add support for SLH-DSA-SHA2-128s TXN authenticators

api/doc/spec.json

@@ -17697,6 +17697,9 @@
           },
           {
             "$ref": "#/components/schemas/PublicKey_FederatedKeyless"
+          },
+          {
+            "$ref": "#/components/schemas/PublicKey_SlhDsa_Sha2_128s"
           }
         ],
         "discriminator": {
@@ -17706,7 +17709,8 @@
             "secp256k1_ecdsa": "#/components/schemas/PublicKey_Secp256k1Ecdsa",
             "secp256r1_ecdsa": "#/components/schemas/PublicKey_Secp256r1Ecdsa",
             "keyless": "#/components/schemas/PublicKey_Keyless",
-            "federated_keyless": "#/components/schemas/PublicKey_FederatedKeyless"
+            "federated_keyless": "#/components/schemas/PublicKey_FederatedKeyless",
+            "slh_dsa__sha2_128s": "#/components/schemas/PublicKey_SlhDsa_Sha2_128s"
           }
         }
       },
@@ -17820,6 +17824,28 @@
           }
         ]
       },
+      "PublicKey_SlhDsa_Sha2_128s": {
+        "allOf": [
+          {
+            "type": "object",
+            "required": [
+              "type"
+            ],
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "slh_dsa__sha2_128s"
+                ],
+                "example": "slh_dsa__sha2_128s"
+              }
+            }
+          },
+          {
+            "$ref": "#/components/schemas/SlhDsa_Sha2_128s"
+          }
+        ]
+      },
       "RSA_JWK": {
         "type": "object",
         "description": "Move type `0x1::jwks::RSA_JWK` in rust.\nSee its doc in Move for more details.",
@@ -17984,6 +18010,9 @@
           },
           {
             "$ref": "#/components/schemas/Signature_Keyless"
+          },
+          {
+            "$ref": "#/components/schemas/Signature_SlhDsa_Sha2_128s"
           }
         ],
         "discriminator": {
@@ -17992,7 +18021,8 @@
             "ed25519": "#/components/schemas/Signature_Ed25519",
             "secp256k1_ecdsa": "#/components/schemas/Signature_Secp256k1Ecdsa",
             "web_authn": "#/components/schemas/Signature_WebAuthn",
-            "keyless": "#/components/schemas/Signature_Keyless"
+            "keyless": "#/components/schemas/Signature_Keyless",
+            "slh_dsa__sha2_128s": "#/components/schemas/Signature_SlhDsa_Sha2_128s"
           }
         }
       },
@@ -18062,6 +18092,28 @@
           }
         ]
       },
+      "Signature_SlhDsa_Sha2_128s": {
+        "allOf": [
+          {
+            "type": "object",
+            "required": [
+              "type"
+            ],
+            "properties": {
+              "type": {
+                "type": "string",
+                "enum": [
+                  "slh_dsa__sha2_128s"
+                ],
+                "example": "slh_dsa__sha2_128s"
+              }
+            }
+          },
+          {
+            "$ref": "#/components/schemas/SlhDsa_Sha2_128s"
+          }
+        ]
+      },
       "Signature_WebAuthn": {
         "allOf": [
           {
@@ -18100,6 +18152,17 @@
           }
         }
       },
+      "SlhDsa_Sha2_128s": {
+        "type": "object",
+        "required": [
+          "value"
+        ],
+        "properties": {
+          "value": {
+            "$ref": "#/components/schemas/HexEncodedBytes"
+          }
+        }
+      },
       "StateCheckpointTransaction": {
         "type": "object",
         "description": "A state checkpoint transaction",

api/doc/spec.yaml

@@ -13279,6 +13279,7 @@ components:
       - $ref: '#/components/schemas/PublicKey_Secp256r1Ecdsa'
       - $ref: '#/components/schemas/PublicKey_Keyless'
       - $ref: '#/components/schemas/PublicKey_FederatedKeyless'
+      - $ref: '#/components/schemas/PublicKey_SlhDsa_Sha2_128s'
       discriminator:
         propertyName: type
         mapping:
@@ -13287,6 +13288,7 @@ components:
           secp256r1_ecdsa: '#/components/schemas/PublicKey_Secp256r1Ecdsa'
           keyless: '#/components/schemas/PublicKey_Keyless'
           federated_keyless: '#/components/schemas/PublicKey_FederatedKeyless'
+          slh_dsa__sha2_128s: '#/components/schemas/PublicKey_SlhDsa_Sha2_128s'
     PublicKey_Ed25519:
       allOf:
       - type: object
@@ -13347,6 +13349,18 @@ components:
             - secp256r1_ecdsa
             example: secp256r1_ecdsa
       - $ref: '#/components/schemas/Secp256r1Ecdsa'
+    PublicKey_SlhDsa_Sha2_128s:
+      allOf:
+      - type: object
+        required:
+        - type
+        properties:
+          type:
+            type: string
+            enum:
+            - slh_dsa__sha2_128s
+            example: slh_dsa__sha2_128s
+      - $ref: '#/components/schemas/SlhDsa_Sha2_128s'
     RSA_JWK:
       type: object
       description: |-
@@ -13454,13 +13468,15 @@ components:
       - $ref: '#/components/schemas/Signature_Secp256k1Ecdsa'
       - $ref: '#/components/schemas/Signature_WebAuthn'
       - $ref: '#/components/schemas/Signature_Keyless'
+      - $ref: '#/components/schemas/Signature_SlhDsa_Sha2_128s'
       discriminator:
         propertyName: type
         mapping:
           ed25519: '#/components/schemas/Signature_Ed25519'
           secp256k1_ecdsa: '#/components/schemas/Signature_Secp256k1Ecdsa'
           web_authn: '#/components/schemas/Signature_WebAuthn'
           keyless: '#/components/schemas/Signature_Keyless'
+          slh_dsa__sha2_128s: '#/components/schemas/Signature_SlhDsa_Sha2_128s'
     Signature_Ed25519:
       allOf:
       - type: object
@@ -13497,6 +13513,18 @@ components:
             - secp256k1_ecdsa
             example: secp256k1_ecdsa
       - $ref: '#/components/schemas/Secp256k1Ecdsa'
+    Signature_SlhDsa_Sha2_128s:
+      allOf:
+      - type: object
+        required:
+        - type
+        properties:
+          type:
+            type: string
+            enum:
+            - slh_dsa__sha2_128s
+            example: slh_dsa__sha2_128s
+      - $ref: '#/components/schemas/SlhDsa_Sha2_128s'
     Signature_WebAuthn:
       allOf:
       - type: object
@@ -13520,6 +13548,13 @@ components:
           $ref: '#/components/schemas/PublicKey'
         signature:
           $ref: '#/components/schemas/Signature'
+    SlhDsa_Sha2_128s:
+      type: object
+      required:
+      - value
+      properties:
+        value:
+          $ref: '#/components/schemas/HexEncodedBytes'
     StateCheckpointTransaction:
       type: object
       description: A state checkpoint transaction

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_multi_slh_dsa_sha2_128s.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0xe6530660a35b39a78f782ec1653f3774d4fcc67de3b5cc952b88e99139c22e5b3869c64641f78ec96cbf9a5a42ed4fd7ee2b804c327ce89e7783f3ff7c9c6d01",
+  "type": "ed25519_signature"
+}

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_multi_slh_dsa_sha2_128s_orderless.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0x3911006313e771d971f581fb64b15f4aa26a2fa60ccc13a02602f6afa627abe22a20212b6ad18801b7c63c56c798ce87167f332730e3a7555c95530f491eca01",
+  "type": "ed25519_signature"
+}

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_multi_slh_dsa_sha2_128s_payload_v2.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0x577369e22ada984a27334c9222443d0863129963a9822f74bb8322e0ef6341c2fdc3f589c5483bac55d625e1f9d2db05bd0812ae9a6938b1de0f5b9852fda703",
+  "type": "ed25519_signature"
+}

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_slh_dsa_sha2_128s.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0xe6530660a35b39a78f782ec1653f3774d4fcc67de3b5cc952b88e99139c22e5b3869c64641f78ec96cbf9a5a42ed4fd7ee2b804c327ce89e7783f3ff7c9c6d01",
+  "type": "ed25519_signature"
+}

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_slh_dsa_sha2_128s_orderless.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0x3911006313e771d971f581fb64b15f4aa26a2fa60ccc13a02602f6afa627abe22a20212b6ad18801b7c63c56c798ce87167f332730e3a7555c95530f491eca01",
+  "type": "ed25519_signature"
+}

api/goldens/aptos_api__tests__slh_dsa_sha2_128s__test_slh_dsa_sha2_128s_payload_v2.json

@@ -0,0 +1,5 @@
+{
+  "public_key": "0x14418f867a0bd6d42abb2daa50cd68a5a869ce208282481f57504f630510d0d3",
+  "signature": "0x577369e22ada984a27334c9222443d0863129963a9822f74bb8322e0ef6341c2fdc3f589c5483bac55d625e1f9d2db05bd0812ae9a6938b1de0f5b9852fda703",
+  "type": "ed25519_signature"
+}

api/src/tests/mod.rs

@@ -18,6 +18,7 @@ mod resource_groups;
 mod secp256k1_ecdsa;
 mod signed_int_test;
 mod simulation_test;
+mod slh_dsa_sha2_128s;
 mod state_test;
 mod string_resource_test;
 mod transaction_vector_test;

api/src/tests/secp256k1_ecdsa.rs

@@ -48,7 +48,10 @@ async fn test_multi_secp256k1_ecdsa(
     )
     .account_address();
 
-    // Set a dummy key
+    // NOTE: LocalAccount requires a private key, but we use a dummy Ed25519 key here as a
+    // placeholder. This key is never used for actual authentication because:
+    // 1. create_user_account() and mint_user_account() are signed by the root/faucet account
+    // 2. The transfer transaction will be re-signed below with the actual secp256k1 key
     let key_bytes =
         hex::decode("a38ba78b1a0fbfc55e2c5dfdedf48d1172283d0f7c59fd64c02d811130a2f4b2").unwrap();
     let ed25519_private_key: Ed25519PrivateKey = (&key_bytes[..]).try_into().unwrap();
@@ -123,7 +126,10 @@ async fn test_secp256k1_ecdsa(
     let address = AuthenticationKey::any_key(AnyPublicKey::secp256k1_ecdsa(public_key.clone()))
         .account_address();
 
-    // Set a dummy key
+    // NOTE: LocalAccount requires a private key, but we use a dummy Ed25519 key here as a
+    // placeholder. This key is never used for actual authentication because:
+    // 1. create_user_account() and mint_user_account() are signed by the root/faucet account
+    // 2. The transfer transaction will be re-signed below with the actual secp256k1 key
     let key_bytes =
         hex::decode("a38ba78b1a0fbfc55e2c5dfdedf48d1172283d0f7c59fd64c02d811130a2f4b2").unwrap();
     let ed25519_private_key: Ed25519PrivateKey = (&key_bytes[..]).try_into().unwrap();