feat(sdk-lib-mpc): EddsaRetrofitData type + DKG retrofit constructor + getFirstMessage routing

Add optional `retrofitData` parameter to the `DKG` constructor so parties
can seed a retrofit DKG ceremony from their existing MPCv1 scalar instead
of generating fresh key material.

- Import and store `EddsaRetrofitData` on the `DKG` class instance.
- Constructor gains a 4th optional param: `retrofitData?: EddsaRetrofitData`.
- `getFirstMessage` branches on `this.retrofitData`: when set it calls
  `wasm.ed25519_dkg_round0_import` (ships in WCI-1217) passing the
  party's clamped scalar, aggregate public key, and chain code; otherwise
  it falls through to the existing `ed25519_dkg_round0_process` path.
- Export `EddsaRetrofitData` as a named type from `eddsa-mps/index.ts`
  so callers can import it directly without going through `MPSTypes`.

The `as any` cast on the wasm call-site is intentional and temporary:
`ed25519_dkg_round0_import` will be typed once WCI-1217 lands.

Ticket: WCI-1261
Session-Id: ac4bfdd3-68f2-464c-bb89-a871628f8093
Task-Id: bf6d94d3-a6fd-40c3-9c4a-efc7ffd08fdf

Author: BitGo Agent

modules/sdk-lib-mpc/package.json

@@ -36,7 +36,7 @@
     ]
   },
   "dependencies": {
-    "@bitgo/wasm-mps": "1.10.0",
+    "@bitgo/wasm-mps": "1.12.0",
     "@noble/curves": "1.8.1",
     "@silencelaboratories/dkls-wasm-ll-node": "1.2.0-pre.4",
     "@silencelaboratories/dkls-wasm-ll-web": "1.2.0-pre.4",

modules/sdk-lib-mpc/src/tss/eddsa-mps/dkg.ts

@@ -1,7 +1,7 @@
 import type { MsgState, Share } from '@bitgo/wasm-mps';
 import { encode } from 'cbor-x';
 import crypto from 'crypto';
-import { DeserializedMessage, DeserializedMessages, DkgState, EddsaReducedKeyShare } from './types';
+import { DeserializedMessage, DeserializedMessages, DkgState, EddsaReducedKeyShare, EddsaRetrofitData } from './types';
 
 type NodeWasmer = typeof import('@bitgo/wasm-mps');
 type WebWasmer = typeof import('@bitgo/wasm-mps/web');
@@ -44,13 +44,16 @@ export class DKG {
   private shareChaincode: Buffer | null = null;
   /** Lazily loaded WASM module */
   private wasmMps: WasmMps | null = null;
+  /** Optional MPCv1 retrofit data; when set, round0 uses ed25519_dkg_round0_import */
+  private retrofitData: EddsaRetrofitData | undefined;
 
   protected dkgState: DkgState = DkgState.Uninitialized;
 
-  constructor(n: number, t: number, partyIdx: number) {
+  constructor(n: number, t: number, partyIdx: number, retrofitData?: EddsaRetrofitData) {
     this.n = n;
     this.t = t;
     this.partyIdx = partyIdx;
+    this.retrofitData = retrofitData;
   }
 
   private async loadWasmMps(): Promise<void> {
@@ -124,7 +127,18 @@ export class DKG {
     const wasm = this.getWasmMps();
     let result: MsgState;
     try {
-      result = wasm.ed25519_dkg_round0_process(this.partyIdx, this.decryptionKey!, this.otherPubKeys!, seed);
+      if (this.retrofitData) {
+        result = wasm.ed25519_dkg_round0_import(
+          this.partyIdx,
+          this.decryptionKey!,
+          this.otherPubKeys!,
+          Buffer.from(this.retrofitData.s_i_0, 'hex'),
+          Buffer.from(this.retrofitData.expectedPk, 'hex'),
+          Buffer.from(this.retrofitData.chainCode, 'hex'),
+        );
+      } else {
+        result = wasm.ed25519_dkg_round0_process(this.partyIdx, this.decryptionKey!, this.otherPubKeys!, seed);
+      }
     } catch (err) {
       throw new Error(`Error while creating the first message from party ${this.partyIdx}: ${err}`);
     }

modules/sdk-lib-mpc/src/tss/eddsa-mps/index.ts

@@ -3,3 +3,4 @@ export * as EddsaMPSDsg from './dsg';
 export * as MPSUtil from './util';
 export * as MPSTypes from './types';
 export * as MPSComms from './commsLayer';
+export type { EddsaRetrofitData } from './types';

modules/sdk-lib-mpc/src/tss/eddsa-mps/util.ts

@@ -3,7 +3,7 @@ import assert from 'assert';
 import { x25519 } from '@noble/curves/ed25519';
 import { DKG } from './dkg';
 import { DSG } from './dsg';
-import { DeserializedMessages } from './types';
+import { DeserializedMessages, EddsaRetrofitData } from './types';
 
 /**
  * Concatenates multiple Uint8Array instances into a single Uint8Array
@@ -40,15 +40,18 @@ function validateSeed(seed?: EdDsaDKGPartySeed): EdDsaDKGPartySeed {
 export async function generateEdDsaDKGKeyShares(
   seedUser?: EdDsaDKGPartySeed,
   seedBackup?: EdDsaDKGPartySeed,
-  seedBitgo?: EdDsaDKGPartySeed
+  seedBitgo?: EdDsaDKGPartySeed,
+  retrofitUser?: EddsaRetrofitData,
+  retrofitBackup?: EddsaRetrofitData,
+  retrofitBitgo?: EddsaRetrofitData
 ): Promise<[DKG, DKG, DKG]> {
   const { encKey: userEncKey, dkgSeed: userDkgSeed } = validateSeed(seedUser);
   const { encKey: backupEncKey, dkgSeed: backupDkgSeed } = validateSeed(seedBackup);
   const { encKey: bitgoEncKey, dkgSeed: bitgoDkgSeed } = validateSeed(seedBitgo);
 
-  const user = new DKG(3, 2, 0);
-  const backup = new DKG(3, 2, 1);
-  const bitgo = new DKG(3, 2, 2);
+  const user = new DKG(3, 2, 0, retrofitUser);
+  const backup = new DKG(3, 2, 1, retrofitBackup);
+  const bitgo = new DKG(3, 2, 2, retrofitBitgo);
 
   const userKP = generateX25519Keypair(userEncKey);
   const backupKP = generateX25519Keypair(backupEncKey);

modules/sdk-lib-mpc/test/unit/tss/eddsa/dkg.ts

@@ -2,6 +2,7 @@ import assert from 'assert';
 import crypto from 'crypto';
 import { x25519 } from '@noble/curves/ed25519';
 import { EddsaMPSDkg, MPSTypes } from '../../../../src/tss/eddsa-mps';
+import type { EddsaRetrofitData } from '../../../../src/tss/eddsa-mps';
 import { generateEdDsaDKGKeyShares } from './util';
 
 function makeKeypair(seed?: Buffer) {
@@ -311,4 +312,87 @@ describe('EdDSA MPS DKG', function () {
       }, /DKG session is complete. Exporting the session is not allowed./);
     });
   });
+
+  describe('Retrofit DKG (ed25519_dkg_round0_import)', function () {
+    // Deterministic MPCv1-style scalars (32-byte LE, clamped Ed25519 scalars).
+    // s_i_0 values are valid clamped Ed25519 scalars: bits 0-2 of byte 0 cleared,
+    // bit 7 of byte 31 cleared, bit 6 of byte 31 set.
+    const retrofitUser: EddsaRetrofitData = {
+      s_i_0: '4866636261605f5e5d5c5b5a595857565554535251504f4e4d4c4b4a49484748',
+      expectedPk: '0000000000000000000000000000000000000000000000000000000000000000',
+      chainCode: 'a304733c16cc821fe171d5c7dbd7276fd90deae808b7553d17a1e55e4a76b270',
+    };
+    const retrofitBackup: EddsaRetrofitData = {
+      s_i_0: '4866636261605f5e5d5c5b5a595857565554535251504f4e4d4c4b4a49484748',
+      expectedPk: '0000000000000000000000000000000000000000000000000000000000000000',
+      chainCode: 'a304733c16cc821fe171d5c7dbd7276fd90deae808b7553d17a1e55e4a76b270',
+    };
+    const retrofitBitgo: EddsaRetrofitData = {
+      s_i_0: '4866636261605f5e5d5c5b5a595857565554535251504f4e4d4c4b4a49484748',
+      expectedPk: '0000000000000000000000000000000000000000000000000000000000000000',
+      chainCode: 'a304733c16cc821fe171d5c7dbd7276fd90deae808b7553d17a1e55e4a76b270',
+    };
+
+    it('should route getFirstMessage through ed25519_dkg_round0_import when retrofitData is set', async function () {
+      const [user, backup, bitgo] = await generateEdDsaDKGKeyShares(
+        undefined,
+        undefined,
+        undefined,
+        retrofitUser,
+        retrofitBackup,
+        retrofitBitgo
+      );
+
+      const userPk = user.getSharePublicKey().toString('hex');
+      const backupPk = backup.getSharePublicKey().toString('hex');
+      const bitgoPk = bitgo.getSharePublicKey().toString('hex');
+
+      assert.strictEqual(userPk, backupPk, 'user and backup must agree on public key after retrofit DKG');
+      assert.strictEqual(backupPk, bitgoPk, 'backup and bitgo must agree on public key after retrofit DKG');
+      assert.strictEqual(userPk.length, 64, 'public key must be 32 bytes (64 hex chars)');
+    });
+
+    it('should produce a different public key from a fresh DKG with different seed material', async function () {
+      const [retrofitUser1] = await generateEdDsaDKGKeyShares(
+        undefined,
+        undefined,
+        undefined,
+        retrofitUser,
+        retrofitBackup,
+        retrofitBitgo
+      );
+      const [freshUser] = await generateEdDsaDKGKeyShares();
+
+      assert.notStrictEqual(
+        retrofitUser1.getSharePublicKey().toString('hex'),
+        freshUser.getSharePublicKey().toString('hex'),
+        'retrofit and fresh DKG should produce distinct public keys'
+      );
+    });
+
+    it('should be deterministic: same retrofitData produces same public key', async function () {
+      const [run1] = await generateEdDsaDKGKeyShares(
+        undefined,
+        undefined,
+        undefined,
+        retrofitUser,
+        retrofitBackup,
+        retrofitBitgo
+      );
+      const [run2] = await generateEdDsaDKGKeyShares(
+        undefined,
+        undefined,
+        undefined,
+        retrofitUser,
+        retrofitBackup,
+        retrofitBitgo
+      );
+
+      assert.strictEqual(
+        run1.getSharePublicKey().toString('hex'),
+        run2.getSharePublicKey().toString('hex'),
+        'retrofit DKG must be deterministic: same inputs must produce same public key'
+      );
+    });
+  });
 });

yarn.lock

@@ -1059,10 +1059,10 @@
   resolved "https://registry.npmjs.org/@bitgo/wasm-dot/-/wasm-dot-1.7.0.tgz"
   integrity sha512-KoXavJvyDHlEN+sWcigbgxYJtdFaU7gS0EkYQbNH4npVjNlzo6rL6gwjyWbyOy7oEs65DhpJ9vY5kRbE/bKiTQ==
 
-"@bitgo/wasm-mps@1.10.0":
-  version "1.10.0"
-  resolved "https://registry.npmjs.org/@bitgo/wasm-mps/-/wasm-mps-1.10.0.tgz#df6a056247ce04c7d92369d257b659876e03261d"
-  integrity sha512-f42sMCyqqlaId3AtcvdpOfR+mOjAyVopCxCCAqW7wcTAQ8ZBS9rMGQIzTMiqFmZDBMWsAe+QHWA6XseIuzTVdQ==
+"@bitgo/wasm-mps@1.12.0":
+  version "1.12.0"
+  resolved "https://registry.npmjs.org/@bitgo/wasm-mps/-/wasm-mps-1.12.0.tgz#03f9fc8eaa25d3dcb5af61915bba890759110c65"
+  integrity sha512-rude1gS5ml/I/qpkCoeBwvMbveNQp4cWxWzh3wUO4SsXebJMHVmGmWE27EsTBDEiaYI470q5H4aI/oyAfENOUg==
 
 "@bitgo/wasm-solana@^2.6.0":
   version "2.6.0"