}", self.sent, self.recv)
     }
 }
 
@@ -278,8 +253,8 @@ pub struct TranscriptProofBuilder<'a> {
     transcript: &'a Transcript,
     encoding_tree: Option<&'a EncodingTree>,
     hash_secrets: Vec<&'a PlaintextHashSecret>,
-    committed_sent: RangeSet<usize>,
-    committed_recv: RangeSet<usize>,
+    committed_sent: Idx,
+    committed_recv: Idx,
     query_idx: QueryIdx,
 }
 
@@ -289,8 +264,8 @@ impl<'a> TranscriptProofBuilder<'a> {
         transcript: &'a Transcript,
         secrets: impl IntoIterator<Item = &'a TranscriptSecret>,
     ) -> Self {
-        let mut committed_sent = RangeSet::default();
-        let mut committed_recv = RangeSet::default();
+        let mut committed_sent = Idx::empty();
+        let mut committed_recv = Idx::empty();
 
         let mut encoding_tree = None;
         let mut hash_secrets = Vec::new();
@@ -348,15 +323,15 @@ impl<'a> TranscriptProofBuilder<'a> {
         ranges: &dyn ToRangeSet<usize>,
         direction: Direction,
     ) -> Result<&mut Self, TranscriptProofBuilderError> {
-        let idx = ranges.to_range_set();
+        let idx = Idx::new(ranges.to_range_set());
 
-        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
+        if idx.end() > self.transcript.len_of_direction(direction) {
             return Err(TranscriptProofBuilderError::new(
                 BuilderErrorKind::Index,
                 format!(
                     "range is out of bounds of the transcript ({}): {} > {}",
                     direction,
-                    idx.end().unwrap_or(0),
+                    idx.end(),
                     self.transcript.len_of_direction(direction)
                 ),
             ));
@@ -370,13 +345,10 @@ impl<'a> TranscriptProofBuilder<'a> {
         if idx.is_subset(committed) {
             self.query_idx.union(&direction, &idx);
         } else {
-            let missing = idx.difference(committed).into_set();
+            let missing = idx.difference(committed);
             return Err(TranscriptProofBuilderError::new(
                 BuilderErrorKind::MissingCommitment,
-                format!(
-                    "commitment is missing for ranges in {direction} transcript: {}",
-                    FmtRangeSet(&missing)
-                ),
+                format!("commitment is missing for ranges in {direction} transcript: {missing}"),
             ));
         }
         Ok(self)
@@ -431,23 +403,25 @@ impl<'a> TranscriptProofBuilder<'a> {
                             continue;
                         };
 
-                        let (sent_dir_idxs, sent_uncovered) = uncovered_query_idx.sent.cover_by(
-                            encoding_tree
-                                .transcript_indices()
-                                .filter(|(dir, _)| *dir == Direction::Sent),
-                            |(_, idx)| idx,
-                        );
+                        let (sent_dir_idxs, sent_uncovered) =
+                            uncovered_query_idx.sent.as_range_set().cover_by(
+                                encoding_tree
+                                    .transcript_indices()
+                                    .filter(|(dir, _)| *dir == Direction::Sent),
+                                |(_, idx)| &idx.0,
+                            );
                         // Uncovered ranges will be checked with ranges of the next
                         // preferred commitment kind.
-                        uncovered_query_idx.sent = sent_uncovered;
+                        uncovered_query_idx.sent = Idx(sent_uncovered);
 
-                        let (recv_dir_idxs, recv_uncovered) = uncovered_query_idx.recv.cover_by(
-                            encoding_tree
-                                .transcript_indices()
-                                .filter(|(dir, _)| *dir == Direction::Received),
-                            |(_, idx)| idx,
-                        );
-                        uncovered_query_idx.recv = recv_uncovered;
+                        let (recv_dir_idxs, recv_uncovered) =
+                            uncovered_query_idx.recv.as_range_set().cover_by(
+                                encoding_tree
+                                    .transcript_indices()
+                                    .filter(|(dir, _)| *dir == Direction::Received),
+                                |(_, idx)| &idx.0,
+                            );
+                        uncovered_query_idx.recv = Idx(recv_uncovered);
 
                         let dir_idxs = sent_dir_idxs
                             .into_iter()
@@ -465,23 +439,25 @@ impl<'a> TranscriptProofBuilder<'a> {
                         }
                     }
                     TranscriptCommitmentKind::Hash { alg } => {
-                        let (sent_hashes, sent_uncovered) = uncovered_query_idx.sent.cover_by(
-                            self.hash_secrets.iter().filter(|hash| {
-                                hash.direction == Direction::Sent && &hash.alg == alg
-                            }),
-                            |hash| &hash.idx,
-                        );
+                        let (sent_hashes, sent_uncovered) =
+                            uncovered_query_idx.sent.as_range_set().cover_by(
+                                self.hash_secrets.iter().filter(|hash| {
+                                    hash.direction == Direction::Sent && &hash.alg == alg
+                                }),
+                                |hash| &hash.idx.0,
+                            );
                         // Uncovered ranges will be checked with ranges of the next
                         // preferred commitment kind.
-                        uncovered_query_idx.sent = sent_uncovered;
+                        uncovered_query_idx.sent = Idx(sent_uncovered);
 
-                        let (recv_hashes, recv_uncovered) = uncovered_query_idx.recv.cover_by(
-                            self.hash_secrets.iter().filter(|hash| {
-                                hash.direction == Direction::Received && &hash.alg == alg
-                            }),
-                            |hash| &hash.idx,
-                        );
-                        uncovered_query_idx.recv = recv_uncovered;
+                        let (recv_hashes, recv_uncovered) =
+                            uncovered_query_idx.recv.as_range_set().cover_by(
+                                self.hash_secrets.iter().filter(|hash| {
+                                    hash.direction == Direction::Received && &hash.alg == alg
+                                }),
+                                |hash| &hash.idx.0,
+                            );
+                        uncovered_query_idx.recv = Idx(recv_uncovered);
 
                         transcript_proof.hash_secrets.extend(
                             sent_hashes
@@ -586,12 +562,12 @@ impl fmt::Display for TranscriptProofBuilderError {
 #[cfg(test)]
 mod tests {
     use rand::{Rng, SeedableRng};
-    use rangeset::prelude::*;
+    use rangeset::RangeSet;
     use rstest::rstest;
     use tlsn_data_fixtures::http::{request::GET_WITH_HEADER, response::OK_JSON};
 
     use crate::{
-        fixtures::{encoder_secret, encoding_provider},
+        fixtures::encoding_provider,
         hash::{Blake3, Blinder, HashAlgId},
         transcript::TranscriptCommitConfigBuilder,
     };
@@ -601,7 +577,7 @@ mod tests {
     #[rstest]
     fn test_verify_missing_encoding_commitment_root() {
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
-        let idxs = vec![(Direction::Received, RangeSet::from(0..transcript.len().1))];
+        let idxs = vec![(Direction::Received, Idx::new(0..transcript.len().1))];
         let encoding_tree = EncodingTree::new(
             &Blake3::default(),
             &idxs,
@@ -618,12 +594,7 @@ mod tests {
 
         let provider = HashProvider::default();
         let err = transcript_proof
-            .verify_with_provider(
-                &provider,
-                &transcript.length(),
-                Some(&encoder_secret()),
-                &[],
-            )
+            .verify_with_provider(&provider, &transcript.length(), &[])
             .err()
             .unwrap();
 
@@ -661,17 +632,15 @@ mod tests {
     }
 
     #[rstest]
-    #[case::sha256(HashAlgId::SHA256)]
-    #[case::blake3(HashAlgId::BLAKE3)]
-    #[case::keccak256(HashAlgId::KECCAK256)]
-    fn test_reveal_with_hash_commitment(#[case] alg: HashAlgId) {
+    fn test_reveal_with_hash_commitment() {
         let mut rng = rand::rngs::StdRng::seed_from_u64(0);
         let provider = HashProvider::default();
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
 
         let direction = Direction::Sent;
-        let idx = RangeSet::from(0..10);
+        let idx = Idx::new(0..10);
         let blinder: Blinder = rng.random();
+        let alg = HashAlgId::SHA256;
         let hasher = provider.get(&alg).unwrap();
 
         let commitment = PlaintextHash {
@@ -698,7 +667,6 @@ mod tests {
             .verify_with_provider(
                 &provider,
                 &transcript.length(),
-                None,
                 &[TranscriptCommitment::Hash(commitment)],
             )
             .unwrap();
@@ -710,17 +678,15 @@ mod tests {
     }
 
     #[rstest]
-    #[case::sha256(HashAlgId::SHA256)]
-    #[case::blake3(HashAlgId::BLAKE3)]
-    #[case::keccak256(HashAlgId::KECCAK256)]
-    fn test_reveal_with_inconsistent_hash_commitment(#[case] alg: HashAlgId) {
+    fn test_reveal_with_inconsistent_hash_commitment() {
         let mut rng = rand::rngs::StdRng::seed_from_u64(0);
         let provider = HashProvider::default();
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
 
         let direction = Direction::Sent;
-        let idx = RangeSet::from(0..10);
+        let idx = Idx::new(0..10);
         let blinder: Blinder = rng.random();
+        let alg = HashAlgId::SHA256;
         let hasher = provider.get(&alg).unwrap();
 
         let commitment = PlaintextHash {
@@ -748,7 +714,6 @@ mod tests {
             .verify_with_provider(
                 &provider,
                 &transcript.length(),
-                None,
                 &[TranscriptCommitment::Hash(commitment)],
             )
             .unwrap_err();
@@ -929,10 +894,10 @@ mod tests {
             match kind {
                 BuilderErrorKind::Cover { uncovered, .. } => {
                     if !uncovered_sent_rangeset.is_empty() {
-                        assert_eq!(uncovered.sent, uncovered_sent_rangeset);
+                        assert_eq!(uncovered.sent, Idx(uncovered_sent_rangeset));
                     }
                     if !uncovered_recv_rangeset.is_empty() {
-                        assert_eq!(uncovered.recv, uncovered_recv_rangeset);
+                        assert_eq!(uncovered.recv, Idx(uncovered_recv_rangeset));
                     }
                 }
                 _ => panic!("unexpected error kind: {kind:?}"),

crates/core/src/transcript/tls.rs

@@ -10,53 +10,10 @@ use crate::{
 use tls_core::msgs::{
     alert::AlertMessagePayload,
     codec::{Codec, Reader},
-    enums::{AlertDescription, ProtocolVersion},
+    enums::{AlertDescription, ContentType, ProtocolVersion},
     handshake::{HandshakeMessagePayload, HandshakePayload},
 };
 
-/// TLS record content type.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-pub enum ContentType {
-    /// Change cipher spec protocol.
-    ChangeCipherSpec,
-    /// Alert protocol.
-    Alert,
-    /// Handshake protocol.
-    Handshake,
-    /// Application data protocol.
-    ApplicationData,
-    /// Heartbeat protocol.
-    Heartbeat,
-    /// Unknown protocol.
-    Unknown(u8),
-}
-
-impl From<ContentType> for tls_core::msgs::enums::ContentType {
-    fn from(content_type: ContentType) -> Self {
-        match content_type {
-            ContentType::ChangeCipherSpec => tls_core::msgs::enums::ContentType::ChangeCipherSpec,
-            ContentType::Alert => tls_core::msgs::enums::ContentType::Alert,
-            ContentType::Handshake => tls_core::msgs::enums::ContentType::Handshake,
-            ContentType::ApplicationData => tls_core::msgs::enums::ContentType::ApplicationData,
-            ContentType::Heartbeat => tls_core::msgs::enums::ContentType::Heartbeat,
-            ContentType::Unknown(id) => tls_core::msgs::enums::ContentType::Unknown(id),
-        }
-    }
-}
-
-impl From<tls_core::msgs::enums::ContentType> for ContentType {
-    fn from(content_type: tls_core::msgs::enums::ContentType) -> Self {
-        match content_type {
-            tls_core::msgs::enums::ContentType::ChangeCipherSpec => ContentType::ChangeCipherSpec,
-            tls_core::msgs::enums::ContentType::Alert => ContentType::Alert,
-            tls_core::msgs::enums::ContentType::Handshake => ContentType::Handshake,
-            tls_core::msgs::enums::ContentType::ApplicationData => ContentType::ApplicationData,
-            tls_core::msgs::enums::ContentType::Heartbeat => ContentType::Heartbeat,
-            tls_core::msgs::enums::ContentType::Unknown(id) => ContentType::Unknown(id),
-        }
-    }
-}
-
 /// A transcript of TLS records sent and received by the prover.
 #[derive(Debug, Clone)]
 pub struct TlsTranscript {

crates/core/src/webpki.rs

@@ -53,21 +53,6 @@ impl RootCertStore {
     pub fn empty() -> Self {
         Self { roots: Vec::new() }
     }
-
-    /// Creates a root certificate store with Mozilla root certificates.
-    ///
-    /// These certificates are sourced from [`webpki-root-certs`](https://docs.rs/webpki-root-certs/latest/webpki_root_certs/). It is not recommended to use these unless the
-    /// application binary can be recompiled and deployed on-demand in the case
-    /// that the root certificates need to be updated.
-    #[cfg(feature = "mozilla-certs")]
-    pub fn mozilla() -> Self {
-        Self {
-            roots: webpki_root_certs::TLS_SERVER_ROOT_CERTS
-                .iter()
-                .map(|cert| CertificateDer(cert.to_vec()))
-                .collect(),
-        }
-    }
 }
 
 /// Server certificate verifier.
@@ -97,12 +82,8 @@ impl ServerCertVerifier {
         Ok(Self { roots })
     }
 
-    /// Creates a server certificate verifier with Mozilla root certificates.
-    ///
-    /// These certificates are sourced from [`webpki-root-certs`](https://docs.rs/webpki-root-certs/latest/webpki_root_certs/). It is not recommended to use these unless the
-    /// application binary can be recompiled and deployed on-demand in the case
-    /// that the root certificates need to be updated.
-    #[cfg(feature = "mozilla-certs")]
+    /// Creates a new server certificate verifier with Mozilla root
+    /// certificates.
     pub fn mozilla() -> Self {
         Self {
             roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),

crates/examples/Cargo.toml

@@ -15,18 +15,20 @@ tlsn-server-fixture = { workspace = true }
 tlsn-server-fixture-certs = { workspace = true }
 spansy = { workspace = true }
 
-anyhow = { workspace = true }
 bincode = { workspace = true }
 chrono = { workspace = true }
 clap = { version = "4.5", features = ["derive"] }
+dotenv = { version = "0.15.0" }
+ethers = "2.0.14"
+eyre = "0.6.12"
 futures = { workspace = true }
 http-body-util = { workspace = true }
 hex = { workspace = true }
 hyper = { workspace = true, features = ["client", "http1"] }
 hyper-util = { workspace = true, features = ["full"] }
 k256 = { workspace = true, features = ["ecdsa"] }
-serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = [
   "rt",
   "rt-multi-thread",
@@ -38,26 +40,12 @@ tokio = { workspace = true, features = [
 tokio-util = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
-noir = { git = "https://github.com/zkmopro/noir-rs", tag = "v1.0.0-beta.8", features = [
-  "barretenberg",
-] }
+rand.workspace = true
 
 [[example]]
 name = "interactive"
 path = "interactive/interactive.rs"
 
 [[example]]
-name = "interactive_zk"
-path = "interactive_zk/interactive_zk.rs"
-
-[[example]]
-name = "attestation_prove"
-path = "attestation/prove.rs"
-
-[[example]]
-name = "attestation_present"
-path = "attestation/present.rs"
-
-[[example]]
-name = "attestation_verify"
-path = "attestation/verify.rs"
+name = "eas"
+path = "eas/eas.rs"

crates/examples/README.md

@@ -4,7 +4,5 @@ This folder contains examples demonstrating how to use the TLSNotary protocol.
 
 * [Interactive](./interactive/README.md): Interactive Prover and Verifier session without a trusted notary.
 * [Attestation](./attestation/README.md): Performing a simple notarization with a trusted notary.
-* [Interactive_zk](./interactive_zk/README.md): Interactive Prover and Verifier session demonstrating zero-knowledge age verification using Noir.
 
-
-Refer to <https://tlsnotary.org/docs/quick_start> for a quick start guide to using TLSNotary with these examples.
+Refer to <https://docs.tlsnotary.org/quick_start/index.html> for a quick start guide to using TLSNotary with these examples.

crates/examples/attestation/README.md

@@ -1,164 +0,0 @@
-# Attestation Example
-
-
-This example demonstrates a **TLSNotary attestation workflow**: notarizing data from a server with a trusted third party (Notary), then creating verifiable presentations with selective disclosure of sensitive information to a Verifier.
-
-## 🔍 How It Works
-
-```mermaid
-sequenceDiagram
-    participant P as Prover
-    participant N as MPC-TLS<br/>Verifier
-    participant S as Server<br/>Fixture
-    participant V as Attestation<br/>Verifier
-
-    Note over P,S: 1. Notarization Phase
-    P->>N: Establish MPC-TLS connection
-    P->>S: Request (MPC-TLS)
-    S->>P: Response (MPC-TLS)
-    N->>P: Issue signed attestation
-
-    Note over P: 2. Presentation Phase
-    P->>P: Create redacted presentation
-
-    Note over P,V: 3. Verification Phase
-    P->>V: Share presentation
-    V->>V: Verify attestation signature
-```
-
-### The Three-Step Process
-
-1. **🔐 Notarize**: Prover collaborates with Notary to create an authenticated TLS session and obtain a signed attestation
-2. **✂️ Present**: Prover creates a selective presentation, choosing which data to reveal or redact
-3. **✅ Verify**: Anyone can verify the presentation's authenticity using the Notary's public key
-
-## 🚀 Quick Start
-
-### Step 1: Notarize Data
-
-**Start the test server** (from repository root):
-```bash
-RUST_LOG=info PORT=4000 cargo run --bin tlsn-server-fixture
-```
-
-**Run the notarization** (in a new terminal):
-```bash
-RUST_LOG=info SERVER_PORT=4000 cargo run --release --example attestation_prove
-```
-
-**Expected output:**
-```
-Notarization completed successfully!
-The attestation has been written to `example-json.attestation.tlsn` and the corresponding secrets to `example-json.secrets.tlsn`.
-```
-
-### Step 2: Create Verifiable Presentation
-
-**Generate a redacted presentation:**
-```bash
-cargo run --release --example attestation_present
-```
-
-**Expected output:**
-```
-Presentation built successfully!
-The presentation has been written to `example-json.presentation.tlsn`.
-```
-
-> 💡 **Tip**: You can create multiple presentations from the same attestation, each with different redactions!
-
-### Step 3: Verify the Presentation
-
-**Verify the presentation:**
-```bash
-cargo run --release --example attestation_verify
-```
-
-**Expected output:**
-```
-Verifying presentation with {key algorithm} key: { hex encoded key }
-
-**Ask yourself, do you trust this key?**
-
--------------------------------------------------------------------
-Successfully verified that the data below came from a session with test-server.io at { time }.
-Note that the data which the Prover chose not to disclose are shown as X.
-
-Data sent:
-
-GET /formats/json HTTP/1.1
-host: test-server.io
-accept: */*
-accept-encoding: identity
-connection: close
-user-agent: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-
-Data received:
-
-HTTP/1.1 200 OK
-content-type: application/json
-content-length: 722
-connection: close
-date: Mon, 08 Sep 2025 09:18:29 GMT
-
-XXXXXX1234567890XXXXXXXXXXXXXXXXXXXXXXXXJohn DoeXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX1.2XX
-```
-
-## 🎯 Use Cases & Examples
-
-### JSON Data (Default)
-Perfect for API responses, configuration data, or structured information:
-```bash
-# All three steps use JSON by default
-SERVER_PORT=4000 cargo run --release --example attestation_prove
-cargo run --release --example attestation_present
-cargo run --release --example attestation_verify
-```
-
-### HTML Content
-Ideal for web pages, forms, or any HTML-based data:
-```bash
-# Notarize HTML content
-SERVER_PORT=4000 cargo run --release --example attestation_prove -- html
-cargo run --release --example attestation_present -- html
-cargo run --release --example attestation_verify -- html
-```
-
-### Authenticated/Private Data
-For APIs requiring authentication tokens, cookies, or private access:
-```bash
-# Notarize private data with authentication
-SERVER_PORT=4000 cargo run --release --example attestation_prove -- authenticated
-cargo run --release --example attestation_present -- authenticated
-cargo run --release --example attestation_verify -- authenticated
-```
-
-### Debug Mode
-
-For detailed logging and troubleshooting:
-```bash
-RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example attestation_prove
-```
-
-### Generated Files
-
-After running the examples, you'll find:
-- **`*.attestation.tlsn`**: The cryptographically signed attestation from the Notary
-- **`*.secrets.tlsn`**: Cryptographic secrets needed to create presentations
-- **`*.presentation.tlsn`**: The verifiable presentation with your chosen redactions
-
-## 🔐 Security Considerations
-
-### Trust Model
-- ✅ **Notary Key**: The presentation includes the Notary's verifying key - The verifier must trust this key
-- ✅ **Data Authenticity**: Cryptographically guaranteed that data came from the specified server
-- ✅ **Tamper Evidence**: Any modification to the presentation will fail verification
-- ⚠️ **Notary Trust**: The verifier must trust the Notary not to collude with the Prover
-
-### Production Deployment
-- 🏭 **Independent Notary**: Use a trusted third-party Notary service (not a local one)
-- 🔒 **Key Management**: Implement proper Notary key distribution and verification
-- 📋 **Audit Trail**: Maintain logs of notarization and verification events
-- 🔄 **Key Rotation**: Plan for Notary key updates and migration
-
-> ⚠️ **Demo Notice**: This example uses a local test server and local Notary for demonstration. In production, use trusted third-party Notary services and real server endpoints.

crates/examples/attestation/present.rs

@@ -1,117 +0,0 @@
-// This example demonstrates how to build a verifiable presentation from an
-// attestation and the corresponding connection secrets. See the `prove.rs`
-// example to learn how to acquire an attestation from a Notary.
-
-use clap::Parser;
-use hyper::header;
-
-use tlsn::attestation::{presentation::Presentation, Attestation, CryptoProvider, Secrets};
-use tlsn_examples::ExampleType;
-use tlsn_formats::http::HttpTranscript;
-
-#[derive(Parser, Debug)]
-#[command(version, about, long_about = None)]
-struct Args {
-    /// What data to notarize
-    #[clap(default_value_t, value_enum)]
-    example_type: ExampleType,
-}
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let args = Args::parse();
-
-    create_presentation(&args.example_type).await
-}
-
-async fn create_presentation(example_type: &ExampleType) -> Result<(), Box<dyn std::error::Error>> {
-    let attestation_path = tlsn_examples::get_file_path(example_type, "attestation");
-    let secrets_path = tlsn_examples::get_file_path(example_type, "secrets");
-
-    // Read attestation from disk.
-    let attestation: Attestation = bincode::deserialize(&std::fs::read(attestation_path)?)?;
-
-    // Read secrets from disk.
-    let secrets: Secrets = bincode::deserialize(&std::fs::read(secrets_path)?)?;
-
-    // Parse the HTTP transcript.
-    let transcript = HttpTranscript::parse(secrets.transcript())?;
-
-    // Build a transcript proof.
-    let mut builder = secrets.transcript_proof_builder();
-
-    // Here is where we reveal all or some of the parts we committed in `prove.rs`
-    // previously.
-    let request = &transcript.requests[0];
-    // Reveal the structure of the request without the headers or body.
-    builder.reveal_sent(&request.without_data())?;
-    // Reveal the request target.
-    builder.reveal_sent(&request.request.target)?;
-    // Reveal all request headers except the values of User-Agent and Authorization.
-    for header in &request.headers {
-        if !(header
-            .name
-            .as_str()
-            .eq_ignore_ascii_case(header::USER_AGENT.as_str())
-            || header
-                .name
-                .as_str()
-                .eq_ignore_ascii_case(header::AUTHORIZATION.as_str()))
-        {
-            builder.reveal_sent(header)?;
-        } else {
-            builder.reveal_sent(&header.without_value())?;
-        }
-    }
-
-    // Reveal only parts of the response.
-    let response = &transcript.responses[0];
-    // Reveal the structure of the response without the headers or body.
-    builder.reveal_recv(&response.without_data())?;
-    // Reveal all response headers.
-    for header in &response.headers {
-        builder.reveal_recv(header)?;
-    }
-
-    let content = &response.body.as_ref().unwrap().content;
-    match content {
-        tlsn_formats::http::BodyContent::Json(json) => {
-            // For experimentation, reveal the entire response or just a selection.
-            let reveal_all = false;
-            if reveal_all {
-                builder.reveal_recv(response)?;
-            } else {
-                builder.reveal_recv(json.get("id").unwrap())?;
-                builder.reveal_recv(json.get("information.name").unwrap())?;
-                builder.reveal_recv(json.get("meta.version").unwrap())?;
-            }
-        }
-        tlsn_formats::http::BodyContent::Unknown(span) => {
-            builder.reveal_recv(span)?;
-        }
-        _ => {}
-    }
-
-    let transcript_proof = builder.build()?;
-
-    // Use default crypto provider to build the presentation.
-    let provider = CryptoProvider::default();
-
-    let mut builder = attestation.presentation_builder(&provider);
-
-    builder
-        .identity_proof(secrets.identity_proof())
-        .transcript_proof(transcript_proof);
-
-    let presentation: Presentation = builder.build()?;
-
-    let presentation_path = tlsn_examples::get_file_path(example_type, "presentation");
-
-    // Write the presentation to disk.
-    std::fs::write(&presentation_path, bincode::serialize(&presentation)?)?;
-
-    println!("Presentation built successfully!");
-    println!("The presentation has been written to `{presentation_path}`.");
-
-    Ok(())
-}

crates/examples/attestation/prove.rs

@@ -1,408 +0,0 @@
-// This example demonstrates how to use the Prover to acquire an attestation for
-// an HTTP request sent to a server fixture. The attestation and secrets are
-// saved to disk.
-
-use std::env;
-
-use anyhow::{anyhow, Result};
-use clap::Parser;
-use http_body_util::Empty;
-use hyper::{body::Bytes, Request, StatusCode};
-use hyper_util::rt::TokioIo;
-use spansy::Spanned;
-use tokio::{
-    io::{AsyncRead, AsyncWrite},
-    sync::oneshot::{self, Receiver, Sender},
-};
-use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
-use tracing::info;
-
-use tlsn::{
-    attestation::{
-        request::{Request as AttestationRequest, RequestConfig},
-        signing::Secp256k1Signer,
-        Attestation, AttestationConfig, CryptoProvider, Secrets,
-    },
-    config::{
-        prove::ProveConfig,
-        prover::ProverConfig,
-        tls::TlsClientConfig,
-        tls_commit::{mpc::MpcTlsConfig, TlsCommitConfig},
-        verifier::VerifierConfig,
-    },
-    connection::{ConnectionInfo, HandshakeData, ServerName, TranscriptLength},
-    prover::{state::Committed, Prover, ProverOutput},
-    transcript::{ContentType, TranscriptCommitConfig},
-    verifier::{Verifier, VerifierOutput},
-    webpki::{CertificateDer, PrivateKeyDer, RootCertStore},
-};
-use tlsn_examples::ExampleType;
-use tlsn_formats::http::{DefaultHttpCommitter, HttpCommit, HttpTranscript};
-use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
-use tlsn_server_fixture_certs::{CA_CERT_DER, CLIENT_CERT_DER, CLIENT_KEY_DER, SERVER_DOMAIN};
-
-// Setting of the application server.
-const USER_AGENT: &str = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36";
-
-#[derive(Parser, Debug)]
-#[command(version, about, long_about = None)]
-struct Args {
-    /// What data to notarize.
-    #[clap(default_value_t, value_enum)]
-    example_type: ExampleType,
-}
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    tracing_subscriber::fmt::init();
-
-    let args = Args::parse();
-    let (uri, extra_headers) = match args.example_type {
-        ExampleType::Json => ("/formats/json", vec![]),
-        ExampleType::Html => ("/formats/html", vec![]),
-        ExampleType::Authenticated => ("/protected", vec![("Authorization", "random_auth_token")]),
-    };
-
-    let (notary_socket, prover_socket) = tokio::io::duplex(1 << 23);
-    let (request_tx, request_rx) = oneshot::channel();
-    let (attestation_tx, attestation_rx) = oneshot::channel();
-
-    tokio::spawn(async move {
-        notary(notary_socket, request_rx, attestation_tx)
-            .await
-            .unwrap()
-    });
-
-    prover(
-        prover_socket,
-        request_tx,
-        attestation_rx,
-        uri,
-        extra_headers,
-        &args.example_type,
-    )
-    .await?;
-
-    Ok(())
-}
-
-async fn prover<S: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
-    socket: S,
-    req_tx: Sender<AttestationRequest>,
-    resp_rx: Receiver<Attestation>,
-    uri: &str,
-    extra_headers: Vec<(&str, &str)>,
-    example_type: &ExampleType,
-) -> Result<()> {
-    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
-    let server_port: u16 = env::var("SERVER_PORT")
-        .map(|port| port.parse().expect("port should be valid integer"))
-        .unwrap_or(DEFAULT_FIXTURE_PORT);
-
-    // Create a new prover and perform necessary setup.
-    let prover = Prover::new(ProverConfig::builder().build()?)
-        .commit(
-            TlsCommitConfig::builder()
-                // Select the TLS commitment protocol.
-                .protocol(
-                    MpcTlsConfig::builder()
-                        // We must configure the amount of data we expect to exchange beforehand,
-                        // which will be preprocessed prior to the
-                        // connection. Reducing these limits will improve
-                        // performance.
-                        .max_sent_data(tlsn_examples::MAX_SENT_DATA)
-                        .max_recv_data(tlsn_examples::MAX_RECV_DATA)
-                        .build()?,
-                )
-                .build()?,
-            socket.compat(),
-        )
-        .await?;
-
-    // Open a TCP connection to the server.
-    let client_socket = tokio::net::TcpStream::connect((server_host, server_port)).await?;
-
-    // Bind the prover to the server connection.
-    let (tls_connection, prover_fut) = prover
-        .connect(
-            TlsClientConfig::builder()
-                .server_name(ServerName::Dns(SERVER_DOMAIN.try_into()?))
-                // Create a root certificate store with the server-fixture's self-signed
-                // certificate. This is only required for offline testing with the
-                // server-fixture.
-                .root_store(RootCertStore {
-                    roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-                })
-                // (Optional) Set up TLS client authentication if required by the server.
-                .client_auth((
-                    vec![CertificateDer(CLIENT_CERT_DER.to_vec())],
-                    PrivateKeyDer(CLIENT_KEY_DER.to_vec()),
-                ))
-                .build()?,
-            client_socket.compat(),
-        )
-        .await?;
-    let tls_connection = TokioIo::new(tls_connection.compat());
-
-    // Spawn the prover task to be run concurrently in the background.
-    let prover_task = tokio::spawn(prover_fut);
-
-    // Attach the hyper HTTP client to the connection.
-    let (mut request_sender, connection) =
-        hyper::client::conn::http1::handshake(tls_connection).await?;
-
-    // Spawn the HTTP task to be run concurrently in the background.
-    tokio::spawn(connection);
-
-    // Build a simple HTTP request with common headers.
-    let request_builder = Request::builder()
-        .uri(uri)
-        .header("Host", SERVER_DOMAIN)
-        .header("Accept", "*/*")
-        // Using "identity" instructs the Server not to use compression for its HTTP response.
-        // TLSNotary tooling does not support compression.
-        .header("Accept-Encoding", "identity")
-        .header("Connection", "close")
-        .header("User-Agent", USER_AGENT);
-    let mut request_builder = request_builder;
-    for (key, value) in extra_headers {
-        request_builder = request_builder.header(key, value);
-    }
-    let request = request_builder.body(Empty::<Bytes>::new())?;
-
-    info!("Starting connection with the server");
-
-    // Send the request to the server and wait for the response.
-    let response = request_sender.send_request(request).await?;
-
-    info!("Got a response from the server: {}", response.status());
-
-    assert!(response.status() == StatusCode::OK);
-
-    // The prover task should be done now, so we can await it.
-    let prover = prover_task.await??;
-
-    // Parse the HTTP transcript.
-    let transcript = HttpTranscript::parse(prover.transcript())?;
-
-    let body_content = &transcript.responses[0].body.as_ref().unwrap().content;
-    let body = String::from_utf8_lossy(body_content.span().as_bytes());
-
-    match body_content {
-        tlsn_formats::http::BodyContent::Json(_json) => {
-            let parsed = serde_json::from_str::<serde_json::Value>(&body)?;
-            info!("{}", serde_json::to_string_pretty(&parsed)?);
-        }
-        tlsn_formats::http::BodyContent::Unknown(_span) => {
-            info!("{}", &body);
-        }
-        _ => {}
-    }
-
-    // Commit to the transcript.
-    let mut builder = TranscriptCommitConfig::builder(prover.transcript());
-
-    // This commits to various parts of the transcript separately (e.g. request
-    // headers, response headers, response body and more). See https://docs.tlsnotary.org//protocol/commit_strategy.html
-    // for other strategies that can be used to generate commitments.
-    DefaultHttpCommitter::default().commit_transcript(&mut builder, &transcript)?;
-
-    let transcript_commit = builder.build()?;
-
-    // Build an attestation request.
-    let mut builder = RequestConfig::builder();
-
-    builder.transcript_commit(transcript_commit);
-
-    // Optionally, add an extension to the attestation if the notary supports it.
-    // builder.extension(Extension {
-    //     id: b"example.name".to_vec(),
-    //     value: b"Bobert".to_vec(),
-    // });
-
-    let request_config = builder.build()?;
-
-    let (attestation, secrets) = notarize(prover, &request_config, req_tx, resp_rx).await?;
-
-    // Write the attestation to disk.
-    let attestation_path = tlsn_examples::get_file_path(example_type, "attestation");
-    let secrets_path = tlsn_examples::get_file_path(example_type, "secrets");
-
-    tokio::fs::write(&attestation_path, bincode::serialize(&attestation)?).await?;
-
-    // Write the secrets to disk.
-    tokio::fs::write(&secrets_path, bincode::serialize(&secrets)?).await?;
-
-    println!("Notarization completed successfully!");
-    println!(
-        "The attestation has been written to `{attestation_path}` and the \
-        corresponding secrets to `{secrets_path}`."
-    );
-
-    Ok(())
-}
-
-async fn notarize(
-    mut prover: Prover<Committed>,
-    config: &RequestConfig,
-    request_tx: Sender<AttestationRequest>,
-    attestation_rx: Receiver<Attestation>,
-) -> Result<(Attestation, Secrets)> {
-    let mut builder = ProveConfig::builder(prover.transcript());
-
-    if let Some(config) = config.transcript_commit() {
-        builder.transcript_commit(config.clone());
-    }
-
-    let disclosure_config = builder.build()?;
-
-    let ProverOutput {
-        transcript_commitments,
-        transcript_secrets,
-        ..
-    } = prover.prove(&disclosure_config).await?;
-
-    let transcript = prover.transcript().clone();
-    let tls_transcript = prover.tls_transcript().clone();
-    prover.close().await?;
-
-    // Build an attestation request.
-    let mut builder = AttestationRequest::builder(config);
-
-    builder
-        .server_name(ServerName::Dns(SERVER_DOMAIN.try_into().unwrap()))
-        .handshake_data(HandshakeData {
-            certs: tls_transcript
-                .server_cert_chain()
-                .expect("server cert chain is present")
-                .to_vec(),
-            sig: tls_transcript
-                .server_signature()
-                .expect("server signature is present")
-                .clone(),
-            binding: tls_transcript.certificate_binding().clone(),
-        })
-        .transcript(transcript)
-        .transcript_commitments(transcript_secrets, transcript_commitments);
-
-    let (request, secrets) = builder.build(&CryptoProvider::default())?;
-
-    // Send attestation request to notary.
-    request_tx
-        .send(request.clone())
-        .map_err(|_| anyhow!("notary is not receiving attestation request"))?;
-
-    // Receive attestation from notary.
-    let attestation = attestation_rx
-        .await
-        .map_err(|err| anyhow!("notary did not respond with attestation: {err}"))?;
-
-    // Signature verifier for the signature algorithm in the request.
-    let provider = CryptoProvider::default();
-
-    // Check the attestation is consistent with the Prover's view.
-    request.validate(&attestation, &provider)?;
-
-    Ok((attestation, secrets))
-}
-
-async fn notary<S: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
-    socket: S,
-    request_rx: Receiver<AttestationRequest>,
-    attestation_tx: Sender<Attestation>,
-) -> Result<()> {
-    // Create a root certificate store with the server-fixture's self-signed
-    // certificate. This is only required for offline testing with the
-    // server-fixture.
-    let verifier_config = VerifierConfig::builder()
-        .root_store(RootCertStore {
-            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-        })
-        .build()
-        .unwrap();
-
-    let verifier = Verifier::new(verifier_config)
-        .commit(socket.compat())
-        .await?
-        .accept()
-        .await?
-        .run()
-        .await?;
-
-    let (
-        VerifierOutput {
-            transcript_commitments,
-            encoder_secret,
-            ..
-        },
-        verifier,
-    ) = verifier.verify().await?.accept().await?;
-
-    let tls_transcript = verifier.tls_transcript().clone();
-
-    verifier.close().await?;
-
-    let sent_len = tls_transcript
-        .sent()
-        .iter()
-        .filter_map(|record| {
-            if let ContentType::ApplicationData = record.typ {
-                Some(record.ciphertext.len())
-            } else {
-                None
-            }
-        })
-        .sum::<usize>();
-
-    let recv_len = tls_transcript
-        .recv()
-        .iter()
-        .filter_map(|record| {
-            if let ContentType::ApplicationData = record.typ {
-                Some(record.ciphertext.len())
-            } else {
-                None
-            }
-        })
-        .sum::<usize>();
-
-    // Receive attestation request from prover.
-    let request = request_rx.await?;
-
-    // Load a dummy signing key.
-    let signing_key = k256::ecdsa::SigningKey::from_bytes(&[1u8; 32].into())?;
-    let signer = Box::new(Secp256k1Signer::new(&signing_key.to_bytes())?);
-    let mut provider = CryptoProvider::default();
-    provider.signer.set_signer(signer);
-
-    // Build an attestation.
-    let mut att_config_builder = AttestationConfig::builder();
-    att_config_builder.supported_signature_algs(Vec::from_iter(provider.signer.supported_algs()));
-    let att_config = att_config_builder.build()?;
-
-    let mut builder = Attestation::builder(&att_config).accept_request(request)?;
-    builder
-        .connection_info(ConnectionInfo {
-            time: tls_transcript.time(),
-            version: (*tls_transcript.version()),
-            transcript_length: TranscriptLength {
-                sent: sent_len as u32,
-                received: recv_len as u32,
-            },
-        })
-        .server_ephemeral_key(tls_transcript.server_ephemeral_key().clone())
-        .transcript_commitments(transcript_commitments);
-
-    if let Some(encoder_secret) = encoder_secret {
-        builder.encoder_secret(encoder_secret);
-    }
-
-    let attestation = builder.build(&provider)?;
-
-    // Send attestation to prover.
-    attestation_tx
-        .send(attestation)
-        .map_err(|_| anyhow!("prover is not receiving attestation"))?;
-
-    Ok(())
-}

crates/examples/attestation/verify.rs

@@ -1,96 +0,0 @@
-// This example demonstrates how to verify a presentation. See `present.rs` for
-// an example of how to build a presentation from an attestation and connection
-// secrets.
-
-use std::time::Duration;
-
-use clap::Parser;
-
-use tlsn::{
-    attestation::{
-        presentation::{Presentation, PresentationOutput},
-        signing::VerifyingKey,
-        CryptoProvider,
-    },
-    verifier::ServerCertVerifier,
-    webpki::{CertificateDer, RootCertStore},
-};
-use tlsn_examples::ExampleType;
-use tlsn_server_fixture_certs::CA_CERT_DER;
-
-#[derive(Parser, Debug)]
-#[command(version, about, long_about = None)]
-struct Args {
-    /// What data to notarize.
-    #[clap(default_value_t, value_enum)]
-    example_type: ExampleType,
-}
-
-#[tokio::main]
-async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let args = Args::parse();
-
-    verify_presentation(&args.example_type).await
-}
-
-async fn verify_presentation(example_type: &ExampleType) -> Result<(), Box<dyn std::error::Error>> {
-    // Read the presentation from disk.
-    let presentation_path = tlsn_examples::get_file_path(example_type, "presentation");
-
-    let presentation: Presentation = bincode::deserialize(&std::fs::read(presentation_path)?)?;
-
-    // Create a crypto provider accepting the server-fixture's self-signed
-    // root certificate.
-    //
-    // This is only required for offline testing with the server-fixture. In
-    // production, use `CryptoProvider::default()` instead.
-    let root_cert_store = RootCertStore {
-        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-    };
-    let crypto_provider = CryptoProvider {
-        cert: ServerCertVerifier::new(&root_cert_store)?,
-        ..Default::default()
-    };
-
-    let VerifyingKey {
-        alg,
-        data: key_data,
-    } = presentation.verifying_key();
-
-    println!(
-        "Verifying presentation with {alg} key: {}\n\n**Ask yourself, do you trust this key?**\n",
-        hex::encode(key_data)
-    );
-
-    // Verify the presentation.
-    let PresentationOutput {
-        server_name,
-        connection_info,
-        transcript,
-        // extensions, // Optionally, verify any custom extensions from prover/notary.
-        ..
-    } = presentation.verify(&crypto_provider).unwrap();
-
-    // The time at which the connection was started.
-    let time = chrono::DateTime::UNIX_EPOCH + Duration::from_secs(connection_info.time);
-    let server_name = server_name.unwrap();
-    let mut partial_transcript = transcript.unwrap();
-    // Set the unauthenticated bytes so they are distinguishable.
-    partial_transcript.set_unauthed(b'X');
-
-    let sent = String::from_utf8_lossy(partial_transcript.sent_unsafe());
-    let recv = String::from_utf8_lossy(partial_transcript.received_unsafe());
-
-    println!("-------------------------------------------------------------------");
-    println!(
-        "Successfully verified that the data below came from a session with {server_name} at {time}.",
-    );
-    println!("Note that the data which the Prover chose not to disclose are shown as X.\n");
-    println!("Data sent:\n");
-    println!("{sent}\n");
-    println!("Data received:\n");
-    println!("{recv}\n");
-    println!("-------------------------------------------------------------------");
-
-    Ok(())
-}

crates/examples/eas/README.md

@@ -0,0 +1,36 @@
+## Simple Interactive Verifier + Ethereum Attestation Service
+
+This example is basically the `interactive` example adding the generation of Offline [EAS](https://attest.org/) Attestation and timestamping it. Please first understand the interactive example and [EAS](https://attest.org/) before getting into this example.
+
+This demo:
+
+- Runs a simple interactive session between a Prover and a Verifier
+- Gets the redacted string of the response and generates an offline signed attestation of it. The attestation generated uses this [schema](https://sepolia.easscan.org/schema/view/0x938b5d03b0057688eef86d8101946311c4aaa740ffc39cef9bbfb6ce572a7198). It is stored in the `eas_attestation.json` local file.
+- Timestamps the attestation (that is mainly calling the `timestamp` method in the EAS contract), the Tx of the transaction will be shown.
+- You can verify the generated attestation with the provided `check-eas-attestation-js` example or using https://sepolia.easscan.org/tools.
+
+To run this demo you need:
+
+- Sepolia RPC provider URL
+- [Ethereum address secret key](https://support.metamask.io/configure/accounts/how-to-export-an-accounts-private-key/) with some ether. 
+
+This example fetches data from a local test server. To start this server, run:
+```shell
+PORT=4000 cargo run --bin tlsn-server-fixture
+```
+Next, run the interactive example with:
+```shell
+EAS_SK=<secret_key> RPC_URL=<rpc_url> SERVER_PORT=4000 cargo run --release --example eas
+```
+To view more detailed debug information, use the following command:
+```shell
+EAS_SK=<secret_key> RPC_URL=<rpc_url> RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example eas
+```
+
+This will generate a signed EAS attestation, you can verify it by using the eas-sdk with:
+```shell
+cd check-eas-attestation-js
+npm i
+RPC_URL=<rpc_url> npm run start
+```
+

crates/examples/eas/check-eas-attestation-js/.gitignore

@@ -0,0 +1 @@
+node_modules

crates/examples/eas/check-eas-attestation-js/index.js

@@ -0,0 +1,24 @@
+import { ethers } from "ethers";
+import { EAS, Offchain } from "@ethereum-attestation-service/eas-sdk";
+import { readFileSync } from 'fs';
+
+async function main() {
+  const provider = new ethers.JsonRpcProvider(process.env.RPC_URL);
+  const EAS_CONTRACT_ADDRESS = "0xC2679fBD37d54388Ce493F1DB75320D236e1815e";
+
+  const eas = new EAS(EAS_CONTRACT_ADDRESS);
+  eas.connect(provider);
+
+  const serializedAttestation = readFileSync('../eas_attestation.json', 'utf8');
+  const attestation = JSON.parse(serializedAttestation);
+
+  const offchain = await eas.getOffchain();
+  try {
+    const signatureOk = await offchain.verifyOffchainAttestationSignature(attestation.signer, attestation.sig);
+    console.log("Signature verification:", signatureOk)
+  } catch (err) {
+    console.error("Invalid or malformed offchain attestation:", err);
+  }
+}
+
+main();

crates/examples/eas/check-eas-attestation-js/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "check-eas-attestation",
+  "version": "1.0.0",
+  "description": "Verify EAS offline attestations with Node.js",
+  "main": "index.js",
+  "type": "module",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "ethers": "^6.0.0",
+    "@ethereum-attestation-service/eas-sdk": "^1.0.0"
+  }
+}

crates/examples/eas/eas.abi.url

@@ -0,0 +1 @@
+https://sepolia.etherscan.io/address/0xC2679fBD37d54388Ce493F1DB75320D236e1815e#code

crates/examples/eas/eas.rs

@@ -0,0 +1,579 @@
+use std::{
+    env,
+    net::{IpAddr, SocketAddr},
+    str::FromStr,
+};
+
+use ethers::{
+    abi::Address,
+    signers::{LocalWallet, Signer},
+    types::H256,
+};
+use http_body_util::Empty;
+use hyper::{body::Bytes, Request, StatusCode, Uri};
+use hyper_util::rt::TokioIo;
+use tokio::io::{AsyncRead, AsyncWrite};
+use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
+use tracing::instrument;
+
+use tls_server_fixture::CA_CERT_DER;
+use tlsn::{
+    config::{CertificateDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore},
+    connection::ServerName,
+    prover::{ProveConfig, Prover, ProverConfig, TlsConfig},
+    transcript::PartialTranscript,
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
+};
+
+use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
+
+const SECRET: &str = "random_auth_token";
+
+// Maximum number of bytes that can be sent from prover to server.
+const MAX_SENT_DATA: usize = 1 << 12;
+// Maximum number of bytes that can be received by prover from server.
+const MAX_RECV_DATA: usize = 1 << 14;
+
+// The contract address of the EAS contract on Sepolia.
+const EAS_ADDRESS: &str = "0xC2679fBD37d54388Ce493F1DB75320D236e1815e";
+// The chain ID of the Sepolia network.
+const EAS_CHAINID: u64 = 11155111;
+// The schema for the EAS attestation.
+const EAS_SCHEMA: &str = "0x938b5d03b0057688eef86d8101946311c4aaa740ffc39cef9bbfb6ce572a7198";
+
+#[tokio::main]
+async fn main() {
+    tracing_subscriber::fmt::init();
+
+    let rpc_url = env::var("RPC_URL").expect("RPC_URL environment variable must be set");
+    let sk = env::var("EAS_SK").expect("EAS_SK environment variable must be set");
+    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
+    let server_port: u16 = env::var("SERVER_PORT")
+        .map(|port| port.parse().expect("port should be valid integer"))
+        .unwrap_or(DEFAULT_FIXTURE_PORT);
+
+    // We use SERVER_DOMAIN here to make sure it matches the domain in the test
+    // server's certificate.
+    let uri = format!("https://{SERVER_DOMAIN}:{server_port}/formats/html");
+    let server_ip: IpAddr = server_host.parse().expect("Invalid IP address");
+    let server_addr = SocketAddr::from((server_ip, server_port));
+
+    // Connect prover and verifier.
+    let (prover_socket, verifier_socket) = tokio::io::duplex(1 << 23);
+    let prover = prover(prover_socket, &server_addr, &uri);
+    let verifier = verifier(verifier_socket);
+    let (_, transcript) = tokio::join!(prover, verifier);
+
+    println!("Successfully verified {}", &uri);
+    println!(
+        "Verified sent data:\n{}",
+        bytes_to_redacted_string(transcript.sent_unsafe())
+    );
+    println!(
+        "Verified received data:\n{}",
+        bytes_to_redacted_string(transcript.received_unsafe())
+    );
+
+    // Generate EAS attestation
+
+    let signer = sk
+        .parse::<LocalWallet>()
+        .expect("Failed to parse LocalWallet")
+        .with_chain_id(EAS_CHAINID);
+
+    println!("Using EAS signer: {}", signer.address());
+
+    let redacted_string = bytes_to_redacted_string(transcript.received_unsafe());
+    let data = ethers::core::abi::encode(&[ethers::core::abi::Token::String(redacted_string)]);
+    let verifying_contract = Address::from_str(EAS_ADDRESS).expect("Failed to parse EAS address");
+
+    let attestation = eas::OfflineAttestationBuilder {
+        schema: H256::from_str(EAS_SCHEMA).unwrap(),
+        recipient: Address::zero(),
+        time: std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_secs(),
+        expiration_time: Some(0),
+        ref_uid: None,
+        revocable: true,
+        nonce: Some(0),
+        data,
+    }
+    .generate(&signer, verifying_contract)
+    .await
+    .expect("Failed to generate attestation");
+
+    std::fs::write(
+        "eas_attestation.json",
+        serde_json::to_string_pretty(&attestation).unwrap(),
+    )
+    .expect("Failed to write attestation to file");
+
+    println!("EAS Attestation generated and saved to eas_attestation.json");
+
+    // Timestamp the attestation using the EAS contract
+
+    _ = eas::timestamp_attestation(&signer, &rpc_url, &attestation)
+        .await
+        .expect("Failed to timestamp attestation");
+}
+
+#[instrument(skip(verifier_socket))]
+async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
+    verifier_socket: T,
+    server_addr: &SocketAddr,
+    uri: &str,
+) {
+    let uri = uri.parse::<Uri>().unwrap();
+    assert_eq!(uri.scheme().unwrap().as_str(), "https");
+    let server_domain = uri.authority().unwrap().host();
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+    let tls_config = tls_config_builder.build().unwrap();
+
+    // Set up protocol configuration for prover.
+    let mut prover_config_builder = ProverConfig::builder();
+    prover_config_builder
+        .server_name(ServerName::Dns(server_domain.try_into().unwrap()))
+        .tls_config(tls_config)
+        .protocol_config(
+            ProtocolConfig::builder()
+                .max_sent_data(MAX_SENT_DATA)
+                .max_recv_data(MAX_RECV_DATA)
+                .build()
+                .unwrap(),
+        );
+
+    let prover_config = prover_config_builder.build().unwrap();
+
+    // Create prover and connect to verifier.
+    //
+    // Perform the setup phase with the verifier.
+    let prover = Prover::new(prover_config)
+        .setup(verifier_socket.compat())
+        .await
+        .unwrap();
+
+    // Connect to TLS Server.
+    let tls_client_socket = tokio::net::TcpStream::connect(server_addr).await.unwrap();
+
+    // Pass server connection into the prover.
+    let (mpc_tls_connection, prover_fut) =
+        prover.connect(tls_client_socket.compat()).await.unwrap();
+
+    // Wrap the connection in a TokioIo compatibility layer to use it with hyper.
+    let mpc_tls_connection = TokioIo::new(mpc_tls_connection.compat());
+
+    // Spawn the Prover to run in the background.
+    let prover_task = tokio::spawn(prover_fut);
+
+    // MPC-TLS Handshake.
+    let (mut request_sender, connection) =
+        hyper::client::conn::http1::handshake(mpc_tls_connection)
+            .await
+            .unwrap();
+
+    // Spawn the connection to run in the background.
+    tokio::spawn(connection);
+
+    // MPC-TLS: Send Request and wait for Response.
+    let request = Request::builder()
+        .uri(uri.clone())
+        .header("Host", server_domain)
+        .header("Connection", "close")
+        .header("Secret", SECRET)
+        .method("GET")
+        .body(Empty::<Bytes>::new())
+        .unwrap();
+    let response = request_sender.send_request(request).await.unwrap();
+
+    assert!(response.status() == StatusCode::OK);
+
+    // Create proof for the Verifier.
+    let mut prover = prover_task.await.unwrap().unwrap();
+
+    let mut builder = ProveConfig::builder(prover.transcript());
+
+    // Reveal the DNS name.
+    builder.server_identity();
+
+    // Find the secret in the request.
+    let pos = prover
+        .transcript()
+        .sent()
+        .windows(SECRET.len())
+        .position(|w| w == SECRET.as_bytes())
+        .expect("the secret should be in the sent data");
+
+    // Reveal everything except for the secret.
+    builder.reveal_sent(&(0..pos)).unwrap();
+    builder
+        .reveal_sent(&(pos + SECRET.len()..prover.transcript().sent().len()))
+        .unwrap();
+
+    // Find the substring "Dick".
+    let pos = prover
+        .transcript()
+        .received()
+        .windows(4)
+        .position(|w| w == b"Dick")
+        .expect("the substring 'Dick' should be in the received data");
+
+    // Reveal everything except for the substring.
+    builder.reveal_recv(&(0..pos)).unwrap();
+    builder
+        .reveal_recv(&(pos + 4..prover.transcript().received().len()))
+        .unwrap();
+
+    let config = builder.build().unwrap();
+
+    prover.prove(&config).await.unwrap();
+    prover.close().await.unwrap();
+}
+
+#[instrument(skip(socket))]
+async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: T,
+) -> PartialTranscript {
+    // Set up Verifier.
+    let config_validator = ProtocolConfigValidator::builder()
+        .max_sent_data(MAX_SENT_DATA)
+        .max_recv_data(MAX_RECV_DATA)
+        .build()
+        .unwrap();
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let verifier_config = VerifierConfig::builder()
+        .root_store(RootCertStore {
+            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+        })
+        .protocol_config_validator(config_validator)
+        .build()
+        .unwrap();
+    let verifier = Verifier::new(verifier_config);
+
+    // Receive authenticated data.
+    let VerifierOutput {
+        server_name,
+        transcript,
+        ..
+    } = verifier
+        .verify(socket.compat(), &VerifyConfig::default())
+        .await
+        .unwrap();
+
+    let server_name = server_name.expect("prover should have revealed server name");
+    let transcript = transcript.expect("prover should have revealed transcript data");
+
+    // Check sent data.
+    let sent = transcript.sent_unsafe().to_vec();
+    let sent_data = String::from_utf8(sent.clone()).expect("Verifier expected sent data");
+    sent_data
+        .find(SERVER_DOMAIN)
+        .unwrap_or_else(|| panic!("Verification failed: Expected host {SERVER_DOMAIN}"));
+
+    // Check received data.
+    let received = transcript.received_unsafe().to_vec();
+    let response = String::from_utf8(received.clone()).expect("Verifier expected received data");
+    response
+        .find("Herman Melville")
+        .unwrap_or_else(|| panic!("Expected valid data from {SERVER_DOMAIN}"));
+
+    // Check Session info: server name.
+    let ServerName::Dns(server_name) = server_name;
+    assert_eq!(server_name.as_str(), SERVER_DOMAIN);
+
+    transcript
+}
+
+/// Render redacted bytes as `🙈`.
+fn bytes_to_redacted_string(bytes: &[u8]) -> String {
+    String::from_utf8(bytes.to_vec())
+        .unwrap()
+        .replace('\0', "🙈")
+}
+
+mod eas {
+
+    use std::{collections::BTreeMap, str::FromStr};
+
+    use super::*;
+    use ethers::{
+        abi::{Abi, Token},
+        middleware::{
+            gas_escalator::{Frequency, GeometricGasPrice},
+            GasEscalatorMiddleware, MiddlewareBuilder, NonceManagerMiddleware, SignerMiddleware,
+        },
+        providers::{Http, Provider},
+        signers::{Signer, Wallet},
+        types::{
+            transaction::eip712::{EIP712Domain, Eip712DomainType, TypedData},
+            Address, Signature, H256, U256,
+        },
+        utils::{hex, keccak256, to_checksum},
+    };
+    use k256::ecdsa::SigningKey;
+    use rand::RngCore;
+    use serde::{Deserialize, Serialize};
+    use serde_json::{Number, Value};
+
+    // A signed offline attestation, which includes the signature and the signer's
+    // address.
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    pub struct SignedOfflineAttestation {
+        /// The attestation and its signature.
+        pub sig: Sig,
+        /// The address of the signer.
+        pub signer: Address,
+    }
+
+    /// Represents the domain for EIP-712 typed data.
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    pub struct Domain {
+        /// The name of the domain.
+        pub name: String,
+        /// The version of the domain.
+        pub version: String,
+        /// The chain ID of the domain.
+        #[serde(rename = "chainId")]
+        pub chain_id: String,
+        /// The address of the verifying contract.
+        #[serde(rename = "verifyingContract")]
+        pub verifying_contract: String,
+    }
+
+    /// The Signed data and its signature for an offline attestation.
+    #[derive(Debug, Clone, Serialize, Deserialize)]
+    pub struct Sig {
+        /// The version of the attestation.
+        pub version: u16,
+        /// The uid of the attestation, which is a hash of the attestation data.
+        pub uid: String,
+
+        /// The domain of the attestation.
+        pub domain: Domain,
+        #[serde(rename = "primaryType")]
+        /// The primary type of the attestation.
+        pub primary_type: String,
+        /// The types that the attestation manages, which is a map of type names
+        /// to their definitions.
+        pub types: BTreeMap<String, Vec<Eip712DomainType>>,
+        /// The message of the attestation, which is a map of field names to
+        /// their values.
+        pub message: BTreeMap<String, Value>,
+
+        /// The secp256k1 signature of the attestation.
+        pub signature: Signature,
+    }
+
+    /// Information to build an offline attestation.
+    #[derive(Debug, Clone)]
+    pub struct OfflineAttestationBuilder {
+        pub schema: H256,
+        pub recipient: Address,
+        pub time: u64,
+        pub expiration_time: Option<u64>,
+        pub ref_uid: Option<H256>,
+        pub revocable: bool,
+        pub nonce: Option<u64>,
+        pub data: Vec<u8>,
+    }
+
+    impl OfflineAttestationBuilder {
+        /// Create and sign and offline attestation, returning a
+        /// `SignedOfflineAttestation`.
+        pub async fn generate<S: Signer>(
+            &self,
+            signer: &S,
+            verifying_contract: Address,
+        ) -> Result<SignedOfflineAttestation, <S as Signer>::Error> {
+            let expiration_time = self.expiration_time.unwrap_or(0);
+
+            let mut salt = [0u8; 32];
+            rand::rng().fill_bytes(&mut salt);
+
+            // the domain for the EIP-712 typed data.
+
+            let domain = EIP712Domain {
+                name: Some("EAS Attestation".to_string()),
+                version: Some("0.26".to_string()),
+                chain_id: Some(U256::from(signer.chain_id())),
+                verifying_contract: Some(verifying_contract),
+                salt: None,
+            };
+
+            // the typed data for the EIP-712 signature.
+
+            let typed_data = TypedData {
+                domain,
+                primary_type: "Attest".to_string(),
+                types: BTreeMap::from([(
+                    "Attest".to_string(),
+                    vec![
+                        domtype("version", "uint16"),
+                        domtype("schema", "bytes32"),
+                        domtype("recipient", "address"),
+                        domtype("time", "uint64"),
+                        domtype("expirationTime", "uint64"),
+                        domtype("revocable", "bool"),
+                        domtype("refUID", "bytes32"),
+                        domtype("data", "bytes"),
+                        domtype("salt", "bytes32"),
+                    ],
+                )]),
+                message: BTreeMap::from([
+                    ("version".to_string(), Value::Number(Number::from(2))),
+                    (
+                        "schema".to_string(),
+                        Value::String(format!("0x{}", hex::encode(self.schema))),
+                    ),
+                    (
+                        "recipient".to_string(),
+                        Value::String(format!("{:#x}", self.recipient)),
+                    ),
+                    ("time".to_string(), Value::String(self.time.to_string())),
+                    (
+                        "expirationTime".to_string(),
+                        Value::String(expiration_time.to_string()),
+                    ),
+                    (
+                        "refUID".to_string(),
+                        Value::String(format!(
+                            "0x{}",
+                            hex::encode(self.ref_uid.unwrap_or_default())
+                        )),
+                    ),
+                    ("revocable".to_string(), Value::Bool(self.revocable)),
+                    (
+                        "data".to_string(),
+                        Value::String(format!("0x{}", hex::encode(&self.data))),
+                    ),
+                    (
+                        "nonce".to_string(),
+                        Value::Number(Number::from(self.nonce.unwrap_or(0))),
+                    ),
+                    (
+                        "salt".to_string(),
+                        Value::String(format!("0x{}", hex::encode(salt))),
+                    ),
+                ]),
+            };
+
+            // the unique identifier (uid) for the attestation, which is a hash of the ABI
+            // encoded data.
+
+            let uid = {
+                let tokens = vec![
+                    Token::FixedBytes(2u16.to_be_bytes().to_vec()),
+                    Token::Bytes(format!("0x{}", hex::encode(self.schema)).into_bytes()),
+                    Token::Address(self.recipient),
+                    Token::Address(Address::zero()),
+                    Token::FixedBytes(self.time.to_be_bytes().to_vec()),
+                    Token::FixedBytes(expiration_time.to_be_bytes().to_vec()),
+                    Token::Bool(self.revocable),
+                    Token::FixedBytes(self.ref_uid.unwrap_or_default().0.to_vec()),
+                    Token::Bytes(self.data.clone()),
+                    Token::FixedBytes(salt.to_vec()),
+                    Token::FixedBytes(0u32.to_be_bytes().to_vec()),
+                ];
+
+                let encoded = ethers::core::abi::encode_packed(&tokens).unwrap();
+                keccak256(encoded)
+            };
+
+            // Sign the typed data using the signer's private key.
+            let signature = signer.sign_typed_data(&typed_data).await?;
+
+            // generate the signed offline attestation.
+            let offline_attestation = SignedOfflineAttestation {
+                sig: Sig {
+                    version: 2,
+                    uid: format!("0x{}", hex::encode(uid)),
+                    domain: Domain {
+                        name: typed_data.domain.name.unwrap(),
+                        version: typed_data.domain.version.unwrap().to_string(),
+                        chain_id: typed_data.domain.chain_id.unwrap().to_string(),
+                        verifying_contract: to_checksum(
+                            &typed_data.domain.verifying_contract.unwrap(),
+                            None,
+                        ),
+                    },
+                    primary_type: typed_data.primary_type,
+                    types: typed_data.r#types,
+                    message: typed_data.message,
+                    signature,
+                },
+                signer: signer.address(),
+            };
+
+            Ok(offline_attestation)
+        }
+    }
+
+    fn domtype(name: &str, type_name: &str) -> Eip712DomainType {
+        Eip712DomainType {
+            name: name.to_string(),
+            r#type: type_name.to_string(),
+        }
+    }
+
+    /// Timestamps an offline attestation by sending a transaction to the EAS
+    /// contract.
+    pub async fn timestamp_attestation(
+        signer: &Wallet<SigningKey>,
+        rpc_url: &str,
+        attestation: &SignedOfflineAttestation,
+    ) -> Result<H256, eyre::ErrReport> {
+        // Set up signer
+
+        let signer_address = signer.address();
+        let escalator = GeometricGasPrice::new(1.125, 60_u64, None::<u64>);
+        let provider = Provider::<Http>::try_from(rpc_url)?
+            .wrap_into(|p| GasEscalatorMiddleware::new(p, escalator, Frequency::PerBlock))
+            .wrap_into(|p| SignerMiddleware::new(p, signer.clone()))
+            .wrap_into(|p| NonceManagerMiddleware::new(p, signer_address)); // Outermost layer
+
+        // Read ABI and create contract instance
+
+        let abi: Abi = serde_json::from_str(include_str!("eas.abi"))?;
+        let contract = ethers::contract::Contract::new(
+            EAS_ADDRESS.parse::<Address>().unwrap(),
+            abi,
+            provider.into(),
+        );
+
+        // Call Timestamp(bytes32 uid) method
+
+        let uid =
+            H256::from_str(&attestation.sig.uid).map_err(|_| eyre::eyre!("Invalid UID format"))?;
+
+        let method = contract.method::<_, H256>("timestamp", uid)?;
+        let pending_tx = method.send().await?;
+
+        // Wait for transaction confirmation
+
+        println!("EAS Timestamping attestation: {:?}", pending_tx);
+
+        let receipt = pending_tx
+            .confirmations(1)
+            .await?
+            .ok_or_else(|| eyre::eyre!("Transaction receipt not found"))?;
+
+        println!(
+            "EAS Attestation timestamped: {:?}",
+            receipt.transaction_hash
+        );
+
+        Ok(receipt.transaction_hash)
+    }
+}

crates/examples/interactive/interactive.rs

@@ -3,7 +3,6 @@ use std::{
     net::{IpAddr, SocketAddr},
 };
 
-use anyhow::Result;
 use http_body_util::Empty;
 use hyper::{body::Bytes, Request, StatusCode, Uri};
 use hyper_util::rt::TokioIo;
@@ -11,22 +10,16 @@ use tokio::io::{AsyncRead, AsyncWrite};
 use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
 use tracing::instrument;
 
+use tls_server_fixture::CA_CERT_DER;
 use tlsn::{
-    config::{
-        prove::ProveConfig,
-        prover::ProverConfig,
-        tls::TlsClientConfig,
-        tls_commit::{mpc::MpcTlsConfig, TlsCommitConfig, TlsCommitProtocolConfig},
-        verifier::VerifierConfig,
-    },
+    config::{CertificateDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore},
     connection::ServerName,
-    prover::Prover,
+    prover::{ProveConfig, Prover, ProverConfig, TlsConfig},
     transcript::PartialTranscript,
-    verifier::{Verifier, VerifierOutput},
-    webpki::{CertificateDer, RootCertStore},
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
 };
 use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
-use tlsn_server_fixture_certs::{CA_CERT_DER, SERVER_DOMAIN};
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
 
 const SECRET: &str = "TLSNotary's private key 🤡";
 
@@ -54,7 +47,7 @@ async fn main() {
     let (prover_socket, verifier_socket) = tokio::io::duplex(1 << 23);
     let prover = prover(prover_socket, &server_addr, &uri);
     let verifier = verifier(verifier_socket);
-    let (_, transcript) = tokio::try_join!(prover, verifier).unwrap();
+    let (_, transcript) = tokio::join!(prover, verifier);
 
     println!("Successfully verified {}", &uri);
     println!(
@@ -72,57 +65,61 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
     verifier_socket: T,
     server_addr: &SocketAddr,
     uri: &str,
-) -> Result<()> {
+) {
     let uri = uri.parse::<Uri>().unwrap();
     assert_eq!(uri.scheme().unwrap().as_str(), "https");
     let server_domain = uri.authority().unwrap().host();
 
-    // Create a new prover and perform necessary setup.
-    let prover = Prover::new(ProverConfig::builder().build()?)
-        .commit(
-            TlsCommitConfig::builder()
-                // Select the TLS commitment protocol.
-                .protocol(
-                    MpcTlsConfig::builder()
-                        // We must configure the amount of data we expect to exchange beforehand,
-                        // which will be preprocessed prior to the
-                        // connection. Reducing these limits will improve
-                        // performance.
-                        .max_sent_data(tlsn_examples::MAX_SENT_DATA)
-                        .max_recv_data(tlsn_examples::MAX_RECV_DATA)
-                        .build()?,
-                )
-                .build()?,
-            verifier_socket.compat(),
-        )
-        .await?;
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+    let tls_config = tls_config_builder.build().unwrap();
 
-    // Open a TCP connection to the server.
-    let client_socket = tokio::net::TcpStream::connect(server_addr).await?;
+    // Set up protocol configuration for prover.
+    let mut prover_config_builder = ProverConfig::builder();
+    prover_config_builder
+        .server_name(ServerName::Dns(server_domain.try_into().unwrap()))
+        .tls_config(tls_config)
+        .protocol_config(
+            ProtocolConfig::builder()
+                .max_sent_data(MAX_SENT_DATA)
+                .max_recv_data(MAX_RECV_DATA)
+                .build()
+                .unwrap(),
+        );
 
-    // Bind the prover to the server connection.
-    let (tls_connection, prover_fut) = prover
-        .connect(
-            TlsClientConfig::builder()
-                .server_name(ServerName::Dns(SERVER_DOMAIN.try_into()?))
-                // Create a root certificate store with the server-fixture's self-signed
-                // certificate. This is only required for offline testing with the
-                // server-fixture.
-                .root_store(RootCertStore {
-                    roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-                })
-                .build()?,
-            client_socket.compat(),
-        )
-        .await?;
-    let tls_connection = TokioIo::new(tls_connection.compat());
+    let prover_config = prover_config_builder.build().unwrap();
+
+    // Create prover and connect to verifier.
+    //
+    // Perform the setup phase with the verifier.
+    let prover = Prover::new(prover_config)
+        .setup(verifier_socket.compat())
+        .await
+        .unwrap();
+
+    // Connect to TLS Server.
+    let tls_client_socket = tokio::net::TcpStream::connect(server_addr).await.unwrap();
+
+    // Pass server connection into the prover.
+    let (mpc_tls_connection, prover_fut) =
+        prover.connect(tls_client_socket.compat()).await.unwrap();
+
+    // Wrap the connection in a TokioIo compatibility layer to use it with hyper.
+    let mpc_tls_connection = TokioIo::new(mpc_tls_connection.compat());
 
     // Spawn the Prover to run in the background.
     let prover_task = tokio::spawn(prover_fut);
 
     // MPC-TLS Handshake.
     let (mut request_sender, connection) =
-        hyper::client::conn::http1::handshake(tls_connection).await?;
+        hyper::client::conn::http1::handshake(mpc_tls_connection)
+            .await
+            .unwrap();
 
     // Spawn the connection to run in the background.
     tokio::spawn(connection);
@@ -134,13 +131,14 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
         .header("Connection", "close")
         .header("Secret", SECRET)
         .method("GET")
-        .body(Empty::<Bytes>::new())?;
-    let response = request_sender.send_request(request).await?;
+        .body(Empty::<Bytes>::new())
+        .unwrap();
+    let response = request_sender.send_request(request).await.unwrap();
 
     assert!(response.status() == StatusCode::OK);
 
     // Create proof for the Verifier.
-    let mut prover = prover_task.await??;
+    let mut prover = prover_task.await.unwrap().unwrap();
 
     let mut builder = ProveConfig::builder(prover.transcript());
 
@@ -156,8 +154,10 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
         .expect("the secret should be in the sent data");
 
     // Reveal everything except for the secret.
-    builder.reveal_sent(&(0..pos))?;
-    builder.reveal_sent(&(pos + SECRET.len()..prover.transcript().sent().len()))?;
+    builder.reveal_sent(&(0..pos)).unwrap();
+    builder
+        .reveal_sent(&(pos + SECRET.len()..prover.transcript().sent().len()))
+        .unwrap();
 
     // Find the substring "Dick".
     let pos = prover
@@ -168,21 +168,28 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
         .expect("the substring 'Dick' should be in the received data");
 
     // Reveal everything except for the substring.
-    builder.reveal_recv(&(0..pos))?;
-    builder.reveal_recv(&(pos + 4..prover.transcript().received().len()))?;
+    builder.reveal_recv(&(0..pos)).unwrap();
+    builder
+        .reveal_recv(&(pos + 4..prover.transcript().received().len()))
+        .unwrap();
 
-    let config = builder.build()?;
+    let config = builder.build().unwrap();
 
-    prover.prove(&config).await?;
-    prover.close().await?;
-
-    Ok(())
+    prover.prove(&config).await.unwrap();
+    prover.close().await.unwrap();
 }
 
 #[instrument(skip(socket))]
 async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
     socket: T,
-) -> Result<PartialTranscript> {
+) -> PartialTranscript {
+    // Set up Verifier.
+    let config_validator = ProtocolConfigValidator::builder()
+        .max_sent_data(MAX_SENT_DATA)
+        .max_recv_data(MAX_RECV_DATA)
+        .build()
+        .unwrap();
+
     // Create a root certificate store with the server-fixture's self-signed
     // certificate. This is only required for offline testing with the
     // server-fixture.
@@ -190,56 +197,20 @@ async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
         .root_store(RootCertStore {
             roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
         })
-        .build()?;
+        .protocol_config_validator(config_validator)
+        .build()
+        .unwrap();
     let verifier = Verifier::new(verifier_config);
 
-    // Validate the proposed configuration and then run the TLS commitment protocol.
-    let verifier = verifier.commit(socket.compat()).await?;
-
-    // This is the opportunity to ensure the prover does not attempt to overload the
-    // verifier.
-    let reject = if let TlsCommitProtocolConfig::Mpc(mpc_tls_config) = verifier.request().protocol()
-    {
-        if mpc_tls_config.max_sent_data() > MAX_SENT_DATA {
-            Some("max_sent_data is too large")
-        } else if mpc_tls_config.max_recv_data() > MAX_RECV_DATA {
-            Some("max_recv_data is too large")
-        } else {
-            None
-        }
-    } else {
-        Some("expecting to use MPC-TLS")
-    };
-
-    if reject.is_some() {
-        verifier.reject(reject).await?;
-        return Err(anyhow::anyhow!("protocol configuration rejected"));
-    }
-
-    // Runs the TLS commitment protocol to completion.
-    let verifier = verifier.accept().await?.run().await?;
-
-    // Validate the proving request and then verify.
-    let verifier = verifier.verify().await?;
-
-    if !verifier.request().server_identity() {
-        let verifier = verifier
-            .reject(Some("expecting to verify the server name"))
-            .await?;
-        verifier.close().await?;
-        return Err(anyhow::anyhow!("prover did not reveal the server name"));
-    }
-
-    let (
-        VerifierOutput {
-            server_name,
-            transcript,
-            ..
-        },
-        verifier,
-    ) = verifier.accept().await?;
-
-    verifier.close().await?;
+    // Receive authenticated data.
+    let VerifierOutput {
+        server_name,
+        transcript,
+        ..
+    } = verifier
+        .verify(socket.compat(), &VerifyConfig::default())
+        .await
+        .unwrap();
 
     let server_name = server_name.expect("prover should have revealed server name");
     let transcript = transcript.expect("prover should have revealed transcript data");
@@ -262,7 +233,7 @@ async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
     let ServerName::Dns(server_name) = server_name;
     assert_eq!(server_name.as_str(), SERVER_DOMAIN);
 
-    Ok(transcript)
+    transcript
 }
 
 /// Render redacted bytes as `🙈`.

crates/examples/interactive_zk/.gitignore

@@ -1,5 +0,0 @@
-!noir/target/
-# Ignore everything inside noir/target
-noir/target/*
-# Except noir.json
-!noir/target/noir.json

crates/examples/interactive_zk/README.md

@@ -1,167 +0,0 @@
-# Interactive Zero-Knowledge Age Verification with TLSNotary
-
-This example demonstrates **privacy-preserving age verification** using TLSNotary and zero-knowledge proofs. It allows a prover to demonstrate they are 18+ years old without revealing their actual birth date or any other personal information.
-
-## 🔍 How It Works (simplified overview)
-
-```mermaid
-sequenceDiagram
-    participant S as Tax Server<br/>(fixture)
-    participant P as Prover
-    participant V as Verifier
-
-    P->>S: Request tax data (with auth token) (MPC-TLS)
-    S->>P: Tax data including `date_of_birth` (MPC-TLS)
-    P->>V: Share transcript with redactions
-    P->>V: Commit to blinded hash of birth date
-    P->>P: Generate ZK proof of age ≥ 18
-    P->>V: Send ZK proof
-    V->>V: Verify transcript & ZK proof
-    V->>V: ✅ Confirm: Prover is 18+ (no birth date revealed)
-```
-
-### The Process
-
-1. **MPC-TLS Session**: The Prover fetches tax information containing their birth date, while the Verifier jointly verifies the TLS session to ensure the data comes from the authentic server.
-2. **Selective Disclosure**:
-   * The authorization token is **redacted**: the Verifier sees the plaintext request but not the token.
-   * The birth date is **committed** as a blinded hash: the Verifier cannot see the date, but the Prover is cryptographically bound to it.  
-   (Depending on the use case more data can be redacted or revealed)
-3. **Zero-Knowledge Proof**: The Prover generates a ZK proof that the committed birth date corresponds to an age ≥ 18.
-4. **Verification**: The Verifier checks both the TLS transcript and the ZK proof, confirming age ≥ 18 without learning the actual date of birth.
-
-
-### Example Data
-
-The tax server returns data like this:
-```json
-{
-    "tax_year": 2024,
-    "taxpayer": {
-        "idnr": "12345678901",
-        "first_name": "Max",
-        "last_name": "Mustermann",
-        "date_of_birth": "1985-03-12",
-        // ...
-    }
-}
-```
-
-## 🔐 Zero-Knowledge Proof Details
-
-The ZK circuit proves: **"I know a birth date that hashes to the committed value AND indicates I am 18+ years old"**
-
-**Public Inputs:**
-- ✅ Verification date
-- ✅ Committed blinded hash of birth date
-
-**Private Inputs (Hidden):**
-- 🔒 Actual birth date plaintext
-- 🔒 Random blinder used in hash commitment
-
-**What the Verifier Learns:**
-- ✅ The prover is 18+ years old
-- ✅ The birth date is authentic (from the MPC-TLS session)
-
-Everything else remains private.
-
-## 🏃 Run the Example
-
-1. **Start the test server** (from repository root):
-   ```bash
-   RUST_LOG=info PORT=4000 cargo run --bin tlsn-server-fixture
-   ```
-
-2. **Run the age verification** (in a new terminal):
-   ```bash
-   SERVER_PORT=4000 cargo run --release --example interactive_zk
-   ```
-
-3. **For detailed logs**:
-   ```bash
-   RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example interactive_zk
-   ```
-
-### Expected Output
-
-```
-Successfully verified https://test-server.io:4000/elster
-Age verified in ZK: 18+ ✅
-
-Verified sent data:
-GET https://test-server.io:4000/elster HTTP/1.1
-host: test-server.io
-connection: close
-authorization: 🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈
-
-Verified received data:
-🙈🙈🙈🙈🙈🙈🙈🙈[truncated for brevity]...🙈🙈🙈🙈🙈"tax_year":2024🙈🙈🙈🙈🙈...
-```
-
-> 💡 **Note**: In this demo, both Prover and Verifier run on the same machine. In production, they would operate on separate systems.
-> 💡 **Note**: This demo assumes that the tax server serves correct data, and that only the submitter of the tax data has access to the specified page.
-
-## 🛠 Development
-
-### Project Structure
-
-```
-interactive_zk/
-├── prover.rs                   # Prover implementation
-├── verifier.rs                 # Verifier implementation  
-├── types.rs                    # Shared types
-└── interactive_zk.rs           # Main example runner
-├── noir/                       # Zero-knowledge circuit
-│   ├── src/main.n              # Noir circuit code
-│   ├── target/                 # Compiled circuit artifacts
-│   └── Nargo.toml              # Noir project config
-│   └── Prover.toml             # Example input for `nargo execute`
-│   └── generate_test_data.rs   # Rust script to generate Noir test data
-└── README.md
-```
-
-### Noir Circuit Commands
-
-We use [Mopro's `noir_rs`](https://zkmopro.org/docs/crates/noir-rs/) for ZK proof generation.  The **circuit is pre-compiled and ready to use**. You don't need to install Noir tools to run the example. But if you want to change or test the circuit in isolation, you can use the following instructions.
-
-Before you proceed, we recommend to double check that your Noir tooling matches the versions used in Mopro's `noir_rs`:
-```sh
-# Install correct Noir and BB versions (important for compatibility!)
-noirup --version 1.0.0-beta.8
-bbup -v 1.0.0-nightly.20250723
-```
-
-If you don't have `noirup` and `bbup` installed yet, check [Noir's Quick Start](https://noir-lang.org/docs/getting_started/quick_start).
-
-To compile the circuit, go to the `noir` folder and run `nargo compile`.
-
-To check and experiment with the Noir circuit, you can use these commands:
-
-* Execute Circuit: Compile the circuit and run it with sample data from `Prover.toml`:
-    ```sh
-    nargo execute
-    ```
-* Generate Verification Key: Create the verification key needed to verify proofs
-    ```sh
-    bb write_vk -b ./target/noir.json -o ./target
-    ```
-* Generate Proof: Create a zero-knowledge proof using the circuit and witness data.
-    ```sh
-    bb prove --bytecode_path ./target/noir.json --witness_path ./target/noir.gz -o ./target
-    ```
-* Verify Proof: Verify that a proof is valid using the verification key.
-    ```sh
-    bb verify -k ./target/vk -p ./target/proof
-    ```
-* Run the Noir tests:
-    ```sh
-    nargo test --show-output
-    ```
-  To create extra tests, you can use `./generate_test_data.rs` to help with generating correct blinders and hashes.
-
-## 📚 Learn More
-
-- [TLSNotary Documentation](https://docs.tlsnotary.org/)
-- [Noir Language Guide](https://noir-lang.org/)
-- [Zero-Knowledge Proofs Explained](https://ethereum.org/en/zero-knowledge-proofs/)
-- [Mopro ZK Toolkit](https://zkmopro.org/)

crates/examples/interactive_zk/interactive_zk.rs

@@ -1,60 +0,0 @@
-mod prover;
-mod types;
-mod verifier;
-
-use anyhow::Result;
-use prover::prover;
-use std::{
-    env,
-    net::{IpAddr, SocketAddr},
-};
-use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
-use tlsn_server_fixture_certs::SERVER_DOMAIN;
-use verifier::verifier;
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    tracing_subscriber::fmt::init();
-
-    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
-    let server_port: u16 = env::var("SERVER_PORT")
-        .map(|port| port.parse().expect("port should be valid integer"))
-        .unwrap_or(DEFAULT_FIXTURE_PORT);
-
-    // We use SERVER_DOMAIN here to make sure it matches the domain in the test
-    // server's certificate.
-    let uri = format!("https://{SERVER_DOMAIN}:{server_port}/elster");
-    let server_ip: IpAddr = server_host
-        .parse()
-        .map_err(|e| anyhow::anyhow!("Invalid IP address '{server_host}': {e}"))?;
-    let server_addr = SocketAddr::from((server_ip, server_port));
-
-    // Connect prover and verifier.
-    let (prover_socket, verifier_socket) = tokio::io::duplex(1 << 23);
-    let (prover_extra_socket, verifier_extra_socket) = tokio::io::duplex(1 << 23);
-
-    let (_, transcript) = tokio::try_join!(
-        prover(prover_socket, prover_extra_socket, &server_addr, &uri),
-        verifier(verifier_socket, verifier_extra_socket)
-    )?;
-
-    println!("---");
-    println!("Successfully verified {}", &uri);
-    println!("Age verified in ZK: 18+ ✅\n");
-
-    println!(
-        "Verified sent data:\n{}",
-        bytes_to_redacted_string(transcript.sent_unsafe())
-    );
-    println!(
-        "Verified received data:\n{}",
-        bytes_to_redacted_string(transcript.received_unsafe())
-    );
-
-    Ok(())
-}
-
-/// Render redacted bytes as `🙈`.
-pub fn bytes_to_redacted_string(bytes: &[u8]) -> String {
-    String::from_utf8_lossy(bytes).replace('\0', "🙈")
-}

crates/examples/interactive_zk/noir/Nargo.toml

@@ -1,8 +0,0 @@
-[package]
-name = "noir"
-type = "bin"
-authors = [""]
-
-[dependencies]
-sha256 = { tag = "v0.1.5", git = "https://github.com/noir-lang/sha256" }
-date = { tag = "v0.5.4", git = "https://github.com/madztheo/noir-date.git" }

crates/examples/interactive_zk/noir/Prover.toml

@@ -1,8 +0,0 @@
-blinder = [108, 93, 120, 205, 15, 35, 159, 124, 243, 96, 22, 128, 16, 149, 219, 216]
-committed_hash = [186, 158, 101, 39, 49, 48, 26, 83, 242, 96, 10, 221, 121, 174, 62, 50, 136, 132, 232, 58, 25, 32, 66, 196, 99, 85, 66, 85, 255, 1, 202, 254]
-date_of_birth = "1985-03-12"
-
-[proof_date]
-day = "29"
-month = "08"
-year = "2025"

crates/examples/interactive_zk/noir/generate_test_data.rs

@@ -1,64 +0,0 @@
-#!/usr/bin/env -S cargo +nightly -Zscript
----
-[package]
-name = "generate_test_data"
-version = "0.0.0"
-edition = "2021"
-publish = false
-
-[dependencies]
-sha2 = "0.10"
-rand = "0.8"
-chrono = "0.4"
----
-use chrono::Datelike;
-use chrono::Local;
-use rand::RngCore;
-use sha2::{Digest, Sha256};
-
-fn main() {
-    // 1. Birthdate string (fixed)
-    let dob_str = "1985-03-12"; // 10 bytes long
-
-    let proof_date = Local::now().date_naive();
-    let proof_year = proof_date.year();
-    let proof_month = proof_date.month();
-    let proof_day = proof_date.day();
-
-    // 2. Generate random 16-byte blinder
-    let mut blinder = [0u8; 16];
-    rand::thread_rng().fill_bytes(&mut blinder);
-
-    // 3. Concatenate blinder + dob string bytes
-    let mut preimage = Vec::with_capacity(26);
-    preimage.extend_from_slice(dob_str.as_bytes());
-    preimage.extend_from_slice(&blinder);
-
-    // 4. Hash it
-    let hash = Sha256::digest(&preimage);
-
-    let blinder = blinder
-        .iter()
-        .map(|b| b.to_string())
-        .collect::<Vec<_>>()
-        .join(", ");
-    let committed_hash = hash
-        .iter()
-        .map(|b| b.to_string())
-        .collect::<Vec<_>>()
-        .join(", ");
-
-    println!(
-        "
-// Private input
-let date_of_birth = \"{dob_str}\";
-let blinder = [{blinder}];
-
-// Public input
-let proof_date = date::Date {{ year: {proof_year}, month: {proof_month}, day: {proof_day} }};
-let committed_hash = [{committed_hash}];
-
-main(proof_date, committed_hash, date_of_birth, blinder);
-"
-    );
-}

crates/examples/interactive_zk/noir/src/main.nr

@@ -1,82 +0,0 @@
-use dep::date::Date;
-
-fn main(
-    // Public inputs
-    proof_date: pub date::Date, // "2025-08-29"
-    committed_hash: pub [u8; 32], // Hash of (blinder || dob string)
-    // Private inputs
-    date_of_birth: str<10>, // "1985-03-12"
-    blinder: [u8; 16], // Random 16-byte blinder
-) {
-    let is_18 = check_18(date_of_birth, proof_date);
-
-    let correct_hash = check_hash(date_of_birth, blinder, committed_hash);
-
-    assert(correct_hash);
-    assert(is_18);
-}
-
-fn check_18(date_of_birth: str<10>, proof_date: date::Date) -> bool {
-    let dob = parse_birth_date(date_of_birth);
-    let is_18 = dob.add_years(18).lt(proof_date);
-    println(f"Is 18? {is_18}");
-    is_18
-}
-
-fn check_hash(date_of_birth: str<10>, blinder: [u8; 16], committed_hash: [u8; 32]) -> bool {
-    let hash_input: [u8; 26] = make_hash_input(date_of_birth, blinder);
-    let computed_hash = sha256::sha256_var(hash_input, 26);
-    let correct_hash = computed_hash == committed_hash;
-    println(f"Correct hash? {correct_hash}");
-    correct_hash
-}
-
-fn make_hash_input(dob: str<10>, blinder: [u8; 16]) -> [u8; 26] {
-    let mut input: [u8; 26] = [0; 26];
-    for i in 0..10 {
-        input[i] = dob.as_bytes()[i];
-    }
-    for i in 0..16 {
-        input[10 + i] = blinder[i];
-    }
-    input
-}
-
-pub fn parse_birth_date(birth_date: str<10>) -> date::Date {
-    let date: [u8; 10] = birth_date.as_bytes();
-    let date_str: str<8> =
-        [date[0], date[1], date[2], date[3], date[5], date[6], date[8], date[9]].as_str_unchecked();
-    Date::from_str_long_year(date_str)
-}
-
-#[test]
-fn test_max_is_over_18() {
-    // Private input
-    let date_of_birth = "1985-03-12";
-    let blinder = [120, 80, 62, 10, 76, 60, 130, 98, 147, 161, 139, 126, 27, 236, 36, 56];
-
-    // Public input
-    let proof_date = date::Date { year: 2025, month: 9, day: 2 };
-    let committed_hash = [
-        229, 118, 202, 216, 213, 230, 125, 163, 48, 178, 118, 225, 84, 7, 140, 63, 173, 255, 163,
-        208, 163, 3, 63, 204, 37, 120, 254, 246, 202, 116, 122, 145,
-    ];
-
-    main(proof_date, committed_hash, date_of_birth, blinder);
-}
-
-#[test(should_fail)]
-fn test_under_18() {
-    // Private input
-    let date_of_birth = "2010-08-01";
-    let blinder = [160, 23, 57, 158, 141, 195, 155, 132, 109, 242, 48, 220, 70, 217, 229, 189];
-
-    // Public input
-    let proof_date = date::Date { year: 2025, month: 8, day: 29 };
-    let committed_hash = [
-        16, 132, 194, 62, 232, 90, 157, 153, 4, 231, 1, 54, 226, 3, 87, 174, 129, 177, 80, 69, 37,
-        222, 209, 91, 168, 156, 9, 109, 108, 144, 168, 109,
-    ];
-
-    main(proof_date, committed_hash, date_of_birth, blinder);
-}

crates/examples/interactive_zk/prover.rs

@@ -1,390 +0,0 @@
-use std::net::SocketAddr;
-
-use crate::types::received_commitments;
-
-use super::types::ZKProofBundle;
-
-use anyhow::Result;
-use chrono::{Datelike, Local, NaiveDate};
-use http_body_util::Empty;
-use hyper::{body::Bytes, header, Request, StatusCode, Uri};
-use hyper_util::rt::TokioIo;
-use k256::sha2::{Digest, Sha256};
-use noir::{
-    barretenberg::{
-        prove::prove_ultra_honk, srs::setup_srs_from_bytecode,
-        verify::get_ultra_honk_verification_key,
-    },
-    witness::from_vec_str_to_witness_map,
-};
-use serde_json::Value;
-use spansy::{
-    http::{BodyContent, Requests, Responses},
-    Spanned,
-};
-use tls_server_fixture::{CA_CERT_DER, SERVER_DOMAIN};
-use tlsn::{
-    config::{
-        prove::{ProveConfig, ProveConfigBuilder},
-        prover::ProverConfig,
-        tls::TlsClientConfig,
-        tls_commit::{mpc::MpcTlsConfig, TlsCommitConfig},
-    },
-    connection::ServerName,
-    hash::HashAlgId,
-    prover::Prover,
-    transcript::{
-        hash::{PlaintextHash, PlaintextHashSecret},
-        Direction, TranscriptCommitConfig, TranscriptCommitConfigBuilder, TranscriptCommitmentKind,
-        TranscriptSecret,
-    },
-    webpki::{CertificateDer, RootCertStore},
-};
-
-use tlsn_examples::{MAX_RECV_DATA, MAX_SENT_DATA};
-use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
-use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
-use tracing::instrument;
-
-#[instrument(skip(verifier_socket, verifier_extra_socket))]
-pub async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
-    verifier_socket: T,
-    mut verifier_extra_socket: T,
-    server_addr: &SocketAddr,
-    uri: &str,
-) -> Result<()> {
-    let uri = uri.parse::<Uri>()?;
-
-    if uri.scheme().map(|s| s.as_str()) != Some("https") {
-        return Err(anyhow::anyhow!("URI must use HTTPS scheme"));
-    }
-
-    let server_domain = uri
-        .authority()
-        .ok_or_else(|| anyhow::anyhow!("URI must have authority"))?
-        .host();
-
-    // Create a new prover and perform necessary setup.
-    let prover = Prover::new(ProverConfig::builder().build()?)
-        .commit(
-            TlsCommitConfig::builder()
-                // Select the TLS commitment protocol.
-                .protocol(
-                    MpcTlsConfig::builder()
-                        // We must configure the amount of data we expect to exchange beforehand,
-                        // which will be preprocessed prior to the
-                        // connection. Reducing these limits will improve
-                        // performance.
-                        .max_sent_data(MAX_SENT_DATA)
-                        .max_recv_data(MAX_RECV_DATA)
-                        .build()?,
-                )
-                .build()?,
-            verifier_socket.compat(),
-        )
-        .await?;
-
-    // Open a TCP connection to the server.
-    let client_socket = tokio::net::TcpStream::connect(server_addr).await?;
-
-    // Bind the prover to the server connection.
-    let (tls_connection, prover_fut) = prover
-        .connect(
-            TlsClientConfig::builder()
-                .server_name(ServerName::Dns(SERVER_DOMAIN.try_into()?))
-                // Create a root certificate store with the server-fixture's self-signed
-                // certificate. This is only required for offline testing with the
-                // server-fixture.
-                .root_store(RootCertStore {
-                    roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-                })
-                .build()?,
-            client_socket.compat(),
-        )
-        .await?;
-    let tls_connection = TokioIo::new(tls_connection.compat());
-
-    // Spawn the Prover to run in the background.
-    let prover_task = tokio::spawn(prover_fut);
-
-    // MPC-TLS Handshake.
-    let (mut request_sender, connection) =
-        hyper::client::conn::http1::handshake(tls_connection).await?;
-
-    // Spawn the connection to run in the background.
-    tokio::spawn(connection);
-
-    // MPC-TLS: Send Request and wait for Response.
-    let request = Request::builder()
-        .uri(uri.clone())
-        .header("Host", server_domain)
-        .header("Connection", "close")
-        .header(header::AUTHORIZATION, "Bearer random_auth_token")
-        .method("GET")
-        .body(Empty::<Bytes>::new())?;
-
-    let response = request_sender.send_request(request).await?;
-
-    if response.status() != StatusCode::OK {
-        return Err(anyhow::anyhow!(
-            "MPC-TLS request failed with status {}",
-            response.status()
-        ));
-    }
-
-    // Create proof for the Verifier.
-    let mut prover = prover_task.await??;
-
-    let transcript = prover.transcript().clone();
-    let mut prove_config_builder = ProveConfig::builder(&transcript);
-
-    // Reveal the DNS name.
-    prove_config_builder.server_identity();
-
-    let sent: &[u8] = transcript.sent();
-    let received: &[u8] = transcript.received();
-    let sent_len = sent.len();
-    let recv_len = received.len();
-    tracing::info!("Sent length: {}, Received length: {}", sent_len, recv_len);
-
-    // Reveal the entire HTTP request except for the authorization bearer token
-    reveal_request(sent, &mut prove_config_builder)?;
-
-    // Create hash commitment for the date of birth field from the response
-    let mut transcript_commitment_builder = TranscriptCommitConfig::builder(&transcript);
-    transcript_commitment_builder.default_kind(TranscriptCommitmentKind::Hash {
-        alg: HashAlgId::SHA256,
-    });
-    reveal_received(
-        received,
-        &mut prove_config_builder,
-        &mut transcript_commitment_builder,
-    )?;
-
-    let transcripts_commitment_config = transcript_commitment_builder.build()?;
-    prove_config_builder.transcript_commit(transcripts_commitment_config);
-
-    let prove_config = prove_config_builder.build()?;
-
-    // MPC-TLS prove
-    let prover_output = prover.prove(&prove_config).await?;
-    prover.close().await?;
-
-    // Prove birthdate is more than 18 years ago.
-    let received_commitments = received_commitments(&prover_output.transcript_commitments);
-    let received_commitment = received_commitments
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("No received commitments found"))?; // committed hash (of date of birth string)
-    let received_secrets = received_secrets(&prover_output.transcript_secrets);
-    let received_secret = received_secrets
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("No received secrets found"))?; // hash blinder
-    let proof_input = prepare_zk_proof_input(received, received_commitment, received_secret)?;
-    let proof_bundle = generate_zk_proof(&proof_input)?;
-
-    // Sent zk proof bundle to verifier
-    let serialized_proof = bincode::serialize(&proof_bundle)?;
-    verifier_extra_socket.write_all(&serialized_proof).await?;
-    verifier_extra_socket.shutdown().await?;
-
-    Ok(())
-}
-
-// Reveal everything from the request, except for the authorization token.
-fn reveal_request(request: &[u8], builder: &mut ProveConfigBuilder<'_>) -> Result<()> {
-    let reqs = Requests::new_from_slice(request).collect::<Result<Vec<_>, _>>()?;
-
-    let req = reqs
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("No requests found"))?;
-
-    if req.request.method.as_str() != "GET" {
-        return Err(anyhow::anyhow!(
-            "Expected GET method, found {}",
-            req.request.method.as_str()
-        ));
-    }
-
-    let authorization_header = req
-        .headers_with_name(header::AUTHORIZATION.as_str())
-        .next()
-        .ok_or_else(|| anyhow::anyhow!("Authorization header not found"))?;
-
-    let start_pos = authorization_header
-        .span()
-        .indices()
-        .min()
-        .ok_or_else(|| anyhow::anyhow!("Could not find authorization header start position"))?
-        + header::AUTHORIZATION.as_str().len()
-        + 2;
-    let end_pos =
-        start_pos + authorization_header.span().len() - header::AUTHORIZATION.as_str().len() - 2;
-
-    builder.reveal_sent(&(0..start_pos))?;
-    builder.reveal_sent(&(end_pos..request.len()))?;
-
-    Ok(())
-}
-
-fn reveal_received(
-    received: &[u8],
-    builder: &mut ProveConfigBuilder<'_>,
-    transcript_commitment_builder: &mut TranscriptCommitConfigBuilder,
-) -> Result<()> {
-    let resp = Responses::new_from_slice(received).collect::<Result<Vec<_>, _>>()?;
-
-    let response = resp
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("No responses found"))?;
-    let body = response
-        .body
-        .as_ref()
-        .ok_or_else(|| anyhow::anyhow!("Response body not found"))?;
-
-    let BodyContent::Json(json) = &body.content else {
-        return Err(anyhow::anyhow!("Expected JSON body content"));
-    };
-
-    // reveal tax year
-    let tax_year = json
-        .get("tax_year")
-        .ok_or_else(|| anyhow::anyhow!("tax_year field not found in JSON"))?;
-    let start_pos = tax_year
-        .span()
-        .indices()
-        .min()
-        .ok_or_else(|| anyhow::anyhow!("Could not find tax_year start position"))?
-        - 11;
-    let end_pos = tax_year
-        .span()
-        .indices()
-        .max()
-        .ok_or_else(|| anyhow::anyhow!("Could not find tax_year end position"))?
-        + 1;
-    builder.reveal_recv(&(start_pos..end_pos))?;
-
-    // commit to hash of date of birth
-    let dob = json
-        .get("taxpayer.date_of_birth")
-        .ok_or_else(|| anyhow::anyhow!("taxpayer.date_of_birth field not found in JSON"))?;
-
-    transcript_commitment_builder.commit_recv(dob.span())?;
-
-    Ok(())
-}
-
-// extract secret from prover output
-fn received_secrets(transcript_secrets: &[TranscriptSecret]) -> Vec<&PlaintextHashSecret> {
-    transcript_secrets
-        .iter()
-        .filter_map(|secret| match secret {
-            TranscriptSecret::Hash(hash) if hash.direction == Direction::Received => Some(hash),
-            _ => None,
-        })
-        .collect()
-}
-
-#[derive(Debug)]
-pub struct ZKProofInput {
-    dob: Vec<u8>,
-    proof_date: NaiveDate,
-    blinder: Vec<u8>,
-    committed_hash: Vec<u8>,
-}
-
-// Verify that the blinded, committed hash is correct
-fn prepare_zk_proof_input(
-    received: &[u8],
-    received_commitment: &PlaintextHash,
-    received_secret: &PlaintextHashSecret,
-) -> Result<ZKProofInput> {
-    assert_eq!(received_commitment.direction, Direction::Received);
-    assert_eq!(received_commitment.hash.alg, HashAlgId::SHA256);
-
-    let hash = &received_commitment.hash;
-
-    let dob_start = received_commitment
-        .idx
-        .min()
-        .ok_or_else(|| anyhow::anyhow!("No start index for DOB"))?;
-    let dob_end = received_commitment
-        .idx
-        .end()
-        .ok_or_else(|| anyhow::anyhow!("No end index for DOB"))?;
-    let dob = received[dob_start..dob_end].to_vec();
-    let blinder = received_secret.blinder.as_bytes().to_vec();
-    let committed_hash = hash.value.as_bytes().to_vec();
-    let proof_date = Local::now().date_naive();
-
-    assert_eq!(received_secret.direction, Direction::Received);
-    assert_eq!(received_secret.alg, HashAlgId::SHA256);
-
-    let mut hasher = Sha256::new();
-    hasher.update(&dob);
-    hasher.update(&blinder);
-    let computed_hash = hasher.finalize();
-
-    if committed_hash != computed_hash.as_ref() as &[u8] {
-        return Err(anyhow::anyhow!(
-            "Computed hash does not match committed hash"
-        ));
-    }
-
-    Ok(ZKProofInput {
-        dob,
-        proof_date,
-        committed_hash,
-        blinder,
-    })
-}
-
-fn generate_zk_proof(proof_input: &ZKProofInput) -> Result<ZKProofBundle> {
-    tracing::info!("🔒 Generating ZK proof with Noir...");
-
-    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
-
-    // 1. Load bytecode from program.json
-    let json: Value = serde_json::from_str(PROGRAM_JSON)?;
-    let bytecode = json["bytecode"]
-        .as_str()
-        .ok_or_else(|| anyhow::anyhow!("bytecode field not found in program.json"))?;
-
-    let mut inputs: Vec<String> = vec![];
-    inputs.push(proof_input.proof_date.day().to_string());
-    inputs.push(proof_input.proof_date.month().to_string());
-    inputs.push(proof_input.proof_date.year().to_string());
-    inputs.extend(proof_input.committed_hash.iter().map(|b| b.to_string()));
-    inputs.extend(proof_input.dob.iter().map(|b| b.to_string()));
-    inputs.extend(proof_input.blinder.iter().map(|b| b.to_string()));
-
-    let proof_date = proof_input.proof_date.to_string();
-    tracing::info!(
-        "Public inputs : Proof date ({}) and committed hash ({})",
-        proof_date,
-        hex::encode(&proof_input.committed_hash)
-    );
-    tracing::info!(
-        "Private inputs: Blinder ({}) and Date of Birth ({})",
-        hex::encode(&proof_input.blinder),
-        String::from_utf8_lossy(&proof_input.dob)
-    );
-
-    tracing::debug!("Witness inputs {:?}", inputs);
-
-    let input_refs: Vec<&str> = inputs.iter().map(String::as_str).collect();
-    let witness = from_vec_str_to_witness_map(input_refs).map_err(|e| anyhow::anyhow!(e))?;
-
-    // Setup SRS
-    setup_srs_from_bytecode(bytecode, None, false).map_err(|e| anyhow::anyhow!(e))?;
-
-    // Verification key
-    let vk = get_ultra_honk_verification_key(bytecode, false).map_err(|e| anyhow::anyhow!(e))?;
-
-    // Generate proof
-    let proof = prove_ultra_honk(bytecode, witness.clone(), vk.clone(), false)
-        .map_err(|e| anyhow::anyhow!(e))?;
-    tracing::info!("✅ Proof generated ({} bytes)", proof.len());
-
-    let proof_bundle = ZKProofBundle { vk, proof };
-    Ok(proof_bundle)
-}

crates/examples/interactive_zk/types.rs

@@ -1,21 +0,0 @@
-use serde::{Deserialize, Serialize};
-use tlsn::transcript::{hash::PlaintextHash, Direction, TranscriptCommitment};
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct ZKProofBundle {
-    pub vk: Vec<u8>,
-    pub proof: Vec<u8>,
-}
-
-// extract commitment from prover output
-pub fn received_commitments(
-    transcript_commitments: &[TranscriptCommitment],
-) -> Vec<&PlaintextHash> {
-    transcript_commitments
-        .iter()
-        .filter_map(|commitment| match commitment {
-            TranscriptCommitment::Hash(hash) if hash.direction == Direction::Received => Some(hash),
-            _ => None,
-        })
-        .collect()
-}

crates/examples/interactive_zk/verifier.rs

@@ -1,219 +0,0 @@
-use crate::types::received_commitments;
-
-use super::types::ZKProofBundle;
-use anyhow::Result;
-use chrono::{Local, NaiveDate};
-use noir::barretenberg::verify::{get_ultra_honk_verification_key, verify_ultra_honk};
-use serde_json::Value;
-use tls_server_fixture::CA_CERT_DER;
-use tlsn::{
-    config::{tls_commit::TlsCommitProtocolConfig, verifier::VerifierConfig},
-    connection::ServerName,
-    hash::HashAlgId,
-    transcript::{Direction, PartialTranscript},
-    verifier::{Verifier, VerifierOutput},
-    webpki::{CertificateDer, RootCertStore},
-};
-use tlsn_examples::{MAX_RECV_DATA, MAX_SENT_DATA};
-use tlsn_server_fixture_certs::SERVER_DOMAIN;
-use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite};
-use tokio_util::compat::TokioAsyncReadCompatExt;
-use tracing::instrument;
-
-#[instrument(skip(socket, extra_socket))]
-pub async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
-    socket: T,
-    mut extra_socket: T,
-) -> Result<PartialTranscript> {
-    let verifier = Verifier::new(
-        VerifierConfig::builder()
-            // Create a root certificate store with the server-fixture's self-signed
-            // certificate. This is only required for offline testing with the
-            // server-fixture.
-            .root_store(RootCertStore {
-                roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-            })
-            .build()?,
-    );
-
-    // Validate the proposed configuration and then run the TLS commitment protocol.
-    let verifier = verifier.commit(socket.compat()).await?;
-
-    // This is the opportunity to ensure the prover does not attempt to overload the
-    // verifier.
-    let reject = if let TlsCommitProtocolConfig::Mpc(mpc_tls_config) = verifier.request().protocol()
-    {
-        if mpc_tls_config.max_sent_data() > MAX_SENT_DATA {
-            Some("max_sent_data is too large")
-        } else if mpc_tls_config.max_recv_data() > MAX_RECV_DATA {
-            Some("max_recv_data is too large")
-        } else {
-            None
-        }
-    } else {
-        Some("expecting to use MPC-TLS")
-    };
-
-    if reject.is_some() {
-        verifier.reject(reject).await?;
-        return Err(anyhow::anyhow!("protocol configuration rejected"));
-    }
-
-    // Runs the TLS commitment protocol to completion.
-    let verifier = verifier.accept().await?.run().await?;
-
-    // Validate the proving request and then verify.
-    let verifier = verifier.verify().await?;
-    let request = verifier.request();
-
-    if !request.server_identity() || request.reveal().is_none() {
-        let verifier = verifier
-            .reject(Some(
-                "expecting to verify the server name and transcript data",
-            ))
-            .await?;
-        verifier.close().await?;
-        return Err(anyhow::anyhow!(
-            "prover did not reveal the server name and transcript data"
-        ));
-    }
-
-    let (
-        VerifierOutput {
-            server_name,
-            transcript,
-            transcript_commitments,
-            ..
-        },
-        verifier,
-    ) = verifier.accept().await?;
-
-    verifier.close().await?;
-
-    let server_name = server_name.expect("server name should be present");
-    let transcript = transcript.expect("transcript should be present");
-
-    // Create hash commitment for the date of birth field from the response
-    let sent = transcript.sent_unsafe().to_vec();
-    let sent_data = String::from_utf8(sent.clone())
-        .map_err(|e| anyhow::anyhow!("Verifier expected valid UTF-8 sent data: {e}"))?;
-
-    if !sent_data.contains(SERVER_DOMAIN) {
-        return Err(anyhow::anyhow!(
-            "Verification failed: Expected host {SERVER_DOMAIN} not found in sent data"
-        ));
-    }
-
-    // Check received data.
-    let received_commitments = received_commitments(&transcript_commitments);
-    let received_commitment = received_commitments
-        .first()
-        .ok_or_else(|| anyhow::anyhow!("Missing hash commitment"))?;
-
-    assert!(received_commitment.direction == Direction::Received);
-    assert!(received_commitment.hash.alg == HashAlgId::SHA256);
-
-    let committed_hash = &received_commitment.hash;
-
-    // Check Session info: server name.
-    let ServerName::Dns(server_name) = server_name;
-    if server_name.as_str() != SERVER_DOMAIN {
-        return Err(anyhow::anyhow!(
-            "Server name mismatch: expected {SERVER_DOMAIN}, got {}",
-            server_name.as_str()
-        ));
-    }
-
-    // Receive ZKProof information from prover
-    let mut buf = Vec::new();
-    extra_socket.read_to_end(&mut buf).await?;
-
-    if buf.is_empty() {
-        return Err(anyhow::anyhow!("No ZK proof data received from prover"));
-    }
-
-    let msg: ZKProofBundle = bincode::deserialize(&buf)
-        .map_err(|e| anyhow::anyhow!("Failed to deserialize ZK proof bundle: {e}"))?;
-
-    // Verify zk proof
-    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
-    let json: Value = serde_json::from_str(PROGRAM_JSON)
-        .map_err(|e| anyhow::anyhow!("Failed to parse Noir circuit: {e}"))?;
-
-    let bytecode = json["bytecode"]
-        .as_str()
-        .ok_or_else(|| anyhow::anyhow!("Bytecode field missing in noir.json"))?;
-
-    let vk = get_ultra_honk_verification_key(bytecode, false)
-        .map_err(|e| anyhow::anyhow!("Failed to get verification key: {e}"))?;
-
-    if vk != msg.vk {
-        return Err(anyhow::anyhow!(
-            "Verification key mismatch between computed and provided by prover"
-        ));
-    }
-
-    let proof = msg.proof.clone();
-
-    // Validate proof has enough data.
-    // The proof should start with the public inputs:
-    // * We expect at least 3 * 32 bytes for the three date fields (day, month,
-    //   year)
-    // * and 32*32 bytes for the hash
-    let min_bytes = (32 + 3) * 32;
-    if proof.len() < min_bytes {
-        return Err(anyhow::anyhow!(
-            "Proof too short: expected at least {min_bytes} bytes, got {}",
-            proof.len()
-        ));
-    }
-
-    // Check that the proof date is correctly included in the proof
-    let proof_date_day: u32 = u32::from_be_bytes(proof[28..32].try_into()?);
-    let proof_date_month: u32 = u32::from_be_bytes(proof[60..64].try_into()?);
-    let proof_date_year: i32 = i32::from_be_bytes(proof[92..96].try_into()?);
-    let proof_date_from_proof =
-        NaiveDate::from_ymd_opt(proof_date_year, proof_date_month, proof_date_day)
-            .ok_or_else(|| anyhow::anyhow!("Invalid proof date in proof"))?;
-    let today = Local::now().date_naive();
-    if (today - proof_date_from_proof).num_days() < 0 {
-        return Err(anyhow::anyhow!(
-            "The proof date can only be today or in the past: provided {proof_date_from_proof}, today {today}"
-        ));
-    }
-
-    // Check that the committed hash in the proof matches the hash from the
-    // commitment
-    let committed_hash_in_proof: Vec<u8> = proof
-        .chunks(32)
-        .skip(3) // skip the first 3 chunks
-        .take(32)
-        .map(|chunk| *chunk.last().unwrap_or(&0))
-        .collect();
-    let expected_hash = committed_hash.value.as_bytes().to_vec();
-    if committed_hash_in_proof != expected_hash {
-        tracing::error!(
-            "❌ The hash in the proof does not match the committed hash in MPC-TLS: {} != {}",
-            hex::encode(&committed_hash_in_proof),
-            hex::encode(&expected_hash)
-        );
-        return Err(anyhow::anyhow!(
-            "Hash in proof does not match committed hash in MPC-TLS"
-        ));
-    }
-    tracing::info!(
-        "✅ The hash in the proof matches the committed hash in MPC-TLS ({})",
-        hex::encode(&expected_hash)
-    );
-
-    // Finally verify the proof
-    let is_valid = verify_ultra_honk(msg.proof, msg.vk)
-        .map_err(|e| anyhow::anyhow!("ZKProof Verification failed: {e}"))?;
-    if !is_valid {
-        tracing::error!("❌ Age verification ZKProof failed to verify");
-        return Err(anyhow::anyhow!("Age verification ZKProof failed to verify"));
-    }
-    tracing::info!("✅ Age verification ZKProof successfully verified");
-
-    Ok(transcript)
-}

crates/formats/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-formats"
-version = "0.1.0-alpha.14-pre"
+version = "0.1.0-alpha.13-pre"
 edition = "2021"
 
 [lints]

crates/harness/build.sh

@@ -3,19 +3,7 @@
 # Ensure the script runs in the folder that contains this script
 cd "$(dirname "$0")"
 
-RUNNER_FEATURES=""
-EXECUTOR_FEATURES=""
-
-if [ "$1" = "debug" ]; then
-    RUNNER_FEATURES="--features debug"
-    EXECUTOR_FEATURES="--no-default-features --features debug"
-fi
-
-cargo build --release \
-    --package tlsn-harness-runner $RUNNER_FEATURES \
-    --package tlsn-harness-executor $EXECUTOR_FEATURES \
-    --package tlsn-server-fixture \
-    --package tlsn-harness-plot
+cargo build --release --package tlsn-harness-runner --package tlsn-harness-executor --package tlsn-server-fixture --package tlsn-harness-plot
 
 mkdir -p bin
 

crates/harness/core/src/bench.rs

@@ -9,7 +9,6 @@ pub const DEFAULT_UPLOAD_SIZE: usize = 1024;
 pub const DEFAULT_DOWNLOAD_SIZE: usize = 4096;
 pub const DEFAULT_DEFER_DECRYPTION: bool = true;
 pub const DEFAULT_MEMORY_PROFILE: bool = false;
-pub const DEFAULT_REVEAL_ALL: bool = false;
 
 pub const WARM_UP_BENCH: Bench = Bench {
     group: None,
@@ -21,7 +20,6 @@ pub const WARM_UP_BENCH: Bench = Bench {
     download_size: 4096,
     defer_decryption: true,
     memory_profile: false,
-    reveal_all: true,
 };
 
 #[derive(Deserialize)]
@@ -81,8 +79,6 @@ pub struct BenchGroupItem {
     pub defer_decryption: Option<bool>,
     #[serde(rename = "memory-profile")]
     pub memory_profile: Option<bool>,
-    #[serde(rename = "reveal-all")]
-    pub reveal_all: Option<bool>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -101,8 +97,6 @@ pub struct BenchItem {
     pub defer_decryption: Option<bool>,
     #[serde(rename = "memory-profile")]
     pub memory_profile: Option<bool>,
-    #[serde(rename = "reveal-all")]
-    pub reveal_all: Option<bool>,
 }
 
 impl BenchItem {
@@ -138,10 +132,6 @@ impl BenchItem {
         if self.memory_profile.is_none() {
             self.memory_profile = group.memory_profile;
         }
-
-        if self.reveal_all.is_none() {
-            self.reveal_all = group.reveal_all;
-        }
     }
 
     pub fn into_bench(&self) -> Bench {
@@ -155,7 +145,6 @@ impl BenchItem {
             download_size: self.download_size.unwrap_or(DEFAULT_DOWNLOAD_SIZE),
             defer_decryption: self.defer_decryption.unwrap_or(DEFAULT_DEFER_DECRYPTION),
             memory_profile: self.memory_profile.unwrap_or(DEFAULT_MEMORY_PROFILE),
-            reveal_all: self.reveal_all.unwrap_or(DEFAULT_REVEAL_ALL),
         }
     }
 }
@@ -175,8 +164,6 @@ pub struct Bench {
     pub defer_decryption: bool,
     #[serde(rename = "memory-profile")]
     pub memory_profile: bool,
-    #[serde(rename = "reveal-all")]
-    pub reveal_all: bool,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

crates/harness/core/src/rpc.rs

@@ -22,10 +22,7 @@ pub enum CmdOutput {
     GetTests(Vec<String>),
     Test(TestOutput),
     Bench(BenchOutput),
-    #[cfg(target_arch = "wasm32")]
-    Fail {
-        reason: Option<String>,
-    },
+    Fail { reason: Option<String> },
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

crates/harness/executor/.cargo/config.toml

@@ -1,14 +1,10 @@
 [target.wasm32-unknown-unknown]
 rustflags = [
-    "-Ctarget-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
-    "-Clink-arg=--shared-memory",
+    "-C",
+    "target-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
+    "-C",
     # 4GB
-    "-Clink-arg=--max-memory=4294967296",
-    "-Clink-arg=--import-memory",
-    "-Clink-arg=--export=__wasm_init_tls",
-    "-Clink-arg=--export=__tls_size",
-    "-Clink-arg=--export=__tls_align",
-    "-Clink-arg=--export=__tls_base",
+    "link-arg=--max-memory=4294967296",
     "--cfg",
     'getrandom_backend="wasm_js"',
 ]

crates/harness/executor/Cargo.toml

@@ -4,12 +4,6 @@ version = "0.1.0"
 edition = "2024"
 publish = false
 
-[features]
-# Disable tracing events as a workaround for issue 959. 
-default = ["tracing/release_max_level_off"]
-# Used to debug the executor itself.
-debug = []
-
 [lib]
 name = "harness_executor"
 crate-type = ["cdylib", "rlib"]
@@ -34,7 +28,8 @@ tokio = { workspace = true, features = ["full"] }
 tokio-util = { workspace = true, features = ["compat"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
-tracing = { workspace = true }
+# Disable tracing events as a workaround for issue 959. 
+tracing = { workspace = true, features = ["release_max_level_off"] }
 wasm-bindgen = { workspace = true }
 tlsn-wasm = { workspace = true }
 js-sys = { workspace = true }

crates/harness/executor/src/bench/prover.rs

@@ -5,15 +5,9 @@ use futures::{AsyncReadExt, AsyncWriteExt, TryFutureExt};
 
 use harness_core::bench::{Bench, ProverMetrics};
 use tlsn::{
-    config::{
-        prove::ProveConfig,
-        prover::ProverConfig,
-        tls::TlsClientConfig,
-        tls_commit::{TlsCommitConfig, mpc::MpcTlsConfig},
-    },
+    config::{CertificateDer, ProtocolConfig, RootCertStore},
     connection::ServerName,
-    prover::Prover,
-    webpki::{CertificateDer, RootCertStore},
+    prover::{ProveConfig, Prover, ProverConfig, TlsConfig},
 };
 use tlsn_server_fixture_certs::{CA_CERT_DER, SERVER_DOMAIN};
 
@@ -28,47 +22,41 @@ pub async fn bench_prover(provider: &IoProvider, config: &Bench) -> Result<Prove
     let sent = verifier_io.sent();
     let recv = verifier_io.recv();
 
-    let prover = Prover::new(ProverConfig::builder().build()?);
+    let mut builder = ProtocolConfig::builder();
+    builder.max_sent_data(config.upload_size);
+
+    builder.defer_decryption_from_start(config.defer_decryption);
+    if !config.defer_decryption {
+        builder.max_recv_data_online(config.download_size + RECV_PADDING);
+    }
+    builder.max_recv_data(config.download_size + RECV_PADDING);
+
+    let protocol_config = builder.build()?;
+
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+    let tls_config = tls_config_builder.build()?;
+
+    let prover = Prover::new(
+        ProverConfig::builder()
+            .tls_config(tls_config)
+            .protocol_config(protocol_config)
+            .server_name(ServerName::Dns(SERVER_DOMAIN.try_into().unwrap()))
+            .build()?,
+    );
 
     let time_start = web_time::Instant::now();
 
-    let prover = prover
-        .commit(
-            TlsCommitConfig::builder()
-                .protocol({
-                    let mut builder = MpcTlsConfig::builder()
-                        .max_sent_data(config.upload_size)
-                        .defer_decryption_from_start(config.defer_decryption);
-
-                    if !config.defer_decryption {
-                        builder = builder.max_recv_data_online(config.download_size + RECV_PADDING);
-                    }
-
-                    builder
-                        .max_recv_data(config.download_size + RECV_PADDING)
-                        .build()
-                }?)
-                .build()?,
-            verifier_io,
-        )
-        .await?;
+    let prover = prover.setup(verifier_io).await?;
 
     let time_preprocess = time_start.elapsed().as_millis();
     let time_start_online = web_time::Instant::now();
     let uploaded_preprocess = sent.load(Ordering::Relaxed);
     let downloaded_preprocess = recv.load(Ordering::Relaxed);
 
-    let (mut conn, prover_fut) = prover
-        .connect(
-            TlsClientConfig::builder()
-                .server_name(ServerName::Dns(SERVER_DOMAIN.try_into()?))
-                .root_store(RootCertStore {
-                    roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-                })
-                .build()?,
-            provider.provide_server_io().await?,
-        )
-        .await?;
+    let (mut conn, prover_fut) = prover.connect(provider.provide_server_io().await?).await?;
 
     let (_, mut prover) = futures::try_join!(
         async {
@@ -98,27 +86,14 @@ pub async fn bench_prover(provider: &IoProvider, config: &Bench) -> Result<Prove
 
     let mut builder = ProveConfig::builder(prover.transcript());
 
-    // When reveal_all is false (the default), we exclude 1 byte to avoid the
-    // reveal-all optimization and benchmark the realistic ZK authentication path.
-    let reveal_sent_range = if config.reveal_all {
-        0..sent_len
-    } else {
-        0..sent_len.saturating_sub(1)
-    };
-    let reveal_recv_range = if config.reveal_all {
-        0..recv_len
-    } else {
-        0..recv_len.saturating_sub(1)
-    };
-
     builder
         .server_identity()
-        .reveal_sent(&reveal_sent_range)?
-        .reveal_recv(&reveal_recv_range)?;
+        .reveal_sent(&(0..sent_len))?
+        .reveal_recv(&(0..recv_len))?;
 
-    let prove_config = builder.build()?;
+    let config = builder.build()?;
 
-    prover.prove(&prove_config).await?;
+    prover.prove(&config).await?;
     prover.close().await?;
 
     let time_total = time_start.elapsed().as_millis();

crates/harness/executor/src/bench/verifier.rs

@@ -2,31 +2,33 @@ use anyhow::Result;
 
 use harness_core::bench::Bench;
 use tlsn::{
-    config::verifier::VerifierConfig,
-    verifier::Verifier,
-    webpki::{CertificateDer, RootCertStore},
+    config::{CertificateDer, ProtocolConfigValidator, RootCertStore},
+    verifier::{Verifier, VerifierConfig, VerifyConfig},
 };
 use tlsn_server_fixture_certs::CA_CERT_DER;
 
-use crate::IoProvider;
+use crate::{IoProvider, bench::RECV_PADDING};
+
+pub async fn bench_verifier(provider: &IoProvider, config: &Bench) -> Result<()> {
+    let mut builder = ProtocolConfigValidator::builder();
+    builder
+        .max_sent_data(config.upload_size)
+        .max_recv_data(config.download_size + RECV_PADDING);
+
+    let protocol_config = builder.build()?;
 
-pub async fn bench_verifier(provider: &IoProvider, _config: &Bench) -> Result<()> {
     let verifier = Verifier::new(
         VerifierConfig::builder()
             .root_store(RootCertStore {
                 roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
             })
+            .protocol_config_validator(protocol_config)
             .build()?,
     );
 
-    let verifier = verifier
-        .commit(provider.provide_proto_io().await?)
-        .await?
-        .accept()
-        .await?
-        .run()
-        .await?;
-    let (_, verifier) = verifier.verify().await?.accept().await?;
+    let verifier = verifier.setup(provider.provide_proto_io().await?).await?;
+    let mut verifier = verifier.run().await?;
+    verifier.verify(&VerifyConfig::default()).await?;
     verifier.close().await?;
 
     Ok(())

crates/harness/executor/test_plugins/basic.rs

@@ -1,17 +1,10 @@
 use tlsn::{
-    config::{
-        prove::ProveConfig,
-        prover::ProverConfig,
-        tls::TlsClientConfig,
-        tls_commit::{TlsCommitConfig, mpc::MpcTlsConfig},
-        verifier::VerifierConfig,
-    },
+    config::{CertificateDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore},
     connection::ServerName,
     hash::HashAlgId,
-    prover::Prover,
+    prover::{ProveConfig, Prover, ProverConfig, TlsConfig},
     transcript::{TranscriptCommitConfig, TranscriptCommitment, TranscriptCommitmentKind},
-    verifier::{Verifier, VerifierOutput},
-    webpki::{CertificateDer, RootCertStore},
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
 };
 use tlsn_server_fixture_certs::{CA_CERT_DER, SERVER_DOMAIN};
 
@@ -28,35 +21,35 @@ const MAX_RECV_DATA: usize = 1 << 11;
 crate::test!("basic", prover, verifier);
 
 async fn prover(provider: &IoProvider) {
-    let prover = Prover::new(ProverConfig::builder().build().unwrap())
-        .commit(
-            TlsCommitConfig::builder()
-                .protocol(
-                    MpcTlsConfig::builder()
-                        .max_sent_data(MAX_SENT_DATA)
-                        .max_recv_data(MAX_RECV_DATA)
-                        .defer_decryption_from_start(true)
-                        .build()
-                        .unwrap(),
-                )
-                .build()
-                .unwrap(),
-            provider.provide_proto_io().await.unwrap(),
-        )
-        .await
-        .unwrap();
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+
+    let tls_config = tls_config_builder.build().unwrap();
+
+    let server_name = ServerName::Dns(SERVER_DOMAIN.try_into().unwrap());
+    let prover = Prover::new(
+        ProverConfig::builder()
+            .server_name(server_name)
+            .tls_config(tls_config)
+            .protocol_config(
+                ProtocolConfig::builder()
+                    .max_sent_data(MAX_SENT_DATA)
+                    .max_recv_data(MAX_RECV_DATA)
+                    .defer_decryption_from_start(true)
+                    .build()
+                    .unwrap(),
+            )
+            .build()
+            .unwrap(),
+    )
+    .setup(provider.provide_proto_io().await.unwrap())
+    .await
+    .unwrap();
 
     let (tls_connection, prover_fut) = prover
-        .connect(
-            TlsClientConfig::builder()
-                .server_name(ServerName::Dns(SERVER_DOMAIN.try_into().unwrap()))
-                .root_store(RootCertStore {
-                    roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
-                })
-                .build()
-                .unwrap(),
-            provider.provide_server_io().await.unwrap(),
-        )
+        .connect(provider.provide_server_io().await.unwrap())
         .await
         .unwrap();
 
@@ -120,34 +113,33 @@ async fn prover(provider: &IoProvider) {
 
 async fn verifier(provider: &IoProvider) {
     let config = VerifierConfig::builder()
+        .protocol_config_validator(
+            ProtocolConfigValidator::builder()
+                .max_sent_data(MAX_SENT_DATA)
+                .max_recv_data(MAX_RECV_DATA)
+                .build()
+                .unwrap(),
+        )
         .root_store(RootCertStore {
             roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
         })
         .build()
         .unwrap();
 
-    let verifier = Verifier::new(config)
-        .commit(provider.provide_proto_io().await.unwrap())
-        .await
-        .unwrap()
-        .accept()
-        .await
-        .unwrap()
-        .run()
+    let verifier = Verifier::new(config);
+
+    let VerifierOutput {
+        server_name,
+        transcript_commitments,
+        ..
+    } = verifier
+        .verify(
+            provider.provide_proto_io().await.unwrap(),
+            &VerifyConfig::default(),
+        )
         .await
         .unwrap();
 
-    let (
-        VerifierOutput {
-            server_name,
-            transcript_commitments,
-            ..
-        },
-        verifier,
-    ) = verifier.verify().await.unwrap().accept().await.unwrap();
-
-    verifier.close().await.unwrap();
-
     let ServerName::Dns(server_name) = server_name.unwrap();
 
     assert_eq!(server_name.as_str(), SERVER_DOMAIN);

crates/harness/harness.Dockerfile

@@ -1,8 +1,6 @@
 FROM rust AS builder
 WORKDIR /usr/src/tlsn
 
-ARG DEBUG=0
-
 RUN \
     rustup update; \
     apt update && apt install -y clang; \
@@ -12,12 +10,7 @@ RUN \
 COPY . .
 RUN \
     cd crates/harness; \
-    # Pass `--build-arg DEBUG=1` to `docker build` if you need to debug the harness.
-    if [ "$DEBUG" = "1" ]; then \
-      ./build.sh debug; \
-    else \
-      ./build.sh; \
-    fi
+    ./build.sh;
 
 FROM debian:latest
 

crates/harness/plot/Cargo.toml

@@ -7,9 +7,10 @@ publish = false
 [dependencies]
 tlsn-harness-core = { workspace = true }
 # tlsn-server-fixture = { workspace = true }
-charming = { version = "0.6.0", features = ["ssr"] }
+charming = { version = "0.5.1", features = ["ssr"] }
+csv = "1.3.0"
 clap = { workspace = true, features = ["derive", "env"] }
-polars = { version = "0.44", features = ["csv", "lazy"] }
+itertools = "0.14.0"
 toml = { workspace = true }
 
 

crates/harness/plot/README.md

@@ -1,111 +0,0 @@
-# TLSNotary Benchmark Plot Tool
-
-Generates interactive HTML and SVG plots from TLSNotary benchmark results. Supports comparing multiple benchmark runs (e.g., before/after optimization, native vs browser).
-
-## Usage
-
-```bash
-tlsn-harness-plot <TOML> <CSV>... [OPTIONS]
-```
-
-### Arguments
-
-- `<TOML>` - Path to Bench.toml file defining benchmark structure
-- `<CSV>...` - One or more CSV files with benchmark results
-
-### Options
-
-- `-l, --labels <LABEL>...` - Labels for each dataset (optional)
-  - If omitted, datasets are labeled "Dataset 1", "Dataset 2", etc.
-  - Number of labels must match number of CSV files
-- `--min-max-band` - Add min/max bands to plots showing variance
-- `-h, --help` - Print help information
-
-## Examples
-
-### Single Dataset
-
-```bash
-tlsn-harness-plot bench.toml results.csv
-```
-
-Generates plots from a single benchmark run.
-
-### Compare Two Runs
-
-```bash
-tlsn-harness-plot bench.toml before.csv after.csv \
-  --labels "Before Optimization" "After Optimization"
-```
-
-Overlays two datasets to compare performance improvements.
-
-### Multiple Datasets
-
-```bash
-tlsn-harness-plot bench.toml native.csv browser.csv wasm.csv \
-  --labels "Native" "Browser" "WASM"
-```
-
-Compare three different runtime environments.
-
-### With Min/Max Bands
-
-```bash
-tlsn-harness-plot bench.toml run1.csv run2.csv \
-  --labels "Config A" "Config B" \
-  --min-max-band
-```
-
-Shows variance ranges for each dataset.
-
-## Output Files
-
-The tool generates two files per benchmark group:
-
-- `<output>.html` - Interactive HTML chart (zoomable, hoverable)
-- `<output>.svg` - Static SVG image for documentation
-
-Default output filenames:
-- `runtime_vs_bandwidth.{html,svg}` - When `protocol_latency` is defined in group
-- `runtime_vs_latency.{html,svg}` - When `bandwidth` is defined in group
-
-## Plot Format
-
-Each dataset displays:
-- **Solid line** - Total runtime (preprocessing + online phase)
-- **Dashed line** - Online phase only
-- **Shaded area** (optional) - Min/max variance bands
-
-Different datasets automatically use distinct colors for easy comparison.
-
-## CSV Format
-
-Expected columns in each CSV file:
-- `group` - Benchmark group name (must match TOML)
-- `bandwidth` - Network bandwidth in Kbps (for bandwidth plots)
-- `latency` - Network latency in ms (for latency plots)
-- `time_preprocess` - Preprocessing time in ms
-- `time_online` - Online phase time in ms
-- `time_total` - Total runtime in ms
-
-## TOML Format
-
-The benchmark TOML file defines groups with either:
-
-```toml
-[[group]]
-name = "my_benchmark"
-protocol_latency = 50  # Fixed latency for bandwidth plots
-# OR
-bandwidth = 10000      # Fixed bandwidth for latency plots
-```
-
-All datasets must use the same TOML file to ensure consistent benchmark structure.
-
-## Tips
-
-- Use descriptive labels to make plots self-documenting
-- Keep CSV files from the same benchmark configuration for valid comparisons
-- Min/max bands are useful for showing stability but can clutter plots with many datasets
-- Interactive HTML plots support zooming and hovering for detailed values

crates/harness/plot/bin/plot.rs

@@ -1,18 +1,17 @@
 use std::f32;
 
 use charming::{
-    Chart, HtmlRenderer, ImageRenderer,
+    Chart, HtmlRenderer,
     component::{Axis, Legend, Title},
-    element::{
-        AreaStyle, ItemStyle, LineStyle, LineStyleType, NameLocation, Orient, TextStyle, Tooltip,
-        Trigger,
-    },
+    element::{AreaStyle, LineStyle, NameLocation, Orient, TextStyle, Tooltip, Trigger},
     series::Line,
     theme::Theme,
 };
 use clap::Parser;
-use harness_core::bench::BenchItems;
-use polars::prelude::*;
+use harness_core::bench::{BenchItems, Measurement};
+use itertools::Itertools;
+
+const THEME: Theme = Theme::Default;
 
 #[derive(Parser, Debug)]
 #[command(author, version, about)]
@@ -20,131 +19,72 @@ struct Cli {
     /// Path to the Bench.toml file with benchmark spec
     toml: String,
 
-    /// Paths to CSV files with benchmark results (one or more)
-    csv: Vec<String>,
+    /// Path to the CSV file with benchmark results
+    csv: String,
 
-    /// Labels for each dataset (optional, defaults to "Dataset 1", "Dataset 2", etc.)
-    #[arg(short, long, num_args = 0..)]
-    labels: Vec<String>,
+    /// Prover kind: native or browser
+    #[arg(short, long, value_enum, default_value = "native")]
+    prover_kind: ProverKind,
 
     /// Add min/max bands to plots
     #[arg(long, default_value_t = false)]
     min_max_band: bool,
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
+enum ProverKind {
+    Native,
+    Browser,
+}
+
+impl std::fmt::Display for ProverKind {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ProverKind::Native => write!(f, "Native"),
+            ProverKind::Browser => write!(f, "Browser"),
+        }
+    }
+}
+
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let cli = Cli::parse();
 
-    if cli.csv.is_empty() {
-        return Err("At least one CSV file must be provided".into());
-    }
-
-    // Generate labels if not provided
-    let labels: Vec<String> = if cli.labels.is_empty() {
-        cli.csv
-            .iter()
-            .enumerate()
-            .map(|(i, _)| format!("Dataset {}", i + 1))
-            .collect()
-    } else if cli.labels.len() != cli.csv.len() {
-        return Err(format!(
-            "Number of labels ({}) must match number of CSV files ({})",
-            cli.labels.len(),
-            cli.csv.len()
-        )
-        .into());
-    } else {
-        cli.labels.clone()
-    };
-
-    // Load all CSVs and add dataset label
-    let mut dfs = Vec::new();
-    for (csv_path, label) in cli.csv.iter().zip(labels.iter()) {
-        let mut df = CsvReadOptions::default()
-            .try_into_reader_with_file_path(Some(csv_path.clone().into()))?
-            .finish()?;
-
-        let label_series = Series::new("dataset_label".into(), vec![label.as_str(); df.height()]);
-        df.with_column(label_series)?;
-        dfs.push(df);
-    }
-
-    // Combine all dataframes
-    let df = dfs
-        .into_iter()
-        .reduce(|acc, df| acc.vstack(&df).unwrap())
-        .unwrap();
+    let mut rdr = csv::Reader::from_path(&cli.csv)?;
 
     let items: BenchItems = toml::from_str(&std::fs::read_to_string(&cli.toml)?)?;
     let groups = items.group;
 
-    for group in groups {
-        // Determine which field varies in benches for this group
-        let benches_in_group: Vec<_> = items
-            .bench
-            .iter()
-            .filter(|b| b.group.as_deref() == Some(&group.name))
-            .collect();
+    // Prepare data for plotting.
+    let all_data: Vec<Measurement> = rdr
+        .deserialize::<Measurement>()
+        .collect::<Result<Vec<_>, _>>()?;
 
-        if benches_in_group.is_empty() {
-            continue;
+    for group in groups {
+        if group.protocol_latency.is_some() {
+            let latency = group.protocol_latency.unwrap();
+            plot_runtime_vs(
+                &all_data,
+                cli.min_max_band,
+                &group.name,
+                |r| r.bandwidth as f32 / 1000.0, // Kbps to Mbps
+                "Runtime vs Bandwidth",
+                format!("{} ms Latency, {} mode", latency, cli.prover_kind),
+                "runtime_vs_bandwidth.html",
+                "Bandwidth (Mbps)",
+            )?;
         }
 
-        // Check which field has varying values
-        let bandwidth_varies = benches_in_group
-            .windows(2)
-            .any(|w| w[0].bandwidth != w[1].bandwidth);
-        let latency_varies = benches_in_group
-            .windows(2)
-            .any(|w| w[0].protocol_latency != w[1].protocol_latency);
-        let download_size_varies = benches_in_group
-            .windows(2)
-            .any(|w| w[0].download_size != w[1].download_size);
-
-        if download_size_varies {
-            let upload_size = group.upload_size.unwrap_or(1024);
+        if group.bandwidth.is_some() {
+            let bandwidth = group.bandwidth.unwrap();
             plot_runtime_vs(
-                &df,
-                &labels,
+                &all_data,
                 cli.min_max_band,
                 &group.name,
-                "download_size",
-                1.0 / 1024.0, // bytes to KB
-                "Runtime vs Response Size",
-                format!("{} bytes upload size", upload_size),
-                "runtime_vs_download_size",
-                "Response Size (KB)",
-                true, // legend on left
-            )?;
-        } else if bandwidth_varies {
-            let latency = group.protocol_latency.unwrap_or(50);
-            plot_runtime_vs(
-                &df,
-                &labels,
-                cli.min_max_band,
-                &group.name,
-                "bandwidth",
-                1.0 / 1000.0, // Kbps to Mbps
-                "Runtime vs Bandwidth",
-                format!("{} ms Latency", latency),
-                "runtime_vs_bandwidth",
-                "Bandwidth (Mbps)",
-                false, // legend on right
-            )?;
-        } else if latency_varies {
-            let bandwidth = group.bandwidth.unwrap_or(1000);
-            plot_runtime_vs(
-                &df,
-                &labels,
-                cli.min_max_band,
-                &group.name,
-                "latency",
-                1.0,
+                |r| r.latency as f32,
                 "Runtime vs Latency",
-                format!("{} bps bandwidth", bandwidth),
-                "runtime_vs_latency",
+                format!("{} bps bandwidth, {} mode", bandwidth, cli.prover_kind),
+                "runtime_vs_latency.html",
                 "Latency (ms)",
-                true, // legend on left
             )?;
         }
     }
@@ -152,52 +92,84 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+struct DataPoint {
+    min: f32,
+    mean: f32,
+    max: f32,
+}
+
+struct Points {
+    preprocess: DataPoint,
+    online: DataPoint,
+    total: DataPoint,
+}
+
 #[allow(clippy::too_many_arguments)]
-fn plot_runtime_vs(
-    df: &DataFrame,
-    labels: &[String],
+fn plot_runtime_vs<Fx>(
+    all_data: &[Measurement],
     show_min_max: bool,
     group: &str,
-    x_col: &str,
-    x_scale: f32,
+    x_value: Fx,
     title: &str,
     subtitle: String,
     output_file: &str,
     x_axis_label: &str,
-    legend_left: bool,
-) -> Result<Chart, Box<dyn std::error::Error>> {
-    let stats_df = df
-        .clone()
-        .lazy()
-        .filter(col("group").eq(lit(group)))
-        .with_column((col(x_col).cast(DataType::Float32) * lit(x_scale)).alias("x"))
-        .with_columns([
-            (col("time_preprocess").cast(DataType::Float32) / lit(1000.0)).alias("preprocess"),
-            (col("time_online").cast(DataType::Float32) / lit(1000.0)).alias("online"),
-            (col("time_total").cast(DataType::Float32) / lit(1000.0)).alias("total"),
-        ])
-        .group_by([col("x"), col("dataset_label")])
-        .agg([
-            col("preprocess").min().alias("preprocess_min"),
-            col("preprocess").mean().alias("preprocess_mean"),
-            col("preprocess").max().alias("preprocess_max"),
-            col("online").min().alias("online_min"),
-            col("online").mean().alias("online_mean"),
-            col("online").max().alias("online_max"),
-            col("total").min().alias("total_min"),
-            col("total").mean().alias("total_mean"),
-            col("total").max().alias("total_max"),
-        ])
-        .sort(["dataset_label", "x"], Default::default())
-        .collect()?;
-
-    // Build legend entries
-    let mut legend_data = Vec::new();
-    for label in labels {
-        legend_data.push(format!("Total Mean ({})", label));
-        legend_data.push(format!("Online Mean ({})", label));
+) -> Result<Chart, Box<dyn std::error::Error>>
+where
+    Fx: Fn(&Measurement) -> f32,
+{
+    fn data_point(values: &[f32]) -> DataPoint {
+        let mean = values.iter().copied().sum::<f32>() / values.len() as f32;
+        let max = values.iter().copied().reduce(f32::max).unwrap_or_default();
+        let min = values.iter().copied().reduce(f32::min).unwrap_or_default();
+        DataPoint { min, mean, max }
     }
 
+    let stats: Vec<(f32, Points)> = all_data
+        .iter()
+        .filter(|r| r.group.as_deref() == Some(group))
+        .map(|r| {
+            (
+                x_value(r),
+                r.time_preprocess as f32 / 1000.0, // ms to s
+                r.time_online as f32 / 1000.0,
+                r.time_total as f32 / 1000.0,
+            )
+        })
+        .sorted_by(|a, b| a.0.partial_cmp(&b.0).unwrap())
+        .chunk_by(|entry| entry.0)
+        .into_iter()
+        .map(|(x, group)| {
+            let group_vec: Vec<_> = group.collect();
+            let preprocess = data_point(
+                &group_vec
+                    .iter()
+                    .map(|(_, t, _, _)| *t)
+                    .collect::<Vec<f32>>(),
+            );
+            let online = data_point(
+                &group_vec
+                    .iter()
+                    .map(|(_, _, t, _)| *t)
+                    .collect::<Vec<f32>>(),
+            );
+            let total = data_point(
+                &group_vec
+                    .iter()
+                    .map(|(_, _, _, t)| *t)
+                    .collect::<Vec<f32>>(),
+            );
+            (
+                x,
+                Points {
+                    preprocess,
+                    online,
+                    total,
+                },
+            )
+        })
+        .collect();
+
     let mut chart = Chart::new()
         .title(
             Title::new()
@@ -207,6 +179,14 @@ fn plot_runtime_vs(
                 .subtext_style(TextStyle::new().font_size(16)),
         )
         .tooltip(Tooltip::new().trigger(Trigger::Axis))
+        .legend(
+            Legend::new()
+                .data(vec!["Preprocess Mean", "Online Mean", "Total Mean"])
+                .top("80")
+                .right("110")
+                .orient(Orient::Vertical)
+                .item_gap(10),
+        )
         .x_axis(
             Axis::new()
                 .name(x_axis_label)
@@ -225,156 +205,73 @@ fn plot_runtime_vs(
                 .name_text_style(TextStyle::new().font_size(21)),
         );
 
-    // Add legend with conditional positioning
-    let legend = Legend::new()
-        .data(legend_data)
-        .top("80")
-        .orient(Orient::Vertical)
-        .item_gap(10);
+    chart = add_mean_series(chart, &stats, "Preprocess Mean", |p| p.preprocess.mean);
+    chart = add_mean_series(chart, &stats, "Online Mean", |p| p.online.mean);
+    chart = add_mean_series(chart, &stats, "Total Mean", |p| p.total.mean);
 
-    let legend = if legend_left {
-        legend.left("110")
-    } else {
-        legend.right("110")
-    };
-
-    chart = chart.legend(legend);
-
-    // Define colors for each dataset
-    let colors = vec![
-        "#5470c6", "#91cc75", "#fac858", "#ee6666", "#73c0de", "#3ba272", "#fc8452", "#9a60b4",
-    ];
-
-    for (idx, label) in labels.iter().enumerate() {
-        let color = colors.get(idx % colors.len()).unwrap();
-
-        // Total time - solid line
-        chart = add_dataset_series(
-            &chart,
-            &stats_df,
-            label,
-            &format!("Total Mean ({})", label),
-            "total_mean",
-            false,
-            color,
-        )?;
-
-        // Online time - dashed line (same color as total)
-        chart = add_dataset_series(
-            &chart,
-            &stats_df,
-            label,
-            &format!("Online Mean ({})", label),
-            "online_mean",
-            true,
-            color,
-        )?;
-
-        if show_min_max {
-            chart = add_dataset_min_max_band(
-                &chart,
-                &stats_df,
-                label,
-                &format!("Total Min/Max ({})", label),
-                "total",
-                color,
-            )?;
-        }
+    if show_min_max {
+        chart = add_min_max_band(
+            chart,
+            &stats,
+            "Preprocess Min/Max",
+            |p| &p.preprocess,
+            "#ccc",
+        );
+        chart = add_min_max_band(chart, &stats, "Online Min/Max", |p| &p.online, "#ccc");
+        chart = add_min_max_band(chart, &stats, "Total Min/Max", |p| &p.total, "#ccc");
     }
-    // Save the chart as HTML file (no theme)
+    // Save the chart as HTML file.
     HtmlRenderer::new(title, 1000, 800)
-        .save(&chart, &format!("{}.html", output_file))
-        .unwrap();
-
-    // Save SVG with default theme
-    ImageRenderer::new(1000, 800)
-        .theme(Theme::Default)
-        .save(&chart, &format!("{}.svg", output_file))
-        .unwrap();
-
-    // Save SVG with dark theme
-    ImageRenderer::new(1000, 800)
-        .theme(Theme::Dark)
-        .save(&chart, &format!("{}_dark.svg", output_file))
+        .theme(THEME)
+        .save(&chart, output_file)
         .unwrap();
 
     Ok(chart)
 }
 
-fn add_dataset_series(
-    chart: &Chart,
-    df: &DataFrame,
-    dataset_label: &str,
-    series_name: &str,
-    col_name: &str,
-    dashed: bool,
-    color: &str,
-) -> Result<Chart, Box<dyn std::error::Error>> {
-    // Filter for specific dataset
-    let mask = df.column("dataset_label")?.str()?.equal(dataset_label);
-    let filtered = df.filter(&mask)?;
-
-    let x = filtered.column("x")?.f32()?;
-    let y = filtered.column(col_name)?.f32()?;
-
-    let data: Vec<Vec<f32>> = x
-        .into_iter()
-        .zip(y.into_iter())
-        .filter_map(|(x, y)| Some(vec![x?, y?]))
-        .collect();
-
-    let mut line = Line::new()
-        .name(series_name)
-        .data(data)
-        .symbol_size(6)
-        .item_style(ItemStyle::new().color(color));
-
-    let mut line_style = LineStyle::new();
-    if dashed {
-        line_style = line_style.type_(LineStyleType::Dashed);
-    }
-    line = line.line_style(line_style.color(color));
-
-    Ok(chart.clone().series(line))
-}
-
-fn add_dataset_min_max_band(
-    chart: &Chart,
-    df: &DataFrame,
-    dataset_label: &str,
+fn add_mean_series(
+    chart: Chart,
+    stats: &[(f32, Points)],
     name: &str,
-    col_prefix: &str,
-    color: &str,
-) -> Result<Chart, Box<dyn std::error::Error>> {
-    // Filter for specific dataset
-    let mask = df.column("dataset_label")?.str()?.equal(dataset_label);
-    let filtered = df.filter(&mask)?;
-
-    let x = filtered.column("x")?.f32()?;
-    let min_col = filtered.column(&format!("{}_min", col_prefix))?.f32()?;
-    let max_col = filtered.column(&format!("{}_max", col_prefix))?.f32()?;
-
-    let max_data: Vec<Vec<f32>> = x
-        .into_iter()
-        .zip(max_col.into_iter())
-        .filter_map(|(x, y)| Some(vec![x?, y?]))
-        .collect();
-
-    let min_data: Vec<Vec<f32>> = x
-        .into_iter()
-        .zip(min_col.into_iter())
-        .filter_map(|(x, y)| Some(vec![x?, y?]))
-        .rev()
-        .collect();
-
-    let data: Vec<Vec<f32>> = max_data.into_iter().chain(min_data).collect();
-
-    Ok(chart.clone().series(
+    extract: impl Fn(&Points) -> f32,
+) -> Chart {
+    chart.series(
         Line::new()
             .name(name)
-            .data(data)
+            .data(
+                stats
+                    .iter()
+                    .map(|(x, points)| vec![*x, extract(points)])
+                    .collect(),
+            )
+            .symbol_size(6),
+    )
+}
+
+fn add_min_max_band(
+    chart: Chart,
+    stats: &[(f32, Points)],
+    name: &str,
+    extract: impl Fn(&Points) -> &DataPoint,
+    color: &str,
+) -> Chart {
+    chart.series(
+        Line::new()
+            .name(name)
+            .data(
+                stats
+                    .iter()
+                    .map(|(x, points)| vec![*x, extract(points).max])
+                    .chain(
+                        stats
+                            .iter()
+                            .rev()
+                            .map(|(x, points)| vec![*x, extract(points).min]),
+                    )
+                    .collect(),
+            )
             .show_symbol(false)
             .line_style(LineStyle::new().opacity(0.0))
             .area_style(AreaStyle::new().opacity(0.3).color(color)),
-    ))
+    )
 }

crates/harness/runner/Cargo.toml

@@ -7,10 +7,6 @@ publish = false
 [lib]
 name = "harness_runner"
 
-[features]
-# Used to debug the runner itself.
-debug = []
-
 [dependencies]
 tlsn-harness-core = { workspace = true }
 tlsn-server-fixture = { workspace = true }

crates/harness/runner/src/debug_prelude.rs

@@ -1,17 +0,0 @@
-#![allow(unused_imports)]
-pub use futures::FutureExt;
-
-pub use tracing::{debug, error};
-
-pub use chromiumoxide::{
-    Browser, Page,
-    cdp::{
-        browser_protocol::{
-            log::{EventEntryAdded, LogEntryLevel},
-            network::{EnableParams, SetCacheDisabledParams},
-            page::ReloadParams,
-        },
-        js_protocol::runtime::EventExceptionThrown,
-    },
-    handler::HandlerConfig,
-};