fix: attestation example (#1030)

* fix(example): close prover (#1025)

* fix: provide encoder secret to attestation

.github/workflows/ci.yml

@@ -18,10 +18,10 @@ env:
   # We need a higher number of parallel rayon tasks than the default (which is 4)
   # in order to prevent a deadlock, c.f.
   #   - https://github.com/tlsnotary/tlsn/issues/548
-  #   - https://github.com/privacy-scaling-explorations/mpz/issues/178
+  #   - https://github.com/privacy-ethereum/mpz/issues/178
   # 32 seems to be big enough for the foreseeable future
   RAYON_NUM_THREADS: 32
-  RUST_VERSION: 1.89.0
+  RUST_VERSION: 1.90.0
 
 jobs:
   clippy:
@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@master
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: clippy
@@ -41,7 +41,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.7.7
 
       - name: Clippy
-        run: cargo clippy --keep-going --all-features --all-targets --locked -- -D warnings
+        run: cargo clippy --keep-going --all-features --all-targets --locked
 
   fmt:
     name: Check formatting

.github/workflows/releng.yml

@@ -6,7 +6,7 @@ on:
       tag:
         description: 'Tag to publish to NPM'
         required: true
-        default: 'v0.1.0-alpha.13-pre'
+        default: 'v0.1.0-alpha.13'
 
 jobs:
   release:

.github/workflows/rustdoc.yml

@@ -23,7 +23,6 @@ jobs:
       - name: "rustdoc"
         run: crates/wasm/build-docs.sh
 
-
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v3
         if: ${{ github.ref == 'refs/heads/dev' }}

Cargo.toml

@@ -66,19 +66,20 @@ tlsn-harness-runner = { path = "crates/harness/runner" }
 tlsn-wasm = { path = "crates/wasm" }
 tlsn = { path = "crates/tlsn" }
 
-mpz-circuits = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-memory-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-common = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-vm-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-garble = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-garble-core = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-ole = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-ot = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-share-conversion = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-fields = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-zk = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
-mpz-hash = { git = "https://github.com/privacy-scaling-explorations/mpz", rev = "6432a43" }
+mpz-circuits = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-memory-core = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-common = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-core = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-vm-core = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-garble = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-garble-core = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-ole = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-ot = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-share-conversion = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-fields = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-zk = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-hash = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
+mpz-ideal-vm = { git = "https://github.com/privacy-ethereum/mpz", tag = "v0.1.0-alpha.4" }
 
 rangeset = { version = "0.2" }
 serio = { version = "0.2" }
@@ -86,6 +87,7 @@ spansy = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6168663" }
 uid-mux = { version = "0.2" }
 websocket-relay = { git = "https://github.com/tlsnotary/tlsn-utils", rev = "6168663" }
 
+aead = { version = "0.4" }
 aes = { version = "0.8" }
 aes-gcm = { version = "0.9" }
 anyhow = { version = "1.0" }
@@ -109,7 +111,7 @@ elliptic-curve = { version = "0.13" }
 enum-try-as-inner = { version = "0.1" }
 env_logger = { version = "0.10" }
 futures = { version = "0.3" }
-futures-rustls = { version = "0.26" }
+futures-rustls = { version = "0.25" }
 generic-array = { version = "0.14" }
 ghash = { version = "0.5" }
 hex = { version = "0.4" }

crates/attestation/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-attestation"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2024"
 
 [features]
@@ -23,9 +23,9 @@ thiserror = { workspace = true }
 tiny-keccak = { workspace = true, features = ["keccak"] }
 
 [dev-dependencies]
-alloy-primitives = { version = "0.8.22", default-features = false }
-alloy-signer = { version = "0.12", default-features = false }
-alloy-signer-local = { version = "0.12", default-features = false }
+alloy-primitives = { version = "1.3.1", default-features = false }
+alloy-signer = { version = "1.0", default-features = false }
+alloy-signer-local = { version = "1.0", default-features = false }
 rand06-compat = { workspace = true }
 rstest = { workspace = true }
 tlsn-core = { workspace = true, features = ["fixtures"] }

crates/attestation/src/builder.rs

@@ -5,7 +5,7 @@ use rand::{Rng, rng};
 use tlsn_core::{
     connection::{ConnectionInfo, ServerEphemKey},
     hash::HashAlgId,
-    transcript::TranscriptCommitment,
+    transcript::{TranscriptCommitment, encoding::EncoderSecret},
 };
 
 use crate::{
@@ -25,6 +25,7 @@ pub struct Sign {
     connection_info: Option<ConnectionInfo>,
     server_ephemeral_key: Option<ServerEphemKey>,
     cert_commitment: ServerCertCommitment,
+    encoder_secret: Option<EncoderSecret>,
     extensions: Vec<Extension>,
     transcript_commitments: Vec<TranscriptCommitment>,
 }
@@ -86,6 +87,7 @@ impl<'a> AttestationBuilder<'a, Accept> {
                 connection_info: None,
                 server_ephemeral_key: None,
                 cert_commitment,
+                encoder_secret: None,
                 transcript_commitments: Vec::new(),
                 extensions,
             },
@@ -106,6 +108,12 @@ impl AttestationBuilder<'_, Sign> {
         self
     }
 
+    /// Sets the secret for encoding commitments.
+    pub fn encoder_secret(&mut self, secret: EncoderSecret) -> &mut Self {
+        self.state.encoder_secret = Some(secret);
+        self
+    }
+
     /// Adds an extension to the attestation.
     pub fn extension(&mut self, extension: Extension) -> &mut Self {
         self.state.extensions.push(extension);
@@ -129,6 +137,7 @@ impl AttestationBuilder<'_, Sign> {
             connection_info,
             server_ephemeral_key,
             cert_commitment,
+            encoder_secret,
             extensions,
             transcript_commitments,
         } = self.state;
@@ -159,6 +168,7 @@ impl AttestationBuilder<'_, Sign> {
                 AttestationBuilderError::new(ErrorKind::Field, "handshake data was not set")
             })?),
             cert_commitment: field_id.next(cert_commitment),
+            encoder_secret: encoder_secret.map(|secret| field_id.next(secret)),
             extensions: extensions
                 .into_iter()
                 .map(|extension| field_id.next(extension))

crates/attestation/src/lib.rs

@@ -219,7 +219,7 @@ use tlsn_core::{
     connection::{ConnectionInfo, ServerEphemKey},
     hash::{Hash, HashAlgorithm, TypedHash},
     merkle::MerkleTree,
-    transcript::TranscriptCommitment,
+    transcript::{TranscriptCommitment, encoding::EncoderSecret},
 };
 
 use crate::{
@@ -327,6 +327,7 @@ pub struct Body {
     connection_info: Field<ConnectionInfo>,
     server_ephemeral_key: Field<ServerEphemKey>,
     cert_commitment: Field<ServerCertCommitment>,
+    encoder_secret: Option<Field<EncoderSecret>>,
     extensions: Vec<Field<Extension>>,
     transcript_commitments: Vec<Field<TranscriptCommitment>>,
 }
@@ -372,6 +373,7 @@ impl Body {
             connection_info: conn_info,
             server_ephemeral_key,
             cert_commitment,
+            encoder_secret,
             extensions,
             transcript_commitments,
         } = self;
@@ -389,6 +391,13 @@ impl Body {
             ),
         ];
 
+        if let Some(encoder_secret) = encoder_secret {
+            fields.push((
+                encoder_secret.id,
+                hasher.hash_separated(&encoder_secret.data),
+            ));
+        }
+
         for field in extensions.iter() {
             fields.push((field.id, hasher.hash_separated(&field.data)));
         }

crates/attestation/src/presentation.rs

@@ -91,6 +91,11 @@ impl Presentation {
                 transcript.verify_with_provider(
                     &provider.hash,
                     &attestation.body.connection_info().transcript_length,
+                    attestation
+                        .body
+                        .encoder_secret
+                        .as_ref()
+                        .map(|field| &field.data),
                     attestation.body.transcript_commitments(),
                 )
             })

crates/attestation/src/serialize.rs

@@ -49,5 +49,6 @@ impl_domain_separator!(tlsn_core::connection::ConnectionInfo);
 impl_domain_separator!(tlsn_core::connection::CertBinding);
 impl_domain_separator!(tlsn_core::transcript::TranscriptCommitment);
 impl_domain_separator!(tlsn_core::transcript::TranscriptSecret);
+impl_domain_separator!(tlsn_core::transcript::encoding::EncoderSecret);
 impl_domain_separator!(tlsn_core::transcript::encoding::EncodingCommitment);
 impl_domain_separator!(tlsn_core::transcript::hash::PlaintextHash);

crates/attestation/tests/api.rs

@@ -64,7 +64,6 @@ fn test_api() {
 
     let encoding_commitment = EncodingCommitment {
         root: encoding_tree.root(),
-        secret: encoder_secret(),
     };
 
     let request_config = RequestConfig::default();
@@ -96,6 +95,7 @@ fn test_api() {
         .connection_info(connection_info.clone())
         // Server key Notary received during handshake
         .server_ephemeral_key(server_ephemeral_key)
+        .encoder_secret(encoder_secret())
         .transcript_commitments(vec![TranscriptCommitment::Encoding(encoding_commitment)]);
 
     let attestation = attestation_builder.build(&provider).unwrap();

crates/components/cipher/Cargo.toml

@@ -5,7 +5,7 @@ description = "This crate provides implementations of ciphers for two parties"
 keywords = ["tls", "mpc", "2pc", "aes"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/components/deap/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-deap"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/components/hmac-sha256/Cargo.toml

@@ -5,7 +5,7 @@ description = "A 2PC implementation of TLS HMAC-SHA256 PRF"
 keywords = ["tls", "mpc", "2pc", "hmac", "sha256"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/components/key-exchange/Cargo.toml

@@ -5,7 +5,7 @@ description = "Implementation of the 3-party key-exchange protocol"
 keywords = ["tls", "mpc", "2pc", "pms", "key-exchange"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/core/Cargo.toml

@@ -5,7 +5,7 @@ description = "Core types for TLSNotary"
 keywords = ["tls", "mpc", "2pc", "types"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]
@@ -13,7 +13,13 @@ workspace = true
 
 [features]
 default = []
-fixtures = ["dep:hex", "dep:tlsn-data-fixtures"]
+fixtures = [
+    "dep:hex",
+    "dep:tlsn-data-fixtures",
+    "dep:aead",
+    "dep:aes-gcm",
+    "dep:generic-array",
+]
 
 [dependencies]
 tlsn-data-fixtures = { workspace = true, optional = true }
@@ -21,6 +27,9 @@ tlsn-tls-core = { workspace = true, features = ["serde"] }
 tlsn-utils = { workspace = true }
 rangeset = { workspace = true, features = ["serde"] }
 
+aead = { workspace = true, features = ["alloc"], optional = true }
+aes-gcm = { workspace = true, optional = true }
+generic-array = { workspace = true, optional = true }
 bimap = { version = "0.6", features = ["serde"] }
 blake3 = { workspace = true }
 hex = { workspace = true, optional = true }
@@ -39,9 +48,12 @@ webpki-roots = { workspace = true }
 rustls-webpki = { workspace = true, features = ["ring"] }
 rustls-pki-types = { workspace = true }
 itybity = { workspace = true }
-zeroize = { workspace = true }
+zeroize = { workspace = true, features = ["zeroize_derive"] }
 
 [dev-dependencies]
+aead = { workspace = true, features = ["alloc"] }
+aes-gcm = { workspace = true }
+generic-array = { workspace = true }
 bincode = { workspace = true }
 hex = { workspace = true }
 rstest = { workspace = true }

crates/core/src/connection.rs

@@ -116,84 +116,75 @@ pub enum KeyType {
     SECP256R1 = 0x0017,
 }
 
-/// Signature scheme on the key exchange parameters.
+/// Signature algorithm used on the key exchange parameters.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
 #[allow(non_camel_case_types, missing_docs)]
-pub enum SignatureScheme {
-    RSA_PKCS1_SHA1 = 0x0201,
-    ECDSA_SHA1_Legacy = 0x0203,
-    RSA_PKCS1_SHA256 = 0x0401,
-    ECDSA_NISTP256_SHA256 = 0x0403,
-    RSA_PKCS1_SHA384 = 0x0501,
-    ECDSA_NISTP384_SHA384 = 0x0503,
-    RSA_PKCS1_SHA512 = 0x0601,
-    ECDSA_NISTP521_SHA512 = 0x0603,
-    RSA_PSS_SHA256 = 0x0804,
-    RSA_PSS_SHA384 = 0x0805,
-    RSA_PSS_SHA512 = 0x0806,
-    ED25519 = 0x0807,
+pub enum SignatureAlgorithm {
+    ECDSA_NISTP256_SHA256,
+    ECDSA_NISTP256_SHA384,
+    ECDSA_NISTP384_SHA256,
+    ECDSA_NISTP384_SHA384,
+    ED25519,
+    RSA_PKCS1_2048_8192_SHA256,
+    RSA_PKCS1_2048_8192_SHA384,
+    RSA_PKCS1_2048_8192_SHA512,
+    RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
+    RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
+    RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
 }
 
-impl fmt::Display for SignatureScheme {
+impl fmt::Display for SignatureAlgorithm {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            SignatureScheme::RSA_PKCS1_SHA1 => write!(f, "RSA_PKCS1_SHA1"),
-            SignatureScheme::ECDSA_SHA1_Legacy => write!(f, "ECDSA_SHA1_Legacy"),
-            SignatureScheme::RSA_PKCS1_SHA256 => write!(f, "RSA_PKCS1_SHA256"),
-            SignatureScheme::ECDSA_NISTP256_SHA256 => write!(f, "ECDSA_NISTP256_SHA256"),
-            SignatureScheme::RSA_PKCS1_SHA384 => write!(f, "RSA_PKCS1_SHA384"),
-            SignatureScheme::ECDSA_NISTP384_SHA384 => write!(f, "ECDSA_NISTP384_SHA384"),
-            SignatureScheme::RSA_PKCS1_SHA512 => write!(f, "RSA_PKCS1_SHA512"),
-            SignatureScheme::ECDSA_NISTP521_SHA512 => write!(f, "ECDSA_NISTP521_SHA512"),
-            SignatureScheme::RSA_PSS_SHA256 => write!(f, "RSA_PSS_SHA256"),
-            SignatureScheme::RSA_PSS_SHA384 => write!(f, "RSA_PSS_SHA384"),
-            SignatureScheme::RSA_PSS_SHA512 => write!(f, "RSA_PSS_SHA512"),
-            SignatureScheme::ED25519 => write!(f, "ED25519"),
+            SignatureAlgorithm::ECDSA_NISTP256_SHA256 => write!(f, "ECDSA_NISTP256_SHA256"),
+            SignatureAlgorithm::ECDSA_NISTP256_SHA384 => write!(f, "ECDSA_NISTP256_SHA384"),
+            SignatureAlgorithm::ECDSA_NISTP384_SHA256 => write!(f, "ECDSA_NISTP384_SHA256"),
+            SignatureAlgorithm::ECDSA_NISTP384_SHA384 => write!(f, "ECDSA_NISTP384_SHA384"),
+            SignatureAlgorithm::ED25519 => write!(f, "ED25519"),
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256 => {
+                write!(f, "RSA_PKCS1_2048_8192_SHA256")
+            }
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384 => {
+                write!(f, "RSA_PKCS1_2048_8192_SHA384")
+            }
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512 => {
+                write!(f, "RSA_PKCS1_2048_8192_SHA512")
+            }
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
+                write!(f, "RSA_PSS_2048_8192_SHA256_LEGACY_KEY")
+            }
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
+                write!(f, "RSA_PSS_2048_8192_SHA384_LEGACY_KEY")
+            }
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
+                write!(f, "RSA_PSS_2048_8192_SHA512_LEGACY_KEY")
+            }
         }
     }
 }
 
-impl TryFrom<tls_core::msgs::enums::SignatureScheme> for SignatureScheme {
-    type Error = &'static str;
-
-    fn try_from(value: tls_core::msgs::enums::SignatureScheme) -> Result<Self, Self::Error> {
-        use tls_core::msgs::enums::SignatureScheme as Core;
-        use SignatureScheme::*;
-        Ok(match value {
-            Core::RSA_PKCS1_SHA1 => RSA_PKCS1_SHA1,
-            Core::ECDSA_SHA1_Legacy => ECDSA_SHA1_Legacy,
-            Core::RSA_PKCS1_SHA256 => RSA_PKCS1_SHA256,
-            Core::ECDSA_NISTP256_SHA256 => ECDSA_NISTP256_SHA256,
-            Core::RSA_PKCS1_SHA384 => RSA_PKCS1_SHA384,
-            Core::ECDSA_NISTP384_SHA384 => ECDSA_NISTP384_SHA384,
-            Core::RSA_PKCS1_SHA512 => RSA_PKCS1_SHA512,
-            Core::ECDSA_NISTP521_SHA512 => ECDSA_NISTP521_SHA512,
-            Core::RSA_PSS_SHA256 => RSA_PSS_SHA256,
-            Core::RSA_PSS_SHA384 => RSA_PSS_SHA384,
-            Core::RSA_PSS_SHA512 => RSA_PSS_SHA512,
-            Core::ED25519 => ED25519,
-            _ => return Err("unsupported signature scheme"),
-        })
-    }
-}
-
-impl From<SignatureScheme> for tls_core::msgs::enums::SignatureScheme {
-    fn from(value: SignatureScheme) -> Self {
-        use tls_core::msgs::enums::SignatureScheme::*;
+impl From<tls_core::verify::SignatureAlgorithm> for SignatureAlgorithm {
+    fn from(value: tls_core::verify::SignatureAlgorithm) -> Self {
+        use tls_core::verify::SignatureAlgorithm as Core;
         match value {
-            SignatureScheme::RSA_PKCS1_SHA1 => RSA_PKCS1_SHA1,
-            SignatureScheme::ECDSA_SHA1_Legacy => ECDSA_SHA1_Legacy,
-            SignatureScheme::RSA_PKCS1_SHA256 => RSA_PKCS1_SHA256,
-            SignatureScheme::ECDSA_NISTP256_SHA256 => ECDSA_NISTP256_SHA256,
-            SignatureScheme::RSA_PKCS1_SHA384 => RSA_PKCS1_SHA384,
-            SignatureScheme::ECDSA_NISTP384_SHA384 => ECDSA_NISTP384_SHA384,
-            SignatureScheme::RSA_PKCS1_SHA512 => RSA_PKCS1_SHA512,
-            SignatureScheme::ECDSA_NISTP521_SHA512 => ECDSA_NISTP521_SHA512,
-            SignatureScheme::RSA_PSS_SHA256 => RSA_PSS_SHA256,
-            SignatureScheme::RSA_PSS_SHA384 => RSA_PSS_SHA384,
-            SignatureScheme::RSA_PSS_SHA512 => RSA_PSS_SHA512,
-            SignatureScheme::ED25519 => ED25519,
+            Core::ECDSA_NISTP256_SHA256 => SignatureAlgorithm::ECDSA_NISTP256_SHA256,
+            Core::ECDSA_NISTP256_SHA384 => SignatureAlgorithm::ECDSA_NISTP256_SHA384,
+            Core::ECDSA_NISTP384_SHA256 => SignatureAlgorithm::ECDSA_NISTP384_SHA256,
+            Core::ECDSA_NISTP384_SHA384 => SignatureAlgorithm::ECDSA_NISTP384_SHA384,
+            Core::ED25519 => SignatureAlgorithm::ED25519,
+            Core::RSA_PKCS1_2048_8192_SHA256 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256,
+            Core::RSA_PKCS1_2048_8192_SHA384 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384,
+            Core::RSA_PKCS1_2048_8192_SHA512 => SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512,
+            Core::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
+                SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY
+            }
+            Core::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
+                SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY
+            }
+            Core::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
+                SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY
+            }
         }
     }
 }
@@ -201,8 +192,8 @@ impl From<SignatureScheme> for tls_core::msgs::enums::SignatureScheme {
 /// Server's signature of the key exchange parameters.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServerSignature {
-    /// Signature scheme.
-    pub scheme: SignatureScheme,
+    /// Signature algorithm.
+    pub alg: SignatureAlgorithm,
     /// Signature data.
     pub sig: Vec<u8>,
 }
@@ -359,20 +350,23 @@ impl HandshakeData {
         message.extend_from_slice(&server_ephemeral_key.kx_params());
 
         use webpki::ring as alg;
-        let sig_alg = match self.sig.scheme {
-            SignatureScheme::RSA_PKCS1_SHA256 => alg::RSA_PKCS1_2048_8192_SHA256,
-            SignatureScheme::RSA_PKCS1_SHA384 => alg::RSA_PKCS1_2048_8192_SHA384,
-            SignatureScheme::RSA_PKCS1_SHA512 => alg::RSA_PKCS1_2048_8192_SHA512,
-            SignatureScheme::RSA_PSS_SHA256 => alg::RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
-            SignatureScheme::RSA_PSS_SHA384 => alg::RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
-            SignatureScheme::RSA_PSS_SHA512 => alg::RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
-            SignatureScheme::ECDSA_NISTP256_SHA256 => alg::ECDSA_P256_SHA256,
-            SignatureScheme::ECDSA_NISTP384_SHA384 => alg::ECDSA_P384_SHA384,
-            SignatureScheme::ED25519 => alg::ED25519,
-            scheme => {
-                return Err(HandshakeVerificationError::UnsupportedSignatureScheme(
-                    scheme,
-                ))
+        let sig_alg = match self.sig.alg {
+            SignatureAlgorithm::ECDSA_NISTP256_SHA256 => alg::ECDSA_P256_SHA256,
+            SignatureAlgorithm::ECDSA_NISTP256_SHA384 => alg::ECDSA_P256_SHA384,
+            SignatureAlgorithm::ECDSA_NISTP384_SHA256 => alg::ECDSA_P384_SHA256,
+            SignatureAlgorithm::ECDSA_NISTP384_SHA384 => alg::ECDSA_P384_SHA384,
+            SignatureAlgorithm::ED25519 => alg::ED25519,
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256 => alg::RSA_PKCS1_2048_8192_SHA256,
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384 => alg::RSA_PKCS1_2048_8192_SHA384,
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512 => alg::RSA_PKCS1_2048_8192_SHA512,
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY => {
+                alg::RSA_PSS_2048_8192_SHA256_LEGACY_KEY
+            }
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY => {
+                alg::RSA_PSS_2048_8192_SHA384_LEGACY_KEY
+            }
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY => {
+                alg::RSA_PSS_2048_8192_SHA512_LEGACY_KEY
             }
         };
 
@@ -402,8 +396,6 @@ pub enum HandshakeVerificationError {
     InvalidServerEphemeralKey,
     #[error("server certificate verification failed: {0}")]
     ServerCert(ServerCertVerifierError),
-    #[error("unsupported signature scheme: {0}")]
-    UnsupportedSignatureScheme(SignatureScheme),
 }
 
 #[cfg(test)]

crates/core/src/display.rs

@@ -0,0 +1,16 @@
+use rangeset::RangeSet;
+
+pub(crate) struct FmtRangeSet<'a>(pub &'a RangeSet<usize>);
+
+impl<'a> std::fmt::Display for FmtRangeSet<'a> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("{")?;
+        for range in self.0.iter_ranges() {
+            write!(f, "{}..{}", range.start, range.end)?;
+            if range.end < self.0.end().unwrap_or(0) {
+                f.write_str(", ")?;
+            }
+        }
+        f.write_str("}")
+    }
+}

crates/core/src/fixtures.rs

@@ -1,6 +1,7 @@
 //! Fixtures for testing
 
 mod provider;
+pub mod transcript;
 
 pub use provider::FixtureEncodingProvider;
 
@@ -9,7 +10,8 @@ use hex::FromHex;
 use crate::{
     connection::{
         CertBinding, CertBindingV1_2, ConnectionInfo, DnsName, HandshakeData, KeyType,
-        ServerEphemKey, ServerName, ServerSignature, SignatureScheme, TlsVersion, TranscriptLength,
+        ServerEphemKey, ServerName, ServerSignature, SignatureAlgorithm, TlsVersion,
+        TranscriptLength,
     },
     transcript::{
         encoding::{EncoderSecret, EncodingProvider},
@@ -46,7 +48,7 @@ impl ConnectionFixture {
                     CertificateDer(include_bytes!("fixtures/data/tlsnotary.org/ca.der").to_vec()),
                 ],
                 sig: ServerSignature {
-                    scheme: SignatureScheme::RSA_PKCS1_SHA256,
+                    alg: SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256,
                     sig: Vec::<u8>::from_hex(include_bytes!(
                         "fixtures/data/tlsnotary.org/signature"
                     ))
@@ -91,7 +93,7 @@ impl ConnectionFixture {
                     CertificateDer(include_bytes!("fixtures/data/appliedzkp.org/ca.der").to_vec()),
                 ],
                 sig: ServerSignature {
-                    scheme: SignatureScheme::ECDSA_NISTP256_SHA256,
+                    alg: SignatureAlgorithm::ECDSA_NISTP256_SHA256,
                     sig: Vec::<u8>::from_hex(include_bytes!(
                         "fixtures/data/appliedzkp.org/signature"
                     ))

crates/core/src/fixtures/transcript.rs

@@ -0,0 +1,199 @@
+//! Transcript fixtures for testing.
+
+use aead::Payload as AeadPayload;
+use aes_gcm::{aead::Aead, Aes128Gcm, NewAead};
+use generic_array::GenericArray;
+use rand::{rngs::StdRng, Rng, SeedableRng};
+use tls_core::msgs::{
+    base::Payload,
+    codec::Codec,
+    enums::{ContentType, HandshakeType, ProtocolVersion},
+    handshake::{HandshakeMessagePayload, HandshakePayload},
+    message::{OpaqueMessage, PlainMessage},
+};
+
+use crate::{
+    connection::{TranscriptLength, VerifyData},
+    fixtures::ConnectionFixture,
+    transcript::{Record, TlsTranscript},
+};
+
+/// The key used for encryption of the sent and received transcript.
+pub const KEY: [u8; 16] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+
+/// The iv used for encryption of the sent and received transcript.
+pub const IV: [u8; 4] = [1, 3, 3, 7];
+
+/// The record size in bytes.
+pub const RECORD_SIZE: usize = 512;
+
+/// Creates a transript fixture for testing.
+pub fn transcript_fixture(sent: &[u8], recv: &[u8]) -> TlsTranscript {
+    TranscriptGenerator::new(KEY, IV).generate(sent, recv)
+}
+
+struct TranscriptGenerator {
+    key: [u8; 16],
+    iv: [u8; 4],
+}
+
+impl TranscriptGenerator {
+    fn new(key: [u8; 16], iv: [u8; 4]) -> Self {
+        Self { key, iv }
+    }
+
+    fn generate(&self, sent: &[u8], recv: &[u8]) -> TlsTranscript {
+        let mut rng = StdRng::from_seed([1; 32]);
+
+        let transcript_len = TranscriptLength {
+            sent: sent.len() as u32,
+            received: recv.len() as u32,
+        };
+        let tlsn = ConnectionFixture::tlsnotary(transcript_len);
+
+        let time = tlsn.connection_info.time;
+        let version = tlsn.connection_info.version;
+        let server_cert_chain = tlsn.server_cert_data.certs;
+        let server_signature = tlsn.server_cert_data.sig;
+        let cert_binding = tlsn.server_cert_data.binding;
+
+        let cf_vd: [u8; 12] = rng.random();
+        let sf_vd: [u8; 12] = rng.random();
+
+        let verify_data = VerifyData {
+            client_finished: cf_vd.to_vec(),
+            server_finished: sf_vd.to_vec(),
+        };
+
+        let sent = self.gen_records(cf_vd, sent);
+        let recv = self.gen_records(sf_vd, recv);
+
+        TlsTranscript::new(
+            time,
+            version,
+            Some(server_cert_chain),
+            Some(server_signature),
+            cert_binding,
+            verify_data,
+            sent,
+            recv,
+        )
+        .unwrap()
+    }
+
+    fn gen_records(&self, vd: [u8; 12], plaintext: &[u8]) -> Vec<Record> {
+        let mut records = Vec::new();
+
+        let handshake = self.gen_handshake(vd);
+        records.push(handshake);
+
+        for (seq, msg) in (1_u64..).zip(plaintext.chunks(RECORD_SIZE)) {
+            let record = self.gen_app_data(seq, msg);
+            records.push(record);
+        }
+
+        records
+    }
+
+    fn gen_app_data(&self, seq: u64, plaintext: &[u8]) -> Record {
+        assert!(
+            plaintext.len() <= 1 << 14,
+            "plaintext len per record must be smaller than 2^14 bytes"
+        );
+
+        let explicit_nonce: [u8; 8] = seq.to_be_bytes();
+        let msg = PlainMessage {
+            typ: ContentType::ApplicationData,
+            version: ProtocolVersion::TLSv1_2,
+            payload: Payload::new(plaintext),
+        };
+        let opaque = aes_gcm_encrypt(self.key, self.iv, seq, explicit_nonce, &msg);
+
+        let mut payload = opaque.payload.0;
+        let mut ciphertext = payload.split_off(8);
+        let tag = ciphertext.split_off(ciphertext.len() - 16);
+
+        Record {
+            seq,
+            typ: ContentType::ApplicationData,
+            plaintext: Some(plaintext.to_vec()),
+            explicit_nonce: explicit_nonce.to_vec(),
+            ciphertext,
+            tag: Some(tag),
+        }
+    }
+
+    fn gen_handshake(&self, vd: [u8; 12]) -> Record {
+        let seq = 0_u64;
+        let explicit_nonce = seq.to_be_bytes();
+
+        let mut plaintext = Vec::new();
+
+        let payload = Payload(vd.to_vec());
+        let hs_payload = HandshakePayload::Finished(payload);
+        let handshake_message = HandshakeMessagePayload {
+            typ: HandshakeType::Finished,
+            payload: hs_payload,
+        };
+        handshake_message.encode(&mut plaintext);
+
+        let msg = PlainMessage {
+            typ: ContentType::Handshake,
+            version: ProtocolVersion::TLSv1_2,
+            payload: Payload::new(plaintext.clone()),
+        };
+
+        let opaque = aes_gcm_encrypt(self.key, self.iv, seq, explicit_nonce, &msg);
+        let mut payload = opaque.payload.0;
+        let mut ciphertext = payload.split_off(8);
+        let tag = ciphertext.split_off(ciphertext.len() - 16);
+
+        Record {
+            seq,
+            typ: ContentType::Handshake,
+            plaintext: Some(plaintext),
+            explicit_nonce: explicit_nonce.to_vec(),
+            ciphertext,
+            tag: Some(tag),
+        }
+    }
+}
+
+fn aes_gcm_encrypt(
+    key: [u8; 16],
+    iv: [u8; 4],
+    seq: u64,
+    explicit_nonce: [u8; 8],
+    msg: &PlainMessage,
+) -> OpaqueMessage {
+    let mut aad = [0u8; 13];
+
+    aad[..8].copy_from_slice(&seq.to_be_bytes());
+    aad[8] = msg.typ.get_u8();
+    aad[9..11].copy_from_slice(&msg.version.get_u16().to_be_bytes());
+    aad[11..13].copy_from_slice(&(msg.payload.0.len() as u16).to_be_bytes());
+    let payload = AeadPayload {
+        msg: &msg.payload.0,
+        aad: &aad,
+    };
+
+    let mut nonce = [0u8; 12];
+    nonce[..4].copy_from_slice(&iv);
+    nonce[4..].copy_from_slice(&explicit_nonce);
+    let nonce = GenericArray::from_slice(&nonce);
+    let cipher = Aes128Gcm::new_from_slice(&key).unwrap();
+
+    // ciphertext will have the MAC appended
+    let ciphertext = cipher.encrypt(nonce, payload).unwrap();
+
+    // prepend the explicit nonce
+    let mut nonce_ct_mac = vec![0u8; 0];
+    nonce_ct_mac.extend(explicit_nonce.iter());
+    nonce_ct_mac.extend(ciphertext.iter());
+
+    OpaqueMessage {
+        typ: msg.typ,
+        version: msg.version,
+        payload: Payload::new(nonce_ct_mac),
+    }
+}

crates/core/src/hash.rs

@@ -191,6 +191,11 @@ impl Hash {
             len: value.len(),
         }
     }
+
+    /// Returns a byte slice of the hash value.
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.value[..self.len]
+    }
 }
 
 impl rs_merkle::Hash for Hash {

crates/core/src/lib.rs

@@ -11,14 +11,16 @@ pub mod hash;
 pub mod merkle;
 pub mod transcript;
 pub mod webpki;
+pub use rangeset;
+pub(crate) mod display;
 
-use rangeset::ToRangeSet;
+use rangeset::{RangeSet, ToRangeSet, UnionMut};
 use serde::{Deserialize, Serialize};
 
 use crate::{
     connection::{HandshakeData, ServerName},
     transcript::{
-        Direction, Idx, PartialTranscript, Transcript, TranscriptCommitConfig,
+        encoding::EncoderSecret, Direction, PartialTranscript, Transcript, TranscriptCommitConfig,
         TranscriptCommitRequest, TranscriptCommitment, TranscriptSecret,
     },
 };
@@ -27,7 +29,7 @@ use crate::{
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ProveConfig {
     server_identity: bool,
-    transcript: Option<PartialTranscript>,
+    reveal: Option<(RangeSet<usize>, RangeSet<usize>)>,
     transcript_commit: Option<TranscriptCommitConfig>,
 }
 
@@ -42,9 +44,9 @@ impl ProveConfig {
         self.server_identity
     }
 
-    /// Returns the transcript to be proven.
-    pub fn transcript(&self) -> Option<&PartialTranscript> {
-        self.transcript.as_ref()
+    /// Returns the ranges of the transcript to be revealed.
+    pub fn reveal(&self) -> Option<&(RangeSet<usize>, RangeSet<usize>)> {
+        self.reveal.as_ref()
     }
 
     /// Returns the transcript commitment configuration.
@@ -58,8 +60,7 @@ impl ProveConfig {
 pub struct ProveConfigBuilder<'a> {
     transcript: &'a Transcript,
     server_identity: bool,
-    reveal_sent: Idx,
-    reveal_recv: Idx,
+    reveal: Option<(RangeSet<usize>, RangeSet<usize>)>,
     transcript_commit: Option<TranscriptCommitConfig>,
 }
 
@@ -69,8 +70,7 @@ impl<'a> ProveConfigBuilder<'a> {
         Self {
             transcript,
             server_identity: false,
-            reveal_sent: Idx::default(),
-            reveal_recv: Idx::default(),
+            reveal: None,
             transcript_commit: None,
         }
     }
@@ -93,22 +93,24 @@ impl<'a> ProveConfigBuilder<'a> {
         direction: Direction,
         ranges: &dyn ToRangeSet<usize>,
     ) -> Result<&mut Self, ProveConfigBuilderError> {
-        let idx = Idx::new(ranges.to_range_set());
+        let idx = ranges.to_range_set();
 
-        if idx.end() > self.transcript.len_of_direction(direction) {
+        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
             return Err(ProveConfigBuilderError(
                 ProveConfigBuilderErrorRepr::IndexOutOfBounds {
                     direction,
-                    actual: idx.end(),
+                    actual: idx.end().unwrap_or(0),
                     len: self.transcript.len_of_direction(direction),
                 },
             ));
         }
 
+        let (sent, recv) = self.reveal.get_or_insert_default();
         match direction {
-            Direction::Sent => self.reveal_sent.union_mut(&idx),
-            Direction::Received => self.reveal_recv.union_mut(&idx),
+            Direction::Sent => sent.union_mut(&idx),
+            Direction::Received => recv.union_mut(&idx),
         }
+
         Ok(self)
     }
 
@@ -120,6 +122,14 @@ impl<'a> ProveConfigBuilder<'a> {
         self.reveal(Direction::Sent, ranges)
     }
 
+    /// Reveals all of the sent data transcript.
+    pub fn reveal_sent_all(&mut self) -> Result<&mut Self, ProveConfigBuilderError> {
+        let len = self.transcript.len_of_direction(Direction::Sent);
+        let (sent, _) = self.reveal.get_or_insert_default();
+        sent.union_mut(&(0..len));
+        Ok(self)
+    }
+
     /// Reveals the given ranges of the received data transcript.
     pub fn reveal_recv(
         &mut self,
@@ -128,20 +138,19 @@ impl<'a> ProveConfigBuilder<'a> {
         self.reveal(Direction::Received, ranges)
     }
 
+    /// Reveals all of the received data transcript.
+    pub fn reveal_recv_all(&mut self) -> Result<&mut Self, ProveConfigBuilderError> {
+        let len = self.transcript.len_of_direction(Direction::Received);
+        let (_, recv) = self.reveal.get_or_insert_default();
+        recv.union_mut(&(0..len));
+        Ok(self)
+    }
+
     /// Builds the configuration.
     pub fn build(self) -> Result<ProveConfig, ProveConfigBuilderError> {
-        let transcript = if !self.reveal_sent.is_empty() || !self.reveal_recv.is_empty() {
-            Some(
-                self.transcript
-                    .to_partial(self.reveal_sent, self.reveal_recv),
-            )
-        } else {
-            None
-        };
-
         Ok(ProveConfig {
             server_identity: self.server_identity,
-            transcript,
+            reveal: self.reveal,
             transcript_commit: self.transcript_commit,
         })
     }
@@ -197,10 +206,10 @@ pub struct VerifyConfigBuilderError(#[from] VerifyConfigBuilderErrorRepr);
 #[derive(Debug, thiserror::Error)]
 enum VerifyConfigBuilderErrorRepr {}
 
-/// Payload sent to the verifier.
+/// Request to prove statements about the connection.
 #[doc(hidden)]
 #[derive(Debug, Serialize, Deserialize)]
-pub struct ProvePayload {
+pub struct ProveRequest {
     /// Handshake data.
     pub handshake: Option<(ServerName, HandshakeData)>,
     /// Transcript data.
@@ -227,6 +236,8 @@ pub struct VerifierOutput {
     pub server_name: Option<ServerName>,
     /// Transcript data.
     pub transcript: Option<PartialTranscript>,
+    /// Encoding commitment secret.
+    pub encoder_secret: Option<EncoderSecret>,
     /// Transcript commitments.
     pub transcript_commitments: Vec<TranscriptCommitment>,
 }

crates/core/src/transcript.rs

@@ -26,7 +26,7 @@ mod tls;
 
 use std::{fmt, ops::Range};
 
-use rangeset::{Difference, IndexRanges, RangeSet, Subset, ToRangeSet, Union, UnionMut};
+use rangeset::{Difference, IndexRanges, RangeSet, Union};
 use serde::{Deserialize, Serialize};
 
 use crate::connection::TranscriptLength;
@@ -39,6 +39,7 @@ pub use proof::{
     TranscriptProof, TranscriptProofBuilder, TranscriptProofBuilderError, TranscriptProofError,
 };
 pub use tls::{Record, TlsTranscript};
+pub use tls_core::msgs::enums::ContentType;
 
 /// A transcript contains the plaintext of all application data communicated
 /// between the Prover and the Server.
@@ -95,18 +96,18 @@ impl Transcript {
 
     /// Returns the subsequence of the transcript with the provided index,
     /// returning `None` if the index is out of bounds.
-    pub fn get(&self, direction: Direction, idx: &Idx) -> Option<Subsequence> {
+    pub fn get(&self, direction: Direction, idx: &RangeSet<usize>) -> Option<Subsequence> {
         let data = match direction {
             Direction::Sent => &self.sent,
             Direction::Received => &self.received,
         };
 
-        if idx.end() > data.len() {
+        if idx.end().unwrap_or(0) > data.len() {
             return None;
         }
 
         Some(
-            Subsequence::new(idx.clone(), data.index_ranges(&idx.0))
+            Subsequence::new(idx.clone(), data.index_ranges(idx))
                 .expect("data is same length as index"),
         )
     }
@@ -121,7 +122,11 @@ impl Transcript {
     ///
     /// * `sent_idx` - The indices of the sent data to include.
     /// * `recv_idx` - The indices of the received data to include.
-    pub fn to_partial(&self, sent_idx: Idx, recv_idx: Idx) -> PartialTranscript {
+    pub fn to_partial(
+        &self,
+        sent_idx: RangeSet<usize>,
+        recv_idx: RangeSet<usize>,
+    ) -> PartialTranscript {
         let mut sent = vec![0; self.sent.len()];
         let mut received = vec![0; self.received.len()];
 
@@ -156,9 +161,9 @@ pub struct PartialTranscript {
     /// Data received by the Prover from the Server.
     received: Vec<u8>,
     /// Index of `sent` which have been authenticated.
-    sent_authed_idx: Idx,
+    sent_authed_idx: RangeSet<usize>,
     /// Index of `received` which have been authenticated.
-    received_authed_idx: Idx,
+    received_authed_idx: RangeSet<usize>,
 }
 
 /// `PartialTranscript` in a compressed form.
@@ -170,9 +175,9 @@ pub struct CompressedPartialTranscript {
     /// Received data which has been authenticated.
     received_authed: Vec<u8>,
     /// Index of `sent_authed`.
-    sent_idx: Idx,
+    sent_idx: RangeSet<usize>,
     /// Index of `received_authed`.
-    recv_idx: Idx,
+    recv_idx: RangeSet<usize>,
     /// Total bytelength of sent data in the original partial transcript.
     sent_total: usize,
     /// Total bytelength of received data in the original partial transcript.
@@ -184,10 +189,10 @@ impl From<PartialTranscript> for CompressedPartialTranscript {
         Self {
             sent_authed: uncompressed
                 .sent
-                .index_ranges(&uncompressed.sent_authed_idx.0),
+                .index_ranges(&uncompressed.sent_authed_idx),
             received_authed: uncompressed
                 .received
-                .index_ranges(&uncompressed.received_authed_idx.0),
+                .index_ranges(&uncompressed.received_authed_idx),
             sent_idx: uncompressed.sent_authed_idx,
             recv_idx: uncompressed.received_authed_idx,
             sent_total: uncompressed.sent.len(),
@@ -237,8 +242,8 @@ impl PartialTranscript {
         Self {
             sent: vec![0; sent_len],
             received: vec![0; received_len],
-            sent_authed_idx: Idx::default(),
-            received_authed_idx: Idx::default(),
+            sent_authed_idx: RangeSet::default(),
+            received_authed_idx: RangeSet::default(),
         }
     }
 
@@ -259,10 +264,10 @@ impl PartialTranscript {
     }
 
     /// Returns whether the index is in bounds of the transcript.
-    pub fn contains(&self, direction: Direction, idx: &Idx) -> bool {
+    pub fn contains(&self, direction: Direction, idx: &RangeSet<usize>) -> bool {
         match direction {
-            Direction::Sent => idx.end() <= self.sent.len(),
-            Direction::Received => idx.end() <= self.received.len(),
+            Direction::Sent => idx.end().unwrap_or(0) <= self.sent.len(),
+            Direction::Received => idx.end().unwrap_or(0) <= self.received.len(),
         }
     }
 
@@ -289,23 +294,23 @@ impl PartialTranscript {
     }
 
     /// Returns the index of sent data which have been authenticated.
-    pub fn sent_authed(&self) -> &Idx {
+    pub fn sent_authed(&self) -> &RangeSet<usize> {
         &self.sent_authed_idx
     }
 
     /// Returns the index of received data which have been authenticated.
-    pub fn received_authed(&self) -> &Idx {
+    pub fn received_authed(&self) -> &RangeSet<usize> {
         &self.received_authed_idx
     }
 
     /// Returns the index of sent data which haven't been authenticated.
-    pub fn sent_unauthed(&self) -> Idx {
-        Idx(RangeSet::from(0..self.sent.len()).difference(&self.sent_authed_idx.0))
+    pub fn sent_unauthed(&self) -> RangeSet<usize> {
+        (0..self.sent.len()).difference(&self.sent_authed_idx)
     }
 
     /// Returns the index of received data which haven't been authenticated.
-    pub fn received_unauthed(&self) -> Idx {
-        Idx(RangeSet::from(0..self.received.len()).difference(&self.received_authed_idx.0))
+    pub fn received_unauthed(&self) -> RangeSet<usize> {
+        (0..self.received.len()).difference(&self.received_authed_idx)
     }
 
     /// Returns an iterator over the authenticated data in the transcript.
@@ -315,7 +320,7 @@ impl PartialTranscript {
             Direction::Received => (&self.received, &self.received_authed_idx),
         };
 
-        authed.0.iter().map(|i| data[i])
+        authed.iter().map(|i| data[i])
     }
 
     /// Unions the authenticated data of this transcript with another.
@@ -337,8 +342,7 @@ impl PartialTranscript {
 
         for range in other
             .sent_authed_idx
-            .0
-            .difference(&self.sent_authed_idx.0)
+            .difference(&self.sent_authed_idx)
             .iter_ranges()
         {
             self.sent[range.clone()].copy_from_slice(&other.sent[range]);
@@ -346,8 +350,7 @@ impl PartialTranscript {
 
         for range in other
             .received_authed_idx
-            .0
-            .difference(&self.received_authed_idx.0)
+            .difference(&self.received_authed_idx)
             .iter_ranges()
         {
             self.received[range.clone()].copy_from_slice(&other.received[range]);
@@ -399,12 +402,12 @@ impl PartialTranscript {
     pub fn set_unauthed_range(&mut self, value: u8, direction: Direction, range: Range<usize>) {
         match direction {
             Direction::Sent => {
-                for range in range.difference(&self.sent_authed_idx.0).iter_ranges() {
+                for range in range.difference(&self.sent_authed_idx).iter_ranges() {
                     self.sent[range].fill(value);
                 }
             }
             Direction::Received => {
-                for range in range.difference(&self.received_authed_idx.0).iter_ranges() {
+                for range in range.difference(&self.received_authed_idx).iter_ranges() {
                     self.received[range].fill(value);
                 }
             }
@@ -433,130 +436,19 @@ impl fmt::Display for Direction {
     }
 }
 
-/// Transcript index.
-#[derive(Debug, Default, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct Idx(RangeSet<usize>);
-
-impl Idx {
-    /// Creates a new index builder.
-    pub fn builder() -> IdxBuilder {
-        IdxBuilder::default()
-    }
-
-    /// Creates an empty index.
-    pub fn empty() -> Self {
-        Self(RangeSet::default())
-    }
-
-    /// Creates a new transcript index.
-    pub fn new(ranges: impl Into<RangeSet<usize>>) -> Self {
-        Self(ranges.into())
-    }
-
-    /// Returns the start of the index.
-    pub fn start(&self) -> usize {
-        self.0.min().unwrap_or_default()
-    }
-
-    /// Returns the end of the index, non-inclusive.
-    pub fn end(&self) -> usize {
-        self.0.end().unwrap_or_default()
-    }
-
-    /// Returns an iterator over the values in the index.
-    pub fn iter(&self) -> impl Iterator<Item = usize> + '_ {
-        self.0.iter()
-    }
-
-    /// Returns an iterator over the ranges of the index.
-    pub fn iter_ranges(&self) -> impl Iterator<Item = Range<usize>> + '_ {
-        self.0.iter_ranges()
-    }
-
-    /// Returns the number of values in the index.
-    pub fn len(&self) -> usize {
-        self.0.len()
-    }
-
-    /// Returns whether the index is empty.
-    pub fn is_empty(&self) -> bool {
-        self.0.is_empty()
-    }
-
-    /// Returns the number of disjoint ranges in the index.
-    pub fn count(&self) -> usize {
-        self.0.len_ranges()
-    }
-
-    pub(crate) fn as_range_set(&self) -> &RangeSet<usize> {
-        &self.0
-    }
-
-    /// Returns the union of this index with another.
-    pub(crate) fn union(&self, other: &Idx) -> Idx {
-        Idx(self.0.union(&other.0))
-    }
-
-    /// Unions this index with another.
-    pub(crate) fn union_mut(&mut self, other: &Idx) {
-        self.0.union_mut(&other.0);
-    }
-
-    /// Returns the difference between `self` and `other`.
-    pub(crate) fn difference(&self, other: &Idx) -> Idx {
-        Idx(self.0.difference(&other.0))
-    }
-
-    /// Returns `true` if `self` is a subset of `other`.
-    pub(crate) fn is_subset(&self, other: &Idx) -> bool {
-        self.0.is_subset(&other.0)
-    }
-}
-
-impl std::fmt::Display for Idx {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str("Idx([")?;
-        let count = self.0.len_ranges();
-        for (i, range) in self.0.iter_ranges().enumerate() {
-            write!(f, "{}..{}", range.start, range.end)?;
-            if i < count - 1 {
-                write!(f, ", ")?;
-            }
-        }
-        f.write_str("])")?;
-        Ok(())
-    }
-}
-
-/// Builder for [`Idx`].
-#[derive(Debug, Default)]
-pub struct IdxBuilder(RangeSet<usize>);
-
-impl IdxBuilder {
-    /// Unions ranges.
-    pub fn union(self, ranges: &dyn ToRangeSet<usize>) -> Self {
-        IdxBuilder(self.0.union(&ranges.to_range_set()))
-    }
-
-    /// Builds the index.
-    pub fn build(self) -> Idx {
-        Idx(self.0)
-    }
-}
-
 /// Transcript subsequence.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(try_from = "validation::SubsequenceUnchecked")]
 pub struct Subsequence {
     /// Index of the subsequence.
-    idx: Idx,
+    idx: RangeSet<usize>,
     /// Data of the subsequence.
     data: Vec<u8>,
 }
 
 impl Subsequence {
     /// Creates a new subsequence.
-    pub fn new(idx: Idx, data: Vec<u8>) -> Result<Self, InvalidSubsequence> {
+    pub fn new(idx: RangeSet<usize>, data: Vec<u8>) -> Result<Self, InvalidSubsequence> {
         if idx.len() != data.len() {
             return Err(InvalidSubsequence(
                 "index length does not match data length",
@@ -567,7 +459,7 @@ impl Subsequence {
     }
 
     /// Returns the index of the subsequence.
-    pub fn index(&self) -> &Idx {
+    pub fn index(&self) -> &RangeSet<usize> {
         &self.idx
     }
 
@@ -583,7 +475,7 @@ impl Subsequence {
     }
 
     /// Returns the inner parts of the subsequence.
-    pub fn into_parts(self) -> (Idx, Vec<u8>) {
+    pub fn into_parts(self) -> (RangeSet<usize>, Vec<u8>) {
         (self.idx, self.data)
     }
 
@@ -611,7 +503,7 @@ mod validation {
 
     #[derive(Debug, Deserialize)]
     pub(super) struct SubsequenceUnchecked {
-        idx: Idx,
+        idx: RangeSet<usize>,
         data: Vec<u8>,
     }
 
@@ -633,8 +525,8 @@ mod validation {
     pub(super) struct CompressedPartialTranscriptUnchecked {
         sent_authed: Vec<u8>,
         received_authed: Vec<u8>,
-        sent_idx: Idx,
-        recv_idx: Idx,
+        sent_idx: RangeSet<usize>,
+        recv_idx: RangeSet<usize>,
         sent_total: usize,
         recv_total: usize,
     }
@@ -651,8 +543,8 @@ mod validation {
                 ));
             }
 
-            if unchecked.sent_idx.end() > unchecked.sent_total
-                || unchecked.recv_idx.end() > unchecked.recv_total
+            if unchecked.sent_idx.end().unwrap_or(0) > unchecked.sent_total
+                || unchecked.recv_idx.end().unwrap_or(0) > unchecked.recv_total
             {
                 return Err(InvalidCompressedPartialTranscript(
                     "ranges are not in bounds of the data",
@@ -681,8 +573,8 @@ mod validation {
             CompressedPartialTranscriptUnchecked {
                 received_authed: vec![1, 2, 3, 11, 12, 13],
                 sent_authed: vec![4, 5, 6, 14, 15, 16],
-                recv_idx: Idx(RangeSet::new(&[1..4, 11..14])),
-                sent_idx: Idx(RangeSet::new(&[4..7, 14..17])),
+                recv_idx: RangeSet::from([1..4, 11..14]),
+                sent_idx: RangeSet::from([4..7, 14..17]),
                 sent_total: 20,
                 recv_total: 20,
             }
@@ -721,7 +613,6 @@ mod validation {
             // Change the total to be less than the last range's end bound.
             let end = partial_transcript
                 .sent_idx
-                .0
                 .iter_ranges()
                 .next_back()
                 .unwrap()
@@ -753,31 +644,25 @@ mod tests {
 
     #[fixture]
     fn partial_transcript() -> PartialTranscript {
-        transcript().to_partial(
-            Idx::new(RangeSet::new(&[1..4, 6..9])),
-            Idx::new(RangeSet::new(&[2..5, 7..10])),
-        )
+        transcript().to_partial(RangeSet::from([1..4, 6..9]), RangeSet::from([2..5, 7..10]))
     }
 
     #[rstest]
     fn test_transcript_get_subsequence(transcript: Transcript) {
         let subseq = transcript
-            .get(Direction::Received, &Idx(RangeSet::from([0..4, 7..10])))
+            .get(Direction::Received, &RangeSet::from([0..4, 7..10]))
             .unwrap();
         assert_eq!(subseq.data, vec![0, 1, 2, 3, 7, 8, 9]);
 
         let subseq = transcript
-            .get(Direction::Sent, &Idx(RangeSet::from([0..4, 9..12])))
+            .get(Direction::Sent, &RangeSet::from([0..4, 9..12]))
             .unwrap();
         assert_eq!(subseq.data, vec![0, 1, 2, 3, 9, 10, 11]);
 
-        let subseq = transcript.get(
-            Direction::Received,
-            &Idx(RangeSet::from([0..4, 7..10, 11..13])),
-        );
+        let subseq = transcript.get(Direction::Received, &RangeSet::from([0..4, 7..10, 11..13]));
         assert_eq!(subseq, None);
 
-        let subseq = transcript.get(Direction::Sent, &Idx(RangeSet::from([0..4, 7..10, 11..13])));
+        let subseq = transcript.get(Direction::Sent, &RangeSet::from([0..4, 7..10, 11..13]));
         assert_eq!(subseq, None);
     }
 
@@ -790,7 +675,7 @@ mod tests {
 
     #[rstest]
     fn test_transcript_to_partial_success(transcript: Transcript) {
-        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
+        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
         assert_eq!(partial.sent_unsafe(), [0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
         assert_eq!(
             partial.received_unsafe(),
@@ -801,29 +686,30 @@ mod tests {
     #[rstest]
     #[should_panic]
     fn test_transcript_to_partial_failure(transcript: Transcript) {
-        let _ = transcript.to_partial(Idx::new(0..14), Idx::new(3..7));
+        let _ = transcript.to_partial(RangeSet::from(0..14), RangeSet::from(3..7));
     }
 
     #[rstest]
     fn test_partial_transcript_contains(transcript: Transcript) {
-        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
-        assert!(partial.contains(Direction::Sent, &Idx::new([0..5, 7..10])));
-        assert!(!partial.contains(Direction::Received, &Idx::new([4..6, 7..13])))
+        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
+        assert!(partial.contains(Direction::Sent, &RangeSet::from([0..5, 7..10])));
+        assert!(!partial.contains(Direction::Received, &RangeSet::from([4..6, 7..13])))
     }
 
     #[rstest]
     fn test_partial_transcript_unauthed(transcript: Transcript) {
-        let partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
-        assert_eq!(partial.sent_unauthed(), Idx::new(2..12));
-        assert_eq!(partial.received_unauthed(), Idx::new([0..3, 7..12]));
+        let partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
+        assert_eq!(partial.sent_unauthed(), RangeSet::from(2..12));
+        assert_eq!(partial.received_unauthed(), RangeSet::from([0..3, 7..12]));
     }
 
     #[rstest]
     fn test_partial_transcript_union_success(transcript: Transcript) {
         // Non overlapping ranges.
-        let mut simple_partial = transcript.to_partial(Idx::new(0..2), Idx::new(3..7));
+        let mut simple_partial = transcript.to_partial(RangeSet::from(0..2), RangeSet::from(3..7));
 
-        let other_simple_partial = transcript.to_partial(Idx::new(3..5), Idx::new(1..2));
+        let other_simple_partial =
+            transcript.to_partial(RangeSet::from(3..5), RangeSet::from(1..2));
 
         simple_partial.union_transcript(&other_simple_partial);
 
@@ -835,12 +721,16 @@ mod tests {
             simple_partial.received_unsafe(),
             [0, 1, 0, 3, 4, 5, 6, 0, 0, 0, 0, 0]
         );
-        assert_eq!(simple_partial.sent_authed(), &Idx::new([0..2, 3..5]));
-        assert_eq!(simple_partial.received_authed(), &Idx::new([1..2, 3..7]));
+        assert_eq!(simple_partial.sent_authed(), &RangeSet::from([0..2, 3..5]));
+        assert_eq!(
+            simple_partial.received_authed(),
+            &RangeSet::from([1..2, 3..7])
+        );
 
         // Overwrite with another partial transcript.
 
-        let another_simple_partial = transcript.to_partial(Idx::new(1..4), Idx::new(6..9));
+        let another_simple_partial =
+            transcript.to_partial(RangeSet::from(1..4), RangeSet::from(6..9));
 
         simple_partial.union_transcript(&another_simple_partial);
 
@@ -852,13 +742,17 @@ mod tests {
             simple_partial.received_unsafe(),
             [0, 1, 0, 3, 4, 5, 6, 7, 8, 0, 0, 0]
         );
-        assert_eq!(simple_partial.sent_authed(), &Idx::new(0..5));
-        assert_eq!(simple_partial.received_authed(), &Idx::new([1..2, 3..9]));
+        assert_eq!(simple_partial.sent_authed(), &RangeSet::from(0..5));
+        assert_eq!(
+            simple_partial.received_authed(),
+            &RangeSet::from([1..2, 3..9])
+        );
 
         // Overlapping ranges.
-        let mut overlap_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
+        let mut overlap_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
 
-        let other_overlap_partial = transcript.to_partial(Idx::new(3..5), Idx::new(5..9));
+        let other_overlap_partial =
+            transcript.to_partial(RangeSet::from(3..5), RangeSet::from(5..9));
 
         overlap_partial.union_transcript(&other_overlap_partial);
 
@@ -870,13 +764,16 @@ mod tests {
             overlap_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 7, 8, 0, 0, 0]
         );
-        assert_eq!(overlap_partial.sent_authed(), &Idx::new([3..5, 4..6]));
-        assert_eq!(overlap_partial.received_authed(), &Idx::new([3..7, 5..9]));
+        assert_eq!(overlap_partial.sent_authed(), &RangeSet::from([3..5, 4..6]));
+        assert_eq!(
+            overlap_partial.received_authed(),
+            &RangeSet::from([3..7, 5..9])
+        );
 
         // Equal ranges.
-        let mut equal_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
+        let mut equal_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
 
-        let other_equal_partial = transcript.to_partial(Idx::new(4..6), Idx::new(3..7));
+        let other_equal_partial = transcript.to_partial(RangeSet::from(4..6), RangeSet::from(3..7));
 
         equal_partial.union_transcript(&other_equal_partial);
 
@@ -888,13 +785,15 @@ mod tests {
             equal_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 0, 0, 0, 0, 0]
         );
-        assert_eq!(equal_partial.sent_authed(), &Idx::new(4..6));
-        assert_eq!(equal_partial.received_authed(), &Idx::new(3..7));
+        assert_eq!(equal_partial.sent_authed(), &RangeSet::from(4..6));
+        assert_eq!(equal_partial.received_authed(), &RangeSet::from(3..7));
 
         // Subset ranges.
-        let mut subset_partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
+        let mut subset_partial =
+            transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
 
-        let other_subset_partial = transcript.to_partial(Idx::new(6..9), Idx::new(5..6));
+        let other_subset_partial =
+            transcript.to_partial(RangeSet::from(6..9), RangeSet::from(5..6));
 
         subset_partial.union_transcript(&other_subset_partial);
 
@@ -906,30 +805,32 @@ mod tests {
             subset_partial.received_unsafe(),
             [0, 0, 0, 3, 4, 5, 6, 7, 8, 9, 10, 0]
         );
-        assert_eq!(subset_partial.sent_authed(), &Idx::new(4..10));
-        assert_eq!(subset_partial.received_authed(), &Idx::new(3..11));
+        assert_eq!(subset_partial.sent_authed(), &RangeSet::from(4..10));
+        assert_eq!(subset_partial.received_authed(), &RangeSet::from(3..11));
     }
 
     #[rstest]
     #[should_panic]
     fn test_partial_transcript_union_failure(transcript: Transcript) {
-        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
+        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
 
         let other_transcript = Transcript::new(
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9],
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
         );
 
-        let other_partial = other_transcript.to_partial(Idx::new(6..9), Idx::new(5..6));
+        let other_partial = other_transcript.to_partial(RangeSet::from(6..9), RangeSet::from(5..6));
 
         partial.union_transcript(&other_partial);
     }
 
     #[rstest]
     fn test_partial_transcript_union_subseq_success(transcript: Transcript) {
-        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
-        let sent_seq = Subsequence::new(Idx::new([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
-        let recv_seq = Subsequence::new(Idx::new([0..4, 5..7]), [0, 1, 2, 3, 5, 6].into()).unwrap();
+        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
+        let sent_seq =
+            Subsequence::new(RangeSet::from([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
+        let recv_seq =
+            Subsequence::new(RangeSet::from([0..4, 5..7]), [0, 1, 2, 3, 5, 6].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &sent_seq);
         partial.union_subsequence(Direction::Received, &recv_seq);
@@ -939,30 +840,31 @@ mod tests {
             partial.received_unsafe(),
             [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0]
         );
-        assert_eq!(partial.sent_authed(), &Idx::new([0..3, 4..10]));
-        assert_eq!(partial.received_authed(), &Idx::new(0..11));
+        assert_eq!(partial.sent_authed(), &RangeSet::from([0..3, 4..10]));
+        assert_eq!(partial.received_authed(), &RangeSet::from(0..11));
 
         // Overwrite with another subseq.
-        let other_sent_seq = Subsequence::new(Idx::new(0..3), [3, 2, 1].into()).unwrap();
+        let other_sent_seq = Subsequence::new(RangeSet::from(0..3), [3, 2, 1].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &other_sent_seq);
         assert_eq!(partial.sent_unsafe(), [3, 2, 1, 0, 4, 5, 6, 7, 8, 9, 0, 0]);
-        assert_eq!(partial.sent_authed(), &Idx::new([0..3, 4..10]));
+        assert_eq!(partial.sent_authed(), &RangeSet::from([0..3, 4..10]));
     }
 
     #[rstest]
     #[should_panic]
     fn test_partial_transcript_union_subseq_failure(transcript: Transcript) {
-        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..11));
+        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..11));
 
-        let sent_seq = Subsequence::new(Idx::new([0..3, 13..15]), [0, 1, 2, 5, 6].into()).unwrap();
+        let sent_seq =
+            Subsequence::new(RangeSet::from([0..3, 13..15]), [0, 1, 2, 5, 6].into()).unwrap();
 
         partial.union_subsequence(Direction::Sent, &sent_seq);
     }
 
     #[rstest]
     fn test_partial_transcript_set_unauthed_range(transcript: Transcript) {
-        let mut partial = transcript.to_partial(Idx::new(4..10), Idx::new(3..7));
+        let mut partial = transcript.to_partial(RangeSet::from(4..10), RangeSet::from(3..7));
 
         partial.set_unauthed_range(7, Direction::Sent, 2..5);
         partial.set_unauthed_range(5, Direction::Sent, 0..2);
@@ -979,13 +881,13 @@ mod tests {
     #[rstest]
     #[should_panic]
     fn test_subsequence_new_invalid_len() {
-        let _ = Subsequence::new(Idx::new([0..3, 5..8]), [0, 1, 2, 5, 6].into()).unwrap();
+        let _ = Subsequence::new(RangeSet::from([0..3, 5..8]), [0, 1, 2, 5, 6].into()).unwrap();
     }
 
     #[rstest]
     #[should_panic]
     fn test_subsequence_copy_to_invalid_len() {
-        let seq = Subsequence::new(Idx::new([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
+        let seq = Subsequence::new(RangeSet::from([0..3, 5..7]), [0, 1, 2, 5, 6].into()).unwrap();
 
         let mut data: [u8; 3] = [0, 1, 2];
         seq.copy_to(&mut data);

crates/core/src/transcript/commit.rs

@@ -2,7 +2,7 @@
 
 use std::{collections::HashSet, fmt};
 
-use rangeset::ToRangeSet;
+use rangeset::{ToRangeSet, UnionMut};
 use serde::{Deserialize, Serialize};
 
 use crate::{
@@ -10,7 +10,7 @@ use crate::{
     transcript::{
         encoding::{EncodingCommitment, EncodingTree},
         hash::{PlaintextHash, PlaintextHashSecret},
-        Direction, Idx, Transcript,
+        Direction, RangeSet, Transcript,
     },
 };
 
@@ -71,7 +71,7 @@ pub struct TranscriptCommitConfig {
     encoding_hash_alg: HashAlgId,
     has_encoding: bool,
     has_hash: bool,
-    commits: Vec<((Direction, Idx), TranscriptCommitmentKind)>,
+    commits: Vec<((Direction, RangeSet<usize>), TranscriptCommitmentKind)>,
 }
 
 impl TranscriptCommitConfig {
@@ -96,7 +96,7 @@ impl TranscriptCommitConfig {
     }
 
     /// Returns an iterator over the encoding commitment indices.
-    pub fn iter_encoding(&self) -> impl Iterator<Item = &(Direction, Idx)> {
+    pub fn iter_encoding(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>)> {
         self.commits.iter().filter_map(|(idx, kind)| match kind {
             TranscriptCommitmentKind::Encoding => Some(idx),
             _ => None,
@@ -104,7 +104,7 @@ impl TranscriptCommitConfig {
     }
 
     /// Returns an iterator over the hash commitment indices.
-    pub fn iter_hash(&self) -> impl Iterator<Item = (&(Direction, Idx), &HashAlgId)> {
+    pub fn iter_hash(&self) -> impl Iterator<Item = (&(Direction, RangeSet<usize>), &HashAlgId)> {
         self.commits.iter().filter_map(|(idx, kind)| match kind {
             TranscriptCommitmentKind::Hash { alg } => Some((idx, alg)),
             _ => None,
@@ -114,7 +114,19 @@ impl TranscriptCommitConfig {
     /// Returns a request for the transcript commitments.
     pub fn to_request(&self) -> TranscriptCommitRequest {
         TranscriptCommitRequest {
-            encoding: self.has_encoding,
+            encoding: self.has_encoding.then(|| {
+                let mut sent = RangeSet::default();
+                let mut recv = RangeSet::default();
+
+                for (dir, idx) in self.iter_encoding() {
+                    match dir {
+                        Direction::Sent => sent.union_mut(idx),
+                        Direction::Received => recv.union_mut(idx),
+                    }
+                }
+
+                (sent, recv)
+            }),
             hash: self
                 .iter_hash()
                 .map(|((dir, idx), alg)| (*dir, idx.clone(), *alg))
@@ -134,7 +146,7 @@ pub struct TranscriptCommitConfigBuilder<'a> {
     has_encoding: bool,
     has_hash: bool,
     default_kind: TranscriptCommitmentKind,
-    commits: HashSet<((Direction, Idx), TranscriptCommitmentKind)>,
+    commits: HashSet<((Direction, RangeSet<usize>), TranscriptCommitmentKind)>,
 }
 
 impl<'a> TranscriptCommitConfigBuilder<'a> {
@@ -175,15 +187,15 @@ impl<'a> TranscriptCommitConfigBuilder<'a> {
         direction: Direction,
         kind: TranscriptCommitmentKind,
     ) -> Result<&mut Self, TranscriptCommitConfigBuilderError> {
-        let idx = Idx::new(ranges.to_range_set());
+        let idx = ranges.to_range_set();
 
-        if idx.end() > self.transcript.len_of_direction(direction) {
+        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
             return Err(TranscriptCommitConfigBuilderError::new(
                 ErrorKind::Index,
                 format!(
                     "range is out of bounds of the transcript ({}): {} > {}",
                     direction,
-                    idx.end(),
+                    idx.end().unwrap_or(0),
                     self.transcript.len_of_direction(direction)
                 ),
             ));
@@ -289,14 +301,14 @@ impl fmt::Display for TranscriptCommitConfigBuilderError {
 /// Request to compute transcript commitments.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TranscriptCommitRequest {
-    encoding: bool,
-    hash: Vec<(Direction, Idx, HashAlgId)>,
+    encoding: Option<(RangeSet<usize>, RangeSet<usize>)>,
+    hash: Vec<(Direction, RangeSet<usize>, HashAlgId)>,
 }
 
 impl TranscriptCommitRequest {
     /// Returns `true` if an encoding commitment is requested.
-    pub fn encoding(&self) -> bool {
-        self.encoding
+    pub fn has_encoding(&self) -> bool {
+        self.encoding.is_some()
     }
 
     /// Returns `true` if a hash commitment is requested.
@@ -305,9 +317,14 @@ impl TranscriptCommitRequest {
     }
 
     /// Returns an iterator over the hash commitments.
-    pub fn iter_hash(&self) -> impl Iterator<Item = &(Direction, Idx, HashAlgId)> {
+    pub fn iter_hash(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>, HashAlgId)> {
         self.hash.iter()
     }
+
+    /// Returns the ranges of the encoding commitments.
+    pub fn encoding(&self) -> Option<&(RangeSet<usize>, RangeSet<usize>)> {
+        self.encoding.as_ref()
+    }
 }
 
 #[cfg(test)]

crates/core/src/transcript/encoding.rs

@@ -19,6 +19,4 @@ use crate::hash::TypedHash;
 pub struct EncodingCommitment {
     /// Merkle root of the encoding commitments.
     pub root: TypedHash,
-    /// Seed used to generate the encodings.
-    pub secret: EncoderSecret,
 }

crates/core/src/transcript/encoding/proof.rs

@@ -8,8 +8,8 @@ use crate::{
     merkle::{MerkleError, MerkleProof},
     transcript::{
         commit::MAX_TOTAL_COMMITTED_DATA,
-        encoding::{new_encoder, Encoder, EncodingCommitment},
-        Direction, Idx,
+        encoding::{new_encoder, Encoder, EncoderSecret, EncodingCommitment},
+        Direction,
     },
 };
 
@@ -17,7 +17,7 @@ use crate::{
 #[derive(Clone, Serialize, Deserialize)]
 pub(super) struct Opening {
     pub(super) direction: Direction,
-    pub(super) idx: Idx,
+    pub(super) idx: RangeSet<usize>,
     pub(super) blinder: Blinder,
 }
 
@@ -48,13 +48,14 @@ impl EncodingProof {
     pub fn verify_with_provider(
         &self,
         provider: &HashProvider,
+        secret: &EncoderSecret,
         commitment: &EncodingCommitment,
         sent: &[u8],
         recv: &[u8],
-    ) -> Result<(Idx, Idx), EncodingProofError> {
+    ) -> Result<(RangeSet<usize>, RangeSet<usize>), EncodingProofError> {
         let hasher = provider.get(&commitment.root.alg)?;
 
-        let encoder = new_encoder(&commitment.secret);
+        let encoder = new_encoder(secret);
         let Self {
             inclusion_proof,
             openings,
@@ -89,13 +90,13 @@ impl EncodingProof {
             };
 
             // Make sure the ranges are within the bounds of the transcript.
-            if idx.end() > data.len() {
+            if idx.end().unwrap_or(0) > data.len() {
                 return Err(EncodingProofError::new(
                     ErrorKind::Proof,
                     format!(
                         "index out of bounds of the transcript ({}): {} > {}",
                         direction,
-                        idx.end(),
+                        idx.end().unwrap_or(0),
                         data.len()
                     ),
                 ));
@@ -111,7 +112,7 @@ impl EncodingProof {
             // present in the merkle tree.
             leaves.push((*id, hasher.hash(&expected_leaf)));
 
-            auth.union_mut(idx.as_range_set());
+            auth.union_mut(idx);
         }
 
         // Verify that the expected hashes are present in the merkle tree.
@@ -121,7 +122,7 @@ impl EncodingProof {
         // data is authentic.
         inclusion_proof.verify(hasher, &commitment.root, leaves)?;
 
-        Ok((Idx(auth_sent), Idx(auth_recv)))
+        Ok((auth_sent, auth_recv))
     }
 }
 
@@ -232,10 +233,7 @@ mod test {
     use crate::{
         fixtures::{encoder_secret, encoder_secret_tampered_seed, encoding_provider},
         hash::Blake3,
-        transcript::{
-            encoding::{EncoderSecret, EncodingTree},
-            Idx, Transcript,
-        },
+        transcript::{encoding::EncodingTree, Transcript},
     };
 
     use super::*;
@@ -246,21 +244,18 @@ mod test {
         commitment: EncodingCommitment,
     }
 
-    fn new_encoding_fixture(secret: EncoderSecret) -> EncodingFixture {
+    fn new_encoding_fixture() -> EncodingFixture {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len()));
 
         let provider = encoding_provider(transcript.sent(), transcript.received());
         let tree = EncodingTree::new(&Blake3::default(), [&idx_0, &idx_1], &provider).unwrap();
 
         let proof = tree.proof([&idx_0, &idx_1].into_iter()).unwrap();
 
-        let commitment = EncodingCommitment {
-            root: tree.root(),
-            secret,
-        };
+        let commitment = EncodingCommitment { root: tree.root() };
 
         EncodingFixture {
             transcript,
@@ -275,11 +270,12 @@ mod test {
             transcript,
             proof,
             commitment,
-        } = new_encoding_fixture(encoder_secret_tampered_seed());
+        } = new_encoding_fixture();
 
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
+                &encoder_secret_tampered_seed(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -295,13 +291,19 @@ mod test {
             transcript,
             proof,
             commitment,
-        } = new_encoding_fixture(encoder_secret());
+        } = new_encoding_fixture();
 
         let sent = &transcript.sent()[transcript.sent().len() - 1..];
         let recv = &transcript.received()[transcript.received().len() - 2..];
 
         let err = proof
-            .verify_with_provider(&HashProvider::default(), &commitment, sent, recv)
+            .verify_with_provider(
+                &HashProvider::default(),
+                &encoder_secret(),
+                &commitment,
+                sent,
+                recv,
+            )
             .unwrap_err();
 
         assert!(matches!(err.kind, ErrorKind::Proof));
@@ -313,15 +315,16 @@ mod test {
             transcript,
             mut proof,
             commitment,
-        } = new_encoding_fixture(encoder_secret());
+        } = new_encoding_fixture();
 
         let Opening { idx, .. } = proof.openings.values_mut().next().unwrap();
 
-        *idx = Idx::new([0..3, 13..15]);
+        *idx = RangeSet::from([0..3, 13..15]);
 
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
+                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -337,7 +340,7 @@ mod test {
             transcript,
             mut proof,
             commitment,
-        } = new_encoding_fixture(encoder_secret());
+        } = new_encoding_fixture();
 
         let Opening { blinder, .. } = proof.openings.values_mut().next().unwrap();
 
@@ -346,6 +349,7 @@ mod test {
         let err = proof
             .verify_with_provider(
                 &HashProvider::default(),
+                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),

crates/core/src/transcript/encoding/tree.rs

@@ -1,6 +1,7 @@
 use std::collections::HashMap;
 
 use bimap::BiMap;
+use rangeset::{RangeSet, UnionMut};
 use serde::{Deserialize, Serialize};
 
 use crate::{
@@ -11,7 +12,7 @@ use crate::{
             proof::{EncodingProof, Opening},
             EncodingProvider,
         },
-        Direction, Idx,
+        Direction,
     },
 };
 
@@ -22,7 +23,7 @@ pub enum EncodingTreeError {
     #[error("index is out of bounds of the transcript")]
     OutOfBounds {
         /// The index.
-        index: Idx,
+        index: RangeSet<usize>,
         /// The transcript length.
         transcript_length: usize,
     },
@@ -30,13 +31,13 @@ pub enum EncodingTreeError {
     #[error("encoding provider is missing an encoding for an index")]
     MissingEncoding {
         /// The index which is missing.
-        index: Idx,
+        index: RangeSet<usize>,
     },
     /// Index is missing from the tree.
     #[error("index is missing from the tree")]
     MissingLeaf {
         /// The index which is missing.
-        index: Idx,
+        index: RangeSet<usize>,
     },
 }
 
@@ -49,11 +50,11 @@ pub struct EncodingTree {
     blinders: Vec<Blinder>,
     /// Mapping between the index of a leaf and the transcript index it
     /// corresponds to.
-    idxs: BiMap<usize, (Direction, Idx)>,
+    idxs: BiMap<usize, (Direction, RangeSet<usize>)>,
     /// Union of all transcript indices in the sent direction.
-    sent_idx: Idx,
+    sent_idx: RangeSet<usize>,
     /// Union of all transcript indices in the received direction.
-    received_idx: Idx,
+    received_idx: RangeSet<usize>,
 }
 
 opaque_debug::implement!(EncodingTree);
@@ -68,15 +69,15 @@ impl EncodingTree {
     /// * `provider` - The encoding provider.
     pub fn new<'idx>(
         hasher: &dyn HashAlgorithm,
-        idxs: impl IntoIterator<Item = &'idx (Direction, Idx)>,
+        idxs: impl IntoIterator<Item = &'idx (Direction, RangeSet<usize>)>,
         provider: &dyn EncodingProvider,
     ) -> Result<Self, EncodingTreeError> {
         let mut this = Self {
             tree: MerkleTree::new(hasher.id()),
             blinders: Vec::new(),
             idxs: BiMap::new(),
-            sent_idx: Idx::empty(),
-            received_idx: Idx::empty(),
+            sent_idx: RangeSet::default(),
+            received_idx: RangeSet::default(),
         };
 
         let mut leaves = Vec::new();
@@ -138,7 +139,7 @@ impl EncodingTree {
     /// * `idxs` - The transcript indices to prove.
     pub fn proof<'idx>(
         &self,
-        idxs: impl Iterator<Item = &'idx (Direction, Idx)>,
+        idxs: impl Iterator<Item = &'idx (Direction, RangeSet<usize>)>,
     ) -> Result<EncodingProof, EncodingTreeError> {
         let mut openings = HashMap::new();
         for dir_idx in idxs {
@@ -171,11 +172,11 @@ impl EncodingTree {
     }
 
     /// Returns whether the tree contains the given transcript index.
-    pub fn contains(&self, idx: &(Direction, Idx)) -> bool {
+    pub fn contains(&self, idx: &(Direction, RangeSet<usize>)) -> bool {
         self.idxs.contains_right(idx)
     }
 
-    pub(crate) fn idx(&self, direction: Direction) -> &Idx {
+    pub(crate) fn idx(&self, direction: Direction) -> &RangeSet<usize> {
         match direction {
             Direction::Sent => &self.sent_idx,
             Direction::Received => &self.received_idx,
@@ -183,7 +184,7 @@ impl EncodingTree {
     }
 
     /// Returns the committed transcript indices.
-    pub(crate) fn transcript_indices(&self) -> impl Iterator<Item = &(Direction, Idx)> {
+    pub(crate) fn transcript_indices(&self) -> impl Iterator<Item = &(Direction, RangeSet<usize>)> {
         self.idxs.right_values()
     }
 }
@@ -200,7 +201,7 @@ mod tests {
 
     fn new_tree<'seq>(
         transcript: &Transcript,
-        idxs: impl Iterator<Item = &'seq (Direction, Idx)>,
+        idxs: impl Iterator<Item = &'seq (Direction, RangeSet<usize>)>,
     ) -> Result<EncodingTree, EncodingTreeError> {
         let provider = encoding_provider(transcript.sent(), transcript.received());
 
@@ -211,8 +212,8 @@ mod tests {
     fn test_encoding_tree() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1].into_iter()).unwrap();
 
@@ -221,14 +222,12 @@ mod tests {
 
         let proof = tree.proof([&idx_0, &idx_1].into_iter()).unwrap();
 
-        let commitment = EncodingCommitment {
-            root: tree.root(),
-            secret: encoder_secret(),
-        };
+        let commitment = EncodingCommitment { root: tree.root() };
 
         let (auth_sent, auth_recv) = proof
             .verify_with_provider(
                 &HashProvider::default(),
+                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
@@ -243,10 +242,10 @@ mod tests {
     fn test_encoding_tree_multiple_ranges() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, Idx::new(0..1));
-        let idx_1 = (Direction::Sent, Idx::new(1..POST_JSON.len()));
-        let idx_2 = (Direction::Received, Idx::new(0..1));
-        let idx_3 = (Direction::Received, Idx::new(1..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, RangeSet::from(0..1));
+        let idx_1 = (Direction::Sent, RangeSet::from(1..POST_JSON.len()));
+        let idx_2 = (Direction::Received, RangeSet::from(0..1));
+        let idx_3 = (Direction::Received, RangeSet::from(1..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1, &idx_2, &idx_3].into_iter()).unwrap();
 
@@ -259,25 +258,23 @@ mod tests {
             .proof([&idx_0, &idx_1, &idx_2, &idx_3].into_iter())
             .unwrap();
 
-        let commitment = EncodingCommitment {
-            root: tree.root(),
-            secret: encoder_secret(),
-        };
+        let commitment = EncodingCommitment { root: tree.root() };
 
         let (auth_sent, auth_recv) = proof
             .verify_with_provider(
                 &HashProvider::default(),
+                &encoder_secret(),
                 &commitment,
                 transcript.sent(),
                 transcript.received(),
             )
             .unwrap();
 
-        let mut expected_auth_sent = Idx::default();
+        let mut expected_auth_sent = RangeSet::default();
         expected_auth_sent.union_mut(&idx_0.1);
         expected_auth_sent.union_mut(&idx_1.1);
 
-        let mut expected_auth_recv = Idx::default();
+        let mut expected_auth_recv = RangeSet::default();
         expected_auth_recv.union_mut(&idx_2.1);
         expected_auth_recv.union_mut(&idx_3.1);
 
@@ -289,9 +286,9 @@ mod tests {
     fn test_encoding_tree_proof_missing_leaf() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len()));
-        let idx_1 = (Direction::Received, Idx::new(0..4));
-        let idx_2 = (Direction::Received, Idx::new(4..OK_JSON.len()));
+        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len()));
+        let idx_1 = (Direction::Received, RangeSet::from(0..4));
+        let idx_2 = (Direction::Received, RangeSet::from(4..OK_JSON.len()));
 
         let tree = new_tree(&transcript, [&idx_0, &idx_1].into_iter()).unwrap();
 
@@ -305,8 +302,8 @@ mod tests {
     fn test_encoding_tree_out_of_bounds() {
         let transcript = Transcript::new(POST_JSON, OK_JSON);
 
-        let idx_0 = (Direction::Sent, Idx::new(0..POST_JSON.len() + 1));
-        let idx_1 = (Direction::Received, Idx::new(0..OK_JSON.len() + 1));
+        let idx_0 = (Direction::Sent, RangeSet::from(0..POST_JSON.len() + 1));
+        let idx_1 = (Direction::Received, RangeSet::from(0..OK_JSON.len() + 1));
 
         let result = new_tree(&transcript, [&idx_0].into_iter()).unwrap_err();
         assert!(matches!(result, EncodingTreeError::MissingEncoding { .. }));
@@ -321,7 +318,7 @@ mod tests {
 
         let result = EncodingTree::new(
             &Blake3::default(),
-            [(Direction::Sent, Idx::new(0..8))].iter(),
+            [(Direction::Sent, RangeSet::from(0..8))].iter(),
             &provider,
         )
         .unwrap_err();

crates/core/src/transcript/hash.rs

@@ -4,7 +4,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::{
     hash::{Blinder, HashAlgId, HashAlgorithm, TypedHash},
-    transcript::{Direction, Idx},
+    transcript::{Direction, RangeSet},
 };
 
 /// Hashes plaintext with a blinder.
@@ -23,7 +23,7 @@ pub struct PlaintextHash {
     /// Direction of the plaintext.
     pub direction: Direction,
     /// Index of plaintext.
-    pub idx: Idx,
+    pub idx: RangeSet<usize>,
     /// The hash of the data.
     pub hash: TypedHash,
 }
@@ -34,7 +34,7 @@ pub struct PlaintextHashSecret {
     /// Direction of the plaintext.
     pub direction: Direction,
     /// Index of plaintext.
-    pub idx: Idx,
+    pub idx: RangeSet<usize>,
     /// The algorithm of the hash.
     pub alg: HashAlgId,
     /// Blinder for the hash.

crates/core/src/transcript/proof.rs

@@ -1,17 +1,18 @@
 //! Transcript proofs.
 
-use rangeset::{Cover, ToRangeSet};
+use rangeset::{Cover, Difference, Subset, ToRangeSet, UnionMut};
 use serde::{Deserialize, Serialize};
 use std::{collections::HashSet, fmt};
 
 use crate::{
     connection::TranscriptLength,
+    display::FmtRangeSet,
     hash::{HashAlgId, HashProvider},
     transcript::{
         commit::{TranscriptCommitment, TranscriptCommitmentKind},
-        encoding::{EncodingProof, EncodingProofError, EncodingTree},
+        encoding::{EncoderSecret, EncodingProof, EncodingProofError, EncodingTree},
         hash::{hash_plaintext, PlaintextHash, PlaintextHashSecret},
-        Direction, Idx, PartialTranscript, Transcript, TranscriptSecret,
+        Direction, PartialTranscript, RangeSet, Transcript, TranscriptSecret,
     },
 };
 
@@ -21,6 +22,9 @@ const DEFAULT_COMMITMENT_KINDS: &[TranscriptCommitmentKind] = &[
     TranscriptCommitmentKind::Hash {
         alg: HashAlgId::SHA256,
     },
+    TranscriptCommitmentKind::Hash {
+        alg: HashAlgId::BLAKE3,
+    },
     TranscriptCommitmentKind::Encoding,
 ];
 
@@ -47,6 +51,7 @@ impl TranscriptProof {
         self,
         provider: &HashProvider,
         length: &TranscriptLength,
+        encoder_secret: Option<&EncoderSecret>,
         commitments: impl IntoIterator<Item = &'a TranscriptCommitment>,
     ) -> Result<PartialTranscript, TranscriptProofError> {
         let mut encoding_commitment = None;
@@ -77,11 +82,18 @@ impl TranscriptProof {
             ));
         }
 
-        let mut total_auth_sent = Idx::default();
-        let mut total_auth_recv = Idx::default();
+        let mut total_auth_sent = RangeSet::default();
+        let mut total_auth_recv = RangeSet::default();
 
         // Verify encoding proof.
         if let Some(proof) = self.encoding_proof {
+            let secret = encoder_secret.ok_or_else(|| {
+                TranscriptProofError::new(
+                    ErrorKind::Encoding,
+                    "contains an encoding proof but missing encoder secret",
+                )
+            })?;
+
             let commitment = encoding_commitment.ok_or_else(|| {
                 TranscriptProofError::new(
                     ErrorKind::Encoding,
@@ -91,6 +103,7 @@ impl TranscriptProof {
 
             let (auth_sent, auth_recv) = proof.verify_with_provider(
                 provider,
+                secret,
                 commitment,
                 self.transcript.sent_unsafe(),
                 self.transcript.received_unsafe(),
@@ -120,7 +133,7 @@ impl TranscriptProof {
                 Direction::Received => (self.transcript.received_unsafe(), &mut total_auth_recv),
             };
 
-            if idx.end() > plaintext.len() {
+            if idx.end().unwrap_or(0) > plaintext.len() {
                 return Err(TranscriptProofError::new(
                     ErrorKind::Hash,
                     "hash opening index is out of bounds",
@@ -215,15 +228,15 @@ impl From<EncodingProofError> for TranscriptProofError {
 /// Union of ranges to reveal.
 #[derive(Clone, Debug, PartialEq)]
 struct QueryIdx {
-    sent: Idx,
-    recv: Idx,
+    sent: RangeSet<usize>,
+    recv: RangeSet<usize>,
 }
 
 impl QueryIdx {
     fn new() -> Self {
         Self {
-            sent: Idx::empty(),
-            recv: Idx::empty(),
+            sent: RangeSet::default(),
+            recv: RangeSet::default(),
         }
     }
 
@@ -231,7 +244,7 @@ impl QueryIdx {
         self.sent.is_empty() && self.recv.is_empty()
     }
 
-    fn union(&mut self, direction: &Direction, other: &Idx) {
+    fn union(&mut self, direction: &Direction, other: &RangeSet<usize>) {
         match direction {
             Direction::Sent => self.sent.union_mut(other),
             Direction::Received => self.recv.union_mut(other),
@@ -241,7 +254,12 @@ impl QueryIdx {
 
 impl std::fmt::Display for QueryIdx {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "sent: {}, received: {}", self.sent, self.recv)
+        write!(
+            f,
+            "sent: {}, received: {}",
+            FmtRangeSet(&self.sent),
+            FmtRangeSet(&self.recv)
+        )
     }
 }
 
@@ -253,8 +271,8 @@ pub struct TranscriptProofBuilder<'a> {
     transcript: &'a Transcript,
     encoding_tree: Option<&'a EncodingTree>,
     hash_secrets: Vec<&'a PlaintextHashSecret>,
-    committed_sent: Idx,
-    committed_recv: Idx,
+    committed_sent: RangeSet<usize>,
+    committed_recv: RangeSet<usize>,
     query_idx: QueryIdx,
 }
 
@@ -264,8 +282,8 @@ impl<'a> TranscriptProofBuilder<'a> {
         transcript: &'a Transcript,
         secrets: impl IntoIterator<Item = &'a TranscriptSecret>,
     ) -> Self {
-        let mut committed_sent = Idx::empty();
-        let mut committed_recv = Idx::empty();
+        let mut committed_sent = RangeSet::default();
+        let mut committed_recv = RangeSet::default();
 
         let mut encoding_tree = None;
         let mut hash_secrets = Vec::new();
@@ -323,15 +341,15 @@ impl<'a> TranscriptProofBuilder<'a> {
         ranges: &dyn ToRangeSet<usize>,
         direction: Direction,
     ) -> Result<&mut Self, TranscriptProofBuilderError> {
-        let idx = Idx::new(ranges.to_range_set());
+        let idx = ranges.to_range_set();
 
-        if idx.end() > self.transcript.len_of_direction(direction) {
+        if idx.end().unwrap_or(0) > self.transcript.len_of_direction(direction) {
             return Err(TranscriptProofBuilderError::new(
                 BuilderErrorKind::Index,
                 format!(
                     "range is out of bounds of the transcript ({}): {} > {}",
                     direction,
-                    idx.end(),
+                    idx.end().unwrap_or(0),
                     self.transcript.len_of_direction(direction)
                 ),
             ));
@@ -348,7 +366,10 @@ impl<'a> TranscriptProofBuilder<'a> {
             let missing = idx.difference(committed);
             return Err(TranscriptProofBuilderError::new(
                 BuilderErrorKind::MissingCommitment,
-                format!("commitment is missing for ranges in {direction} transcript: {missing}"),
+                format!(
+                    "commitment is missing for ranges in {direction} transcript: {}",
+                    FmtRangeSet(&missing)
+                ),
             ));
         }
         Ok(self)
@@ -403,25 +424,23 @@ impl<'a> TranscriptProofBuilder<'a> {
                             continue;
                         };
 
-                        let (sent_dir_idxs, sent_uncovered) =
-                            uncovered_query_idx.sent.as_range_set().cover_by(
-                                encoding_tree
-                                    .transcript_indices()
-                                    .filter(|(dir, _)| *dir == Direction::Sent),
-                                |(_, idx)| &idx.0,
-                            );
+                        let (sent_dir_idxs, sent_uncovered) = uncovered_query_idx.sent.cover_by(
+                            encoding_tree
+                                .transcript_indices()
+                                .filter(|(dir, _)| *dir == Direction::Sent),
+                            |(_, idx)| idx,
+                        );
                         // Uncovered ranges will be checked with ranges of the next
                         // preferred commitment kind.
-                        uncovered_query_idx.sent = Idx(sent_uncovered);
+                        uncovered_query_idx.sent = sent_uncovered;
 
-                        let (recv_dir_idxs, recv_uncovered) =
-                            uncovered_query_idx.recv.as_range_set().cover_by(
-                                encoding_tree
-                                    .transcript_indices()
-                                    .filter(|(dir, _)| *dir == Direction::Received),
-                                |(_, idx)| &idx.0,
-                            );
-                        uncovered_query_idx.recv = Idx(recv_uncovered);
+                        let (recv_dir_idxs, recv_uncovered) = uncovered_query_idx.recv.cover_by(
+                            encoding_tree
+                                .transcript_indices()
+                                .filter(|(dir, _)| *dir == Direction::Received),
+                            |(_, idx)| idx,
+                        );
+                        uncovered_query_idx.recv = recv_uncovered;
 
                         let dir_idxs = sent_dir_idxs
                             .into_iter()
@@ -439,25 +458,23 @@ impl<'a> TranscriptProofBuilder<'a> {
                         }
                     }
                     TranscriptCommitmentKind::Hash { alg } => {
-                        let (sent_hashes, sent_uncovered) =
-                            uncovered_query_idx.sent.as_range_set().cover_by(
-                                self.hash_secrets.iter().filter(|hash| {
-                                    hash.direction == Direction::Sent && &hash.alg == alg
-                                }),
-                                |hash| &hash.idx.0,
-                            );
+                        let (sent_hashes, sent_uncovered) = uncovered_query_idx.sent.cover_by(
+                            self.hash_secrets.iter().filter(|hash| {
+                                hash.direction == Direction::Sent && &hash.alg == alg
+                            }),
+                            |hash| &hash.idx,
+                        );
                         // Uncovered ranges will be checked with ranges of the next
                         // preferred commitment kind.
-                        uncovered_query_idx.sent = Idx(sent_uncovered);
+                        uncovered_query_idx.sent = sent_uncovered;
 
-                        let (recv_hashes, recv_uncovered) =
-                            uncovered_query_idx.recv.as_range_set().cover_by(
-                                self.hash_secrets.iter().filter(|hash| {
-                                    hash.direction == Direction::Received && &hash.alg == alg
-                                }),
-                                |hash| &hash.idx.0,
-                            );
-                        uncovered_query_idx.recv = Idx(recv_uncovered);
+                        let (recv_hashes, recv_uncovered) = uncovered_query_idx.recv.cover_by(
+                            self.hash_secrets.iter().filter(|hash| {
+                                hash.direction == Direction::Received && &hash.alg == alg
+                            }),
+                            |hash| &hash.idx,
+                        );
+                        uncovered_query_idx.recv = recv_uncovered;
 
                         transcript_proof.hash_secrets.extend(
                             sent_hashes
@@ -567,7 +584,7 @@ mod tests {
     use tlsn_data_fixtures::http::{request::GET_WITH_HEADER, response::OK_JSON};
 
     use crate::{
-        fixtures::encoding_provider,
+        fixtures::{encoder_secret, encoding_provider},
         hash::{Blake3, Blinder, HashAlgId},
         transcript::TranscriptCommitConfigBuilder,
     };
@@ -577,7 +594,7 @@ mod tests {
     #[rstest]
     fn test_verify_missing_encoding_commitment_root() {
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
-        let idxs = vec![(Direction::Received, Idx::new(0..transcript.len().1))];
+        let idxs = vec![(Direction::Received, RangeSet::from(0..transcript.len().1))];
         let encoding_tree = EncodingTree::new(
             &Blake3::default(),
             &idxs,
@@ -594,7 +611,12 @@ mod tests {
 
         let provider = HashProvider::default();
         let err = transcript_proof
-            .verify_with_provider(&provider, &transcript.length(), &[])
+            .verify_with_provider(
+                &provider,
+                &transcript.length(),
+                Some(&encoder_secret()),
+                &[],
+            )
             .err()
             .unwrap();
 
@@ -632,15 +654,16 @@ mod tests {
     }
 
     #[rstest]
-    fn test_reveal_with_hash_commitment() {
+    #[case::sha256(HashAlgId::SHA256)]
+    #[case::blake3(HashAlgId::BLAKE3)]
+    fn test_reveal_with_hash_commitment(#[case] alg: HashAlgId) {
         let mut rng = rand::rngs::StdRng::seed_from_u64(0);
         let provider = HashProvider::default();
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
 
         let direction = Direction::Sent;
-        let idx = Idx::new(0..10);
+        let idx = RangeSet::from(0..10);
         let blinder: Blinder = rng.random();
-        let alg = HashAlgId::SHA256;
         let hasher = provider.get(&alg).unwrap();
 
         let commitment = PlaintextHash {
@@ -667,6 +690,7 @@ mod tests {
             .verify_with_provider(
                 &provider,
                 &transcript.length(),
+                None,
                 &[TranscriptCommitment::Hash(commitment)],
             )
             .unwrap();
@@ -678,15 +702,16 @@ mod tests {
     }
 
     #[rstest]
-    fn test_reveal_with_inconsistent_hash_commitment() {
+    #[case::sha256(HashAlgId::SHA256)]
+    #[case::blake3(HashAlgId::BLAKE3)]
+    fn test_reveal_with_inconsistent_hash_commitment(#[case] alg: HashAlgId) {
         let mut rng = rand::rngs::StdRng::seed_from_u64(0);
         let provider = HashProvider::default();
         let transcript = Transcript::new(GET_WITH_HEADER, OK_JSON);
 
         let direction = Direction::Sent;
-        let idx = Idx::new(0..10);
+        let idx = RangeSet::from(0..10);
         let blinder: Blinder = rng.random();
-        let alg = HashAlgId::SHA256;
         let hasher = provider.get(&alg).unwrap();
 
         let commitment = PlaintextHash {
@@ -714,6 +739,7 @@ mod tests {
             .verify_with_provider(
                 &provider,
                 &transcript.length(),
+                None,
                 &[TranscriptCommitment::Hash(commitment)],
             )
             .unwrap_err();
@@ -894,10 +920,10 @@ mod tests {
             match kind {
                 BuilderErrorKind::Cover { uncovered, .. } => {
                     if !uncovered_sent_rangeset.is_empty() {
-                        assert_eq!(uncovered.sent, Idx(uncovered_sent_rangeset));
+                        assert_eq!(uncovered.sent, uncovered_sent_rangeset);
                     }
                     if !uncovered_recv_rangeset.is_empty() {
-                        assert_eq!(uncovered.recv, Idx(uncovered_recv_rangeset));
+                        assert_eq!(uncovered.recv, uncovered_recv_rangeset);
                     }
                 }
                 _ => panic!("unexpected error kind: {kind:?}"),

crates/examples/Cargo.toml

@@ -18,13 +18,13 @@ spansy = { workspace = true }
 bincode = { workspace = true }
 chrono = { workspace = true }
 clap = { version = "4.5", features = ["derive"] }
-dotenv = { version = "0.15.0" }
 futures = { workspace = true }
 http-body-util = { workspace = true }
 hex = { workspace = true }
 hyper = { workspace = true, features = ["client", "http1"] }
 hyper-util = { workspace = true, features = ["full"] }
 k256 = { workspace = true, features = ["ecdsa"] }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = [
   "rt",
@@ -37,7 +37,24 @@ tokio = { workspace = true, features = [
 tokio-util = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
+noir = { git = "https://github.com/zkmopro/noir-rs", tag = "v1.0.0-beta.8", features = ["barretenberg"] }
 
 [[example]]
 name = "interactive"
 path = "interactive/interactive.rs"
+
+[[example]]
+name = "interactive_zk"
+path = "interactive_zk/interactive_zk.rs"
+
+[[example]]
+name = "attestation_prove"
+path = "attestation/prove.rs"
+
+[[example]]
+name = "attestation_present"
+path = "attestation/present.rs"
+
+[[example]]
+name = "attestation_verify"
+path = "attestation/verify.rs"

crates/examples/README.md

@@ -5,4 +5,4 @@ This folder contains examples demonstrating how to use the TLSNotary protocol.
 * [Interactive](./interactive/README.md): Interactive Prover and Verifier session without a trusted notary.
 * [Attestation](./attestation/README.md): Performing a simple notarization with a trusted notary.
 
-Refer to <https://docs.tlsnotary.org/quick_start/index.html> for a quick start guide to using TLSNotary with these examples.
+Refer to <https://tlsnotary.org/docs/quick_start> for a quick start guide to using TLSNotary with these examples.

crates/examples/attestation/README.md

@@ -0,0 +1,164 @@
+# Attestation Example
+
+
+This example demonstrates a **TLSNotary attestation workflow**: notarizing data from a server with a trusted third party (Notary), then creating verifiable presentations with selective disclosure of sensitive information to a Verifier.
+
+## 🔍 How It Works
+
+```mermaid
+sequenceDiagram
+    participant P as Prover
+    participant N as MPC-TLS<br/>Verifier
+    participant S as Server<br/>Fixture
+    participant V as Attestation<br/>Verifier
+
+    Note over P,S: 1. Notarization Phase
+    P->>N: Establish MPC-TLS connection
+    P->>S: Request (MPC-TLS)
+    S->>P: Response (MPC-TLS)
+    N->>P: Issue signed attestation
+
+    Note over P: 2. Presentation Phase
+    P->>P: Create redacted presentation
+
+    Note over P,V: 3. Verification Phase
+    P->>V: Share presentation
+    V->>V: Verify attestation signature
+```
+
+### The Three-Step Process
+
+1. **🔐 Notarize**: Prover collaborates with Notary to create an authenticated TLS session and obtain a signed attestation
+2. **✂️ Present**: Prover creates a selective presentation, choosing which data to reveal or redact
+3. **✅ Verify**: Anyone can verify the presentation's authenticity using the Notary's public key
+
+## 🚀 Quick Start
+
+### Step 1: Notarize Data
+
+**Start the test server** (from repository root):
+```bash
+RUST_LOG=info PORT=4000 cargo run --bin tlsn-server-fixture
+```
+
+**Run the notarization** (in a new terminal):
+```bash
+RUST_LOG=info SERVER_PORT=4000 cargo run --release --example attestation_prove
+```
+
+**Expected output:**
+```
+Notarization completed successfully!
+The attestation has been written to `example-json.attestation.tlsn` and the corresponding secrets to `example-json.secrets.tlsn`.
+```
+
+### Step 2: Create Verifiable Presentation
+
+**Generate a redacted presentation:**
+```bash
+cargo run --release --example attestation_present
+```
+
+**Expected output:**
+```
+Presentation built successfully!
+The presentation has been written to `example-json.presentation.tlsn`.
+```
+
+> 💡 **Tip**: You can create multiple presentations from the same attestation, each with different redactions!
+
+### Step 3: Verify the Presentation
+
+**Verify the presentation:**
+```bash
+cargo run --release --example attestation_verify
+```
+
+**Expected output:**
+```
+Verifying presentation with {key algorithm} key: { hex encoded key }
+
+**Ask yourself, do you trust this key?**
+
+-------------------------------------------------------------------
+Successfully verified that the data below came from a session with test-server.io at { time }.
+Note that the data which the Prover chose not to disclose are shown as X.
+
+Data sent:
+
+GET /formats/json HTTP/1.1
+host: test-server.io
+accept: */*
+accept-encoding: identity
+connection: close
+user-agent: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+Data received:
+
+HTTP/1.1 200 OK
+content-type: application/json
+content-length: 722
+connection: close
+date: Mon, 08 Sep 2025 09:18:29 GMT
+
+XXXXXX1234567890XXXXXXXXXXXXXXXXXXXXXXXXJohn DoeXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX1.2XX
+```
+
+## 🎯 Use Cases & Examples
+
+### JSON Data (Default)
+Perfect for API responses, configuration data, or structured information:
+```bash
+# All three steps use JSON by default
+SERVER_PORT=4000 cargo run --release --example attestation_prove
+cargo run --release --example attestation_present
+cargo run --release --example attestation_verify
+```
+
+### HTML Content
+Ideal for web pages, forms, or any HTML-based data:
+```bash
+# Notarize HTML content
+SERVER_PORT=4000 cargo run --release --example attestation_prove -- html
+cargo run --release --example attestation_present -- html
+cargo run --release --example attestation_verify -- html
+```
+
+### Authenticated/Private Data
+For APIs requiring authentication tokens, cookies, or private access:
+```bash
+# Notarize private data with authentication
+SERVER_PORT=4000 cargo run --release --example attestation_prove -- authenticated
+cargo run --release --example attestation_present -- authenticated
+cargo run --release --example attestation_verify -- authenticated
+```
+
+### Debug Mode
+
+For detailed logging and troubleshooting:
+```bash
+RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example attestation_prove
+```
+
+### Generated Files
+
+After running the examples, you'll find:
+- **`*.attestation.tlsn`**: The cryptographically signed attestation from the Notary
+- **`*.secrets.tlsn`**: Cryptographic secrets needed to create presentations
+- **`*.presentation.tlsn`**: The verifiable presentation with your chosen redactions
+
+## 🔐 Security Considerations
+
+### Trust Model
+- ✅ **Notary Key**: The presentation includes the Notary's verifying key - The verifier must trust this key
+- ✅ **Data Authenticity**: Cryptographically guaranteed that data came from the specified server
+- ✅ **Tamper Evidence**: Any modification to the presentation will fail verification
+- ⚠️ **Notary Trust**: The verifier must trust the Notary not to collude with the Prover
+
+### Production Deployment
+- 🏭 **Independent Notary**: Use a trusted third-party Notary service (not a local one)
+- 🔒 **Key Management**: Implement proper Notary key distribution and verification
+- 📋 **Audit Trail**: Maintain logs of notarization and verification events
+- 🔄 **Key Rotation**: Plan for Notary key updates and migration
+
+> ⚠️ **Demo Notice**: This example uses a local test server and local Notary for demonstration. In production, use trusted third-party Notary services and real server endpoints.

crates/examples/attestation/present.rs

@@ -0,0 +1,117 @@
+// This example demonstrates how to build a verifiable presentation from an
+// attestation and the corresponding connection secrets. See the `prove.rs`
+// example to learn how to acquire an attestation from a Notary.
+
+use clap::Parser;
+use hyper::header;
+
+use tlsn::attestation::{presentation::Presentation, Attestation, CryptoProvider, Secrets};
+use tlsn_examples::ExampleType;
+use tlsn_formats::http::HttpTranscript;
+
+#[derive(Parser, Debug)]
+#[command(version, about, long_about = None)]
+struct Args {
+    /// What data to notarize
+    #[clap(default_value_t, value_enum)]
+    example_type: ExampleType,
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let args = Args::parse();
+
+    create_presentation(&args.example_type).await
+}
+
+async fn create_presentation(example_type: &ExampleType) -> Result<(), Box<dyn std::error::Error>> {
+    let attestation_path = tlsn_examples::get_file_path(example_type, "attestation");
+    let secrets_path = tlsn_examples::get_file_path(example_type, "secrets");
+
+    // Read attestation from disk.
+    let attestation: Attestation = bincode::deserialize(&std::fs::read(attestation_path)?)?;
+
+    // Read secrets from disk.
+    let secrets: Secrets = bincode::deserialize(&std::fs::read(secrets_path)?)?;
+
+    // Parse the HTTP transcript.
+    let transcript = HttpTranscript::parse(secrets.transcript())?;
+
+    // Build a transcript proof.
+    let mut builder = secrets.transcript_proof_builder();
+
+    // Here is where we reveal all or some of the parts we committed in `prove.rs`
+    // previously.
+    let request = &transcript.requests[0];
+    // Reveal the structure of the request without the headers or body.
+    builder.reveal_sent(&request.without_data())?;
+    // Reveal the request target.
+    builder.reveal_sent(&request.request.target)?;
+    // Reveal all request headers except the values of User-Agent and Authorization.
+    for header in &request.headers {
+        if !(header
+            .name
+            .as_str()
+            .eq_ignore_ascii_case(header::USER_AGENT.as_str())
+            || header
+                .name
+                .as_str()
+                .eq_ignore_ascii_case(header::AUTHORIZATION.as_str()))
+        {
+            builder.reveal_sent(header)?;
+        } else {
+            builder.reveal_sent(&header.without_value())?;
+        }
+    }
+
+    // Reveal only parts of the response.
+    let response = &transcript.responses[0];
+    // Reveal the structure of the response without the headers or body.
+    builder.reveal_recv(&response.without_data())?;
+    // Reveal all response headers.
+    for header in &response.headers {
+        builder.reveal_recv(header)?;
+    }
+
+    let content = &response.body.as_ref().unwrap().content;
+    match content {
+        tlsn_formats::http::BodyContent::Json(json) => {
+            // For experimentation, reveal the entire response or just a selection.
+            let reveal_all = false;
+            if reveal_all {
+                builder.reveal_recv(response)?;
+            } else {
+                builder.reveal_recv(json.get("id").unwrap())?;
+                builder.reveal_recv(json.get("information.name").unwrap())?;
+                builder.reveal_recv(json.get("meta.version").unwrap())?;
+            }
+        }
+        tlsn_formats::http::BodyContent::Unknown(span) => {
+            builder.reveal_recv(span)?;
+        }
+        _ => {}
+    }
+
+    let transcript_proof = builder.build()?;
+
+    // Use default crypto provider to build the presentation.
+    let provider = CryptoProvider::default();
+
+    let mut builder = attestation.presentation_builder(&provider);
+
+    builder
+        .identity_proof(secrets.identity_proof())
+        .transcript_proof(transcript_proof);
+
+    let presentation: Presentation = builder.build()?;
+
+    let presentation_path = tlsn_examples::get_file_path(example_type, "presentation");
+
+    // Write the presentation to disk.
+    std::fs::write(&presentation_path, bincode::serialize(&presentation)?)?;
+
+    println!("Presentation built successfully!");
+    println!("The presentation has been written to `{presentation_path}`.");
+
+    Ok(())
+}

crates/examples/attestation/prove.rs

@@ -0,0 +1,403 @@
+// This example demonstrates how to use the Prover to acquire an attestation for
+// an HTTP request sent to a server fixture. The attestation and secrets are
+// saved to disk.
+
+use std::env;
+
+use clap::Parser;
+use http_body_util::Empty;
+use hyper::{body::Bytes, Request, StatusCode};
+use hyper_util::rt::TokioIo;
+use spansy::Spanned;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    sync::oneshot::{self, Receiver, Sender},
+};
+use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
+use tracing::info;
+
+use tlsn::{
+    attestation::{
+        request::{Request as AttestationRequest, RequestConfig},
+        signing::Secp256k1Signer,
+        Attestation, AttestationConfig, CryptoProvider, Secrets,
+    },
+    config::{
+        CertificateDer, PrivateKeyDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore,
+    },
+    connection::{ConnectionInfo, HandshakeData, ServerName, TranscriptLength},
+    prover::{state::Committed, ProveConfig, Prover, ProverConfig, ProverOutput, TlsConfig},
+    transcript::{ContentType, TranscriptCommitConfig},
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
+};
+use tlsn_examples::ExampleType;
+use tlsn_formats::http::{DefaultHttpCommitter, HttpCommit, HttpTranscript};
+use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
+use tlsn_server_fixture_certs::{CA_CERT_DER, CLIENT_CERT_DER, CLIENT_KEY_DER, SERVER_DOMAIN};
+
+// Setting of the application server.
+const USER_AGENT: &str = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36";
+
+#[derive(Parser, Debug)]
+#[command(version, about, long_about = None)]
+struct Args {
+    /// What data to notarize.
+    #[clap(default_value_t, value_enum)]
+    example_type: ExampleType,
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt::init();
+
+    let args = Args::parse();
+    let (uri, extra_headers) = match args.example_type {
+        ExampleType::Json => ("/formats/json", vec![]),
+        ExampleType::Html => ("/formats/html", vec![]),
+        ExampleType::Authenticated => ("/protected", vec![("Authorization", "random_auth_token")]),
+    };
+
+    let (notary_socket, prover_socket) = tokio::io::duplex(1 << 23);
+    let (request_tx, request_rx) = oneshot::channel();
+    let (attestation_tx, attestation_rx) = oneshot::channel();
+
+    tokio::spawn(async move {
+        notary(notary_socket, request_rx, attestation_tx)
+            .await
+            .unwrap()
+    });
+
+    prover(
+        prover_socket,
+        request_tx,
+        attestation_rx,
+        uri,
+        extra_headers,
+        &args.example_type,
+    )
+    .await?;
+
+    Ok(())
+}
+
+async fn prover<S: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: S,
+    req_tx: Sender<AttestationRequest>,
+    resp_rx: Receiver<Attestation>,
+    uri: &str,
+    extra_headers: Vec<(&str, &str)>,
+    example_type: &ExampleType,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
+    let server_port: u16 = env::var("SERVER_PORT")
+        .map(|port| port.parse().expect("port should be valid integer"))
+        .unwrap_or(DEFAULT_FIXTURE_PORT);
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder
+        .root_store(RootCertStore {
+            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+        })
+        // (Optional) Set up TLS client authentication if required by the server.
+        .client_auth((
+            vec![CertificateDer(CLIENT_CERT_DER.to_vec())],
+            PrivateKeyDer(CLIENT_KEY_DER.to_vec()),
+        ));
+
+    let tls_config = tls_config_builder.build().unwrap();
+
+    // Set up protocol configuration for prover.
+    let mut prover_config_builder = ProverConfig::builder();
+    prover_config_builder
+        .server_name(ServerName::Dns(SERVER_DOMAIN.try_into().unwrap()))
+        .tls_config(tls_config)
+        .protocol_config(
+            ProtocolConfig::builder()
+                // We must configure the amount of data we expect to exchange beforehand, which will
+                // be preprocessed prior to the connection. Reducing these limits will improve
+                // performance.
+                .max_sent_data(tlsn_examples::MAX_SENT_DATA)
+                .max_recv_data(tlsn_examples::MAX_RECV_DATA)
+                .build()?,
+        );
+
+    let prover_config = prover_config_builder.build()?;
+
+    // Create a new prover and perform necessary setup.
+    let prover = Prover::new(prover_config).setup(socket.compat()).await?;
+
+    // Open a TCP connection to the server.
+    let client_socket = tokio::net::TcpStream::connect((server_host, server_port)).await?;
+
+    // Bind the prover to the server connection.
+    // The returned `mpc_tls_connection` is an MPC TLS connection to the server: all
+    // data written to/read from it will be encrypted/decrypted using MPC with
+    // the notary.
+    let (mpc_tls_connection, prover_fut) = prover.connect(client_socket.compat()).await?;
+    let mpc_tls_connection = TokioIo::new(mpc_tls_connection.compat());
+
+    // Spawn the prover task to be run concurrently in the background.
+    let prover_task = tokio::spawn(prover_fut);
+
+    // Attach the hyper HTTP client to the connection.
+    let (mut request_sender, connection) =
+        hyper::client::conn::http1::handshake(mpc_tls_connection).await?;
+
+    // Spawn the HTTP task to be run concurrently in the background.
+    tokio::spawn(connection);
+
+    // Build a simple HTTP request with common headers.
+    let request_builder = Request::builder()
+        .uri(uri)
+        .header("Host", SERVER_DOMAIN)
+        .header("Accept", "*/*")
+        // Using "identity" instructs the Server not to use compression for its HTTP response.
+        // TLSNotary tooling does not support compression.
+        .header("Accept-Encoding", "identity")
+        .header("Connection", "close")
+        .header("User-Agent", USER_AGENT);
+    let mut request_builder = request_builder;
+    for (key, value) in extra_headers {
+        request_builder = request_builder.header(key, value);
+    }
+    let request = request_builder.body(Empty::<Bytes>::new())?;
+
+    info!("Starting an MPC TLS connection with the server");
+
+    // Send the request to the server and wait for the response.
+    let response = request_sender.send_request(request).await?;
+
+    info!("Got a response from the server: {}", response.status());
+
+    assert!(response.status() == StatusCode::OK);
+
+    // The prover task should be done now, so we can await it.
+    let prover = prover_task.await??;
+
+    // Parse the HTTP transcript.
+    let transcript = HttpTranscript::parse(prover.transcript())?;
+
+    let body_content = &transcript.responses[0].body.as_ref().unwrap().content;
+    let body = String::from_utf8_lossy(body_content.span().as_bytes());
+
+    match body_content {
+        tlsn_formats::http::BodyContent::Json(_json) => {
+            let parsed = serde_json::from_str::<serde_json::Value>(&body)?;
+            info!("{}", serde_json::to_string_pretty(&parsed)?);
+        }
+        tlsn_formats::http::BodyContent::Unknown(_span) => {
+            info!("{}", &body);
+        }
+        _ => {}
+    }
+
+    // Commit to the transcript.
+    let mut builder = TranscriptCommitConfig::builder(prover.transcript());
+
+    // This commits to various parts of the transcript separately (e.g. request
+    // headers, response headers, response body and more). See https://docs.tlsnotary.org//protocol/commit_strategy.html
+    // for other strategies that can be used to generate commitments.
+    DefaultHttpCommitter::default().commit_transcript(&mut builder, &transcript)?;
+
+    let transcript_commit = builder.build()?;
+
+    // Build an attestation request.
+    let mut builder = RequestConfig::builder();
+
+    builder.transcript_commit(transcript_commit);
+
+    // Optionally, add an extension to the attestation if the notary supports it.
+    // builder.extension(Extension {
+    //     id: b"example.name".to_vec(),
+    //     value: b"Bobert".to_vec(),
+    // });
+
+    let request_config = builder.build()?;
+
+    let (attestation, secrets) = notarize(prover, &request_config, req_tx, resp_rx).await?;
+
+    // Write the attestation to disk.
+    let attestation_path = tlsn_examples::get_file_path(example_type, "attestation");
+    let secrets_path = tlsn_examples::get_file_path(example_type, "secrets");
+
+    tokio::fs::write(&attestation_path, bincode::serialize(&attestation)?).await?;
+
+    // Write the secrets to disk.
+    tokio::fs::write(&secrets_path, bincode::serialize(&secrets)?).await?;
+
+    println!("Notarization completed successfully!");
+    println!(
+        "The attestation has been written to `{attestation_path}` and the \
+        corresponding secrets to `{secrets_path}`."
+    );
+
+    Ok(())
+}
+
+async fn notarize(
+    mut prover: Prover<Committed>,
+    config: &RequestConfig,
+    request_tx: Sender<AttestationRequest>,
+    attestation_rx: Receiver<Attestation>,
+) -> Result<(Attestation, Secrets), Box<dyn std::error::Error>> {
+    let mut builder = ProveConfig::builder(prover.transcript());
+
+    if let Some(config) = config.transcript_commit() {
+        builder.transcript_commit(config.clone());
+    }
+
+    let disclosure_config = builder.build()?;
+
+    let ProverOutput {
+        transcript_commitments,
+        transcript_secrets,
+        ..
+    } = prover.prove(&disclosure_config).await?;
+
+    let transcript = prover.transcript().clone();
+    let tls_transcript = prover.tls_transcript().clone();
+    prover.close().await?;
+
+    // Build an attestation request.
+    let mut builder = AttestationRequest::builder(config);
+
+    builder
+        .server_name(ServerName::Dns(SERVER_DOMAIN.try_into().unwrap()))
+        .handshake_data(HandshakeData {
+            certs: tls_transcript
+                .server_cert_chain()
+                .expect("server cert chain is present")
+                .to_vec(),
+            sig: tls_transcript
+                .server_signature()
+                .expect("server signature is present")
+                .clone(),
+            binding: tls_transcript.certificate_binding().clone(),
+        })
+        .transcript(transcript)
+        .transcript_commitments(transcript_secrets, transcript_commitments);
+
+    let (request, secrets) = builder.build(&CryptoProvider::default())?;
+
+    // Send attestation request to notary.
+    request_tx
+        .send(request.clone())
+        .map_err(|_| "notary is not receiving attestation request".to_string())?;
+
+    // Receive attestation from notary.
+    let attestation = attestation_rx
+        .await
+        .map_err(|err| format!("notary did not respond with attestation: {err}"))?;
+
+    // Check the attestation is consistent with the Prover's view.
+    request.validate(&attestation)?;
+
+    Ok((attestation, secrets))
+}
+
+async fn notary<S: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: S,
+    request_rx: Receiver<AttestationRequest>,
+    attestation_tx: Sender<Attestation>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    // Set up Verifier.
+    let config_validator = ProtocolConfigValidator::builder()
+        .max_sent_data(tlsn_examples::MAX_SENT_DATA)
+        .max_recv_data(tlsn_examples::MAX_RECV_DATA)
+        .build()
+        .unwrap();
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let verifier_config = VerifierConfig::builder()
+        .root_store(RootCertStore {
+            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+        })
+        .protocol_config_validator(config_validator)
+        .build()
+        .unwrap();
+
+    let mut verifier = Verifier::new(verifier_config)
+        .setup(socket.compat())
+        .await?
+        .run()
+        .await?;
+
+    let VerifierOutput {
+        transcript_commitments,
+        encoder_secret,
+        ..
+    } = verifier.verify(&VerifyConfig::default()).await?;
+
+    let tls_transcript = verifier.tls_transcript().clone();
+
+    verifier.close().await?;
+
+    let sent_len = tls_transcript
+        .sent()
+        .iter()
+        .filter_map(|record| {
+            if let ContentType::ApplicationData = record.typ {
+                Some(record.ciphertext.len())
+            } else {
+                None
+            }
+        })
+        .sum::<usize>();
+
+    let recv_len = tls_transcript
+        .recv()
+        .iter()
+        .filter_map(|record| {
+            if let ContentType::ApplicationData = record.typ {
+                Some(record.ciphertext.len())
+            } else {
+                None
+            }
+        })
+        .sum::<usize>();
+
+    // Receive attestation request from prover.
+    let request = request_rx.await?;
+
+    // Load a dummy signing key.
+    let signing_key = k256::ecdsa::SigningKey::from_bytes(&[1u8; 32].into())?;
+    let signer = Box::new(Secp256k1Signer::new(&signing_key.to_bytes())?);
+    let mut provider = CryptoProvider::default();
+    provider.signer.set_signer(signer);
+
+    // Build an attestation.
+    let mut att_config_builder = AttestationConfig::builder();
+    att_config_builder.supported_signature_algs(Vec::from_iter(provider.signer.supported_algs()));
+    let att_config = att_config_builder.build()?;
+
+    let mut builder = Attestation::builder(&att_config).accept_request(request)?;
+    builder
+        .connection_info(ConnectionInfo {
+            time: tls_transcript.time(),
+            version: (*tls_transcript.version()),
+            transcript_length: TranscriptLength {
+                sent: sent_len as u32,
+                received: recv_len as u32,
+            },
+        })
+        .server_ephemeral_key(tls_transcript.server_ephemeral_key().clone())
+        .transcript_commitments(transcript_commitments);
+
+    if let Some(encoder_secret) = encoder_secret {
+        builder.encoder_secret(encoder_secret);
+    }
+
+    let attestation = builder.build(&provider)?;
+
+    // Send attestation to prover.
+    attestation_tx
+        .send(attestation)
+        .map_err(|_| "prover is not receiving attestation".to_string())?;
+
+    Ok(())
+}

crates/examples/attestation/verify.rs

@@ -0,0 +1,96 @@
+// This example demonstrates how to verify a presentation. See `present.rs` for
+// an example of how to build a presentation from an attestation and connection
+// secrets.
+
+use std::time::Duration;
+
+use clap::Parser;
+
+use tlsn::{
+    attestation::{
+        presentation::{Presentation, PresentationOutput},
+        signing::VerifyingKey,
+        CryptoProvider,
+    },
+    config::{CertificateDer, RootCertStore},
+    verifier::ServerCertVerifier,
+};
+use tlsn_examples::ExampleType;
+use tlsn_server_fixture_certs::CA_CERT_DER;
+
+#[derive(Parser, Debug)]
+#[command(version, about, long_about = None)]
+struct Args {
+    /// What data to notarize.
+    #[clap(default_value_t, value_enum)]
+    example_type: ExampleType,
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let args = Args::parse();
+
+    verify_presentation(&args.example_type).await
+}
+
+async fn verify_presentation(example_type: &ExampleType) -> Result<(), Box<dyn std::error::Error>> {
+    // Read the presentation from disk.
+    let presentation_path = tlsn_examples::get_file_path(example_type, "presentation");
+
+    let presentation: Presentation = bincode::deserialize(&std::fs::read(presentation_path)?)?;
+
+    // Create a crypto provider accepting the server-fixture's self-signed
+    // root certificate.
+    //
+    // This is only required for offline testing with the server-fixture. In
+    // production, use `CryptoProvider::default()` instead.
+    let root_cert_store = RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    };
+    let crypto_provider = CryptoProvider {
+        cert: ServerCertVerifier::new(&root_cert_store)?,
+        ..Default::default()
+    };
+
+    let VerifyingKey {
+        alg,
+        data: key_data,
+    } = presentation.verifying_key();
+
+    println!(
+        "Verifying presentation with {alg} key: {}\n\n**Ask yourself, do you trust this key?**\n",
+        hex::encode(key_data)
+    );
+
+    // Verify the presentation.
+    let PresentationOutput {
+        server_name,
+        connection_info,
+        transcript,
+        // extensions, // Optionally, verify any custom extensions from prover/notary.
+        ..
+    } = presentation.verify(&crypto_provider).unwrap();
+
+    // The time at which the connection was started.
+    let time = chrono::DateTime::UNIX_EPOCH + Duration::from_secs(connection_info.time);
+    let server_name = server_name.unwrap();
+    let mut partial_transcript = transcript.unwrap();
+    // Set the unauthenticated bytes so they are distinguishable.
+    partial_transcript.set_unauthed(b'X');
+
+    let sent = String::from_utf8_lossy(partial_transcript.sent_unsafe());
+    let recv = String::from_utf8_lossy(partial_transcript.received_unsafe());
+
+    println!("-------------------------------------------------------------------");
+    println!(
+        "Successfully verified that the data below came from a session with {server_name} at {time}.",
+    );
+    println!("Note that the data which the Prover chose not to disclose are shown as X.\n");
+    println!("Data sent:\n");
+    println!("{sent}\n");
+    println!("Data received:\n");
+    println!("{recv}\n");
+    println!("-------------------------------------------------------------------");
+
+    Ok(())
+}

crates/examples/interactive/interactive.rs

@@ -10,7 +10,6 @@ use tokio::io::{AsyncRead, AsyncWrite};
 use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
 use tracing::instrument;
 
-use tls_server_fixture::CA_CERT_DER;
 use tlsn::{
     config::{CertificateDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore},
     connection::ServerName,
@@ -19,7 +18,7 @@ use tlsn::{
     verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
 };
 use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
-use tlsn_server_fixture_certs::SERVER_DOMAIN;
+use tlsn_server_fixture_certs::{CA_CERT_DER, SERVER_DOMAIN};
 
 const SECRET: &str = "TLSNotary's private key 🤡";
 

crates/examples/interactive_zk/.gitignore

@@ -0,0 +1,5 @@
+!noir/target/
+# Ignore everything inside noir/target
+noir/target/*
+# Except noir.json
+!noir/target/noir.json

crates/examples/interactive_zk/README.md

@@ -0,0 +1,167 @@
+# Interactive Zero-Knowledge Age Verification with TLSNotary
+
+This example demonstrates **privacy-preserving age verification** using TLSNotary and zero-knowledge proofs. It allows a prover to demonstrate they are 18+ years old without revealing their actual birth date or any other personal information.
+
+## 🔍 How It Works (simplified overview)
+
+```mermaid
+sequenceDiagram
+    participant S as Tax Server<br/>(fixture)
+    participant P as Prover
+    participant V as Verifier
+
+    P->>S: Request tax data (with auth token) (MPC-TLS)
+    S->>P: Tax data including `date_of_birth` (MPC-TLS)
+    P->>V: Share transcript with redactions
+    P->>V: Commit to blinded hash of birth date
+    P->>P: Generate ZK proof of age ≥ 18
+    P->>V: Send ZK proof
+    V->>V: Verify transcript & ZK proof
+    V->>V: ✅ Confirm: Prover is 18+ (no birth date revealed)
+```
+
+### The Process
+
+1. **MPC-TLS Session**: The Prover fetches tax information containing their birth date, while the Verifier jointly verifies the TLS session to ensure the data comes from the authentic server.
+2. **Selective Disclosure**:
+   * The authorization token is **redacted**: the Verifier sees the plaintext request but not the token.
+   * The birth date is **committed** as a blinded hash: the Verifier cannot see the date, but the Prover is cryptographically bound to it.  
+   (Depending on the use case more data can be redacted or revealed)
+3. **Zero-Knowledge Proof**: The Prover generates a ZK proof that the committed birth date corresponds to an age ≥ 18.
+4. **Verification**: The Verifier checks both the TLS transcript and the ZK proof, confirming age ≥ 18 without learning the actual date of birth.
+
+
+### Example Data
+
+The tax server returns data like this:
+```json
+{
+    "tax_year": 2024,
+    "taxpayer": {
+        "idnr": "12345678901",
+        "first_name": "Max",
+        "last_name": "Mustermann",
+        "date_of_birth": "1985-03-12",
+        // ...
+    }
+}
+```
+
+## 🔐 Zero-Knowledge Proof Details
+
+The ZK circuit proves: **"I know a birth date that hashes to the committed value AND indicates I am 18+ years old"**
+
+**Public Inputs:**
+- ✅ Verification date
+- ✅ Committed blinded hash of birth date
+
+**Private Inputs (Hidden):**
+- 🔒 Actual birth date plaintext
+- 🔒 Random blinder used in hash commitment
+
+**What the Verifier Learns:**
+- ✅ The prover is 18+ years old
+- ✅ The birth date is authentic (from the MPC-TLS session)
+
+Everything else remains private.
+
+## 🏃 Run the Example
+
+1. **Start the test server** (from repository root):
+   ```bash
+   RUST_LOG=info PORT=4000 cargo run --bin tlsn-server-fixture
+   ```
+
+2. **Run the age verification** (in a new terminal):
+   ```bash
+   SERVER_PORT=4000 cargo run --release --example interactive_zk
+   ```
+
+3. **For detailed logs**:
+   ```bash
+   RUST_LOG=debug,yamux=info,uid_mux=info SERVER_PORT=4000 cargo run --release --example interactive_zk
+   ```
+
+### Expected Output
+
+```
+Successfully verified https://test-server.io:4000/elster
+Age verified in ZK: 18+ ✅
+
+Verified sent data:
+GET https://test-server.io:4000/elster HTTP/1.1
+host: test-server.io
+connection: close
+authorization: 🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈🙈
+
+Verified received data:
+🙈🙈🙈🙈🙈🙈🙈🙈[truncated for brevity]...🙈🙈🙈🙈🙈"tax_year":2024🙈🙈🙈🙈🙈...
+```
+
+> 💡 **Note**: In this demo, both Prover and Verifier run on the same machine. In production, they would operate on separate systems.
+> 💡 **Note**: This demo assumes that the tax server serves correct data, and that only the submitter of the tax data has access to the specified page.
+
+## 🛠 Development
+
+### Project Structure
+
+```
+interactive_zk/
+├── prover.rs                   # Prover implementation
+├── verifier.rs                 # Verifier implementation  
+├── types.rs                    # Shared types
+└── interactive_zk.rs           # Main example runner
+├── noir/                       # Zero-knowledge circuit
+│   ├── src/main.n              # Noir circuit code
+│   ├── target/                 # Compiled circuit artifacts
+│   └── Nargo.toml              # Noir project config
+│   └── Prover.toml             # Example input for `nargo execute`
+│   └── generate_test_data.rs   # Rust script to generate Noir test data
+└── README.md
+```
+
+### Noir Circuit Commands
+
+We use [Mopro's `noir_rs`](https://zkmopro.org/docs/crates/noir-rs/) for ZK proof generation.  The **circuit is pre-compiled and ready to use**. You don't need to install Noir tools to run the example. But if you want to change or test the circuit in isolation, you can use the following instructions.
+
+Before you proceed, we recommend to double check that your Noir tooling matches the versions used in Mopro's `noir_rs`:
+```sh
+# Install correct Noir and BB versions (important for compatibility!)
+noirup --version 1.0.0-beta.8
+bbup -v 1.0.0-nightly.20250723
+```
+
+If you don't have `noirup` and `bbup` installed yet, check [Noir's Quick Start](https://noir-lang.org/docs/getting_started/quick_start).
+
+To compile the circuit, go to the `noir` folder and run `nargo compile`.
+
+To check and experiment with the Noir circuit, you can use these commands:
+
+* Execute Circuit: Compile the circuit and run it with sample data from `Prover.toml`:
+    ```sh
+    nargo execute
+    ```
+* Generate Verification Key: Create the verification key needed to verify proofs
+    ```sh
+    bb write_vk -b ./target/noir.json -o ./target
+    ```
+* Generate Proof: Create a zero-knowledge proof using the circuit and witness data.
+    ```sh
+    bb prove --bytecode_path ./target/noir.json --witness_path ./target/noir.gz -o ./target
+    ```
+* Verify Proof: Verify that a proof is valid using the verification key.
+    ```sh
+    bb verify -k ./target/vk -p ./target/proof
+    ```
+* Run the Noir tests:
+    ```sh
+    nargo test --show-output
+    ```
+  To create extra tests, you can use `./generate_test_data.rs` to help with generating correct blinders and hashes.
+
+## 📚 Learn More
+
+- [TLSNotary Documentation](https://docs.tlsnotary.org/)
+- [Noir Language Guide](https://noir-lang.org/)
+- [Zero-Knowledge Proofs Explained](https://ethereum.org/en/zero-knowledge-proofs/)
+- [Mopro ZK Toolkit](https://zkmopro.org/)

crates/examples/interactive_zk/interactive_zk.rs

@@ -0,0 +1,59 @@
+mod prover;
+mod types;
+mod verifier;
+
+use prover::prover;
+use std::{
+    env,
+    net::{IpAddr, SocketAddr},
+};
+use tlsn_server_fixture::DEFAULT_FIXTURE_PORT;
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
+use verifier::verifier;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt::init();
+
+    let server_host: String = env::var("SERVER_HOST").unwrap_or("127.0.0.1".into());
+    let server_port: u16 = env::var("SERVER_PORT")
+        .map(|port| port.parse().expect("port should be valid integer"))
+        .unwrap_or(DEFAULT_FIXTURE_PORT);
+
+    // We use SERVER_DOMAIN here to make sure it matches the domain in the test
+    // server's certificate.
+    let uri = format!("https://{SERVER_DOMAIN}:{server_port}/elster");
+    let server_ip: IpAddr = server_host
+        .parse()
+        .map_err(|e| format!("Invalid IP address '{}': {}", server_host, e))?;
+    let server_addr = SocketAddr::from((server_ip, server_port));
+
+    // Connect prover and verifier.
+    let (prover_socket, verifier_socket) = tokio::io::duplex(1 << 23);
+    let (prover_extra_socket, verifier_extra_socket) = tokio::io::duplex(1 << 23);
+
+    let (_, transcript) = tokio::try_join!(
+        prover(prover_socket, prover_extra_socket, &server_addr, &uri),
+        verifier(verifier_socket, verifier_extra_socket)
+    )?;
+
+    println!("---");
+    println!("Successfully verified {}", &uri);
+    println!("Age verified in ZK: 18+ ✅\n");
+
+    println!(
+        "Verified sent data:\n{}",
+        bytes_to_redacted_string(transcript.sent_unsafe())
+    );
+    println!(
+        "Verified received data:\n{}",
+        bytes_to_redacted_string(transcript.received_unsafe())
+    );
+
+    Ok(())
+}
+
+/// Render redacted bytes as `🙈`.
+pub fn bytes_to_redacted_string(bytes: &[u8]) -> String {
+    String::from_utf8_lossy(bytes).replace('\0', "🙈")
+}

crates/examples/interactive_zk/noir/Nargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "noir"
+type = "bin"
+authors = [""]
+
+[dependencies]
+sha256 = { tag = "v0.1.5", git = "https://github.com/noir-lang/sha256" }
+date = { tag = "v0.5.4", git = "https://github.com/madztheo/noir-date.git" }

crates/examples/interactive_zk/noir/Prover.toml

@@ -0,0 +1,8 @@
+blinder = [108, 93, 120, 205, 15, 35, 159, 124, 243, 96, 22, 128, 16, 149, 219, 216]
+committed_hash = [186, 158, 101, 39, 49, 48, 26, 83, 242, 96, 10, 221, 121, 174, 62, 50, 136, 132, 232, 58, 25, 32, 66, 196, 99, 85, 66, 85, 255, 1, 202, 254]
+date_of_birth = "1985-03-12"
+
+[proof_date]
+day = "29"
+month = "08"
+year = "2025"

crates/examples/interactive_zk/noir/generate_test_data.rs

@@ -0,0 +1,64 @@
+#!/usr/bin/env -S cargo +nightly -Zscript
+---
+[package]
+name = "generate_test_data"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+sha2 = "0.10"
+rand = "0.8"
+chrono = "0.4"
+---
+use chrono::Datelike;
+use chrono::Local;
+use rand::RngCore;
+use sha2::{Digest, Sha256};
+
+fn main() {
+    // 1. Birthdate string (fixed)
+    let dob_str = "1985-03-12"; // 10 bytes long
+
+    let proof_date = Local::now().date_naive();
+    let proof_year = proof_date.year();
+    let proof_month = proof_date.month();
+    let proof_day = proof_date.day();
+
+    // 2. Generate random 16-byte blinder
+    let mut blinder = [0u8; 16];
+    rand::thread_rng().fill_bytes(&mut blinder);
+
+    // 3. Concatenate blinder + dob string bytes
+    let mut preimage = Vec::with_capacity(26);
+    preimage.extend_from_slice(dob_str.as_bytes());
+    preimage.extend_from_slice(&blinder);
+
+    // 4. Hash it
+    let hash = Sha256::digest(&preimage);
+
+    let blinder = blinder
+        .iter()
+        .map(|b| b.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+    let committed_hash = hash
+        .iter()
+        .map(|b| b.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+
+    println!(
+        "
+// Private input
+let date_of_birth = \"{dob_str}\";
+let blinder = [{blinder}];
+
+// Public input
+let proof_date = date::Date {{ year: {proof_year}, month: {proof_month}, day: {proof_day} }};
+let committed_hash = [{committed_hash}];
+
+main(proof_date, committed_hash, date_of_birth, blinder);
+"
+    );
+}

crates/examples/interactive_zk/noir/src/main.nr

@@ -0,0 +1,82 @@
+use dep::date::Date;
+
+fn main(
+    // Public inputs
+    proof_date: pub date::Date, // "2025-08-29"
+    committed_hash: pub [u8; 32], // Hash of (blinder || dob string)
+    // Private inputs
+    date_of_birth: str<10>, // "1985-03-12"
+    blinder: [u8; 16], // Random 16-byte blinder
+) {
+    let is_18 = check_18(date_of_birth, proof_date);
+
+    let correct_hash = check_hash(date_of_birth, blinder, committed_hash);
+
+    assert(correct_hash);
+    assert(is_18);
+}
+
+fn check_18(date_of_birth: str<10>, proof_date: date::Date) -> bool {
+    let dob = parse_birth_date(date_of_birth);
+    let is_18 = dob.add_years(18).lt(proof_date);
+    println(f"Is 18? {is_18}");
+    is_18
+}
+
+fn check_hash(date_of_birth: str<10>, blinder: [u8; 16], committed_hash: [u8; 32]) -> bool {
+    let hash_input: [u8; 26] = make_hash_input(date_of_birth, blinder);
+    let computed_hash = sha256::sha256_var(hash_input, 26);
+    let correct_hash = computed_hash == committed_hash;
+    println(f"Correct hash? {correct_hash}");
+    correct_hash
+}
+
+fn make_hash_input(dob: str<10>, blinder: [u8; 16]) -> [u8; 26] {
+    let mut input: [u8; 26] = [0; 26];
+    for i in 0..10 {
+        input[i] = dob.as_bytes()[i];
+    }
+    for i in 0..16 {
+        input[10 + i] = blinder[i];
+    }
+    input
+}
+
+pub fn parse_birth_date(birth_date: str<10>) -> date::Date {
+    let date: [u8; 10] = birth_date.as_bytes();
+    let date_str: str<8> =
+        [date[0], date[1], date[2], date[3], date[5], date[6], date[8], date[9]].as_str_unchecked();
+    Date::from_str_long_year(date_str)
+}
+
+#[test]
+fn test_max_is_over_18() {
+    // Private input
+    let date_of_birth = "1985-03-12";
+    let blinder = [120, 80, 62, 10, 76, 60, 130, 98, 147, 161, 139, 126, 27, 236, 36, 56];
+
+    // Public input
+    let proof_date = date::Date { year: 2025, month: 9, day: 2 };
+    let committed_hash = [
+        229, 118, 202, 216, 213, 230, 125, 163, 48, 178, 118, 225, 84, 7, 140, 63, 173, 255, 163,
+        208, 163, 3, 63, 204, 37, 120, 254, 246, 202, 116, 122, 145,
+    ];
+
+    main(proof_date, committed_hash, date_of_birth, blinder);
+}
+
+#[test(should_fail)]
+fn test_under_18() {
+    // Private input
+    let date_of_birth = "2010-08-01";
+    let blinder = [160, 23, 57, 158, 141, 195, 155, 132, 109, 242, 48, 220, 70, 217, 229, 189];
+
+    // Public input
+    let proof_date = date::Date { year: 2025, month: 8, day: 29 };
+    let committed_hash = [
+        16, 132, 194, 62, 232, 90, 157, 153, 4, 231, 1, 54, 226, 3, 87, 174, 129, 177, 80, 69, 37,
+        222, 209, 91, 168, 156, 9, 109, 108, 144, 168, 109,
+    ];
+
+    main(proof_date, committed_hash, date_of_birth, blinder);
+}

crates/examples/interactive_zk/prover.rs

@@ -0,0 +1,371 @@
+use std::net::SocketAddr;
+
+use crate::types::received_commitments;
+
+use super::types::ZKProofBundle;
+
+use chrono::{Datelike, Local, NaiveDate};
+use http_body_util::Empty;
+use hyper::{body::Bytes, header, Request, StatusCode, Uri};
+use hyper_util::rt::TokioIo;
+use k256::sha2::{Digest, Sha256};
+use noir::{
+    barretenberg::{
+        prove::prove_ultra_honk, srs::setup_srs_from_bytecode,
+        verify::get_ultra_honk_verification_key,
+    },
+    witness::from_vec_str_to_witness_map,
+};
+use serde_json::Value;
+use spansy::{
+    http::{BodyContent, Requests, Responses},
+    Spanned,
+};
+use tls_server_fixture::CA_CERT_DER;
+use tlsn::{
+    config::{CertificateDer, ProtocolConfig, RootCertStore},
+    connection::ServerName,
+    hash::HashAlgId,
+    prover::{ProveConfig, ProveConfigBuilder, Prover, ProverConfig, TlsConfig},
+    transcript::{
+        hash::{PlaintextHash, PlaintextHashSecret},
+        Direction, TranscriptCommitConfig, TranscriptCommitConfigBuilder, TranscriptCommitmentKind,
+        TranscriptSecret,
+    },
+};
+
+use tlsn_examples::MAX_RECV_DATA;
+use tokio::io::AsyncWriteExt;
+
+use tlsn_examples::MAX_SENT_DATA;
+use tokio::io::{AsyncRead, AsyncWrite};
+use tokio_util::compat::{FuturesAsyncReadCompatExt, TokioAsyncReadCompatExt};
+use tracing::instrument;
+
+#[instrument(skip(verifier_socket, verifier_extra_socket))]
+pub async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
+    verifier_socket: T,
+    mut verifier_extra_socket: T,
+    server_addr: &SocketAddr,
+    uri: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let uri = uri.parse::<Uri>()?;
+
+    if uri.scheme().map(|s| s.as_str()) != Some("https") {
+        return Err("URI must use HTTPS scheme".into());
+    }
+
+    let server_domain = uri.authority().ok_or("URI must have authority")?.host();
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let mut tls_config_builder = TlsConfig::builder();
+    tls_config_builder.root_store(RootCertStore {
+        roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+    });
+    let tls_config = tls_config_builder.build()?;
+
+    // Set up protocol configuration for prover.
+    let mut prover_config_builder = ProverConfig::builder();
+    prover_config_builder
+        .server_name(ServerName::Dns(server_domain.try_into()?))
+        .tls_config(tls_config)
+        .protocol_config(
+            ProtocolConfig::builder()
+                .max_sent_data(MAX_SENT_DATA)
+                .max_recv_data(MAX_RECV_DATA)
+                .build()?,
+        );
+
+    let prover_config = prover_config_builder.build()?;
+
+    // Create prover and connect to verifier.
+    //
+    // Perform the setup phase with the verifier.
+    let prover = Prover::new(prover_config)
+        .setup(verifier_socket.compat())
+        .await?;
+
+    // Connect to TLS Server.
+    let tls_client_socket = tokio::net::TcpStream::connect(server_addr).await?;
+
+    // Pass server connection into the prover.
+    let (mpc_tls_connection, prover_fut) = prover.connect(tls_client_socket.compat()).await?;
+
+    // Wrap the connection in a TokioIo compatibility layer to use it with hyper.
+    let mpc_tls_connection = TokioIo::new(mpc_tls_connection.compat());
+
+    // Spawn the Prover to run in the background.
+    let prover_task = tokio::spawn(prover_fut);
+
+    // MPC-TLS Handshake.
+    let (mut request_sender, connection) =
+        hyper::client::conn::http1::handshake(mpc_tls_connection).await?;
+
+    // Spawn the connection to run in the background.
+    tokio::spawn(connection);
+
+    // MPC-TLS: Send Request and wait for Response.
+    let request = Request::builder()
+        .uri(uri.clone())
+        .header("Host", server_domain)
+        .header("Connection", "close")
+        .header(header::AUTHORIZATION, "Bearer random_auth_token")
+        .method("GET")
+        .body(Empty::<Bytes>::new())?;
+
+    let response = request_sender.send_request(request).await?;
+
+    if response.status() != StatusCode::OK {
+        return Err(format!("MPC-TLS request failed with status {}", response.status()).into());
+    }
+
+    // Create proof for the Verifier.
+    let mut prover = prover_task.await??;
+
+    let transcript = prover.transcript().clone();
+    let mut prove_config_builder = ProveConfig::builder(&transcript);
+
+    // Reveal the DNS name.
+    prove_config_builder.server_identity();
+
+    let sent: &[u8] = transcript.sent();
+    let received: &[u8] = transcript.received();
+    let sent_len = sent.len();
+    let recv_len = received.len();
+    tracing::info!("Sent length: {}, Received length: {}", sent_len, recv_len);
+
+    // Reveal the entire HTTP request except for the authorization bearer token
+    reveal_request(sent, &mut prove_config_builder)?;
+
+    // Create hash commitment for the date of birth field from the response
+    let mut transcript_commitment_builder = TranscriptCommitConfig::builder(&transcript);
+    transcript_commitment_builder.default_kind(TranscriptCommitmentKind::Hash {
+        alg: HashAlgId::SHA256,
+    });
+    reveal_received(
+        received,
+        &mut prove_config_builder,
+        &mut transcript_commitment_builder,
+    )?;
+
+    let transcripts_commitment_config = transcript_commitment_builder.build()?;
+    prove_config_builder.transcript_commit(transcripts_commitment_config);
+
+    let prove_config = prove_config_builder.build()?;
+
+    // MPC-TLS prove
+    let prover_output = prover.prove(&prove_config).await?;
+    prover.close().await?;
+
+    // Prove birthdate is more than 18 years ago.
+    let received_commitments = received_commitments(&prover_output.transcript_commitments);
+    let received_commitment = received_commitments
+        .first()
+        .ok_or("No received commitments found")?; // committed hash (of date of birth string)
+    let received_secrets = received_secrets(&prover_output.transcript_secrets);
+    let received_secret = received_secrets
+        .first()
+        .ok_or("No received secrets found")?; // hash blinder
+    let proof_input = prepare_zk_proof_input(received, received_commitment, received_secret)?;
+    let proof_bundle = generate_zk_proof(&proof_input)?;
+
+    // Sent zk proof bundle to verifier
+    let serialized_proof = bincode::serialize(&proof_bundle)?;
+    verifier_extra_socket.write_all(&serialized_proof).await?;
+    verifier_extra_socket.shutdown().await?;
+
+    Ok(())
+}
+
+// Reveal everything from the request, except for the authorization token.
+fn reveal_request(
+    request: &[u8],
+    builder: &mut ProveConfigBuilder<'_>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let reqs = Requests::new_from_slice(request).collect::<Result<Vec<_>, _>>()?;
+
+    let req = reqs.first().ok_or("No requests found")?;
+
+    if req.request.method.as_str() != "GET" {
+        return Err(format!("Expected GET method, found {}", req.request.method.as_str()).into());
+    }
+
+    let authorization_header = req
+        .headers_with_name(header::AUTHORIZATION.as_str())
+        .next()
+        .ok_or("Authorization header not found")?;
+
+    let start_pos = authorization_header
+        .span()
+        .indices()
+        .min()
+        .ok_or("Could not find authorization header start position")?
+        + header::AUTHORIZATION.as_str().len()
+        + 2;
+    let end_pos =
+        start_pos + authorization_header.span().len() - header::AUTHORIZATION.as_str().len() - 2;
+
+    builder.reveal_sent(&(0..start_pos))?;
+    builder.reveal_sent(&(end_pos..request.len()))?;
+
+    Ok(())
+}
+
+fn reveal_received(
+    received: &[u8],
+    builder: &mut ProveConfigBuilder<'_>,
+    transcript_commitment_builder: &mut TranscriptCommitConfigBuilder,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let resp = Responses::new_from_slice(received).collect::<Result<Vec<_>, _>>()?;
+
+    let response = resp.first().ok_or("No responses found")?;
+    let body = response.body.as_ref().ok_or("Response body not found")?;
+
+    let BodyContent::Json(json) = &body.content else {
+        return Err("Expected JSON body content".into());
+    };
+
+    // reveal tax year
+    let tax_year = json
+        .get("tax_year")
+        .ok_or("tax_year field not found in JSON")?;
+    let start_pos = tax_year
+        .span()
+        .indices()
+        .min()
+        .ok_or("Could not find tax_year start position")?
+        - 11;
+    let end_pos = tax_year
+        .span()
+        .indices()
+        .max()
+        .ok_or("Could not find tax_year end position")?
+        + 1;
+    builder.reveal_recv(&(start_pos..end_pos))?;
+
+    // commit to hash of date of birth
+    let dob = json
+        .get("taxpayer.date_of_birth")
+        .ok_or("taxpayer.date_of_birth field not found in JSON")?;
+
+    transcript_commitment_builder.commit_recv(dob.span())?;
+
+    Ok(())
+}
+
+// extract secret from prover output
+fn received_secrets(transcript_secrets: &[TranscriptSecret]) -> Vec<&PlaintextHashSecret> {
+    transcript_secrets
+        .iter()
+        .filter_map(|secret| match secret {
+            TranscriptSecret::Hash(hash) if hash.direction == Direction::Received => Some(hash),
+            _ => None,
+        })
+        .collect()
+}
+
+#[derive(Debug)]
+pub struct ZKProofInput {
+    dob: Vec<u8>,
+    proof_date: NaiveDate,
+    blinder: Vec<u8>,
+    committed_hash: Vec<u8>,
+}
+
+// Verify that the blinded, committed hash is correct
+fn prepare_zk_proof_input(
+    received: &[u8],
+    received_commitment: &PlaintextHash,
+    received_secret: &PlaintextHashSecret,
+) -> Result<ZKProofInput, Box<dyn std::error::Error>> {
+    assert_eq!(received_commitment.direction, Direction::Received);
+    assert_eq!(received_commitment.hash.alg, HashAlgId::SHA256);
+
+    let hash = &received_commitment.hash;
+
+    let dob_start = received_commitment
+        .idx
+        .min()
+        .ok_or("No start index for DOB")?;
+    let dob_end = received_commitment
+        .idx
+        .end()
+        .ok_or("No end index for DOB")?;
+    let dob = received[dob_start..dob_end].to_vec();
+    let blinder = received_secret.blinder.as_bytes().to_vec();
+    let committed_hash = hash.value.as_bytes().to_vec();
+    let proof_date = Local::now().date_naive();
+
+    assert_eq!(received_secret.direction, Direction::Received);
+    assert_eq!(received_secret.alg, HashAlgId::SHA256);
+
+    let mut hasher = Sha256::new();
+    hasher.update(&dob);
+    hasher.update(&blinder);
+    let computed_hash = hasher.finalize();
+
+    if committed_hash != computed_hash.as_slice() {
+        return Err("Computed hash does not match committed hash".into());
+    }
+
+    Ok(ZKProofInput {
+        dob,
+        proof_date,
+        committed_hash,
+        blinder,
+    })
+}
+
+fn generate_zk_proof(
+    proof_input: &ZKProofInput,
+) -> Result<ZKProofBundle, Box<dyn std::error::Error>> {
+    tracing::info!("🔒 Generating ZK proof with Noir...");
+
+    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
+
+    // 1. Load bytecode from program.json
+    let json: Value = serde_json::from_str(PROGRAM_JSON)?;
+    let bytecode = json["bytecode"]
+        .as_str()
+        .ok_or("bytecode field not found in program.json")?;
+
+    let mut inputs: Vec<String> = vec![];
+    inputs.push(proof_input.proof_date.day().to_string());
+    inputs.push(proof_input.proof_date.month().to_string());
+    inputs.push(proof_input.proof_date.year().to_string());
+    inputs.extend(proof_input.committed_hash.iter().map(|b| b.to_string()));
+    inputs.extend(proof_input.dob.iter().map(|b| b.to_string()));
+    inputs.extend(proof_input.blinder.iter().map(|b| b.to_string()));
+
+    let proof_date = proof_input.proof_date.to_string();
+    tracing::info!(
+        "Public inputs : Proof date ({}) and committed hash ({})",
+        proof_date,
+        hex::encode(&proof_input.committed_hash)
+    );
+    tracing::info!(
+        "Private inputs: Blinder ({}) and Date of Birth ({})",
+        hex::encode(&proof_input.blinder),
+        String::from_utf8_lossy(&proof_input.dob)
+    );
+
+    tracing::debug!("Witness inputs {:?}", inputs);
+
+    let input_refs: Vec<&str> = inputs.iter().map(String::as_str).collect();
+    let witness = from_vec_str_to_witness_map(input_refs)?;
+
+    // Setup SRS
+    setup_srs_from_bytecode(bytecode, None, false)?;
+
+    // Verification key
+    let vk = get_ultra_honk_verification_key(bytecode, false)?;
+
+    // Generate proof
+    let proof = prove_ultra_honk(bytecode, witness.clone(), vk.clone(), false)?;
+    tracing::info!("✅ Proof generated ({} bytes)", proof.len());
+
+    let proof_bundle = ZKProofBundle { vk, proof };
+    Ok(proof_bundle)
+}

crates/examples/interactive_zk/types.rs

@@ -0,0 +1,21 @@
+use serde::{Deserialize, Serialize};
+use tlsn::transcript::{hash::PlaintextHash, Direction, TranscriptCommitment};
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct ZKProofBundle {
+    pub vk: Vec<u8>,
+    pub proof: Vec<u8>,
+}
+
+// extract commitment from prover output
+pub fn received_commitments(
+    transcript_commitments: &[TranscriptCommitment],
+) -> Vec<&PlaintextHash> {
+    transcript_commitments
+        .iter()
+        .filter_map(|commitment| match commitment {
+            TranscriptCommitment::Hash(hash) if hash.direction == Direction::Received => Some(hash),
+            _ => None,
+        })
+        .collect()
+}

crates/examples/interactive_zk/verifier.rs

@@ -0,0 +1,184 @@
+use crate::types::received_commitments;
+
+use super::types::ZKProofBundle;
+use chrono::{Local, NaiveDate};
+use noir::barretenberg::verify::{get_ultra_honk_verification_key, verify_ultra_honk};
+use serde_json::Value;
+use tls_server_fixture::CA_CERT_DER;
+use tlsn::{
+    config::{CertificateDer, ProtocolConfigValidator, RootCertStore},
+    connection::ServerName,
+    hash::HashAlgId,
+    transcript::{Direction, PartialTranscript},
+    verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
+};
+use tlsn_examples::{MAX_RECV_DATA, MAX_SENT_DATA};
+use tlsn_server_fixture_certs::SERVER_DOMAIN;
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite};
+use tokio_util::compat::TokioAsyncReadCompatExt;
+use tracing::instrument;
+
+#[instrument(skip(socket, extra_socket))]
+pub async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: T,
+    mut extra_socket: T,
+) -> Result<PartialTranscript, Box<dyn std::error::Error>> {
+    // Set up Verifier.
+    let config_validator = ProtocolConfigValidator::builder()
+        .max_sent_data(MAX_SENT_DATA)
+        .max_recv_data(MAX_RECV_DATA)
+        .build()?;
+
+    // Create a root certificate store with the server-fixture's self-signed
+    // certificate. This is only required for offline testing with the
+    // server-fixture.
+    let verifier_config = VerifierConfig::builder()
+        .root_store(RootCertStore {
+            roots: vec![CertificateDer(CA_CERT_DER.to_vec())],
+        })
+        .protocol_config_validator(config_validator)
+        .build()?;
+
+    let verifier = Verifier::new(verifier_config);
+
+    // Receive authenticated data.
+    let VerifierOutput {
+        server_name,
+        transcript,
+        transcript_commitments,
+        ..
+    } = verifier
+        .verify(socket.compat(), &VerifyConfig::default())
+        .await?;
+
+    let server_name = server_name.ok_or("Prover should have revealed server name")?;
+    let transcript = transcript.ok_or("Prover should have revealed transcript data")?;
+
+    // Create hash commitment for the date of birth field from the response
+    let sent = transcript.sent_unsafe().to_vec();
+    let sent_data = String::from_utf8(sent.clone())
+        .map_err(|e| format!("Verifier expected valid UTF-8 sent data: {}", e))?;
+
+    if !sent_data.contains(SERVER_DOMAIN) {
+        return Err(format!(
+            "Verification failed: Expected host {} not found in sent data",
+            SERVER_DOMAIN
+        )
+        .into());
+    }
+
+    // Check received data.
+    let received_commitments = received_commitments(&transcript_commitments);
+    let received_commitment = received_commitments
+        .first()
+        .ok_or("Missing received hash commitment")?;
+
+    assert!(received_commitment.direction == Direction::Received);
+    assert!(received_commitment.hash.alg == HashAlgId::SHA256);
+
+    let committed_hash = &received_commitment.hash;
+
+    // Check Session info: server name.
+    let ServerName::Dns(server_name) = server_name;
+    if server_name.as_str() != SERVER_DOMAIN {
+        return Err(format!(
+            "Server name mismatch: expected {}, got {}",
+            SERVER_DOMAIN,
+            server_name.as_str()
+        )
+        .into());
+    }
+
+    // Receive ZKProof information from prover
+    let mut buf = Vec::new();
+    extra_socket.read_to_end(&mut buf).await?;
+
+    if buf.is_empty() {
+        return Err("No ZK proof data received from prover".into());
+    }
+
+    let msg: ZKProofBundle = bincode::deserialize(&buf)
+        .map_err(|e| format!("Failed to deserialize ZK proof bundle: {}", e))?;
+
+    // Verify zk proof
+    const PROGRAM_JSON: &str = include_str!("./noir/target/noir.json");
+    let json: Value = serde_json::from_str(PROGRAM_JSON)
+        .map_err(|e| format!("Failed to parse Noir circuit: {}", e))?;
+
+    let bytecode = json["bytecode"]
+        .as_str()
+        .ok_or("Bytecode field missing in noir.json")?;
+
+    let vk = get_ultra_honk_verification_key(bytecode, false)
+        .map_err(|e| format!("Failed to get verification key: {}", e))?;
+
+    if vk != msg.vk {
+        return Err("Verification key mismatch between computed and provided by prover".into());
+    }
+
+    let proof = msg.proof.clone();
+
+    // Validate proof has enough data.
+    // The proof should start with the public inputs:
+    // * We expect at least 3 * 32 bytes for the three date fields (day, month,
+    //   year)
+    // * and 32*32 bytes for the hash
+    let min_bytes = (32 + 3) * 32;
+    if proof.len() < min_bytes {
+        return Err(format!(
+            "Proof too short: expected at least {} bytes, got {}",
+            min_bytes,
+            proof.len()
+        )
+        .into());
+    }
+
+    // Check that the proof date is correctly included in the proof
+    let proof_date_day: u32 = u32::from_be_bytes(proof[28..32].try_into()?);
+    let proof_date_month: u32 = u32::from_be_bytes(proof[60..64].try_into()?);
+    let proof_date_year: i32 = i32::from_be_bytes(proof[92..96].try_into()?);
+    let proof_date_from_proof =
+        NaiveDate::from_ymd_opt(proof_date_year, proof_date_month, proof_date_day)
+            .ok_or("Invalid proof date in proof")?;
+    let today = Local::now().date_naive();
+    if (today - proof_date_from_proof).num_days() < 0 {
+        return Err(format!(
+            "The proof date can only be today or in the past: provided {}, today {}",
+            proof_date_from_proof, today
+        )
+        .into());
+    }
+
+    // Check that the committed hash in the proof matches the hash from the
+    // commitment
+    let committed_hash_in_proof: Vec<u8> = proof
+        .chunks(32)
+        .skip(3) // skip the first 3 chunks
+        .take(32)
+        .map(|chunk| *chunk.last().unwrap_or(&0))
+        .collect();
+    let expected_hash = committed_hash.value.as_bytes().to_vec();
+    if committed_hash_in_proof != expected_hash {
+        tracing::error!(
+            "❌ The hash in the proof does not match the committed hash in MPC-TLS: {} != {}",
+            hex::encode(&committed_hash_in_proof),
+            hex::encode(&expected_hash)
+        );
+        return Err("Hash in proof does not match committed hash in MPC-TLS".into());
+    }
+    tracing::info!(
+        "✅ The hash in the proof matches the committed hash in MPC-TLS ({})",
+        hex::encode(&expected_hash)
+    );
+
+    // Finally verify the proof
+    let is_valid = verify_ultra_honk(msg.proof, msg.vk)
+        .map_err(|e| format!("ZKProof Verification failed: {}", e))?;
+    if !is_valid {
+        tracing::error!("❌ Age verification ZKProof failed to verify");
+        return Err("Age verification ZKProof failed to verify".into());
+    }
+    tracing::info!("✅ Age verification ZKProof successfully verified");
+
+    Ok(transcript)
+}

crates/formats/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-formats"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/harness/build.sh

@@ -3,7 +3,19 @@
 # Ensure the script runs in the folder that contains this script
 cd "$(dirname "$0")"
 
-cargo build --release --package tlsn-harness-runner --package tlsn-harness-executor --package tlsn-server-fixture --package tlsn-harness-plot
+RUNNER_FEATURES=""
+EXECUTOR_FEATURES=""
+
+if [ "$1" = "debug" ]; then
+    RUNNER_FEATURES="--features debug"
+    EXECUTOR_FEATURES="--no-default-features --features debug"
+fi
+
+cargo build --release \
+    --package tlsn-harness-runner $RUNNER_FEATURES \
+    --package tlsn-harness-executor $EXECUTOR_FEATURES \
+    --package tlsn-server-fixture \
+    --package tlsn-harness-plot
 
 mkdir -p bin
 

crates/harness/executor/.cargo/config.toml

@@ -1,10 +1,14 @@
 [target.wasm32-unknown-unknown]
 rustflags = [
-    "-C",
-    "target-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
-    "-C",
+    "-Ctarget-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
+    "-Clink-arg=--shared-memory",
     # 4GB
-    "link-arg=--max-memory=4294967296",
+    "-Clink-arg=--max-memory=4294967296",
+    "-Clink-arg=--import-memory",
+    "-Clink-arg=--export=__wasm_init_tls",
+    "-Clink-arg=--export=__tls_size",
+    "-Clink-arg=--export=__tls_align",
+    "-Clink-arg=--export=__tls_base",
     "--cfg",
     'getrandom_backend="wasm_js"',
 ]

crates/harness/executor/Cargo.toml

@@ -4,6 +4,12 @@ version = "0.1.0"
 edition = "2024"
 publish = false
 
+[features]
+# Disable tracing events as a workaround for issue 959. 
+default = ["tracing/release_max_level_off"]
+# Used to debug the executor itself.
+debug = []
+
 [lib]
 name = "harness_executor"
 crate-type = ["cdylib", "rlib"]
@@ -28,8 +34,7 @@ tokio = { workspace = true, features = ["full"] }
 tokio-util = { workspace = true, features = ["compat"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
-# Disable tracing events as a workaround for issue 959. 
-tracing = { workspace = true, features = ["release_max_level_off"] }
+tracing = { workspace = true }
 wasm-bindgen = { workspace = true }
 tlsn-wasm = { workspace = true }
 js-sys = { workspace = true }

crates/harness/harness.Dockerfile

@@ -1,6 +1,8 @@
 FROM rust AS builder
 WORKDIR /usr/src/tlsn
 
+ARG DEBUG=0
+
 RUN \
     rustup update; \
     apt update && apt install -y clang; \
@@ -10,7 +12,12 @@ RUN \
 COPY . .
 RUN \
     cd crates/harness; \
-    ./build.sh;
+    # Pass `--build-arg DEBUG=1` to `docker build` if you need to debug the harness.
+    if [ "$DEBUG" = "1" ]; then \
+      ./build.sh debug; \
+    else \
+      ./build.sh; \
+    fi
 
 FROM debian:latest
 

crates/harness/runner/Cargo.toml

@@ -7,6 +7,10 @@ publish = false
 [lib]
 name = "harness_runner"
 
+[features]
+# Used to debug the runner itself.
+debug = []
+
 [dependencies]
 tlsn-harness-core = { workspace = true }
 tlsn-server-fixture = { workspace = true }

crates/harness/runner/src/debug_prelude.rs

@@ -0,0 +1,17 @@
+#![allow(unused_imports)]
+pub use futures::FutureExt;
+
+pub use tracing::{debug, error};
+
+pub use chromiumoxide::{
+    Browser, Page,
+    cdp::{
+        browser_protocol::{
+            log::{EventEntryAdded, LogEntryLevel},
+            network::{EnableParams, SetCacheDisabledParams},
+            page::ReloadParams,
+        },
+        js_protocol::runtime::EventExceptionThrown,
+    },
+    handler::HandlerConfig,
+};

crates/harness/runner/src/executor.rs

@@ -21,6 +21,9 @@ use harness_core::{
 
 use crate::{Target, network::Namespace, rpc::Rpc};
 
+#[cfg(feature = "debug")]
+use crate::debug_prelude::*;
+
 pub struct Executor {
     ns: Namespace,
     config: ExecutorConfig,
@@ -66,20 +69,34 @@ impl Executor {
                     Id::One => self.config.network().rpc_1,
                 };
 
-                let process = duct::cmd!(
-                    "sudo",
-                    "ip",
-                    "netns",
-                    "exec",
-                    self.ns.name(),
-                    "env",
+                let mut args = vec![
+                    "ip".into(),
+                    "netns".into(),
+                    "exec".into(),
+                    self.ns.name().into(),
+                    "env".into(),
                     format!("CONFIG={}", serde_json::to_string(&self.config)?),
-                    executor_path
-                )
-                .stdout_capture()
-                .stderr_capture()
-                .unchecked()
-                .start()?;
+                ];
+
+                if cfg!(feature = "debug") {
+                    let level = &std::env::var("RUST_LOG").unwrap_or("debug".to_string());
+                    args.push("env".into());
+                    args.push(format!("RUST_LOG={}", level));
+                };
+
+                args.push(executor_path.to_str().expect("valid path").into());
+
+                let process = duct::cmd("sudo", args);
+
+                let process = if !cfg!(feature = "debug") {
+                    process
+                        .stdout_capture()
+                        .stderr_capture()
+                        .unchecked()
+                        .start()?
+                } else {
+                    process.unchecked().start()?
+                };
 
                 let rpc = Rpc::new_native(rpc_addr).await?;
 
@@ -119,10 +136,13 @@ impl Executor {
                     "--no-sandbox",
                     format!("--user-data-dir={tmp}"),
                     format!("--allowed-ips=10.250.0.1"),
-                )
-                .stderr_capture()
-                .stdout_capture()
-                .start()?;
+                );
+
+                let process = if !cfg!(feature = "debug") {
+                    process.stderr_capture().stdout_capture().start()?
+                } else {
+                    process.start()?
+                };
 
                 const TIMEOUT: usize = 10000;
                 const DELAY: usize = 100;
@@ -171,6 +191,38 @@ impl Executor {
                     .new_page(&format!("http://{wasm_addr}:{wasm_port}/index.html"))
                     .await?;
 
+                #[cfg(feature = "debug")]
+                tokio::spawn(register_listeners(page.clone()).await?);
+
+                #[cfg(feature = "debug")]
+                async fn register_listeners(page: Page) -> Result<impl Future<Output = ()>> {
+                    let mut logs = page.event_listener::<EventEntryAdded>().await?.fuse();
+                    let mut exceptions =
+                        page.event_listener::<EventExceptionThrown>().await?.fuse();
+
+                    Ok(futures::future::join(
+                        async move {
+                            while let Some(event) = logs.next().await {
+                                let entry = &event.entry;
+                                match entry.level {
+                                    LogEntryLevel::Error => {
+                                        error!("{:?}", entry);
+                                    }
+                                    _ => {
+                                        debug!("{:?}: {}", entry.timestamp, entry.text);
+                                    }
+                                }
+                            }
+                        },
+                        async move {
+                            while let Some(event) = exceptions.next().await {
+                                error!("{:?}", event);
+                            }
+                        },
+                    )
+                    .map(|_| ()))
+                }
+
                 page.execute(EnableParams::builder().build()).await?;
                 page.execute(SetCacheDisabledParams {
                     cache_disabled: true,

crates/harness/runner/src/lib.rs

@@ -6,6 +6,9 @@ mod server_fixture;
 pub mod wasm_server;
 mod ws_proxy;
 
+#[cfg(feature = "debug")]
+mod debug_prelude;
+
 use std::time::Duration;
 
 use anyhow::Result;
@@ -24,6 +27,9 @@ use cli::{Cli, Command};
 use executor::Executor;
 use server_fixture::ServerFixture;
 
+#[cfg(feature = "debug")]
+use crate::debug_prelude::*;
+
 use crate::{cli::Route, network::Network, wasm_server::WasmServer, ws_proxy::WsProxy};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, clap::ValueEnum)]
@@ -113,6 +119,9 @@ impl Runner {
 }
 
 pub async fn main() -> Result<()> {
+    #[cfg(feature = "debug")]
+    tracing_subscriber::fmt::init();
+
     let cli = Cli::parse();
     let mut runner = Runner::new(&cli)?;
 
@@ -227,6 +236,9 @@ pub async fn main() -> Result<()> {
                 // Wait for the network to stabilize
                 tokio::time::sleep(Duration::from_millis(100)).await;
 
+                #[cfg(feature = "debug")]
+                debug!("Starting bench in group {:?}", config.group);
+
                 let (output, _) = tokio::try_join!(
                     runner.exec_p.bench(BenchCmd {
                         config: config.clone(),

crates/mpc-tls/Cargo.toml

@@ -5,7 +5,7 @@ description = "TLSNotary MPC-TLS protocol"
 keywords = ["tls", "mpc", "2pc"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/mpc-tls/src/leader.rs

@@ -41,6 +41,7 @@ use tls_core::{
         message::{OpaqueMessage, PlainMessage},
     },
     suites::SupportedCipherSuite,
+    verify::verify_sig_determine_alg,
 };
 use tlsn_core::{
     connection::{CertBinding, CertBindingV1_2, ServerSignature, TlsVersion, VerifyData},
@@ -327,12 +328,20 @@ impl MpcTlsLeader {
             .map(|cert| CertificateDer(cert.0.clone()))
             .collect();
 
+        let mut sig_msg = Vec::new();
+        sig_msg.extend_from_slice(&client_random.0);
+        sig_msg.extend_from_slice(&server_random.0);
+        sig_msg.extend_from_slice(server_kx_details.kx_params());
+
+        let server_signature_alg = verify_sig_determine_alg(
+            &server_cert_details.cert_chain()[0],
+            &sig_msg,
+            server_kx_details.kx_sig(),
+        )
+        .expect("only supported signature should have been accepted");
+
         let server_signature = ServerSignature {
-            scheme: server_kx_details
-                .kx_sig()
-                .scheme
-                .try_into()
-                .expect("only supported signature scheme should have been accepted"),
+            alg: server_signature_alg.into(),
             sig: server_kx_details.kx_sig().sig.0.clone(),
         };
 

crates/mpc-tls/src/msg.rs

@@ -72,4 +72,5 @@ pub(crate) struct ServerFinishedVd {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[allow(dead_code)]
 pub(crate) struct CloseConnection;

crates/mpc-tls/src/record_layer/aead/ghash.rs

@@ -193,7 +193,7 @@ where
         };
 
         // Divide by block length and round up.
-        let block_count = input.len() / 16 + (input.len() % 16 != 0) as usize;
+        let block_count = input.len() / 16 + !input.len().is_multiple_of(16) as usize;
 
         if block_count > MAX_POWER {
             return Err(ErrorRepr::InputLength {
@@ -282,11 +282,11 @@ fn build_ghash_data(mut aad: Vec<u8>, mut ciphertext: Vec<u8>) -> Vec<u8> {
     let len_block = ((associated_data_bitlen as u128) << 64) + (text_bitlen as u128);
 
     // Pad data to be a multiple of 16 bytes.
-    let aad_padded_block_count = (aad.len() / 16) + (aad.len() % 16 != 0) as usize;
+    let aad_padded_block_count = (aad.len() / 16) + !aad.len().is_multiple_of(16) as usize;
     aad.resize(aad_padded_block_count * 16, 0);
 
     let ciphertext_padded_block_count =
-        (ciphertext.len() / 16) + (ciphertext.len() % 16 != 0) as usize;
+        (ciphertext.len() / 16) + !ciphertext.len().is_multiple_of(16) as usize;
     ciphertext.resize(ciphertext_padded_block_count * 16, 0);
 
     let mut data: Vec<u8> = Vec::with_capacity(aad.len() + ciphertext.len() + 16);

crates/server-fixture/certs/src/lib.rs

@@ -6,7 +6,7 @@ pub static SERVER_CERT_DER: &[u8] = include_bytes!("tls/test_server_cert.der");
 pub static SERVER_KEY_DER: &[u8] = include_bytes!("tls/test_server_private_key.der");
 /// The domain name bound to the server certificate.
 pub static SERVER_DOMAIN: &str = "test-server.io";
-/// A client certificate fixture PEM-encoded.
-pub static CLIENT_CERT: &[u8] = include_bytes!("tls/client_cert.pem");
-/// A client private key fixture PEM-encoded.
-pub static CLIENT_KEY: &[u8] = include_bytes!("tls/client_cert.key");
+/// A client certificate fixture.
+pub static CLIENT_CERT_DER: &[u8] = include_bytes!("tls/client_cert.der");
+/// A client private key fixture.
+pub static CLIENT_KEY_DER: &[u8] = include_bytes!("tls/client_cert_private_key.der");

crates/server-fixture/certs/src/tls/README.md

@@ -33,5 +33,8 @@ openssl req -new -key client_cert.key -out client_cert.csr -subj "/C=US/ST=State
 # Sign the CSR with the root CA to create the end entity certificate (100 years validity)
 openssl x509 -req -in client_cert.csr -CA root_ca.crt -CAkey root_ca.key -CAcreateserial -out client_cert.crt -days 36525 -sha256 -extfile openssl.cnf -extensions v3_req
 
-# Convert the end entity certificate to PEM format
-openssl x509 -in client_cert.crt -outform pem -out client_cert.pem
+# Convert the end entity certificate to DER format
+openssl x509 -in client_cert.crt -outform der -out client_cert.der
+
+# Convert the end entity certificate private key to DER format
+openssl pkcs8 -topk8 -inform PEM -outform DER -in client_cert.key -out client_cert_private_key.der -nocrypt

crates/server-fixture/certs/src/tls/client_cert.pem

@@ -1,23 +0,0 @@
------BEGIN CERTIFICATE-----
-MIID2jCCAsKgAwIBAgIUG5JKIz/fbUDdpX1+TAw33mS+mWwwDQYJKoZIhvcNAQEL
-BQAwZTELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5
-MRIwEAYDVQQKDAl0bHNub3RhcnkxCzAJBgNVBAsMAklUMRYwFAYDVQQDDA10bHNu
-b3Rhcnkub3JnMCAXDTI1MDYxMDA3MTYxOVoYDzIxMjUwNjExMDcxNjE5WjBwMQsw
-CQYDVQQGEwJVUzEOMAwGA1UECAwFU3RhdGUxDTALBgNVBAcMBENpdHkxEjAQBgNV
-BAoMCXRsc25vdGFyeTELMAkGA1UECwwCSVQxITAfBgNVBAMMGGNsaWVudC1hdXRo
-ZW50aWNhdGlvbi5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANsx
-Tf3JqWdAMGFzOwbO64vJ5fV/IPSrdBwKY/Fjef0REZC1Z/gGzmp0nnlaHZzZLtLS
-Z9kyfdUrL6PuG3HfP6wxhiaBpUay+1O9KZsuhkKSif4KMPjlYKm+oZLvD12Qj62r
-TFlui4+1wKgPrTGUUO6SQdoRxKU4nzuzRYRLyzDi0pO5YD9RLaruBj+IDEOVRW7d
-1uleheVMg61lbQle5Fo0c4I0Sif96Z+7aotj3j9F2lK52jaLpA1kvC3oLajfAT30
-BzpNLZTnWa1b5PRRxkuOYUXeNr+aNO90fL80K1YeIlea0f7qmKL9uDLtQbrqIJv5
-tBaf8Uf0UghtBm//kx8CAwEAAaN1MHMwCQYDVR0TBAIwADALBgNVHQ8EBAMCBeAw
-GQYDVR0RBBIwEIIOdGVzdC1zZXJ2ZXIuaW8wHQYDVR0OBBYEFH1qCgl04Y5i75aF
-cT0V3fn9423iMB8GA1UdIwQYMBaAFMmBciQ/DZlWROxwXH8IplmuHKbNMA0GCSqG
-SIb3DQEBCwUAA4IBAQB8Gvj3dsENAn0u6PS9uTFm46MaA9Dm+Fa+KbXuEHp3ADs2
-7m4Hb3eojM3yae93/v/stYn8IVcB5zWmMvg6WA6obe86muuB+SZeMC/AnSD8P4pm
-AzO3eTSR1s5Dr4O0qVPd2VP36e7NWXfojQg4W9t9UQtC64bVOaCDQvbe0xeWT+AR
-w0y7GwnuCr/8bisqQZS8+Er1JU3zxBEjQwMiMxlOWHnYtjGeA6pdWaeLp0E6Ss3x
-ecsTjmrLt6oY+BdfRSyWU4qVEOpuZLCeikUWXFzpxRX7NWYRtJUfVnoRWwuD2lzG
-LybzCW2qxwHJe4biGIfWKQ7Ne7DrwQwFxVRJxCm0
------END CERTIFICATE-----

crates/server-fixture/server/src/data/elster.json

@@ -0,0 +1,37 @@
+{
+    "tax_year": 2024,
+    "taxpayer": {
+        "idnr": "12345678901",
+        "first_name": "Max",
+        "last_name": "Mustermann",
+        "date_of_birth": "1985-03-12",
+        "address": {
+            "street": "Musterstraße 1",
+            "postal_code": "10115",
+            "city": "Berlin"
+        }
+    },
+    "income": {
+        "employment_income": 54200.00,
+        "other_income": 1200.00,
+        "capital_gains": 350.00
+    },
+    "deductions": {
+        "pension_insurance": 4200.00,
+        "health_insurance": 3600.00,
+        "donations": 500.00,
+        "work_related_expenses": 1100.00
+    },
+    "assessment": {
+        "taxable_income": 49200.00,
+        "income_tax": 9156.00,
+        "solidarity_surcharge": 503.58,
+        "total_tax": 9659.58,
+        "prepaid_tax": 9500.00,
+        "refund": 159.58
+    },
+    "submission": {
+        "submitted_at": "2025-03-01T14:22:30Z",
+        "submitted_by": "ElsterOnline-Portal"
+    }
+}

crates/server-fixture/server/src/lib.rs

@@ -47,6 +47,7 @@ fn app(state: AppState) -> Router {
         .route("/formats/json", get(json))
         .route("/formats/html", get(html))
         .route("/protected", get(protected_route))
+        .route("/elster", get(elster_route))
         .layer(TraceLayer::new_for_http())
         .with_state(Arc::new(Mutex::new(state)))
 }
@@ -196,6 +197,12 @@ async fn protected_route(_: AuthenticatedUser) -> Result<Json<Value>, StatusCode
     get_json_value(include_str!("data/protected_data.json"))
 }
 
+async fn elster_route(_: AuthenticatedUser) -> Result<Json<Value>, StatusCode> {
+    info!("Handling /elster");
+
+    get_json_value(include_str!("data/elster.json"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

crates/tls/backend/Cargo.toml

@@ -5,7 +5,7 @@ description = "A TLS backend trait for TLSNotary"
 keywords = ["tls", "mpc", "2pc"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/tls/client-async/Cargo.toml

@@ -5,7 +5,7 @@ description = "An async TLS client for TLSNotary"
 keywords = ["tls", "mpc", "2pc", "client", "async"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/tls/client/Cargo.toml

@@ -5,7 +5,7 @@ description = "A TLS client for TLSNotary"
 keywords = ["tls", "mpc", "2pc", "client", "sync"]
 categories = ["cryptography"]
 license = "Apache-2.0 OR ISC OR MIT"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 autobenches = false
 

crates/tls/client/tests/api.rs

@@ -886,6 +886,7 @@ async fn client_error_is_sticky() {
 }
 
 #[tokio::test]
+#[allow(clippy::no_effect)]
 #[allow(clippy::unnecessary_operation)]
 async fn client_is_send() {
     let (client, _) = make_pair(KeyType::Rsa).await;

crates/tls/core/Cargo.toml

@@ -5,7 +5,7 @@ description = "Cryptographic operations for the TLSNotary TLS client"
 keywords = ["tls", "mpc", "2pc"]
 categories = ["cryptography"]
 license = "Apache-2.0 OR ISC OR MIT"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 
 [lints]

crates/tls/core/src/verify.rs

@@ -415,7 +415,8 @@ pub(crate) fn pki_error(error: webpki::Error) -> Error {
     match error {
         BadDer | BadDerTime => Error::InvalidCertificateEncoding,
         InvalidSignatureForPublicKey => Error::InvalidCertificateSignature,
-        UnsupportedSignatureAlgorithm | UnsupportedSignatureAlgorithmForPublicKey => {
+        UnsupportedSignatureAlgorithmContext(_)
+        | UnsupportedSignatureAlgorithmForPublicKeyContext(_) => {
             Error::InvalidCertificateSignatureType
         }
         e => Error::InvalidCertificateData(format!("invalid peer certificate: {e}")),
@@ -464,23 +465,90 @@ fn convert_scheme(scheme: SignatureScheme) -> Result<SignatureAlgorithms, Error>
     }
 }
 
+/// Signature algorithm.
+#[derive(Debug, Clone, Copy, PartialEq)]
+#[allow(non_camel_case_types)]
+pub enum SignatureAlgorithm {
+    ECDSA_NISTP256_SHA256,
+    ECDSA_NISTP256_SHA384,
+    ECDSA_NISTP384_SHA256,
+    ECDSA_NISTP384_SHA384,
+    ED25519,
+    RSA_PKCS1_2048_8192_SHA256,
+    RSA_PKCS1_2048_8192_SHA384,
+    RSA_PKCS1_2048_8192_SHA512,
+    RSA_PSS_2048_8192_SHA256_LEGACY_KEY,
+    RSA_PSS_2048_8192_SHA384_LEGACY_KEY,
+    RSA_PSS_2048_8192_SHA512_LEGACY_KEY,
+}
+
+impl SignatureAlgorithm {
+    pub fn from_alg(alg: &dyn pki_types::SignatureVerificationAlgorithm) -> Self {
+        let id = alg.signature_alg_id();
+        if id == webpki::ring::ECDSA_P256_SHA256.signature_alg_id() {
+            SignatureAlgorithm::ECDSA_NISTP256_SHA256
+        } else if id == webpki::ring::ECDSA_P256_SHA384.signature_alg_id() {
+            SignatureAlgorithm::ECDSA_NISTP256_SHA384
+        } else if id == webpki::ring::ECDSA_P384_SHA256.signature_alg_id() {
+            SignatureAlgorithm::ECDSA_NISTP384_SHA256
+        } else if id == webpki::ring::ECDSA_P384_SHA384.signature_alg_id() {
+            SignatureAlgorithm::ECDSA_NISTP384_SHA384
+        } else if id == webpki::ring::ED25519.signature_alg_id() {
+            SignatureAlgorithm::ED25519
+        } else if id == webpki::ring::RSA_PKCS1_2048_8192_SHA256.signature_alg_id() {
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA256
+        } else if id == webpki::ring::RSA_PKCS1_2048_8192_SHA384.signature_alg_id() {
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA384
+        } else if id == webpki::ring::RSA_PKCS1_2048_8192_SHA512.signature_alg_id() {
+            SignatureAlgorithm::RSA_PKCS1_2048_8192_SHA512
+        } else if id == webpki::ring::RSA_PSS_2048_8192_SHA256_LEGACY_KEY.signature_alg_id() {
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA256_LEGACY_KEY
+        } else if id == webpki::ring::RSA_PSS_2048_8192_SHA384_LEGACY_KEY.signature_alg_id() {
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA384_LEGACY_KEY
+        } else if id == webpki::ring::RSA_PSS_2048_8192_SHA512_LEGACY_KEY.signature_alg_id() {
+            SignatureAlgorithm::RSA_PSS_2048_8192_SHA512_LEGACY_KEY
+        } else {
+            unreachable!()
+        }
+    }
+}
+
+/// Verify the signature and return the algorithm which passed verification.
+pub fn verify_sig_determine_alg(
+    cert: &Certificate,
+    message: &[u8],
+    dss: &DigitallySignedStruct,
+) -> Result<SignatureAlgorithm, Error> {
+    let cert = pki_types::CertificateDer::from(cert.0.as_slice());
+    let cert = webpki::EndEntityCert::try_from(&cert).map_err(pki_error)?;
+
+    verify_sig_using_any_alg(&cert, convert_scheme(dss.scheme)?, message, &dss.sig.0)
+        .map_err(pki_error)
+}
+
 fn verify_sig_using_any_alg(
     cert: &webpki::EndEntityCert,
     algs: SignatureAlgorithms,
     message: &[u8],
     sig: &[u8],
-) -> Result<(), webpki::Error> {
+) -> Result<SignatureAlgorithm, webpki::Error> {
     // TLS doesn't itself give us enough info to map to a single
     // webpki::SignatureAlgorithm. Therefore, convert_algs maps to several and
     // we try them all.
     for alg in algs {
         match cert.verify_signature(*alg, message, sig) {
-            Err(webpki::Error::UnsupportedSignatureAlgorithmForPublicKey) => continue,
-            res => return res,
+            Ok(_) => return Ok(SignatureAlgorithm::from_alg(*alg)),
+            Err(webpki::Error::UnsupportedSignatureAlgorithmForPublicKeyContext(_)) => continue,
+            Err(e) => return Err(e),
         }
     }
 
-    Err(webpki::Error::UnsupportedSignatureAlgorithmForPublicKey)
+    Err(webpki::Error::UnsupportedSignatureAlgorithmContext(
+        webpki::UnsupportedSignatureAlgorithmContext {
+            signature_algorithm_id: vec![],
+            supported_algorithms: algs.iter().map(|alg| alg.signature_alg_id()).collect(),
+        },
+    ))
 }
 
 fn verify_signed_struct(

crates/tlsn/Cargo.toml

@@ -4,7 +4,7 @@ authors = ["TLSNotary Team"]
 keywords = ["tls", "mpc", "2pc", "prover"]
 categories = ["cryptography"]
 license = "MIT OR Apache-2.0"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2024"
 
 [lints]
@@ -31,6 +31,7 @@ web-spawn = { workspace = true, optional = true }
 
 mpz-common = { workspace = true }
 mpz-core = { workspace = true }
+mpz-circuits = { workspace = true }
 mpz-garble = { workspace = true }
 mpz-garble-core = { workspace = true }
 mpz-hash = { workspace = true }
@@ -40,6 +41,8 @@ mpz-ot = { workspace = true }
 mpz-vm-core = { workspace = true }
 mpz-zk = { workspace = true }
 
+aes = { workspace = true }
+ctr = { workspace = true }
 derive_builder = { workspace = true }
 futures = { workspace = true }
 opaque-debug = { workspace = true }
@@ -57,7 +60,9 @@ rangeset = { workspace = true }
 webpki-roots = { workspace = true }
 
 [dev-dependencies]
+mpz-ideal-vm = { workspace = true }
 rstest = { workspace = true }
+tlsn-core = { workspace = true, features = ["fixtures"] }
 tlsn-server-fixture = { workspace = true }
 tlsn-server-fixture-certs = { workspace = true }
 tokio = { workspace = true, features = ["full"] }

crates/tlsn/src/commit.rs

@@ -1,109 +0,0 @@
-//! Plaintext commitment and proof of encryption.
-
-pub(crate) mod hash;
-pub(crate) mod transcript;
-
-use mpz_core::bitvec::BitVec;
-use mpz_memory_core::{
-    DecodeFutureTyped, Vector,
-    binary::{Binary, U8},
-};
-use mpz_vm_core::{Vm, prelude::*};
-use tlsn_core::transcript::Record;
-
-use crate::{
-    Role,
-    zk_aes_ctr::{ZkAesCtr, ZkAesCtrError},
-};
-
-/// Commits the plaintext of the provided records, returning a proof of
-/// encryption.
-///
-/// Writes the plaintext VM reference to the provided records.
-pub(crate) fn commit_records<'record>(
-    vm: &mut dyn Vm<Binary>,
-    aes: &mut ZkAesCtr,
-    records: impl IntoIterator<Item = &'record Record>,
-) -> Result<(Vec<Vector<U8>>, RecordProof), RecordProofError> {
-    let mut plaintexts = Vec::new();
-    let mut ciphertexts = Vec::new();
-    for record in records {
-        let (plaintext_ref, ciphertext_ref) = aes
-            .encrypt(vm, record.explicit_nonce.clone(), record.ciphertext.len())
-            .map_err(ErrorRepr::Aes)?;
-
-        if let Role::Prover = aes.role() {
-            let Some(plaintext) = record.plaintext.clone() else {
-                return Err(ErrorRepr::MissingPlaintext.into());
-            };
-
-            vm.assign(plaintext_ref, plaintext)
-                .map_err(RecordProofError::vm)?;
-        }
-        vm.commit(plaintext_ref).map_err(RecordProofError::vm)?;
-
-        let ciphertext = vm.decode(ciphertext_ref).map_err(RecordProofError::vm)?;
-
-        plaintexts.push(plaintext_ref);
-        ciphertexts.push((ciphertext, record.ciphertext.clone()));
-    }
-
-    Ok((plaintexts, RecordProof { ciphertexts }))
-}
-
-/// Proof of encryption.
-#[derive(Debug)]
-#[must_use]
-#[allow(clippy::type_complexity)]
-pub(crate) struct RecordProof {
-    ciphertexts: Vec<(DecodeFutureTyped<BitVec, Vec<u8>>, Vec<u8>)>,
-}
-
-impl RecordProof {
-    /// Verifies the proof.
-    pub(crate) fn verify(self) -> Result<(), RecordProofError> {
-        let Self { ciphertexts } = self;
-
-        for (mut ciphertext, expected) in ciphertexts {
-            let ciphertext = ciphertext
-                .try_recv()
-                .map_err(RecordProofError::vm)?
-                .ok_or_else(|| ErrorRepr::NotDecoded)?;
-
-            if ciphertext != expected {
-                return Err(ErrorRepr::InvalidCiphertext.into());
-            }
-        }
-
-        Ok(())
-    }
-}
-
-/// Error for [`RecordProof`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub(crate) struct RecordProofError(#[from] ErrorRepr);
-
-impl RecordProofError {
-    fn vm<E>(err: E) -> Self
-    where
-        E: Into<Box<dyn std::error::Error + Send + Sync + 'static>>,
-    {
-        Self(ErrorRepr::Vm(err.into()))
-    }
-}
-
-#[derive(Debug, thiserror::Error)]
-#[error("record proof error: {0}")]
-enum ErrorRepr {
-    #[error("VM error: {0}")]
-    Vm(Box<dyn std::error::Error + Send + Sync + 'static>),
-    #[error("zk aes error: {0}")]
-    Aes(ZkAesCtrError),
-    #[error("plaintext is missing")]
-    MissingPlaintext,
-    #[error("ciphertext was not decoded")]
-    NotDecoded,
-    #[error("ciphertext does not match expected")]
-    InvalidCiphertext,
-}

crates/tlsn/src/commit/transcript.rs

@@ -1,212 +0,0 @@
-use mpz_memory_core::{
-    MemoryExt, Vector,
-    binary::{Binary, U8},
-};
-use mpz_vm_core::{Vm, VmError};
-use rangeset::Intersection;
-use tlsn_core::transcript::{Direction, Idx, PartialTranscript};
-
-/// References to the application plaintext in the transcript.
-#[derive(Debug, Default, Clone)]
-pub(crate) struct TranscriptRefs {
-    sent: Vec<Vector<U8>>,
-    recv: Vec<Vector<U8>>,
-}
-
-impl TranscriptRefs {
-    pub(crate) fn new(sent: Vec<Vector<U8>>, recv: Vec<Vector<U8>>) -> Self {
-        Self { sent, recv }
-    }
-
-    /// Returns the sent plaintext references.
-    pub(crate) fn sent(&self) -> &[Vector<U8>] {
-        &self.sent
-    }
-
-    /// Returns the received plaintext references.
-    pub(crate) fn recv(&self) -> &[Vector<U8>] {
-        &self.recv
-    }
-
-    /// Returns the transcript lengths.
-    pub(crate) fn len(&self) -> (usize, usize) {
-        let sent = self.sent.iter().map(|v| v.len()).sum();
-        let recv = self.recv.iter().map(|v| v.len()).sum();
-
-        (sent, recv)
-    }
-
-    /// Returns VM references for the given direction and index, otherwise
-    /// `None` if the index is out of bounds.
-    pub(crate) fn get(&self, direction: Direction, idx: &Idx) -> Option<Vec<Vector<U8>>> {
-        if idx.is_empty() {
-            return Some(Vec::new());
-        }
-
-        let refs = match direction {
-            Direction::Sent => &self.sent,
-            Direction::Received => &self.recv,
-        };
-
-        // Computes the transcript range for each reference.
-        let mut start = 0;
-        let mut slice_iter = refs.iter().map(move |slice| {
-            let out = (slice, start..start + slice.len());
-            start += slice.len();
-            out
-        });
-
-        let mut slices = Vec::new();
-        let (mut slice, mut slice_range) = slice_iter.next()?;
-        for range in idx.iter_ranges() {
-            loop {
-                if let Some(intersection) = slice_range.intersection(&range) {
-                    let start = intersection.start - slice_range.start;
-                    let end = intersection.end - slice_range.start;
-                    slices.push(slice.get(start..end).expect("range should be in bounds"));
-                }
-
-                // Proceed to next range if the current slice extends beyond. Otherwise, proceed
-                // to the next slice.
-                if range.end <= slice_range.end {
-                    break;
-                } else {
-                    (slice, slice_range) = slice_iter.next()?;
-                }
-            }
-        }
-
-        Some(slices)
-    }
-}
-
-/// Decodes the transcript.
-pub(crate) fn decode_transcript(
-    vm: &mut dyn Vm<Binary>,
-    sent: &Idx,
-    recv: &Idx,
-    refs: &TranscriptRefs,
-) -> Result<(), VmError> {
-    let sent_refs = refs.get(Direction::Sent, sent).expect("index is in bounds");
-    let recv_refs = refs
-        .get(Direction::Received, recv)
-        .expect("index is in bounds");
-
-    for slice in sent_refs.into_iter().chain(recv_refs) {
-        // Drop the future, we don't need it.
-        drop(vm.decode(slice)?);
-    }
-
-    Ok(())
-}
-
-/// Verifies a partial transcript.
-pub(crate) fn verify_transcript(
-    vm: &mut dyn Vm<Binary>,
-    transcript: &PartialTranscript,
-    refs: &TranscriptRefs,
-) -> Result<(), InconsistentTranscript> {
-    let sent_refs = refs
-        .get(Direction::Sent, transcript.sent_authed())
-        .expect("index is in bounds");
-    let recv_refs = refs
-        .get(Direction::Received, transcript.received_authed())
-        .expect("index is in bounds");
-
-    let mut authenticated_data = Vec::new();
-    for data in sent_refs.into_iter().chain(recv_refs) {
-        let plaintext = vm
-            .get(data)
-            .expect("reference is valid")
-            .expect("plaintext is decoded");
-        authenticated_data.extend_from_slice(&plaintext);
-    }
-
-    let mut purported_data = Vec::with_capacity(authenticated_data.len());
-    for range in transcript.sent_authed().iter_ranges() {
-        purported_data.extend_from_slice(&transcript.sent_unsafe()[range]);
-    }
-
-    for range in transcript.received_authed().iter_ranges() {
-        purported_data.extend_from_slice(&transcript.received_unsafe()[range]);
-    }
-
-    if purported_data != authenticated_data {
-        return Err(InconsistentTranscript {});
-    }
-
-    Ok(())
-}
-
-/// Error for [`verify_transcript`].
-#[derive(Debug, thiserror::Error)]
-#[error("inconsistent transcript")]
-pub(crate) struct InconsistentTranscript {}
-
-#[cfg(test)]
-mod tests {
-    use super::TranscriptRefs;
-    use mpz_memory_core::{FromRaw, Slice, Vector, binary::U8};
-    use rangeset::RangeSet;
-    use std::ops::Range;
-    use tlsn_core::transcript::{Direction, Idx};
-
-    // TRANSCRIPT_REFS:
-    //
-    // 48..96 -> 6 slots
-    // 112..176 -> 8 slots
-    // 240..288 -> 6 slots
-    // 352..392 -> 5 slots
-    // 440..480 -> 5 slots
-    const TRANSCRIPT_REFS: &[Range<usize>] = &[48..96, 112..176, 240..288, 352..392, 440..480];
-
-    const IDXS: &[Range<usize>] = &[0..4, 5..10, 14..16, 16..28];
-
-    // 1. Take slots 0..4,   4  slots -> 48..80 (4)
-    // 2. Take slots 5..10,  5  slots -> 88..96 (1) + 112..144 (4)
-    // 3. Take slots 14..16, 2  slots -> 240..256 (2)
-    // 4. Take slots 16..28, 12 slots -> 256..288 (4) + 352..392 (5) + 440..464 (3)
-    //
-    // 5. Merge slots 240..256 and 256..288 => 240..288 and get EXPECTED_REFS
-    const EXPECTED_REFS: &[Range<usize>] =
-        &[48..80, 88..96, 112..144, 240..288, 352..392, 440..464];
-
-    #[test]
-    fn test_transcript_refs_get() {
-        let transcript_refs: Vec<Vector<U8>> = TRANSCRIPT_REFS
-            .iter()
-            .cloned()
-            .map(|range| Vector::from_raw(Slice::from_range_unchecked(range)))
-            .collect();
-
-        let transcript_refs = TranscriptRefs {
-            sent: transcript_refs.clone(),
-            recv: transcript_refs,
-        };
-
-        let vm_refs = transcript_refs
-            .get(Direction::Sent, &idx_fixture())
-            .unwrap();
-
-        let expected_refs: Vec<Vector<U8>> = EXPECTED_REFS
-            .iter()
-            .cloned()
-            .map(|range| Vector::from_raw(Slice::from_range_unchecked(range)))
-            .collect();
-
-        assert_eq!(
-            vm_refs.len(),
-            expected_refs.len(),
-            "Length of actual and expected refs are not equal"
-        );
-
-        for (&expected, actual) in expected_refs.iter().zip(vm_refs) {
-            assert_eq!(expected, actual);
-        }
-    }
-
-    fn idx_fixture() -> Idx {
-        let set = RangeSet::from(IDXS);
-        Idx::builder().union(&set).build()
-    }
-}

crates/tlsn/src/encoding.rs

@@ -1,248 +0,0 @@
-//! Encoding commitment protocol.
-
-use std::ops::Range;
-
-use mpz_common::Context;
-use mpz_memory_core::{
-    Vector,
-    binary::U8,
-    correlated::{Delta, Key, Mac},
-};
-use rand::Rng;
-use serde::{Deserialize, Serialize};
-use serio::{SinkExt, stream::IoStreamExt};
-use tlsn_core::{
-    hash::HashAlgorithm,
-    transcript::{
-        Direction, Idx,
-        encoding::{
-            Encoder, EncoderSecret, EncodingCommitment, EncodingProvider, EncodingProviderError,
-            EncodingTree, EncodingTreeError, new_encoder,
-        },
-    },
-};
-
-use crate::commit::transcript::TranscriptRefs;
-
-/// Bytes of encoding, per byte.
-const ENCODING_SIZE: usize = 128;
-
-#[derive(Debug, Serialize, Deserialize)]
-struct Encodings {
-    sent: Vec<u8>,
-    recv: Vec<u8>,
-}
-
-/// Transfers the encodings using the provided seed and keys.
-///
-/// The keys must be consistent with the global delta used in the encodings.
-pub(crate) async fn transfer<'a>(
-    ctx: &mut Context,
-    refs: &TranscriptRefs,
-    delta: &Delta,
-    f: impl Fn(Vector<U8>) -> &'a [Key],
-) -> Result<EncodingCommitment, EncodingError> {
-    let secret = EncoderSecret::new(rand::rng().random(), delta.as_block().to_bytes());
-    let encoder = new_encoder(&secret);
-
-    let sent_keys: Vec<u8> = refs
-        .sent()
-        .iter()
-        .copied()
-        .flat_map(&f)
-        .flat_map(|key| key.as_block().as_bytes())
-        .copied()
-        .collect();
-    let recv_keys: Vec<u8> = refs
-        .recv()
-        .iter()
-        .copied()
-        .flat_map(&f)
-        .flat_map(|key| key.as_block().as_bytes())
-        .copied()
-        .collect();
-
-    assert_eq!(sent_keys.len() % ENCODING_SIZE, 0);
-    assert_eq!(recv_keys.len() % ENCODING_SIZE, 0);
-
-    let mut sent_encoding = Vec::with_capacity(sent_keys.len());
-    let mut recv_encoding = Vec::with_capacity(recv_keys.len());
-
-    encoder.encode_range(
-        Direction::Sent,
-        0..sent_keys.len() / ENCODING_SIZE,
-        &mut sent_encoding,
-    );
-    encoder.encode_range(
-        Direction::Received,
-        0..recv_keys.len() / ENCODING_SIZE,
-        &mut recv_encoding,
-    );
-
-    sent_encoding
-        .iter_mut()
-        .zip(sent_keys)
-        .for_each(|(enc, key)| *enc ^= key);
-    recv_encoding
-        .iter_mut()
-        .zip(recv_keys)
-        .for_each(|(enc, key)| *enc ^= key);
-
-    // Set frame limit and add some extra bytes cushion room.
-    let (sent, recv) = refs.len();
-    let frame_limit = ENCODING_SIZE * (sent + recv) + ctx.io().limit();
-
-    ctx.io_mut()
-        .with_limit(frame_limit)
-        .send(Encodings {
-            sent: sent_encoding,
-            recv: recv_encoding,
-        })
-        .await?;
-
-    let root = ctx.io_mut().expect_next().await?;
-    ctx.io_mut().send(secret.clone()).await?;
-
-    Ok(EncodingCommitment {
-        root,
-        secret: secret.clone(),
-    })
-}
-
-/// Receives the encodings using the provided MACs.
-///
-/// The MACs must be consistent with the global delta used in the encodings.
-pub(crate) async fn receive<'a>(
-    ctx: &mut Context,
-    hasher: &(dyn HashAlgorithm + Send + Sync),
-    refs: &TranscriptRefs,
-    f: impl Fn(Vector<U8>) -> &'a [Mac],
-    idxs: impl IntoIterator<Item = &(Direction, Idx)>,
-) -> Result<(EncodingCommitment, EncodingTree), EncodingError> {
-    // Set frame limit and add some extra bytes cushion room.
-    let (sent, recv) = refs.len();
-    let frame_limit = ENCODING_SIZE * (sent + recv) + ctx.io().limit();
-
-    let Encodings { mut sent, mut recv } =
-        ctx.io_mut().with_limit(frame_limit).expect_next().await?;
-
-    let sent_macs: Vec<u8> = refs
-        .sent()
-        .iter()
-        .copied()
-        .flat_map(&f)
-        .flat_map(|mac| mac.as_bytes())
-        .copied()
-        .collect();
-    let recv_macs: Vec<u8> = refs
-        .recv()
-        .iter()
-        .copied()
-        .flat_map(&f)
-        .flat_map(|mac| mac.as_bytes())
-        .copied()
-        .collect();
-
-    assert_eq!(sent_macs.len() % ENCODING_SIZE, 0);
-    assert_eq!(recv_macs.len() % ENCODING_SIZE, 0);
-
-    if sent.len() != sent_macs.len() {
-        return Err(ErrorRepr::IncorrectMacCount {
-            direction: Direction::Sent,
-            expected: sent_macs.len(),
-            got: sent.len(),
-        }
-        .into());
-    }
-
-    if recv.len() != recv_macs.len() {
-        return Err(ErrorRepr::IncorrectMacCount {
-            direction: Direction::Received,
-            expected: recv_macs.len(),
-            got: recv.len(),
-        }
-        .into());
-    }
-
-    sent.iter_mut()
-        .zip(sent_macs)
-        .for_each(|(enc, mac)| *enc ^= mac);
-    recv.iter_mut()
-        .zip(recv_macs)
-        .for_each(|(enc, mac)| *enc ^= mac);
-
-    let provider = Provider { sent, recv };
-
-    let tree = EncodingTree::new(hasher, idxs, &provider)?;
-    let root = tree.root();
-
-    ctx.io_mut().send(root.clone()).await?;
-    let secret = ctx.io_mut().expect_next().await?;
-
-    let commitment = EncodingCommitment { root, secret };
-
-    Ok((commitment, tree))
-}
-
-#[derive(Debug)]
-struct Provider {
-    sent: Vec<u8>,
-    recv: Vec<u8>,
-}
-
-impl EncodingProvider for Provider {
-    fn provide_encoding(
-        &self,
-        direction: Direction,
-        range: Range<usize>,
-        dest: &mut Vec<u8>,
-    ) -> Result<(), EncodingProviderError> {
-        let encodings = match direction {
-            Direction::Sent => &self.sent,
-            Direction::Received => &self.recv,
-        };
-
-        let start = range.start * ENCODING_SIZE;
-        let end = range.end * ENCODING_SIZE;
-
-        if end > encodings.len() {
-            return Err(EncodingProviderError);
-        }
-
-        dest.extend_from_slice(&encodings[start..end]);
-
-        Ok(())
-    }
-}
-
-/// Encoding protocol error.
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct EncodingError(#[from] ErrorRepr);
-
-#[derive(Debug, thiserror::Error)]
-#[error("encoding protocol error: {0}")]
-enum ErrorRepr {
-    #[error("I/O error: {0}")]
-    Io(std::io::Error),
-    #[error("incorrect MAC count for {direction}: expected {expected}, got {got}")]
-    IncorrectMacCount {
-        direction: Direction,
-        expected: usize,
-        got: usize,
-    },
-    #[error("encoding tree error: {0}")]
-    EncodingTree(EncodingTreeError),
-}
-
-impl From<std::io::Error> for EncodingError {
-    fn from(value: std::io::Error) -> Self {
-        Self(ErrorRepr::Io(value))
-    }
-}
-
-impl From<EncodingTreeError> for EncodingError {
-    fn from(value: EncodingTreeError) -> Self {
-        Self(ErrorRepr::EncodingTree(value))
-    }
-}

crates/tlsn/src/ghash.rs

@@ -23,11 +23,11 @@ pub(crate) fn build_ghash_data(mut aad: Vec<u8>, mut ciphertext: Vec<u8>) -> Vec
     let len_block = ((associated_data_bitlen as u128) << 64) + (text_bitlen as u128);
 
     // Pad data to be a multiple of 16 bytes.
-    let aad_padded_block_count = (aad.len() / 16) + (aad.len() % 16 != 0) as usize;
+    let aad_padded_block_count = (aad.len() / 16) + !aad.len().is_multiple_of(16) as usize;
     aad.resize(aad_padded_block_count * 16, 0);
 
     let ciphertext_padded_block_count =
-        (ciphertext.len() / 16) + (ciphertext.len() % 16 != 0) as usize;
+        (ciphertext.len() / 16) + !ciphertext.len().is_multiple_of(16) as usize;
     ciphertext.resize(ciphertext_padded_block_count * 16, 0);
 
     let mut data: Vec<u8> = Vec::with_capacity(aad.len() + ciphertext.len() + 16);

crates/tlsn/src/lib.rs

@@ -4,17 +4,15 @@
 #![deny(clippy::all)]
 #![forbid(unsafe_code)]
 
-pub(crate) mod commit;
 pub mod config;
 pub(crate) mod context;
-pub(crate) mod encoding;
 pub(crate) mod ghash;
-pub(crate) mod msg;
+pub(crate) mod map;
 pub(crate) mod mux;
 pub mod prover;
 pub(crate) mod tag;
+pub(crate) mod transcript_internal;
 pub mod verifier;
-pub(crate) mod zk_aes_ctr;
 
 pub use tlsn_attestation as attestation;
 pub use tlsn_core::{connection, hash, transcript};

crates/tlsn/src/map.rs

@@ -0,0 +1,208 @@
+use std::ops::Range;
+
+use mpz_memory_core::{Vector, binary::U8};
+use rangeset::RangeSet;
+
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct RangeMap<T> {
+    map: Vec<(usize, T)>,
+}
+
+impl<T> Default for RangeMap<T>
+where
+    T: Item,
+{
+    fn default() -> Self {
+        Self { map: Vec::new() }
+    }
+}
+
+impl<T> RangeMap<T>
+where
+    T: Item,
+{
+    pub(crate) fn new(map: Vec<(usize, T)>) -> Self {
+        let mut pos = 0;
+        for (idx, item) in &map {
+            assert!(
+                *idx >= pos,
+                "items must be sorted by index and non-overlapping"
+            );
+
+            pos = *idx + item.length();
+        }
+
+        Self { map }
+    }
+
+    /// Returns `true` if the map is empty.
+    pub(crate) fn is_empty(&self) -> bool {
+        self.map.is_empty()
+    }
+
+    /// Returns the keys of the map.
+    pub(crate) fn keys(&self) -> impl Iterator<Item = Range<usize>> {
+        self.map
+            .iter()
+            .map(|(idx, item)| *idx..*idx + item.length())
+    }
+
+    /// Returns the length of the map.
+    pub(crate) fn len(&self) -> usize {
+        self.map.iter().map(|(_, item)| item.length()).sum()
+    }
+
+    pub(crate) fn iter(&self) -> impl Iterator<Item = (Range<usize>, &T)> {
+        self.map
+            .iter()
+            .map(|(idx, item)| (*idx..*idx + item.length(), item))
+    }
+
+    pub(crate) fn get(&self, range: Range<usize>) -> Option<T::Slice<'_>> {
+        if range.start >= range.end {
+            return None;
+        }
+
+        // Find the item with the greatest start index <= range.start
+        let pos = match self.map.binary_search_by(|(idx, _)| idx.cmp(&range.start)) {
+            Ok(i) => i,
+            Err(0) => return None,
+            Err(i) => i - 1,
+        };
+
+        let (base, item) = &self.map[pos];
+
+        item.slice(range.start - *base..range.end - *base)
+    }
+
+    pub(crate) fn index(&self, idx: &RangeSet<usize>) -> Option<Self> {
+        let mut map = Vec::new();
+        for idx in idx.iter_ranges() {
+            let pos = match self.map.binary_search_by(|(base, _)| base.cmp(&idx.start)) {
+                Ok(i) => i,
+                Err(0) => return None,
+                Err(i) => i - 1,
+            };
+
+            let (base, item) = self.map.get(pos)?;
+            if idx.start < *base || idx.end > *base + item.length() {
+                return None;
+            }
+
+            let start = idx.start - *base;
+            let end = start + idx.len();
+
+            map.push((
+                idx.start,
+                item.slice(start..end)
+                    .expect("slice length is checked")
+                    .into(),
+            ));
+        }
+
+        Some(Self { map })
+    }
+}
+
+impl<T> FromIterator<(usize, T)> for RangeMap<T>
+where
+    T: Item,
+{
+    fn from_iter<I: IntoIterator<Item = (usize, T)>>(items: I) -> Self {
+        let mut pos = 0;
+        let mut map = Vec::new();
+        for (idx, item) in items {
+            assert!(
+                idx >= pos,
+                "items must be sorted by index and non-overlapping"
+            );
+
+            pos = idx + item.length();
+            map.push((idx, item));
+        }
+
+        Self { map }
+    }
+}
+
+pub(crate) trait Item: Sized {
+    type Slice<'a>: Into<Self>
+    where
+        Self: 'a;
+
+    fn length(&self) -> usize;
+
+    fn slice<'a>(&'a self, range: Range<usize>) -> Option<Self::Slice<'a>>;
+}
+
+impl Item for Vector<U8> {
+    type Slice<'a> = Vector<U8>;
+
+    fn length(&self) -> usize {
+        self.len()
+    }
+
+    fn slice<'a>(&'a self, range: Range<usize>) -> Option<Self::Slice<'a>> {
+        self.get(range)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    impl Item for Range<usize> {
+        type Slice<'a> = Range<usize>;
+
+        fn length(&self) -> usize {
+            self.end - self.start
+        }
+
+        fn slice(&self, range: Range<usize>) -> Option<Self> {
+            if range.end > self.end - self.start {
+                return None;
+            }
+
+            Some(range.start + self.start..range.end + self.start)
+        }
+    }
+
+    #[test]
+    fn test_range_map() {
+        let map = RangeMap::from_iter([(0, 10..14), (10, 20..24), (20, 30..32)]);
+
+        assert_eq!(map.get(0..4), Some(10..14));
+        assert_eq!(map.get(10..14), Some(20..24));
+        assert_eq!(map.get(20..22), Some(30..32));
+        assert_eq!(map.get(0..2), Some(10..12));
+        assert_eq!(map.get(11..13), Some(21..23));
+        assert_eq!(map.get(0..10), None);
+        assert_eq!(map.get(10..20), None);
+        assert_eq!(map.get(20..30), None);
+    }
+
+    #[test]
+    fn test_range_map_index() {
+        let map = RangeMap::from_iter([(0, 10..14), (10, 20..24), (20, 30..32)]);
+
+        let idx = RangeSet::from([0..4, 10..14, 20..22]);
+        assert_eq!(map.index(&idx), Some(map.clone()));
+
+        let idx = RangeSet::from(25..30);
+        assert_eq!(map.index(&idx), None);
+
+        let idx = RangeSet::from(15..20);
+        assert_eq!(map.index(&idx), None);
+
+        let idx = RangeSet::from([1..3, 11..12, 13..14, 21..22]);
+        assert_eq!(
+            map.index(&idx),
+            Some(RangeMap::from_iter([
+                (1, 11..13),
+                (11, 21..22),
+                (13, 23..24),
+                (21, 31..32)
+            ]))
+        );
+    }
+}

crates/tlsn/src/msg.rs

@@ -1,14 +0,0 @@
-//! Message types.
-
-use serde::{Deserialize, Serialize};
-
-use tlsn_core::connection::{HandshakeData, ServerName};
-
-/// Message sent from Prover to Verifier to prove the server identity.
-#[derive(Debug, Serialize, Deserialize)]
-pub(crate) struct ServerIdentityProof {
-    /// Server name.
-    pub name: ServerName,
-    /// Server identity data.
-    pub data: HandshakeData,
-}

crates/tlsn/src/prover.rs

@@ -3,6 +3,7 @@
 mod config;
 mod error;
 mod future;
+mod prove;
 pub mod state;
 
 pub use config::{ProverConfig, ProverConfigBuilder, TlsConfig, TlsConfigBuilder};
@@ -18,19 +19,7 @@ use mpz_vm_core::prelude::*;
 use mpz_zk::ProverConfig as ZkProverConfig;
 use webpki::anchor_from_trusted_cert;
 
-use crate::{
-    Role,
-    commit::{
-        commit_records,
-        hash::prove_hash,
-        transcript::{TranscriptRefs, decode_transcript},
-    },
-    context::build_mt_context,
-    encoding,
-    mux::attach_mux,
-    tag::verify_tags,
-    zk_aes_ctr::ZkAesCtr,
-};
+use crate::{Role, context::build_mt_context, mux::attach_mux, tag::verify_tags};
 
 use futures::{AsyncRead, AsyncWrite, TryFutureExt};
 use mpc_tls::{LeaderCtrl, MpcTlsLeader, SessionKeys};
@@ -39,12 +28,9 @@ use serio::SinkExt;
 use std::sync::Arc;
 use tls_client::{ClientConnection, ServerName as TlsServerName};
 use tls_client_async::{TlsConnection, bind_client};
-use tls_core::msgs::enums::ContentType;
 use tlsn_core::{
-    ProvePayload,
-    connection::{HandshakeData, ServerName},
-    hash::{Blake3, HashAlgId, HashAlgorithm, Keccak256, Sha256},
-    transcript::{TlsTranscript, Transcript, TranscriptCommitment, TranscriptSecret},
+    connection::ServerName,
+    transcript::{TlsTranscript, Transcript},
 };
 use tlsn_deap::Deap;
 use tokio::sync::Mutex;
@@ -115,22 +101,6 @@ impl Prover<state::Initialized> {
         let mut keys = mpc_tls.alloc()?;
         let vm_lock = vm.try_lock().expect("VM is not locked");
         translate_keys(&mut keys, &vm_lock)?;
-
-        // Allocate for committing to plaintext.
-        let mut zk_aes_ctr_sent = ZkAesCtr::new(Role::Prover);
-        zk_aes_ctr_sent.set_key(keys.client_write_key, keys.client_write_iv);
-        zk_aes_ctr_sent.alloc(
-            &mut *vm_lock.zk(),
-            self.config.protocol_config().max_sent_data(),
-        )?;
-
-        let mut zk_aes_ctr_recv = ZkAesCtr::new(Role::Prover);
-        zk_aes_ctr_recv.set_key(keys.server_write_key, keys.server_write_iv);
-        zk_aes_ctr_recv.alloc(
-            &mut *vm_lock.zk(),
-            self.config.protocol_config().max_recv_data(),
-        )?;
-
         drop(vm_lock);
 
         debug!("setting up mpc-tls");
@@ -146,8 +116,6 @@ impl Prover<state::Initialized> {
                 mux_ctrl,
                 mux_fut,
                 mpc_tls,
-                zk_aes_ctr_sent,
-                zk_aes_ctr_recv,
                 keys,
                 vm,
             },
@@ -173,8 +141,6 @@ impl Prover<state::Setup> {
             mux_ctrl,
             mut mux_fut,
             mpc_tls,
-            mut zk_aes_ctr_sent,
-            mut zk_aes_ctr_recv,
             keys,
             vm,
             ..
@@ -281,28 +247,6 @@ impl Prover<state::Setup> {
                 )
                 .map_err(ProverError::zk)?;
 
-                // Prove received plaintext. Prover drops the proof output, as
-                // they trust themselves.
-                let (sent_refs, _) = commit_records(
-                    &mut vm,
-                    &mut zk_aes_ctr_sent,
-                    tls_transcript
-                        .sent()
-                        .iter()
-                        .filter(|record| record.typ == ContentType::ApplicationData),
-                )
-                .map_err(ProverError::zk)?;
-
-                let (recv_refs, _) = commit_records(
-                    &mut vm,
-                    &mut zk_aes_ctr_recv,
-                    tls_transcript
-                        .recv()
-                        .iter()
-                        .filter(|record| record.typ == ContentType::ApplicationData),
-                )
-                .map_err(ProverError::zk)?;
-
                 mux_fut
                     .poll_with(vm.execute_all(&mut ctx).map_err(ProverError::zk))
                     .await?;
@@ -310,7 +254,6 @@ impl Prover<state::Setup> {
                 let transcript = tls_transcript
                     .to_transcript()
                     .expect("transcript is complete");
-                let transcript_refs = TranscriptRefs::new(sent_refs, recv_refs);
 
                 Ok(Prover {
                     config: self.config,
@@ -320,9 +263,9 @@ impl Prover<state::Setup> {
                         mux_fut,
                         ctx,
                         vm,
+                        keys,
                         tls_transcript,
                         transcript,
-                        transcript_refs,
                     },
                 })
             }
@@ -361,118 +304,24 @@ impl Prover<state::Committed> {
             mux_fut,
             ctx,
             vm,
+            keys,
             tls_transcript,
-            transcript_refs,
+            transcript,
             ..
         } = &mut self.state;
 
-        let mut output = ProverOutput {
-            transcript_commitments: Vec::new(),
-            transcript_secrets: Vec::new(),
-        };
-
-        let payload = ProvePayload {
-            handshake: config.server_identity().then(|| {
-                (
-                    self.config.server_name().clone(),
-                    HandshakeData {
-                        certs: tls_transcript
-                            .server_cert_chain()
-                            .expect("server cert chain is present")
-                            .to_vec(),
-                        sig: tls_transcript
-                            .server_signature()
-                            .expect("server signature is present")
-                            .clone(),
-                        binding: tls_transcript.certificate_binding().clone(),
-                    },
-                )
-            }),
-            transcript: config.transcript().cloned(),
-            transcript_commit: config.transcript_commit().map(|config| config.to_request()),
-        };
-
-        // Send payload.
-        mux_fut
-            .poll_with(ctx.io_mut().send(payload).map_err(ProverError::from))
-            .await?;
-
-        if let Some(partial_transcript) = config.transcript() {
-            decode_transcript(
+        let output = mux_fut
+            .poll_with(prove::prove(
+                ctx,
                 vm,
-                partial_transcript.sent_authed(),
-                partial_transcript.received_authed(),
-                transcript_refs,
-            )
-            .map_err(ProverError::zk)?;
-        }
-
-        let mut hash_commitments = None;
-        if let Some(commit_config) = config.transcript_commit() {
-            if commit_config.has_encoding() {
-                let hasher: &(dyn HashAlgorithm + Send + Sync) =
-                    match *commit_config.encoding_hash_alg() {
-                        HashAlgId::SHA256 => &Sha256::default(),
-                        HashAlgId::KECCAK256 => &Keccak256::default(),
-                        HashAlgId::BLAKE3 => &Blake3::default(),
-                        alg => {
-                            return Err(ProverError::config(format!(
-                                "unsupported hash algorithm for encoding commitment: {alg}"
-                            )));
-                        }
-                    };
-
-                let (commitment, tree) = mux_fut
-                    .poll_with(
-                        encoding::receive(
-                            ctx,
-                            hasher,
-                            transcript_refs,
-                            |plaintext| vm.get_macs(plaintext).expect("reference is valid"),
-                            commit_config.iter_encoding(),
-                        )
-                        .map_err(ProverError::commit),
-                    )
-                    .await?;
-
-                output
-                    .transcript_commitments
-                    .push(TranscriptCommitment::Encoding(commitment));
-                output
-                    .transcript_secrets
-                    .push(TranscriptSecret::Encoding(tree));
-            }
-
-            if commit_config.has_hash() {
-                hash_commitments = Some(
-                    prove_hash(
-                        vm,
-                        transcript_refs,
-                        commit_config
-                            .iter_hash()
-                            .map(|((dir, idx), alg)| (*dir, idx.clone(), *alg)),
-                    )
-                    .map_err(ProverError::commit)?,
-                );
-            }
-        }
-
-        mux_fut
-            .poll_with(vm.execute_all(ctx).map_err(ProverError::zk))
+                keys,
+                self.config.server_name(),
+                transcript,
+                tls_transcript,
+                config,
+            ))
             .await?;
 
-        if let Some((hash_fut, hash_secrets)) = hash_commitments {
-            let hash_commitments = hash_fut.try_recv().map_err(ProverError::commit)?;
-            for (commitment, secret) in hash_commitments.into_iter().zip(hash_secrets) {
-                output
-                    .transcript_commitments
-                    .push(TranscriptCommitment::Hash(commitment));
-                output
-                    .transcript_secrets
-                    .push(TranscriptSecret::Hash(secret));
-            }
-        }
-
         Ok(output)
     }
 

crates/tlsn/src/prover/error.rs

@@ -2,7 +2,7 @@ use std::{error::Error, fmt};
 
 use mpc_tls::MpcTlsError;
 
-use crate::{encoding::EncodingError, zk_aes_ctr::ZkAesCtrError};
+use crate::transcript_internal::commit::encoding::EncodingError;
 
 /// Error for [`Prover`](crate::Prover).
 #[derive(Debug, thiserror::Error)]
@@ -110,12 +110,6 @@ impl From<MpcTlsError> for ProverError {
     }
 }
 
-impl From<ZkAesCtrError> for ProverError {
-    fn from(e: ZkAesCtrError) -> Self {
-        Self::new(ErrorKind::Zk, e)
-    }
-}
-
 impl From<EncodingError> for ProverError {
     fn from(e: EncodingError) -> Self {
         Self::new(ErrorKind::Commit, e)

crates/tlsn/src/prover/prove.rs

@@ -0,0 +1,187 @@
+use mpc_tls::SessionKeys;
+use mpz_common::Context;
+use mpz_memory_core::binary::Binary;
+use mpz_vm_core::Vm;
+use rangeset::{RangeSet, UnionMut};
+use serio::SinkExt;
+use tlsn_core::{
+    ProveConfig, ProveRequest, ProverOutput,
+    connection::{HandshakeData, ServerName},
+    transcript::{
+        ContentType, Direction, TlsTranscript, Transcript, TranscriptCommitment, TranscriptSecret,
+    },
+};
+
+use crate::{
+    prover::ProverError,
+    transcript_internal::{
+        TranscriptRefs,
+        auth::prove_plaintext,
+        commit::{
+            encoding::{self, MacStore},
+            hash::prove_hash,
+        },
+    },
+};
+
+pub(crate) async fn prove<T: Vm<Binary> + MacStore + Send + Sync>(
+    ctx: &mut Context,
+    vm: &mut T,
+    keys: &SessionKeys,
+    server_name: &ServerName,
+    transcript: &Transcript,
+    tls_transcript: &TlsTranscript,
+    config: &ProveConfig,
+) -> Result<ProverOutput, ProverError> {
+    let mut output = ProverOutput {
+        transcript_commitments: Vec::default(),
+        transcript_secrets: Vec::default(),
+    };
+
+    let request = ProveRequest {
+        handshake: config.server_identity().then(|| {
+            (
+                server_name.clone(),
+                HandshakeData {
+                    certs: tls_transcript
+                        .server_cert_chain()
+                        .expect("server cert chain is present")
+                        .to_vec(),
+                    sig: tls_transcript
+                        .server_signature()
+                        .expect("server signature is present")
+                        .clone(),
+                    binding: tls_transcript.certificate_binding().clone(),
+                },
+            )
+        }),
+        transcript: config
+            .reveal()
+            .map(|(sent, recv)| transcript.to_partial(sent.clone(), recv.clone())),
+        transcript_commit: config.transcript_commit().map(|config| config.to_request()),
+    };
+
+    ctx.io_mut()
+        .send(request)
+        .await
+        .map_err(ProverError::from)?;
+
+    let (reveal_sent, reveal_recv) = config.reveal().cloned().unwrap_or_default();
+    let (mut commit_sent, mut commit_recv) = (RangeSet::default(), RangeSet::default());
+    if let Some(commit_config) = config.transcript_commit() {
+        commit_config
+            .iter_hash()
+            .for_each(|((direction, idx), _)| match direction {
+                Direction::Sent => commit_sent.union_mut(idx),
+                Direction::Received => commit_recv.union_mut(idx),
+            });
+
+        commit_config
+            .iter_encoding()
+            .for_each(|(direction, idx)| match direction {
+                Direction::Sent => commit_sent.union_mut(idx),
+                Direction::Received => commit_recv.union_mut(idx),
+            });
+    }
+
+    let transcript_refs = TranscriptRefs {
+        sent: prove_plaintext(
+            vm,
+            keys.client_write_key,
+            keys.client_write_iv,
+            transcript.sent(),
+            tls_transcript
+                .sent()
+                .iter()
+                .filter(|record| record.typ == ContentType::ApplicationData),
+            &reveal_sent,
+            &commit_sent,
+        )
+        .map_err(ProverError::commit)?,
+        recv: prove_plaintext(
+            vm,
+            keys.server_write_key,
+            keys.server_write_iv,
+            transcript.received(),
+            tls_transcript
+                .recv()
+                .iter()
+                .filter(|record| record.typ == ContentType::ApplicationData),
+            &reveal_recv,
+            &commit_recv,
+        )
+        .map_err(ProverError::commit)?,
+    };
+
+    let hash_commitments = if let Some(commit_config) = config.transcript_commit()
+        && commit_config.has_hash()
+    {
+        Some(
+            prove_hash(
+                vm,
+                &transcript_refs,
+                commit_config
+                    .iter_hash()
+                    .map(|((dir, idx), alg)| (*dir, idx.clone(), *alg)),
+            )
+            .map_err(ProverError::commit)?,
+        )
+    } else {
+        None
+    };
+
+    vm.execute_all(ctx).await.map_err(ProverError::zk)?;
+
+    if let Some(commit_config) = config.transcript_commit()
+        && commit_config.has_encoding()
+    {
+        let mut sent_ranges = RangeSet::default();
+        let mut recv_ranges = RangeSet::default();
+        for (dir, idx) in commit_config.iter_encoding() {
+            match dir {
+                Direction::Sent => sent_ranges.union_mut(idx),
+                Direction::Received => recv_ranges.union_mut(idx),
+            }
+        }
+
+        let sent_map = transcript_refs
+            .sent
+            .index(&sent_ranges)
+            .expect("indices are valid");
+        let recv_map = transcript_refs
+            .recv
+            .index(&recv_ranges)
+            .expect("indices are valid");
+
+        let (commitment, tree) = encoding::receive(
+            ctx,
+            vm,
+            *commit_config.encoding_hash_alg(),
+            &sent_map,
+            &recv_map,
+            commit_config.iter_encoding(),
+        )
+        .await?;
+
+        output
+            .transcript_commitments
+            .push(TranscriptCommitment::Encoding(commitment));
+        output
+            .transcript_secrets
+            .push(TranscriptSecret::Encoding(tree));
+    }
+
+    if let Some((hash_fut, hash_secrets)) = hash_commitments {
+        let hash_commitments = hash_fut.try_recv().map_err(ProverError::commit)?;
+        for (commitment, secret) in hash_commitments.into_iter().zip(hash_secrets) {
+            output
+                .transcript_commitments
+                .push(TranscriptCommitment::Hash(commitment));
+            output
+                .transcript_secrets
+                .push(TranscriptSecret::Hash(secret));
+        }
+    }
+
+    Ok(output)
+}

crates/tlsn/src/prover/state.rs

@@ -9,10 +9,8 @@ use tlsn_deap::Deap;
 use tokio::sync::Mutex;
 
 use crate::{
-    commit::transcript::TranscriptRefs,
     mux::{MuxControl, MuxFuture},
     prover::{Mpc, Zk},
-    zk_aes_ctr::ZkAesCtr,
 };
 
 /// Entry state
@@ -25,8 +23,6 @@ pub struct Setup {
     pub(crate) mux_ctrl: MuxControl,
     pub(crate) mux_fut: MuxFuture,
     pub(crate) mpc_tls: MpcTlsLeader,
-    pub(crate) zk_aes_ctr_sent: ZkAesCtr,
-    pub(crate) zk_aes_ctr_recv: ZkAesCtr,
     pub(crate) keys: SessionKeys,
     pub(crate) vm: Arc<Mutex<Deap<Mpc, Zk>>>,
 }
@@ -39,9 +35,9 @@ pub struct Committed {
     pub(crate) mux_fut: MuxFuture,
     pub(crate) ctx: Context,
     pub(crate) vm: Zk,
+    pub(crate) keys: SessionKeys,
     pub(crate) tls_transcript: TlsTranscript,
     pub(crate) transcript: Transcript,
-    pub(crate) transcript_refs: TranscriptRefs,
 }
 
 opaque_debug::implement!(Committed);

crates/tlsn/src/transcript_internal.rs

@@ -0,0 +1,16 @@
+pub(crate) mod auth;
+pub(crate) mod commit;
+
+use mpz_memory_core::{Vector, binary::U8};
+
+use crate::map::RangeMap;
+
+/// Maps transcript ranges to VM references.
+pub(crate) type ReferenceMap = RangeMap<Vector<U8>>;
+
+/// References to the application plaintext in the transcript.
+#[derive(Debug, Default, Clone)]
+pub(crate) struct TranscriptRefs {
+    pub(crate) sent: ReferenceMap,
+    pub(crate) recv: ReferenceMap,
+}

crates/tlsn/src/transcript_internal/auth.rs

@@ -0,0 +1,639 @@
+use std::sync::Arc;
+
+use aes::Aes128;
+use ctr::{
+    Ctr32BE,
+    cipher::{KeyIvInit, StreamCipher, StreamCipherSeek},
+};
+use mpz_circuits::circuits::{AES128, xor};
+use mpz_core::bitvec::BitVec;
+use mpz_memory_core::{
+    Array, DecodeFutureTyped, MemoryExt, Vector, ViewExt,
+    binary::{Binary, U8},
+};
+use mpz_vm_core::{Call, CallableExt, Vm};
+use rangeset::{Difference, RangeSet, Union};
+use tlsn_core::transcript::Record;
+
+use crate::transcript_internal::ReferenceMap;
+
+pub(crate) fn prove_plaintext<'a>(
+    vm: &mut dyn Vm<Binary>,
+    key: Array<U8, 16>,
+    iv: Array<U8, 4>,
+    plaintext: &[u8],
+    records: impl IntoIterator<Item = &'a Record>,
+    reveal: &RangeSet<usize>,
+    commit: &RangeSet<usize>,
+) -> Result<ReferenceMap, PlaintextAuthError> {
+    let is_reveal_all = reveal == (0..plaintext.len());
+
+    let alloc_ranges = if is_reveal_all {
+        commit.clone()
+    } else {
+        // The plaintext is only partially revealed, so we need to authenticate in ZK.
+        commit.union(reveal)
+    };
+
+    let plaintext_refs = alloc_plaintext(vm, &alloc_ranges)?;
+    let records = RecordParams::from_iter(records).collect::<Vec<_>>();
+
+    if is_reveal_all {
+        drop(vm.decode(key).map_err(PlaintextAuthError::vm)?);
+        drop(vm.decode(iv).map_err(PlaintextAuthError::vm)?);
+
+        for (range, slice) in plaintext_refs.iter() {
+            vm.mark_public(*slice).map_err(PlaintextAuthError::vm)?;
+            vm.assign(*slice, plaintext[range].to_vec())
+                .map_err(PlaintextAuthError::vm)?;
+            vm.commit(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+    } else {
+        let private = commit.difference(reveal);
+        for (_, slice) in plaintext_refs
+            .index(&private)
+            .expect("all ranges are allocated")
+            .iter()
+        {
+            vm.mark_private(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        for (_, slice) in plaintext_refs
+            .index(reveal)
+            .expect("all ranges are allocated")
+            .iter()
+        {
+            vm.mark_public(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        for (range, slice) in plaintext_refs.iter() {
+            vm.assign(*slice, plaintext[range].to_vec())
+                .map_err(PlaintextAuthError::vm)?;
+            vm.commit(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        let ciphertext = alloc_ciphertext(vm, key, iv, plaintext_refs.clone(), &records)?;
+        for (_, slice) in ciphertext.iter() {
+            drop(vm.decode(*slice).map_err(PlaintextAuthError::vm)?);
+        }
+    }
+
+    Ok(plaintext_refs)
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn verify_plaintext<'a>(
+    vm: &mut dyn Vm<Binary>,
+    key: Array<U8, 16>,
+    iv: Array<U8, 4>,
+    plaintext: &'a [u8],
+    ciphertext: &'a [u8],
+    records: impl IntoIterator<Item = &'a Record>,
+    reveal: &RangeSet<usize>,
+    commit: &RangeSet<usize>,
+) -> Result<(ReferenceMap, PlaintextProof<'a>), PlaintextAuthError> {
+    let is_reveal_all = reveal == (0..plaintext.len());
+
+    let alloc_ranges = if is_reveal_all {
+        commit.clone()
+    } else {
+        // The plaintext is only partially revealed, so we need to authenticate in ZK.
+        commit.union(reveal)
+    };
+
+    let plaintext_refs = alloc_plaintext(vm, &alloc_ranges)?;
+    let records = RecordParams::from_iter(records).collect::<Vec<_>>();
+
+    let plaintext_proof = if is_reveal_all {
+        let key = vm.decode(key).map_err(PlaintextAuthError::vm)?;
+        let iv = vm.decode(iv).map_err(PlaintextAuthError::vm)?;
+
+        for (range, slice) in plaintext_refs.iter() {
+            vm.mark_public(*slice).map_err(PlaintextAuthError::vm)?;
+            vm.assign(*slice, plaintext[range].to_vec())
+                .map_err(PlaintextAuthError::vm)?;
+            vm.commit(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        PlaintextProof(ProofInner::WithKey {
+            key,
+            iv,
+            records,
+            plaintext,
+            ciphertext,
+        })
+    } else {
+        let private = commit.difference(reveal);
+        for (_, slice) in plaintext_refs
+            .index(&private)
+            .expect("all ranges are allocated")
+            .iter()
+        {
+            vm.mark_blind(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        for (range, slice) in plaintext_refs
+            .index(reveal)
+            .expect("all ranges are allocated")
+            .iter()
+        {
+            vm.mark_public(*slice).map_err(PlaintextAuthError::vm)?;
+            vm.assign(*slice, plaintext[range].to_vec())
+                .map_err(PlaintextAuthError::vm)?;
+        }
+
+        for (_, slice) in plaintext_refs.iter() {
+            vm.commit(*slice).map_err(PlaintextAuthError::vm)?;
+        }
+
+        let ciphertext_map = alloc_ciphertext(vm, key, iv, plaintext_refs.clone(), &records)?;
+
+        let mut ciphertexts = Vec::new();
+        for (range, chunk) in ciphertext_map.iter() {
+            ciphertexts.push((
+                &ciphertext[range],
+                vm.decode(*chunk).map_err(PlaintextAuthError::vm)?,
+            ));
+        }
+
+        PlaintextProof(ProofInner::WithZk { ciphertexts })
+    };
+
+    Ok((plaintext_refs, plaintext_proof))
+}
+
+fn alloc_plaintext(
+    vm: &mut dyn Vm<Binary>,
+    ranges: &RangeSet<usize>,
+) -> Result<ReferenceMap, PlaintextAuthError> {
+    let len = ranges.len();
+
+    if len == 0 {
+        return Ok(ReferenceMap::default());
+    }
+
+    let plaintext = vm.alloc_vec::<U8>(len).map_err(PlaintextAuthError::vm)?;
+
+    let mut pos = 0;
+    Ok(ReferenceMap::from_iter(ranges.iter_ranges().map(
+        move |range| {
+            let chunk = plaintext
+                .get(pos..pos + range.len())
+                .expect("length was checked");
+            pos += range.len();
+            (range.start, chunk)
+        },
+    )))
+}
+
+fn alloc_ciphertext<'a>(
+    vm: &mut dyn Vm<Binary>,
+    key: Array<U8, 16>,
+    iv: Array<U8, 4>,
+    plaintext: ReferenceMap,
+    records: impl IntoIterator<Item = &'a RecordParams>,
+) -> Result<ReferenceMap, PlaintextAuthError> {
+    if plaintext.is_empty() {
+        return Ok(ReferenceMap::default());
+    }
+
+    let ranges = RangeSet::from(plaintext.keys().collect::<Vec<_>>());
+
+    let keystream = alloc_keystream(vm, key, iv, &ranges, records)?;
+    let mut builder = Call::builder(Arc::new(xor(ranges.len() * 8)));
+    for (_, slice) in plaintext.iter() {
+        builder = builder.arg(*slice);
+    }
+    for slice in keystream {
+        builder = builder.arg(slice);
+    }
+    let call = builder.build().expect("call should be valid");
+
+    let ciphertext: Vector<U8> = vm.call(call).map_err(PlaintextAuthError::vm)?;
+
+    let mut pos = 0;
+    Ok(ReferenceMap::from_iter(ranges.iter_ranges().map(
+        move |range| {
+            let chunk = ciphertext
+                .get(pos..pos + range.len())
+                .expect("length was checked");
+            pos += range.len();
+            (range.start, chunk)
+        },
+    )))
+}
+
+fn alloc_keystream<'a>(
+    vm: &mut dyn Vm<Binary>,
+    key: Array<U8, 16>,
+    iv: Array<U8, 4>,
+    ranges: &RangeSet<usize>,
+    records: impl IntoIterator<Item = &'a RecordParams>,
+) -> Result<Vec<Vector<U8>>, PlaintextAuthError> {
+    let mut keystream = Vec::new();
+
+    let mut pos = 0;
+    let mut range_iter = ranges.iter_ranges();
+    let mut current_range = range_iter.next();
+    for record in records {
+        let mut explicit_nonce = None;
+        let mut current_block = None;
+        loop {
+            let Some(range) = current_range.take().or_else(|| range_iter.next()) else {
+                return Ok(keystream);
+            };
+
+            let record_range = pos..pos + record.len;
+            if range.start >= record_range.end {
+                current_range = Some(range);
+                break;
+            }
+
+            // Range with record offset applied.
+            let offset_range = range.start - pos..range.end - pos;
+
+            let explicit_nonce = if let Some(explicit_nonce) = explicit_nonce {
+                explicit_nonce
+            } else {
+                let nonce = alloc_explicit_nonce(vm, record.explicit_nonce.clone())?;
+                explicit_nonce = Some(nonce);
+                nonce
+            };
+
+            const BLOCK_SIZE: usize = 16;
+            let block_num = offset_range.start / BLOCK_SIZE;
+            let block = if let Some((current_block_num, block)) = current_block.take()
+                && current_block_num == block_num
+            {
+                block
+            } else {
+                let block = alloc_block(vm, key, iv, explicit_nonce, block_num)?;
+                current_block = Some((block_num, block));
+                block
+            };
+
+            // Range within the block.
+            let block_range_start = offset_range.start % BLOCK_SIZE;
+            let len =
+                (range.end.min(record_range.end) - range.start).min(BLOCK_SIZE - block_range_start);
+            let block_range = block_range_start..block_range_start + len;
+
+            keystream.push(block.get(block_range).expect("range is checked"));
+
+            // If the range extends past the block, process the tail.
+            if range.start + len < range.end {
+                current_range = Some(range.start + len..range.end);
+            }
+        }
+
+        pos += record.len;
+    }
+
+    Err(ErrorRepr::OutOfBounds.into())
+}
+
+fn alloc_explicit_nonce(
+    vm: &mut dyn Vm<Binary>,
+    explicit_nonce: Vec<u8>,
+) -> Result<Vector<U8>, PlaintextAuthError> {
+    const EXPLICIT_NONCE_LEN: usize = 8;
+    let nonce = vm
+        .alloc_vec::<U8>(EXPLICIT_NONCE_LEN)
+        .map_err(PlaintextAuthError::vm)?;
+    vm.mark_public(nonce).map_err(PlaintextAuthError::vm)?;
+    vm.assign(nonce, explicit_nonce)
+        .map_err(PlaintextAuthError::vm)?;
+    vm.commit(nonce).map_err(PlaintextAuthError::vm)?;
+
+    Ok(nonce)
+}
+
+fn alloc_block(
+    vm: &mut dyn Vm<Binary>,
+    key: Array<U8, 16>,
+    iv: Array<U8, 4>,
+    explicit_nonce: Vector<U8>,
+    block: usize,
+) -> Result<Vector<U8>, PlaintextAuthError> {
+    let ctr: Array<U8, 4> = vm.alloc().map_err(PlaintextAuthError::vm)?;
+    vm.mark_public(ctr).map_err(PlaintextAuthError::vm)?;
+    const START_CTR: u32 = 2;
+    vm.assign(ctr, (START_CTR + block as u32).to_be_bytes())
+        .map_err(PlaintextAuthError::vm)?;
+    vm.commit(ctr).map_err(PlaintextAuthError::vm)?;
+
+    let block: Array<U8, 16> = vm
+        .call(
+            Call::builder(AES128.clone())
+                .arg(key)
+                .arg(iv)
+                .arg(explicit_nonce)
+                .arg(ctr)
+                .build()
+                .expect("call should be valid"),
+        )
+        .map_err(PlaintextAuthError::vm)?;
+
+    Ok(Vector::from(block))
+}
+
+struct RecordParams {
+    explicit_nonce: Vec<u8>,
+    len: usize,
+}
+
+impl RecordParams {
+    fn from_iter<'a>(records: impl IntoIterator<Item = &'a Record>) -> impl Iterator<Item = Self> {
+        records.into_iter().map(|record| Self {
+            explicit_nonce: record.explicit_nonce.clone(),
+            len: record.ciphertext.len(),
+        })
+    }
+}
+
+#[must_use]
+pub(crate) struct PlaintextProof<'a>(ProofInner<'a>);
+
+impl<'a> PlaintextProof<'a> {
+    pub(crate) fn verify(self) -> Result<(), PlaintextAuthError> {
+        match self.0 {
+            ProofInner::WithKey {
+                mut key,
+                mut iv,
+                records,
+                plaintext,
+                ciphertext,
+            } => {
+                let key = key
+                    .try_recv()
+                    .map_err(PlaintextAuthError::vm)?
+                    .ok_or(ErrorRepr::MissingDecoding)?;
+                let iv = iv
+                    .try_recv()
+                    .map_err(PlaintextAuthError::vm)?
+                    .ok_or(ErrorRepr::MissingDecoding)?;
+
+                verify_plaintext_with_key(key, iv, &records, plaintext, ciphertext)?;
+            }
+            ProofInner::WithZk { ciphertexts } => {
+                for (expected, mut actual) in ciphertexts {
+                    let actual = actual
+                        .try_recv()
+                        .map_err(PlaintextAuthError::vm)?
+                        .ok_or(PlaintextAuthError(ErrorRepr::MissingDecoding))?;
+
+                    if actual != expected {
+                        return Err(PlaintextAuthError(ErrorRepr::InvalidPlaintext));
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+}
+
+enum ProofInner<'a> {
+    WithKey {
+        key: DecodeFutureTyped<BitVec, [u8; 16]>,
+        iv: DecodeFutureTyped<BitVec, [u8; 4]>,
+        records: Vec<RecordParams>,
+        plaintext: &'a [u8],
+        ciphertext: &'a [u8],
+    },
+    WithZk {
+        // (expected, actual)
+        #[allow(clippy::type_complexity)]
+        ciphertexts: Vec<(&'a [u8], DecodeFutureTyped<BitVec, Vec<u8>>)>,
+    },
+}
+
+fn aes_ctr_apply_keystream(key: &[u8; 16], iv: &[u8; 4], explicit_nonce: &[u8], input: &mut [u8]) {
+    let mut full_iv = [0u8; 16];
+    full_iv[0..4].copy_from_slice(iv);
+    full_iv[4..12].copy_from_slice(&explicit_nonce[..8]);
+
+    const START_CTR: u32 = 2;
+    let mut cipher = Ctr32BE::<Aes128>::new(key.into(), &full_iv.into());
+    cipher
+        .try_seek(START_CTR * 16)
+        .expect("start counter is less than keystream length");
+    cipher.apply_keystream(input);
+}
+
+fn verify_plaintext_with_key<'a>(
+    key: [u8; 16],
+    iv: [u8; 4],
+    records: impl IntoIterator<Item = &'a RecordParams>,
+    plaintext: &[u8],
+    ciphertext: &[u8],
+) -> Result<(), PlaintextAuthError> {
+    let mut pos = 0;
+    let mut text = Vec::new();
+    for record in records {
+        text.clear();
+        text.extend_from_slice(&plaintext[pos..pos + record.len]);
+
+        aes_ctr_apply_keystream(&key, &iv, &record.explicit_nonce, &mut text);
+
+        if text != ciphertext[pos..pos + record.len] {
+            return Err(PlaintextAuthError(ErrorRepr::InvalidPlaintext));
+        }
+
+        pos += record.len;
+    }
+
+    Ok(())
+}
+
+#[derive(Debug, thiserror::Error)]
+#[error("plaintext authentication error: {0}")]
+pub(crate) struct PlaintextAuthError(#[from] ErrorRepr);
+
+impl PlaintextAuthError {
+    fn vm<E>(err: E) -> Self
+    where
+        E: Into<Box<dyn std::error::Error + Send + Sync + 'static>>,
+    {
+        Self(ErrorRepr::Vm(err.into()))
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+enum ErrorRepr {
+    #[error("vm error: {0}")]
+    Vm(Box<dyn std::error::Error + Send + Sync + 'static>),
+    #[error("plaintext out of bounds of records. This should never happen and is an internal bug.")]
+    OutOfBounds,
+    #[error("missing decoding")]
+    MissingDecoding,
+    #[error("plaintext does not match ciphertext")]
+    InvalidPlaintext,
+}
+
+#[cfg(test)]
+#[allow(clippy::all)]
+mod tests {
+    use super::*;
+    use mpz_common::context::test_st_context;
+    use mpz_ideal_vm::IdealVm;
+    use mpz_vm_core::prelude::*;
+    use rand::{Rng, SeedableRng, rngs::StdRng};
+    use rstest::*;
+    use std::ops::Range;
+
+    fn build_vm(key: [u8; 16], iv: [u8; 4]) -> (IdealVm, Array<U8, 16>, Array<U8, 4>) {
+        let mut vm = IdealVm::new();
+        let key_ref = vm.alloc::<Array<U8, 16>>().unwrap();
+        let iv_ref = vm.alloc::<Array<U8, 4>>().unwrap();
+
+        vm.mark_public(key_ref).unwrap();
+        vm.mark_public(iv_ref).unwrap();
+        vm.assign(key_ref, key).unwrap();
+        vm.assign(iv_ref, iv).unwrap();
+        vm.commit(key_ref).unwrap();
+        vm.commit(iv_ref).unwrap();
+
+        (vm, key_ref, iv_ref)
+    }
+
+    fn expected_aes_ctr<'a>(
+        key: [u8; 16],
+        iv: [u8; 4],
+        records: impl IntoIterator<Item = &'a RecordParams>,
+        ranges: &RangeSet<usize>,
+    ) -> Vec<u8> {
+        let mut keystream = Vec::new();
+        let mut pos = 0;
+        for record in records {
+            let mut record_keystream = vec![0u8; record.len];
+            aes_ctr_apply_keystream(&key, &iv, &record.explicit_nonce, &mut record_keystream);
+            for mut range in ranges.iter_ranges() {
+                range.start = range.start.max(pos);
+                range.end = range.end.min(pos + record.len);
+                if range.start < range.end {
+                    keystream
+                        .extend_from_slice(&record_keystream[range.start - pos..range.end - pos]);
+                }
+            }
+            pos += record.len;
+        }
+
+        keystream
+    }
+
+    #[rstest]
+    #[case::single_record_empty([0], [])]
+    #[case::multiple_empty_records_empty([0, 0], [])]
+    #[case::multiple_records_empty([128, 64], [])]
+    #[case::single_block_full([16], [0..16])]
+    #[case::single_block_partial([16], [2..14])]
+    #[case::partial_block_full([15], [0..15])]
+    #[case::out_of_bounds([16], [0..17])]
+    #[case::multiple_records_full([128, 63, 33, 15, 4], [0..243])]
+    #[case::multiple_records_partial([128, 63, 33, 15, 4], [1..15, 16..17, 18..19, 126..130, 224..225, 242..243])]
+    #[tokio::test]
+    async fn test_alloc_keystream(
+        #[case] record_lens: impl IntoIterator<Item = usize>,
+        #[case] ranges: impl IntoIterator<Item = Range<usize>>,
+    ) {
+        let mut rng = StdRng::seed_from_u64(0);
+        let mut key = [0u8; 16];
+        let mut iv = [0u8; 4];
+        rng.fill(&mut key);
+        rng.fill(&mut iv);
+
+        let mut total_len = 0;
+        let records = record_lens
+            .into_iter()
+            .map(|len| {
+                let mut explicit_nonce = [0u8; 8];
+                rng.fill(&mut explicit_nonce);
+                total_len += len;
+                RecordParams {
+                    explicit_nonce: explicit_nonce.to_vec(),
+                    len,
+                }
+            })
+            .collect::<Vec<_>>();
+
+        let ranges = RangeSet::from(ranges.into_iter().collect::<Vec<_>>());
+        let is_out_of_bounds = ranges.end().unwrap_or(0) > total_len;
+
+        let (mut ctx, _) = test_st_context(1024);
+        let (mut vm, key_ref, iv_ref) = build_vm(key, iv);
+
+        let keystream = match alloc_keystream(&mut vm, key_ref, iv_ref, &ranges, &records) {
+            Ok(_) if is_out_of_bounds => panic!("should be out of bounds"),
+            Ok(keystream) => keystream,
+            Err(PlaintextAuthError(ErrorRepr::OutOfBounds)) if is_out_of_bounds => {
+                return;
+            }
+            Err(e) => panic!("unexpected error: {:?}", e),
+        };
+
+        vm.execute(&mut ctx).await.unwrap();
+
+        let keystream: Vec<u8> = keystream
+            .iter()
+            .flat_map(|slice| vm.get(*slice).unwrap().unwrap())
+            .collect();
+
+        assert_eq!(keystream.len(), ranges.len());
+
+        let expected = expected_aes_ctr(key, iv, &records, &ranges);
+
+        assert_eq!(keystream, expected);
+    }
+
+    #[rstest]
+    #[case::single_record_empty([0])]
+    #[case::single_record([32])]
+    #[case::multiple_records([128, 63, 33, 15, 4])]
+    #[case::multiple_records_with_empty([128, 63, 33, 0, 15, 4])]
+    fn test_verify_plaintext_with_key(
+        #[case] record_lens: impl IntoIterator<Item = usize>,
+        #[values(false, true)] tamper: bool,
+    ) {
+        let mut rng = StdRng::seed_from_u64(0);
+        let mut key = [0u8; 16];
+        let mut iv = [0u8; 4];
+        rng.fill(&mut key);
+        rng.fill(&mut iv);
+
+        let mut total_len = 0;
+        let records = record_lens
+            .into_iter()
+            .map(|len| {
+                let mut explicit_nonce = [0u8; 8];
+                rng.fill(&mut explicit_nonce);
+                total_len += len;
+                RecordParams {
+                    explicit_nonce: explicit_nonce.to_vec(),
+                    len,
+                }
+            })
+            .collect::<Vec<_>>();
+
+        let mut plaintext = vec![0u8; total_len];
+        rng.fill(plaintext.as_mut_slice());
+
+        let mut ciphertext = plaintext.clone();
+        expected_aes_ctr(key, iv, &records, &(0..total_len).into())
+            .iter()
+            .zip(ciphertext.iter_mut())
+            .for_each(|(key, pt)| {
+                *pt ^= *key;
+            });
+
+        if tamper {
+            plaintext.first_mut().map(|pt| *pt ^= 1);
+        }
+
+        match verify_plaintext_with_key(key, iv, &records, &plaintext, &ciphertext) {
+            Ok(_) if tamper && !plaintext.is_empty() => panic!("should be invalid"),
+            Err(e) if !tamper => panic!("unexpected error: {:?}", e),
+            _ => {}
+        }
+    }
+}

crates/tlsn/src/transcript_internal/commit.rs

@@ -0,0 +1,4 @@
+//! Plaintext commitment and proof of encryption.
+
+pub(crate) mod encoding;
+pub(crate) mod hash;

crates/tlsn/src/transcript_internal/commit/encoding.rs

@@ -0,0 +1,283 @@
+//! Encoding commitment protocol.
+
+use std::ops::Range;
+
+use mpz_common::Context;
+use mpz_memory_core::{
+    Vector,
+    binary::U8,
+    correlated::{Delta, Key, Mac},
+};
+use rand::Rng;
+use rangeset::RangeSet;
+use serde::{Deserialize, Serialize};
+use serio::{SinkExt, stream::IoStreamExt};
+use tlsn_core::{
+    hash::{Blake3, HashAlgId, HashAlgorithm, Keccak256, Sha256},
+    transcript::{
+        Direction,
+        encoding::{
+            Encoder, EncoderSecret, EncodingCommitment, EncodingProvider, EncodingProviderError,
+            EncodingTree, EncodingTreeError, new_encoder,
+        },
+    },
+};
+
+use crate::{
+    map::{Item, RangeMap},
+    transcript_internal::ReferenceMap,
+};
+
+/// Bytes of encoding, per byte.
+const ENCODING_SIZE: usize = 128;
+
+#[derive(Debug, Serialize, Deserialize)]
+struct Encodings {
+    sent: Vec<u8>,
+    recv: Vec<u8>,
+}
+
+/// Transfers encodings for the provided plaintext ranges.
+pub(crate) async fn transfer<K: KeyStore>(
+    ctx: &mut Context,
+    store: &K,
+    sent: &ReferenceMap,
+    recv: &ReferenceMap,
+) -> Result<(EncoderSecret, EncodingCommitment), EncodingError> {
+    let secret = EncoderSecret::new(rand::rng().random(), store.delta().as_block().to_bytes());
+    let encoder = new_encoder(&secret);
+
+    // Collects the encodings for the provided plaintext ranges.
+    fn collect_encodings(
+        encoder: &impl Encoder,
+        store: &impl KeyStore,
+        direction: Direction,
+        map: &ReferenceMap,
+    ) -> Vec<u8> {
+        let mut encodings = Vec::with_capacity(map.len() * ENCODING_SIZE);
+        for (range, chunk) in map.iter() {
+            let start = encodings.len();
+            encoder.encode_range(direction, range, &mut encodings);
+            let keys = store
+                .get_keys(*chunk)
+                .expect("keys are present for provided plaintext ranges");
+            encodings[start..]
+                .iter_mut()
+                .zip(keys.iter().flat_map(|key| key.as_block().as_bytes()))
+                .for_each(|(encoding, key)| {
+                    *encoding ^= *key;
+                });
+        }
+        encodings
+    }
+
+    let encodings = Encodings {
+        sent: collect_encodings(&encoder, store, Direction::Sent, sent),
+        recv: collect_encodings(&encoder, store, Direction::Received, recv),
+    };
+
+    let frame_limit = ctx
+        .io()
+        .limit()
+        .saturating_add(encodings.sent.len() + encodings.recv.len());
+    ctx.io_mut().with_limit(frame_limit).send(encodings).await?;
+
+    let root = ctx.io_mut().expect_next().await?;
+
+    Ok((secret, EncodingCommitment { root }))
+}
+
+/// Receives and commits to the encodings for the provided plaintext ranges.
+pub(crate) async fn receive<M: MacStore>(
+    ctx: &mut Context,
+    store: &M,
+    hash_alg: HashAlgId,
+    sent: &ReferenceMap,
+    recv: &ReferenceMap,
+    idxs: impl IntoIterator<Item = &(Direction, RangeSet<usize>)>,
+) -> Result<(EncodingCommitment, EncodingTree), EncodingError> {
+    let hasher: &(dyn HashAlgorithm + Send + Sync) = match hash_alg {
+        HashAlgId::SHA256 => &Sha256::default(),
+        HashAlgId::KECCAK256 => &Keccak256::default(),
+        HashAlgId::BLAKE3 => &Blake3::default(),
+        alg => {
+            return Err(ErrorRepr::UnsupportedHashAlgorithm(alg).into());
+        }
+    };
+
+    let (sent_len, recv_len) = (sent.len(), recv.len());
+    let frame_limit = ctx
+        .io()
+        .limit()
+        .saturating_add(ENCODING_SIZE * (sent_len + recv_len));
+    let encodings: Encodings = ctx.io_mut().with_limit(frame_limit).expect_next().await?;
+
+    if encodings.sent.len() != sent_len * ENCODING_SIZE {
+        return Err(ErrorRepr::IncorrectMacCount {
+            direction: Direction::Sent,
+            expected: sent_len,
+            got: encodings.sent.len() / ENCODING_SIZE,
+        }
+        .into());
+    }
+
+    if encodings.recv.len() != recv_len * ENCODING_SIZE {
+        return Err(ErrorRepr::IncorrectMacCount {
+            direction: Direction::Received,
+            expected: recv_len,
+            got: encodings.recv.len() / ENCODING_SIZE,
+        }
+        .into());
+    }
+
+    // Collects a map of plaintext ranges to their encodings.
+    fn collect_map(
+        store: &impl MacStore,
+        mut encodings: Vec<u8>,
+        map: &ReferenceMap,
+    ) -> RangeMap<EncodingSlice> {
+        let mut encoding_map = Vec::new();
+        let mut pos = 0;
+        for (range, chunk) in map.iter() {
+            let macs = store
+                .get_macs(*chunk)
+                .expect("MACs are present for provided plaintext ranges");
+            let encoding = &mut encodings[pos..pos + range.len() * ENCODING_SIZE];
+            encoding
+                .iter_mut()
+                .zip(macs.iter().flat_map(|mac| mac.as_bytes()))
+                .for_each(|(encoding, mac)| {
+                    *encoding ^= *mac;
+                });
+
+            encoding_map.push((range.start, EncodingSlice::from(&(*encoding))));
+            pos += range.len() * ENCODING_SIZE;
+        }
+        RangeMap::new(encoding_map)
+    }
+
+    let provider = Provider {
+        sent: collect_map(store, encodings.sent, sent),
+        recv: collect_map(store, encodings.recv, recv),
+    };
+
+    let tree = EncodingTree::new(hasher, idxs, &provider)?;
+    let root = tree.root();
+
+    ctx.io_mut().send(root.clone()).await?;
+
+    let commitment = EncodingCommitment { root };
+
+    Ok((commitment, tree))
+}
+
+pub(crate) trait KeyStore {
+    fn delta(&self) -> &Delta;
+
+    fn get_keys(&self, data: Vector<U8>) -> Option<&[Key]>;
+}
+
+impl KeyStore for crate::verifier::Zk {
+    fn delta(&self) -> &Delta {
+        crate::verifier::Zk::delta(self)
+    }
+
+    fn get_keys(&self, data: Vector<U8>) -> Option<&[Key]> {
+        self.get_keys(data).ok()
+    }
+}
+
+pub(crate) trait MacStore {
+    fn get_macs(&self, data: Vector<U8>) -> Option<&[Mac]>;
+}
+
+impl MacStore for crate::prover::Zk {
+    fn get_macs(&self, data: Vector<U8>) -> Option<&[Mac]> {
+        self.get_macs(data).ok()
+    }
+}
+
+#[derive(Debug)]
+struct Provider {
+    sent: RangeMap<EncodingSlice>,
+    recv: RangeMap<EncodingSlice>,
+}
+
+impl EncodingProvider for Provider {
+    fn provide_encoding(
+        &self,
+        direction: Direction,
+        range: Range<usize>,
+        dest: &mut Vec<u8>,
+    ) -> Result<(), EncodingProviderError> {
+        let encodings = match direction {
+            Direction::Sent => &self.sent,
+            Direction::Received => &self.recv,
+        };
+
+        let encoding = encodings.get(range).ok_or(EncodingProviderError)?;
+
+        dest.extend_from_slice(encoding);
+
+        Ok(())
+    }
+}
+
+#[derive(Debug)]
+struct EncodingSlice(Vec<u8>);
+
+impl From<&[u8]> for EncodingSlice {
+    fn from(value: &[u8]) -> Self {
+        Self(value.to_vec())
+    }
+}
+
+impl Item for EncodingSlice {
+    type Slice<'a>
+        = &'a [u8]
+    where
+        Self: 'a;
+
+    fn length(&self) -> usize {
+        self.0.len() / ENCODING_SIZE
+    }
+
+    fn slice<'a>(&'a self, range: Range<usize>) -> Option<Self::Slice<'a>> {
+        self.0
+            .get(range.start * ENCODING_SIZE..range.end * ENCODING_SIZE)
+    }
+}
+
+/// Encoding protocol error.
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct EncodingError(#[from] ErrorRepr);
+
+#[derive(Debug, thiserror::Error)]
+#[error("encoding protocol error: {0}")]
+enum ErrorRepr {
+    #[error("I/O error: {0}")]
+    Io(std::io::Error),
+    #[error("incorrect MAC count for {direction}: expected {expected}, got {got}")]
+    IncorrectMacCount {
+        direction: Direction,
+        expected: usize,
+        got: usize,
+    },
+    #[error("encoding tree error: {0}")]
+    EncodingTree(EncodingTreeError),
+    #[error("unsupported hash algorithm: {0}")]
+    UnsupportedHashAlgorithm(HashAlgId),
+}
+
+impl From<std::io::Error> for EncodingError {
+    fn from(value: std::io::Error) -> Self {
+        Self(ErrorRepr::Io(value))
+    }
+}
+
+impl From<EncodingTreeError> for EncodingError {
+    fn from(value: EncodingTreeError) -> Self {
+        Self(ErrorRepr::EncodingTree(value))
+    }
+}

crates/tlsn/src/transcript_internal/commit/hash.rs

@@ -3,21 +3,22 @@
 use std::collections::HashMap;
 
 use mpz_core::bitvec::BitVec;
-use mpz_hash::sha256::Sha256;
+use mpz_hash::{blake3::Blake3, sha256::Sha256};
 use mpz_memory_core::{
     DecodeFutureTyped, MemoryExt, Vector,
     binary::{Binary, U8},
 };
 use mpz_vm_core::{Vm, VmError, prelude::*};
+use rangeset::RangeSet;
 use tlsn_core::{
     hash::{Blinder, Hash, HashAlgId, TypedHash},
     transcript::{
-        Direction, Idx,
+        Direction,
         hash::{PlaintextHash, PlaintextHashSecret},
     },
 };
 
-use crate::{Role, commit::transcript::TranscriptRefs};
+use crate::{Role, transcript_internal::TranscriptRefs};
 
 /// Future which will resolve to the committed hash values.
 #[derive(Debug)]
@@ -26,7 +27,7 @@ pub(crate) struct HashCommitFuture {
     #[allow(clippy::type_complexity)]
     futs: Vec<(
         Direction,
-        Idx,
+        RangeSet<usize>,
         HashAlgId,
         DecodeFutureTyped<BitVec, Vec<u8>>,
     )>,
@@ -60,7 +61,7 @@ impl HashCommitFuture {
 pub(crate) fn prove_hash(
     vm: &mut dyn Vm<Binary>,
     refs: &TranscriptRefs,
-    idxs: impl IntoIterator<Item = (Direction, Idx, HashAlgId)>,
+    idxs: impl IntoIterator<Item = (Direction, RangeSet<usize>, HashAlgId)>,
 ) -> Result<(HashCommitFuture, Vec<PlaintextHashSecret>), HashCommitError> {
     let mut futs = Vec::new();
     let mut secrets = Vec::new();
@@ -90,7 +91,7 @@ pub(crate) fn prove_hash(
 pub(crate) fn verify_hash(
     vm: &mut dyn Vm<Binary>,
     refs: &TranscriptRefs,
-    idxs: impl IntoIterator<Item = (Direction, Idx, HashAlgId)>,
+    idxs: impl IntoIterator<Item = (Direction, RangeSet<usize>, HashAlgId)>,
 ) -> Result<HashCommitFuture, HashCommitError> {
     let mut futs = Vec::new();
     for (direction, idx, alg, hash_ref, blinder_ref) in
@@ -106,14 +107,29 @@ pub(crate) fn verify_hash(
     Ok(HashCommitFuture { futs })
 }
 
+#[derive(Clone)]
+enum Hasher {
+    Sha256(Sha256),
+    Blake3(Blake3),
+}
+
 /// Commit plaintext hashes of the transcript.
 #[allow(clippy::type_complexity)]
 fn hash_commit_inner(
     vm: &mut dyn Vm<Binary>,
     role: Role,
     refs: &TranscriptRefs,
-    idxs: impl IntoIterator<Item = (Direction, Idx, HashAlgId)>,
-) -> Result<Vec<(Direction, Idx, HashAlgId, Array<U8, 32>, Vector<U8>)>, HashCommitError> {
+    idxs: impl IntoIterator<Item = (Direction, RangeSet<usize>, HashAlgId)>,
+) -> Result<
+    Vec<(
+        Direction,
+        RangeSet<usize>,
+        HashAlgId,
+        Array<U8, 32>,
+        Vector<U8>,
+    )>,
+    HashCommitError,
+> {
     let mut output = Vec::new();
     let mut hashers = HashMap::new();
     for (direction, idx, alg) in idxs {
@@ -125,20 +141,50 @@ fn hash_commit_inner(
 
         let hash = match alg {
             HashAlgId::SHA256 => {
-                let mut hasher = if let Some(hasher) = hashers.get(&alg).cloned() {
+                let mut hasher = if let Some(Hasher::Sha256(hasher)) = hashers.get(&alg).cloned() {
                     hasher
                 } else {
                     let hasher = Sha256::new_with_init(vm).map_err(HashCommitError::hasher)?;
-                    hashers.insert(alg, hasher.clone());
+                    hashers.insert(alg, Hasher::Sha256(hasher.clone()));
                     hasher
                 };
 
-                for plaintext in refs.get(direction, &idx).expect("plaintext refs are valid") {
-                    hasher.update(&plaintext);
+                let refs = match direction {
+                    Direction::Sent => &refs.sent,
+                    Direction::Received => &refs.recv,
+                };
+
+                for range in idx.iter_ranges() {
+                    hasher.update(&refs.get(range).expect("plaintext refs are valid"));
                 }
+
                 hasher.update(&blinder);
                 hasher.finalize(vm).map_err(HashCommitError::hasher)?
             }
+            HashAlgId::BLAKE3 => {
+                let mut hasher = if let Some(Hasher::Blake3(hasher)) = hashers.get(&alg).cloned() {
+                    hasher
+                } else {
+                    let hasher = Blake3::new(vm).map_err(HashCommitError::hasher)?;
+                    hashers.insert(alg, Hasher::Blake3(hasher.clone()));
+                    hasher
+                };
+
+                let refs = match direction {
+                    Direction::Sent => &refs.sent,
+                    Direction::Received => &refs.recv,
+                };
+
+                for range in idx.iter_ranges() {
+                    hasher
+                        .update(vm, &refs.get(range).expect("plaintext refs are valid"))
+                        .map_err(HashCommitError::hasher)?;
+                }
+                hasher
+                    .update(vm, &blinder)
+                    .map_err(HashCommitError::hasher)?;
+                hasher.finalize(vm).map_err(HashCommitError::hasher)?
+            }
             alg => {
                 return Err(HashCommitError::unsupported_alg(alg));
             }

crates/tlsn/src/verifier.rs

@@ -3,6 +3,7 @@
 pub(crate) mod config;
 mod error;
 pub mod state;
+mod verify;
 
 use std::sync::Arc;
 
@@ -14,18 +15,7 @@ pub use tlsn_core::{
 };
 
 use crate::{
-    Role,
-    commit::{
-        commit_records,
-        hash::verify_hash,
-        transcript::{TranscriptRefs, decode_transcript, verify_transcript},
-    },
-    config::ProtocolConfig,
-    context::build_mt_context,
-    encoding,
-    mux::attach_mux,
-    tag::verify_tags,
-    zk_aes_ctr::ZkAesCtr,
+    Role, config::ProtocolConfig, context::build_mt_context, mux::attach_mux, tag::verify_tags,
 };
 use futures::{AsyncRead, AsyncWrite, TryFutureExt};
 use mpc_tls::{MpcTlsFollower, SessionKeys};
@@ -35,11 +25,9 @@ use mpz_garble_core::Delta;
 use mpz_vm_core::prelude::*;
 use mpz_zk::VerifierConfig as ZkVerifierConfig;
 use serio::stream::IoStreamExt;
-use tls_core::msgs::enums::ContentType;
 use tlsn_core::{
-    ProvePayload,
     connection::{ConnectionInfo, ServerName},
-    transcript::{TlsTranscript, TranscriptCommitment},
+    transcript::TlsTranscript,
 };
 use tlsn_deap::Deap;
 use tokio::sync::Mutex;
@@ -114,23 +102,12 @@ impl Verifier<state::Initialized> {
             })
             .await?;
 
-        let delta = Delta::random(&mut rand::rng());
-        let (vm, mut mpc_tls) = build_mpc_tls(&self.config, &protocol_config, delta, ctx);
+        let (vm, mut mpc_tls) = build_mpc_tls(&self.config, &protocol_config, ctx);
 
         // Allocate resources for MPC-TLS in the VM.
         let mut keys = mpc_tls.alloc()?;
         let vm_lock = vm.try_lock().expect("VM is not locked");
         translate_keys(&mut keys, &vm_lock)?;
-
-        // Allocate for committing to plaintext.
-        let mut zk_aes_ctr_sent = ZkAesCtr::new(Role::Verifier);
-        zk_aes_ctr_sent.set_key(keys.client_write_key, keys.client_write_iv);
-        zk_aes_ctr_sent.alloc(&mut *vm_lock.zk(), protocol_config.max_sent_data())?;
-
-        let mut zk_aes_ctr_recv = ZkAesCtr::new(Role::Verifier);
-        zk_aes_ctr_recv.set_key(keys.server_write_key, keys.server_write_iv);
-        zk_aes_ctr_recv.alloc(&mut *vm_lock.zk(), protocol_config.max_recv_data())?;
-
         drop(vm_lock);
 
         debug!("setting up mpc-tls");
@@ -145,10 +122,7 @@ impl Verifier<state::Initialized> {
             state: state::Setup {
                 mux_ctrl,
                 mux_fut,
-                delta,
                 mpc_tls,
-                zk_aes_ctr_sent,
-                zk_aes_ctr_recv,
                 keys,
                 vm,
             },
@@ -186,10 +160,7 @@ impl Verifier<state::Setup> {
         let state::Setup {
             mux_ctrl,
             mut mux_fut,
-            delta,
             mpc_tls,
-            mut zk_aes_ctr_sent,
-            mut zk_aes_ctr_recv,
             vm,
             keys,
         } = self.state;
@@ -230,27 +201,6 @@ impl Verifier<state::Setup> {
         )
         .map_err(VerifierError::zk)?;
 
-        // Prepare for the prover to prove received plaintext.
-        let (sent_refs, sent_proof) = commit_records(
-            &mut vm,
-            &mut zk_aes_ctr_sent,
-            tls_transcript
-                .sent()
-                .iter()
-                .filter(|record| record.typ == ContentType::ApplicationData),
-        )
-        .map_err(VerifierError::zk)?;
-
-        let (recv_refs, recv_proof) = commit_records(
-            &mut vm,
-            &mut zk_aes_ctr_recv,
-            tls_transcript
-                .recv()
-                .iter()
-                .filter(|record| record.typ == ContentType::ApplicationData),
-        )
-        .map_err(VerifierError::zk)?;
-
         mux_fut
             .poll_with(vm.execute_all(&mut ctx).map_err(VerifierError::zk))
             .await?;
@@ -260,23 +210,16 @@ impl Verifier<state::Setup> {
         // authenticated from the verifier's perspective.
         tag_proof.verify().map_err(VerifierError::zk)?;
 
-        // Verify the plaintext proofs.
-        sent_proof.verify().map_err(VerifierError::zk)?;
-        recv_proof.verify().map_err(VerifierError::zk)?;
-
-        let transcript_refs = TranscriptRefs::new(sent_refs, recv_refs);
-
         Ok(Verifier {
             config: self.config,
             span: self.span,
             state: state::Committed {
                 mux_ctrl,
                 mux_fut,
-                delta,
                 ctx,
                 vm,
+                keys,
                 tls_transcript,
-                transcript_refs,
             },
         })
     }
@@ -301,130 +244,34 @@ impl Verifier<state::Committed> {
         let state::Committed {
             mux_fut,
             ctx,
-            delta,
             vm,
+            keys,
             tls_transcript,
-            transcript_refs,
             ..
         } = &mut self.state;
 
-        let ProvePayload {
-            handshake,
-            transcript,
-            transcript_commit,
-        } = mux_fut
-            .poll_with(ctx.io_mut().expect_next().map_err(VerifierError::from))
-            .await?;
-
-        let verifier = if let Some(root_store) = self.config.root_store() {
+        let cert_verifier = if let Some(root_store) = self.config.root_store() {
             ServerCertVerifier::new(root_store).map_err(VerifierError::config)?
         } else {
             ServerCertVerifier::mozilla()
         };
 
-        let server_name = if let Some((name, cert_data)) = handshake {
-            cert_data
-                .verify(
-                    &verifier,
-                    tls_transcript.time(),
-                    tls_transcript.server_ephemeral_key(),
-                    &name,
-                )
-                .map_err(VerifierError::verify)?;
-
-            Some(name)
-        } else {
-            None
-        };
-
-        if let Some(partial_transcript) = &transcript {
-            let sent_len = tls_transcript
-                .sent()
-                .iter()
-                .filter_map(|record| {
-                    if let ContentType::ApplicationData = record.typ {
-                        Some(record.ciphertext.len())
-                    } else {
-                        None
-                    }
-                })
-                .sum::<usize>();
-
-            let recv_len = tls_transcript
-                .recv()
-                .iter()
-                .filter_map(|record| {
-                    if let ContentType::ApplicationData = record.typ {
-                        Some(record.ciphertext.len())
-                    } else {
-                        None
-                    }
-                })
-                .sum::<usize>();
-
-            // Check ranges.
-            if partial_transcript.len_sent() != sent_len
-                || partial_transcript.len_received() != recv_len
-            {
-                return Err(VerifierError::verify(
-                    "prover sent transcript with incorrect length",
-                ));
-            }
-
-            decode_transcript(
-                vm,
-                partial_transcript.sent_authed(),
-                partial_transcript.received_authed(),
-                transcript_refs,
-            )
-            .map_err(VerifierError::zk)?;
-        }
-
-        let mut transcript_commitments = Vec::new();
-        let mut hash_commitments = None;
-        if let Some(commit_config) = transcript_commit {
-            if commit_config.encoding() {
-                let commitment = mux_fut
-                    .poll_with(encoding::transfer(
-                        ctx,
-                        transcript_refs,
-                        delta,
-                        |plaintext| vm.get_keys(plaintext).expect("reference is valid"),
-                    ))
-                    .await?;
-
-                transcript_commitments.push(TranscriptCommitment::Encoding(commitment));
-            }
-
-            if commit_config.has_hash() {
-                hash_commitments = Some(
-                    verify_hash(vm, transcript_refs, commit_config.iter_hash().cloned())
-                        .map_err(VerifierError::verify)?,
-                );
-            }
-        }
-
-        mux_fut
-            .poll_with(vm.execute_all(ctx).map_err(VerifierError::zk))
+        let request = mux_fut
+            .poll_with(ctx.io_mut().expect_next().map_err(VerifierError::from))
             .await?;
 
-        // Verify revealed data.
-        if let Some(partial_transcript) = &transcript {
-            verify_transcript(vm, partial_transcript, transcript_refs)
-                .map_err(VerifierError::verify)?;
-        }
+        let output = mux_fut
+            .poll_with(verify::verify(
+                ctx,
+                vm,
+                keys,
+                &cert_verifier,
+                tls_transcript,
+                request,
+            ))
+            .await?;
 
-        if let Some(hash_commitments) = hash_commitments {
-            for commitment in hash_commitments.try_recv().map_err(VerifierError::verify)? {
-                transcript_commitments.push(TranscriptCommitment::Hash(commitment));
-            }
-        }
-
-        Ok(VerifierOutput {
-            server_name,
-            transcript,
-            transcript_commitments,
-        })
+        Ok(output)
     }
 
     /// Closes the connection with the prover.
@@ -447,11 +294,11 @@ impl Verifier<state::Committed> {
 fn build_mpc_tls(
     config: &VerifierConfig,
     protocol_config: &ProtocolConfig,
-    delta: Delta,
     ctx: Context,
 ) -> (Arc<Mutex<Deap<Mpc, Zk>>>, MpcTlsFollower) {
     let mut rng = rand::rng();
 
+    let delta = Delta::random(&mut rng);
     let base_ot_send = mpz_ot::chou_orlandi::Sender::default();
     let base_ot_recv = mpz_ot::chou_orlandi::Receiver::default();
     let rcot_send = mpz_ot::kos::Sender::new(

crates/tlsn/src/verifier/config.rs

@@ -12,7 +12,7 @@ use crate::config::{NetworkSetting, ProtocolConfig, ProtocolConfigValidator};
 #[builder(pattern = "owned")]
 pub struct VerifierConfig {
     protocol_config_validator: ProtocolConfigValidator,
-    #[builder(setter(strip_option))]
+    #[builder(default, setter(strip_option))]
     root_store: Option<RootCertStore>,
 }
 

crates/tlsn/src/verifier/error.rs

@@ -1,7 +1,9 @@
-use crate::{encoding::EncodingError, zk_aes_ctr::ZkAesCtrError};
-use mpc_tls::MpcTlsError;
 use std::{error::Error, fmt};
 
+use mpc_tls::MpcTlsError;
+
+use crate::transcript_internal::commit::encoding::EncodingError;
+
 /// Error for [`Verifier`](crate::Verifier).
 #[derive(Debug, thiserror::Error)]
 pub struct VerifierError {
@@ -110,12 +112,6 @@ impl From<MpcTlsError> for VerifierError {
     }
 }
 
-impl From<ZkAesCtrError> for VerifierError {
-    fn from(e: ZkAesCtrError) -> Self {
-        Self::new(ErrorKind::Zk, e)
-    }
-}
-
 impl From<EncodingError> for VerifierError {
     fn from(e: EncodingError) -> Self {
         Self::new(ErrorKind::Commit, e)

crates/tlsn/src/verifier/state.rs

@@ -2,14 +2,9 @@
 
 use std::sync::Arc;
 
-use crate::{
-    commit::transcript::TranscriptRefs,
-    mux::{MuxControl, MuxFuture},
-    zk_aes_ctr::ZkAesCtr,
-};
+use crate::mux::{MuxControl, MuxFuture};
 use mpc_tls::{MpcTlsFollower, SessionKeys};
 use mpz_common::Context;
-use mpz_memory_core::correlated::Delta;
 use tlsn_core::transcript::TlsTranscript;
 use tlsn_deap::Deap;
 use tokio::sync::Mutex;
@@ -28,10 +23,7 @@ opaque_debug::implement!(Initialized);
 pub struct Setup {
     pub(crate) mux_ctrl: MuxControl,
     pub(crate) mux_fut: MuxFuture,
-    pub(crate) delta: Delta,
     pub(crate) mpc_tls: MpcTlsFollower,
-    pub(crate) zk_aes_ctr_sent: ZkAesCtr,
-    pub(crate) zk_aes_ctr_recv: ZkAesCtr,
     pub(crate) keys: SessionKeys,
     pub(crate) vm: Arc<Mutex<Deap<Mpc, Zk>>>,
 }
@@ -40,11 +32,10 @@ pub struct Setup {
 pub struct Committed {
     pub(crate) mux_ctrl: MuxControl,
     pub(crate) mux_fut: MuxFuture,
-    pub(crate) delta: Delta,
     pub(crate) ctx: Context,
     pub(crate) vm: Zk,
+    pub(crate) keys: SessionKeys,
     pub(crate) tls_transcript: TlsTranscript,
-    pub(crate) transcript_refs: TranscriptRefs,
 }
 
 opaque_debug::implement!(Committed);

crates/tlsn/src/verifier/verify.rs

@@ -0,0 +1,179 @@
+use mpc_tls::SessionKeys;
+use mpz_common::Context;
+use mpz_memory_core::binary::Binary;
+use mpz_vm_core::Vm;
+use rangeset::{RangeSet, UnionMut};
+use tlsn_core::{
+    ProveRequest, VerifierOutput,
+    transcript::{
+        ContentType, Direction, PartialTranscript, Record, TlsTranscript, TranscriptCommitment,
+    },
+    webpki::ServerCertVerifier,
+};
+
+use crate::{
+    transcript_internal::{
+        TranscriptRefs,
+        auth::verify_plaintext,
+        commit::{
+            encoding::{self, KeyStore},
+            hash::verify_hash,
+        },
+    },
+    verifier::VerifierError,
+};
+
+pub(crate) async fn verify<T: Vm<Binary> + KeyStore + Send + Sync>(
+    ctx: &mut Context,
+    vm: &mut T,
+    keys: &SessionKeys,
+    cert_verifier: &ServerCertVerifier,
+    tls_transcript: &TlsTranscript,
+    request: ProveRequest,
+) -> Result<VerifierOutput, VerifierError> {
+    let ProveRequest {
+        handshake,
+        transcript,
+        transcript_commit,
+    } = request;
+
+    let ciphertext_sent = collect_ciphertext(tls_transcript.sent());
+    let ciphertext_recv = collect_ciphertext(tls_transcript.recv());
+
+    let has_reveal = transcript.is_some();
+    let transcript = if let Some(transcript) = transcript {
+        if transcript.len_sent() != ciphertext_sent.len()
+            || transcript.len_received() != ciphertext_recv.len()
+        {
+            return Err(VerifierError::verify(
+                "prover sent transcript with incorrect length",
+            ));
+        }
+
+        transcript
+    } else {
+        PartialTranscript::new(ciphertext_sent.len(), ciphertext_recv.len())
+    };
+
+    let server_name = if let Some((name, cert_data)) = handshake {
+        cert_data
+            .verify(
+                cert_verifier,
+                tls_transcript.time(),
+                tls_transcript.server_ephemeral_key(),
+                &name,
+            )
+            .map_err(VerifierError::verify)?;
+
+        Some(name)
+    } else {
+        None
+    };
+
+    let (mut commit_sent, mut commit_recv) = (RangeSet::default(), RangeSet::default());
+    if let Some(commit_config) = transcript_commit.as_ref() {
+        commit_config
+            .iter_hash()
+            .for_each(|(direction, idx, _)| match direction {
+                Direction::Sent => commit_sent.union_mut(idx),
+                Direction::Received => commit_recv.union_mut(idx),
+            });
+
+        if let Some((sent, recv)) = commit_config.encoding() {
+            commit_sent.union_mut(sent);
+            commit_recv.union_mut(recv);
+        }
+    }
+
+    let (sent_refs, sent_proof) = verify_plaintext(
+        vm,
+        keys.client_write_key,
+        keys.client_write_iv,
+        transcript.sent_unsafe(),
+        &ciphertext_sent,
+        tls_transcript
+            .sent()
+            .iter()
+            .filter(|record| record.typ == ContentType::ApplicationData),
+        transcript.sent_authed(),
+        &commit_sent,
+    )
+    .map_err(VerifierError::zk)?;
+    let (recv_refs, recv_proof) = verify_plaintext(
+        vm,
+        keys.server_write_key,
+        keys.server_write_iv,
+        transcript.received_unsafe(),
+        &ciphertext_recv,
+        tls_transcript
+            .recv()
+            .iter()
+            .filter(|record| record.typ == ContentType::ApplicationData),
+        transcript.received_authed(),
+        &commit_recv,
+    )
+    .map_err(VerifierError::zk)?;
+
+    let transcript_refs = TranscriptRefs {
+        sent: sent_refs,
+        recv: recv_refs,
+    };
+
+    let mut transcript_commitments = Vec::new();
+    let mut hash_commitments = None;
+    if let Some(commit_config) = transcript_commit.as_ref()
+        && commit_config.has_hash()
+    {
+        hash_commitments = Some(
+            verify_hash(vm, &transcript_refs, commit_config.iter_hash().cloned())
+                .map_err(VerifierError::verify)?,
+        );
+    }
+
+    vm.execute_all(ctx).await.map_err(VerifierError::zk)?;
+
+    sent_proof.verify().map_err(VerifierError::verify)?;
+    recv_proof.verify().map_err(VerifierError::verify)?;
+
+    let mut encoder_secret = None;
+    if let Some(commit_config) = transcript_commit
+        && let Some((sent, recv)) = commit_config.encoding()
+    {
+        let sent_map = transcript_refs
+            .sent
+            .index(sent)
+            .expect("ranges were authenticated");
+        let recv_map = transcript_refs
+            .recv
+            .index(recv)
+            .expect("ranges were authenticated");
+
+        let (secret, commitment) = encoding::transfer(ctx, vm, &sent_map, &recv_map).await?;
+        encoder_secret = Some(secret);
+        transcript_commitments.push(TranscriptCommitment::Encoding(commitment));
+    }
+
+    if let Some(hash_commitments) = hash_commitments {
+        for commitment in hash_commitments.try_recv().map_err(VerifierError::verify)? {
+            transcript_commitments.push(TranscriptCommitment::Hash(commitment));
+        }
+    }
+
+    Ok(VerifierOutput {
+        server_name,
+        transcript: has_reveal.then_some(transcript),
+        encoder_secret,
+        transcript_commitments,
+    })
+}
+
+fn collect_ciphertext<'a>(records: impl IntoIterator<Item = &'a Record>) -> Vec<u8> {
+    let mut ciphertext = Vec::new();
+    records
+        .into_iter()
+        .filter(|record| record.typ == ContentType::ApplicationData)
+        .for_each(|record| {
+            ciphertext.extend_from_slice(&record.ciphertext);
+        });
+    ciphertext
+}

crates/tlsn/src/zk_aes_ctr.rs

@@ -1,214 +0,0 @@
-//! Zero-knowledge AES-CTR encryption.
-
-use cipher::{
-    Cipher, CipherError, Keystream,
-    aes::{Aes128, AesError},
-};
-use mpz_memory_core::{
-    Array, Vector,
-    binary::{Binary, U8},
-};
-use mpz_vm_core::{Vm, prelude::*};
-
-use crate::Role;
-
-type Nonce = Array<U8, 8>;
-type Ctr = Array<U8, 4>;
-type Block = Array<U8, 16>;
-
-const START_CTR: u32 = 2;
-
-/// ZK AES-CTR encryption.
-#[derive(Debug)]
-pub(crate) struct ZkAesCtr {
-    role: Role,
-    aes: Aes128,
-    state: State,
-}
-
-impl ZkAesCtr {
-    /// Creates a new ZK AES-CTR instance.
-    pub(crate) fn new(role: Role) -> Self {
-        Self {
-            role,
-            aes: Aes128::default(),
-            state: State::Init,
-        }
-    }
-
-    /// Returns the role.
-    pub(crate) fn role(&self) -> &Role {
-        &self.role
-    }
-
-    /// Allocates `len` bytes for encryption.
-    pub(crate) fn alloc(
-        &mut self,
-        vm: &mut dyn Vm<Binary>,
-        len: usize,
-    ) -> Result<(), ZkAesCtrError> {
-        let State::Init = self.state.take() else {
-            Err(ErrorRepr::State {
-                reason: "must be in init state to allocate",
-            })?
-        };
-
-        // Round up to the nearest block size.
-        let len = 16 * len.div_ceil(16);
-
-        let input = vm.alloc_vec::<U8>(len).map_err(ZkAesCtrError::vm)?;
-        let keystream = self.aes.alloc_keystream(vm, len)?;
-
-        match self.role {
-            Role::Prover => vm.mark_private(input).map_err(ZkAesCtrError::vm)?,
-            Role::Verifier => vm.mark_blind(input).map_err(ZkAesCtrError::vm)?,
-        }
-
-        self.state = State::Ready { input, keystream };
-
-        Ok(())
-    }
-
-    /// Sets the key and IV for the cipher.
-    pub(crate) fn set_key(&mut self, key: Array<U8, 16>, iv: Array<U8, 4>) {
-        self.aes.set_key(key);
-        self.aes.set_iv(iv);
-    }
-
-    /// Proves the encryption of `len` bytes.
-    ///
-    /// Here we only assign certain values in the VM but the actual proving
-    /// happens later when the plaintext is assigned and the VM is executed.
-    ///
-    /// # Arguments
-    ///
-    /// * `vm` - Virtual machine.
-    /// * `explicit_nonce` - Explicit nonce.
-    /// * `len` - Length of the plaintext in bytes.
-    ///
-    /// # Returns
-    ///
-    /// A VM reference to the plaintext and the ciphertext.
-    pub(crate) fn encrypt(
-        &mut self,
-        vm: &mut dyn Vm<Binary>,
-        explicit_nonce: Vec<u8>,
-        len: usize,
-    ) -> Result<(Vector<U8>, Vector<U8>), ZkAesCtrError> {
-        let State::Ready { input, keystream } = &mut self.state else {
-            Err(ErrorRepr::State {
-                reason: "must be in ready state to encrypt",
-            })?
-        };
-
-        let explicit_nonce: [u8; 8] =
-            explicit_nonce
-                .try_into()
-                .map_err(|explicit_nonce: Vec<_>| ErrorRepr::ExplicitNonceLength {
-                    expected: 8,
-                    actual: explicit_nonce.len(),
-                })?;
-
-        let block_count = len.div_ceil(16);
-        let padded_len = block_count * 16;
-        let padding_len = padded_len - len;
-
-        if padded_len > input.len() {
-            Err(ErrorRepr::InsufficientPreprocessing {
-                expected: padded_len,
-                actual: input.len(),
-            })?
-        }
-
-        let mut input = input.split_off(input.len() - padded_len);
-        let keystream = keystream.consume(padded_len)?;
-        let mut output = keystream.apply(vm, input)?;
-
-        // Assign counter block inputs.
-        let mut ctr = START_CTR..;
-        keystream.assign(vm, explicit_nonce, move || {
-            ctr.next().expect("range is unbounded").to_be_bytes()
-        })?;
-
-        // Assign zeroes to the padding.
-        if padding_len > 0 {
-            let padding = input.split_off(input.len() - padding_len);
-            // To simplify the impl, we don't mark the padding as public, that's why only
-            // the prover assigns it.
-            if let Role::Prover = self.role {
-                vm.assign(padding, vec![0; padding_len])
-                    .map_err(ZkAesCtrError::vm)?;
-            }
-            vm.commit(padding).map_err(ZkAesCtrError::vm)?;
-            output.truncate(len);
-        }
-
-        Ok((input, output))
-    }
-}
-
-enum State {
-    Init,
-    Ready {
-        input: Vector<U8>,
-        keystream: Keystream<Nonce, Ctr, Block>,
-    },
-    Error,
-}
-
-impl State {
-    fn take(&mut self) -> Self {
-        std::mem::replace(self, State::Error)
-    }
-}
-
-impl std::fmt::Debug for State {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            State::Init => write!(f, "Init"),
-            State::Ready { .. } => write!(f, "Ready"),
-            State::Error => write!(f, "Error"),
-        }
-    }
-}
-
-/// Error for [`ZkAesCtr`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub struct ZkAesCtrError(#[from] ErrorRepr);
-
-impl ZkAesCtrError {
-    fn vm<E>(err: E) -> Self
-    where
-        E: Into<Box<dyn std::error::Error + Send + Sync + 'static>>,
-    {
-        Self(ErrorRepr::Vm(err.into()))
-    }
-}
-
-#[derive(Debug, thiserror::Error)]
-#[error("zk aes error")]
-enum ErrorRepr {
-    #[error("invalid state: {reason}")]
-    State { reason: &'static str },
-    #[error("cipher error: {0}")]
-    Cipher(Box<dyn std::error::Error + Send + Sync + 'static>),
-    #[error("vm error: {0}")]
-    Vm(Box<dyn std::error::Error + Send + Sync + 'static>),
-    #[error("invalid explicit nonce length: expected {expected}, got {actual}")]
-    ExplicitNonceLength { expected: usize, actual: usize },
-    #[error("insufficient preprocessing: expected {expected}, got {actual}")]
-    InsufficientPreprocessing { expected: usize, actual: usize },
-}
-
-impl From<AesError> for ZkAesCtrError {
-    fn from(err: AesError) -> Self {
-        Self(ErrorRepr::Cipher(Box::new(err)))
-    }
-}
-
-impl From<CipherError> for ZkAesCtrError {
-    fn from(err: CipherError) -> Self {
-        Self(ErrorRepr::Cipher(Box::new(err)))
-    }
-}

crates/tlsn/tests/test.rs

@@ -1,11 +1,17 @@
 use futures::{AsyncReadExt, AsyncWriteExt};
+use rangeset::RangeSet;
 use tlsn::{
     config::{CertificateDer, ProtocolConfig, ProtocolConfigValidator, RootCertStore},
     connection::ServerName,
+    hash::{HashAlgId, HashProvider},
     prover::{ProveConfig, Prover, ProverConfig, TlsConfig},
-    transcript::{TranscriptCommitConfig, TranscriptCommitment},
+    transcript::{
+        Direction, Transcript, TranscriptCommitConfig, TranscriptCommitment,
+        TranscriptCommitmentKind, TranscriptSecret,
+    },
     verifier::{Verifier, VerifierConfig, VerifierOutput, VerifyConfig},
 };
+use tlsn_core::ProverOutput;
 use tlsn_server_fixture::bind;
 use tlsn_server_fixture_certs::{CA_CERT_DER, SERVER_DOMAIN};
 
@@ -29,11 +35,80 @@ async fn test() {
 
     let (socket_0, socket_1) = tokio::io::duplex(2 << 23);
 
-    tokio::join!(prover(socket_0), verifier(socket_1));
+    let ((full_transcript, prover_output), verifier_output) =
+        tokio::join!(prover(socket_0), verifier(socket_1));
+
+    let partial_transcript = verifier_output.transcript.unwrap();
+    let ServerName::Dns(server_name) = verifier_output.server_name.unwrap();
+
+    assert_eq!(server_name.as_str(), SERVER_DOMAIN);
+    assert!(!partial_transcript.is_complete());
+    assert_eq!(
+        partial_transcript
+            .sent_authed()
+            .iter_ranges()
+            .next()
+            .unwrap(),
+        0..10
+    );
+    assert_eq!(
+        partial_transcript
+            .received_authed()
+            .iter_ranges()
+            .next()
+            .unwrap(),
+        0..10
+    );
+
+    let encoding_tree = prover_output
+        .transcript_secrets
+        .iter()
+        .find_map(|secret| {
+            if let TranscriptSecret::Encoding(tree) = secret {
+                Some(tree)
+            } else {
+                None
+            }
+        })
+        .unwrap();
+
+    let encoding_commitment = prover_output
+        .transcript_commitments
+        .iter()
+        .find_map(|commitment| {
+            if let TranscriptCommitment::Encoding(commitment) = commitment {
+                Some(commitment)
+            } else {
+                None
+            }
+        })
+        .unwrap();
+
+    let prove_sent = RangeSet::from(1..full_transcript.sent().len() - 1);
+    let prove_recv = RangeSet::from(1..full_transcript.received().len() - 1);
+    let idxs = [
+        (Direction::Sent, prove_sent.clone()),
+        (Direction::Received, prove_recv.clone()),
+    ];
+    let proof = encoding_tree.proof(idxs.iter()).unwrap();
+    let (auth_sent, auth_recv) = proof
+        .verify_with_provider(
+            &HashProvider::default(),
+            &verifier_output.encoder_secret.unwrap(),
+            encoding_commitment,
+            full_transcript.sent(),
+            full_transcript.received(),
+        )
+        .unwrap();
+
+    assert_eq!(auth_sent, prove_sent);
+    assert_eq!(auth_recv, prove_recv);
 }
 
 #[instrument(skip(verifier_socket))]
-async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(verifier_socket: T) {
+async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(
+    verifier_socket: T,
+) -> (Transcript, ProverOutput) {
     let (client_socket, server_socket) = tokio::io::duplex(2 << 16);
 
     let server_task = tokio::spawn(bind(server_socket.compat()));
@@ -86,9 +161,25 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(verifier_soc
 
     let mut builder = TranscriptCommitConfig::builder(prover.transcript());
 
-    // Commit to everything
-    builder.commit_sent(&(0..sent_tx_len)).unwrap();
-    builder.commit_recv(&(0..recv_tx_len)).unwrap();
+    for kind in [
+        TranscriptCommitmentKind::Encoding,
+        TranscriptCommitmentKind::Hash {
+            alg: HashAlgId::SHA256,
+        },
+    ] {
+        builder
+            .commit_with_kind(&(0..sent_tx_len), Direction::Sent, kind)
+            .unwrap();
+        builder
+            .commit_with_kind(&(0..recv_tx_len), Direction::Received, kind)
+            .unwrap();
+        builder
+            .commit_with_kind(&(1..sent_tx_len - 1), Direction::Sent, kind)
+            .unwrap();
+        builder
+            .commit_with_kind(&(1..recv_tx_len - 1), Direction::Received, kind)
+            .unwrap();
+    }
 
     let transcript_commit = builder.build().unwrap();
 
@@ -102,13 +193,17 @@ async fn prover<T: AsyncWrite + AsyncRead + Send + Unpin + 'static>(verifier_soc
     builder.transcript_commit(transcript_commit);
 
     let config = builder.build().unwrap();
-
-    prover.prove(&config).await.unwrap();
+    let transcript = prover.transcript().clone();
+    let output = prover.prove(&config).await.unwrap();
     prover.close().await.unwrap();
+
+    (transcript, output)
 }
 
 #[instrument(skip(socket))]
-async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(socket: T) {
+async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(
+    socket: T,
+) -> VerifierOutput {
     let config_validator = ProtocolConfigValidator::builder()
         .max_sent_data(MAX_SENT_DATA)
         .max_recv_data(MAX_RECV_DATA)
@@ -125,31 +220,16 @@ async fn verifier<T: AsyncWrite + AsyncRead + Send + Sync + Unpin + 'static>(soc
             .unwrap(),
     );
 
-    let VerifierOutput {
-        server_name,
-        transcript,
-        transcript_commitments,
-    } = verifier
-        .verify(socket.compat(), &VerifyConfig::default())
+    let mut verifier = verifier
+        .setup(socket.compat())
+        .await
+        .unwrap()
+        .run()
         .await
         .unwrap();
 
-    let transcript = transcript.unwrap();
+    let output = verifier.verify(&VerifyConfig::default()).await.unwrap();
+    verifier.close().await.unwrap();
 
-    let ServerName::Dns(server_name) = server_name.unwrap();
-
-    assert_eq!(server_name.as_str(), SERVER_DOMAIN);
-    assert!(!transcript.is_complete());
-    assert_eq!(
-        transcript.sent_authed().iter_ranges().next().unwrap(),
-        0..10
-    );
-    assert_eq!(
-        transcript.received_authed().iter_ranges().next().unwrap(),
-        0..10
-    );
-    assert!(matches!(
-        transcript_commitments[0],
-        TranscriptCommitment::Encoding(_)
-    ));
+    output
 }

crates/wasm/.cargo/config.toml

@@ -6,11 +6,15 @@ build-std = ["panic_abort", "std"]
 
 [target.wasm32-unknown-unknown]
 rustflags = [
-    "-C",
-    "target-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
-    "-C",
+    "-Ctarget-feature=+atomics,+bulk-memory,+mutable-globals,+simd128",
+    "-Clink-arg=--shared-memory",
     # 4GB
-    "link-arg=--max-memory=4294967296",
+    "-Clink-arg=--max-memory=4294967296",
+    "-Clink-arg=--import-memory",
+    "-Clink-arg=--export=__wasm_init_tls",
+    "-Clink-arg=--export=__tls_size",
+    "-Clink-arg=--export=__tls_align",
+    "-Clink-arg=--export=__tls_base",
     "--cfg",
     'getrandom_backend="wasm_js"',
 ]

crates/wasm/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tlsn-wasm"
-version = "0.1.0-alpha.13-pre"
+version = "0.1.0-alpha.13"
 edition = "2021"
 repository = "https://github.com/tlsnotary/tlsn.git"
 description = "A core WebAssembly package for TLSNotary."