feature/simplify ucan mpc did (#1195)

* feat: enable DID auth middleware

* feat: implement passkey creation flow

* feat: persist user address in cookie and retrieve user profile using address cookie

* feat: implement human verification challenge during session initialization

* refactor: remove unnecessary random number generation in profile creation

* refactor: rename credential validation handler and update related routes

* feat: improve profile validation and user experience

* feat: add page rendering for profile and passkey creation

* refactor: remove unused register handler and update routes

* refactor: remove unused imports and simplify credential validation

* fix: Correct insecure gRPC client connection

* refactor: rename models files for better organization

* refactor: refactor grpc client creation and management

* refactor: refactor common clients package

* <no value>

* feat: add CapAccount, CapInterchain, CapVault enums

* feat: add ChainId to ResAccount and ResInterchain

* feat: add asset code to resource account enumeration

* refactor: rename services package to providers

* feat: implement gateway database interactions

* refactor: move gateway repository to internal/gateway

* refactor: Migrate database provider to use sqlx

* refactor: Rename Vaults to VaultProvider in HTTPContext struct

* refactor: Migrate from GORM to sqlc Queries in database context methods

* refactor: Replace GORM with standard SQL and simplify database initialization

* refactor: Migrate session management from GORM to sqlc with type conversion

* refactor: Update import paths and model references in context package

* fix: Resolve session type conversion and middleware issues

* refactor: Migrate database from GORM to sqlx

* refactor: Move models to pkg/common, improve code structure

* refactor: move repository package to internal directory

* refactor: move gateway internal packages to context directory

* refactor: migrate database provider to use sqlx queries

* feat: add session ID to HTTP context and use it to load session data

* feat: implement vault creation API endpoint

* feat: add DIDKey generation from PubKey

* refactor: remove unused DIDAuth components

* refactor: move DID auth controller to vault context

* chore: remove unused DIDAuth package

* refactor: improve clarity of enclave refresh function

* feat: implement nonce-based key encryption for improved security

* feat: Add Export and Import methods with comprehensive tests for Enclave

* fix: Validate AES key length in keyshare encryption and decryption

* fix: Resolve key length validation by hashing input keys

* refactor: Update keyshare import to use protocol decoding

* feat: Refactor enclave encryption to support full enclave export/import

* refactor: Simplify Enclave interface methods by removing role parameter

* refactor: remove unnecessary serialization from enclave interface

* refactor: rename models package in gateway context

* refactor: rename keystore vault constants

* refactor: remove context parameter from Resolver methods

* feat: add CurrentBlock context function and update related components

* refactor: rename resolver.go to resolvers.go

* feat: Add SQLite random() generation for session and profile initialization

* refactor: Update SQL queries to use SQLite-style parameter placeholders

* refactor: Replace '?' placeholders with '$n' PostgreSQL parameter syntax

* <no value>

* refactor: refactor gateway to use middleware for database interactions and improve modularity

* feat: implement gateway for Sonr highway

* refactor: Remove unused gateway context and refactor cookie/header handling

* refactor: improve server initialization and middleware handling

* feat: implement human verification for profile creation

* feat: implement session management middleware

* refactor: refactor common models and config to internal package

* refactor: move env config to internal/config

* refactor: move database-related code to  directory

* refactor: move IPFS client to common package and improve code structure

* refactor: move querier to common package and rename to chain_query

* refactor: move webworker model to internal/models

* feat: add initial view template for Sonr.ID

* docs(concepts): Add documentation for cosmos-proto

* docs: move IBC transfer documentation to tools section

* refactor: rename initpkl.go to pkl_init.go for better naming consistency

* docs(theme): update dark mode toggle icons

* refactor: update sqlite3 driver to ncruces/go-sqlite3

* feat: add Vault model and database interactions

* refactor: Improve SQLite schema with better constraints and indexes

* chore: update project dependencies

* fix: use grpc.WithInsecure() for gRPC connection

* config: set localhost as default Sonr gRPC URL

* refactor: improve gateway middleware and refactor server initialization

* refactor: Remove foreign key pragma from schema SQL

* refactor: Remove foreign key constraints from database schema

* refactor: Convert primary key columns from INTEGER to TEXT

* refactor: Remove unnecessary redirect in error handling

crypto/mpc/codec.go

@@ -3,6 +3,7 @@ package mpc
 import (
 	"github.com/onsonr/sonr/crypto/core/curves"
 	"github.com/onsonr/sonr/crypto/core/protocol"
+	"github.com/onsonr/sonr/crypto/keys"
 	"github.com/onsonr/sonr/crypto/tecdsa/dklsv1/dkg"
 )
 
@@ -20,3 +21,22 @@ type (
 	RefreshFunc interface{ protocol.Iterator } // RefreshFunc is the type for the refresh function
 	SignFunc    interface{ protocol.Iterator } // SignFunc is the type for the sign function
 )
+
+const (
+	RoleVal  = "validator"
+	RoleUser = "user"
+)
+
+// Enclave defines the interface for key management operations
+type Enclave interface {
+	Address() string                              // Address returns the Sonr address of the keyEnclave
+	DID() keys.DID                                // DID returns the DID of the keyEnclave
+	Export(key []byte) ([]byte, error)            // Export returns encrypted enclave data
+	Import(data []byte, key []byte) error         // Import decrypts and loads enclave data
+	IsValid() bool                                // IsValid returns true if the keyEnclave is valid
+	PubKey() keys.PubKey                          // PubKey returns the public key of the keyEnclave
+	Refresh() (Enclave, error)                    // Refresh returns a new keyEnclave
+	Serialize() ([]byte, error)                   // Serialize returns the serialized keyEnclave
+	Sign(data []byte) ([]byte, error)             // Sign returns the signature of the data
+	Verify(data []byte, sig []byte) (bool, error) // Verify returns true if the signature is valid
+}

crypto/mpc/codec_test.go

@@ -1,6 +1,7 @@
 package mpc
 
 import (
+	"crypto/rand"
 	"strings"
 	"testing"
 
@@ -8,22 +9,74 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func randNonce() []byte {
+	nonce := make([]byte, 12)
+	rand.Read(nonce)
+	return nonce
+}
+
 func TestKeyShareGeneration(t *testing.T) {
 	t.Run("Generate Valid Enclave", func(t *testing.T) {
+		nonce := randNonce()
 		// Generate enclave
-		enclave, err := GenEnclave()
+		enclave, err := GenEnclave(nonce)
 		require.NoError(t, err)
 		require.NotNil(t, enclave)
 
 		// Validate enclave contents
 		assert.True(t, enclave.IsValid())
 	})
+
+	t.Run("Export and Import", func(t *testing.T) {
+		nonce := randNonce()
+		// Generate original enclave
+		original, err := GenEnclave(nonce)
+		require.NoError(t, err)
+
+		// Test key for encryption/decryption (32 bytes)
+		testKey := []byte("test-key-12345678-test-key-123456")
+
+		// Test Export/Import
+		t.Run("Full Enclave", func(t *testing.T) {
+			// Export enclave
+			data, err := original.Export(testKey)
+			require.NoError(t, err)
+			require.NotEmpty(t, data)
+
+			// Create new empty enclave
+			newEnclave, err := GenEnclave(nonce)
+			require.NoError(t, err)
+
+			// Import enclave
+			err = newEnclave.Import(data, testKey)
+			require.NoError(t, err)
+
+			// Verify the imported enclave works by signing
+			testData := []byte("test message")
+			sig, err := newEnclave.Sign(testData)
+			require.NoError(t, err)
+			valid, err := newEnclave.Verify(testData, sig)
+			require.NoError(t, err)
+			assert.True(t, valid)
+		})
+
+		// Test Invalid Key
+		t.Run("Invalid Key", func(t *testing.T) {
+			data, err := original.Export(testKey)
+			require.NoError(t, err)
+
+			wrongKey := []byte("wrong-key-12345678")
+			err = original.Import(data, wrongKey)
+			assert.Error(t, err)
+		})
+	})
 }
 
 func TestEnclaveOperations(t *testing.T) {
 	t.Run("Signing and Verification", func(t *testing.T) {
+		nonce := randNonce()
 		// Generate valid enclave
-		enclave, err := GenEnclave()
+		enclave, err := GenEnclave(nonce)
 		require.NoError(t, err)
 
 		// Test signing
@@ -45,7 +98,8 @@ func TestEnclaveOperations(t *testing.T) {
 	})
 
 	t.Run("Address and Public Key", func(t *testing.T) {
-		enclave, err := GenEnclave()
+		nonce := randNonce()
+		enclave, err := GenEnclave(nonce)
 		require.NoError(t, err)
 
 		// Test Address
@@ -60,17 +114,18 @@ func TestEnclaveOperations(t *testing.T) {
 	})
 
 	t.Run("Refresh Operation", func(t *testing.T) {
-		enclave, err := GenEnclave()
+		nonce := randNonce()
+		enclave, err := GenEnclave(nonce)
 		require.NoError(t, err)
 
 		// Test refresh
 		refreshedEnclave, err := enclave.Refresh()
 		require.NoError(t, err)
 		require.NotNil(t, refreshedEnclave)
-		
+
 		// Verify refreshed enclave is valid
 		assert.True(t, refreshedEnclave.IsValid())
-		
+
 		// Verify it maintains the same address
 		assert.Equal(t, enclave.Address(), refreshedEnclave.Address())
 	})
@@ -78,28 +133,28 @@ func TestEnclaveOperations(t *testing.T) {
 
 func TestEnclaveSerialization(t *testing.T) {
 	t.Run("Marshal and Unmarshal", func(t *testing.T) {
+		nonce := randNonce()
 		// Generate original enclave
-		original, err := GenEnclave()
+		original, err := GenEnclave(nonce)
 		require.NoError(t, err)
 		require.NotNil(t, original)
 
 		// Marshal
-		keyEnclave, ok := original.(*KeyEnclave)
+		keyclave, ok := original.(*keyEnclave)
 		require.True(t, ok)
-		
-		data, err := keyEnclave.Marshal()
+
+		data, err := keyclave.Serialize()
 		require.NoError(t, err)
 		require.NotEmpty(t, data)
 
 		// Unmarshal
-		restored := &KeyEnclave{}
+		restored := &keyEnclave{}
 		err = restored.Unmarshal(data)
 		require.NoError(t, err)
 
 		// Verify restored enclave
-		assert.Equal(t, keyEnclave.Addr, restored.Addr)
-		assert.True(t, keyEnclave.PubPoint.Equal(restored.PubPoint))
-		assert.Equal(t, keyEnclave.VaultCID, restored.VaultCID)
+		assert.Equal(t, keyclave.Addr, restored.Addr)
+		assert.True(t, keyclave.PubPoint.Equal(restored.PubPoint))
 		assert.True(t, restored.IsValid())
 	})
 }

crypto/mpc/enclave.go

@@ -1,63 +1,31 @@
 package mpc
 
 import (
+	"crypto/aes"
+	"crypto/cipher"
 	"crypto/ecdsa"
 	"encoding/json"
+	"fmt"
 
 	"github.com/onsonr/sonr/crypto/core/curves"
-	"github.com/onsonr/sonr/crypto/core/protocol"
 	"github.com/onsonr/sonr/crypto/keys"
-	"github.com/onsonr/sonr/crypto/tecdsa/dklsv1"
 	"golang.org/x/crypto/sha3"
 )
 
-// Enclave defines the interface for key management operations
-type Enclave interface {
-	Address() string
-	IsValid() bool
-	PubKey() keys.PubKey
-	Refresh() (Enclave, error)
-	Sign(data []byte) ([]byte, error)
-	Verify(data []byte, sig []byte) (bool, error)
-}
-
-// KeyEnclave implements the Enclave interface
-type KeyEnclave struct {
+// keyEnclave implements the Enclave interface
+type keyEnclave struct {
+	// Serialized fields
 	Addr      string       `json:"address"`
 	PubPoint  curves.Point `json:"-"`
 	PubBytes  []byte       `json:"pub_key"`
 	ValShare  Message      `json:"val_share"`
 	UserShare Message      `json:"user_share"`
-	VaultCID  string       `json:"vault_cid,omitempty"`
+
+	// Extra fields
+	nonce []byte
 }
 
-// Marshal returns the JSON encoding of KeyEnclave
-func (k *KeyEnclave) Marshal() ([]byte, error) {
-	// Store compressed public point bytes before marshaling
-	k.PubBytes = k.PubPoint.ToAffineCompressed()
-	return json.Marshal(k)
-}
-
-// Unmarshal parses the JSON-encoded data and stores the result
-func (k *KeyEnclave) Unmarshal(data []byte) error {
-	if err := json.Unmarshal(data, k); err != nil {
-		return err
-	}
-	// Reconstruct Point from bytes
-	curve := curves.K256()
-	point, err := curve.NewIdentityPoint().FromAffineCompressed(k.PubBytes)
-	if err != nil {
-		return err
-	}
-	k.PubPoint = point
-	return nil
-}
-
-func (k *KeyEnclave) IsValid() bool {
-	return k.PubPoint != nil && k.ValShare != nil && k.UserShare != nil && k.Addr != ""
-}
-
-func initKeyEnclave(valShare, userShare Message) (*KeyEnclave, error) {
+func newEnclave(valShare, userShare Message, nonce []byte) (Enclave, error) {
 	pubPoint, err := getAlicePubPoint(valShare)
 	if err != nil {
 		return nil, err
@@ -67,47 +35,105 @@ func initKeyEnclave(valShare, userShare Message) (*KeyEnclave, error) {
 	if err != nil {
 		return nil, err
 	}
-	return &KeyEnclave{
+	return &keyEnclave{
 		Addr:      addr,
 		PubPoint:  pubPoint,
 		ValShare:  valShare,
 		UserShare: userShare,
+		nonce:     nonce,
 	}, nil
 }
 
-func (k *KeyEnclave) Address() string {
+// Address returns the Sonr address of the keyEnclave
+func (k *keyEnclave) Address() string {
 	return k.Addr
 }
 
-func (k *KeyEnclave) PubKey() keys.PubKey {
+// DID returns the DID of the keyEnclave
+func (k *keyEnclave) DID() keys.DID {
+	return keys.NewFromPubKey(k.PubKey())
+}
+
+// Export returns encrypted enclave data
+func (k *keyEnclave) Export(key []byte) ([]byte, error) {
+	data, err := k.Serialize()
+	if err != nil {
+		return nil, fmt.Errorf("failed to serialize enclave: %w", err)
+	}
+
+	hashedKey := hashKey(key)
+	block, err := aes.NewCipher(hashedKey)
+	if err != nil {
+		return nil, err
+	}
+
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	return aesgcm.Seal(nil, k.nonce, data, nil), nil
+}
+
+// Import decrypts and loads enclave data
+func (k *keyEnclave) Import(data []byte, key []byte) error {
+	hashedKey := hashKey(key)
+	block, err := aes.NewCipher(hashedKey)
+	if err != nil {
+		return err
+	}
+
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	decrypted, err := aesgcm.Open(nil, k.nonce, data, nil)
+	if err != nil {
+		return err
+	}
+
+	return k.Unmarshal(decrypted)
+}
+
+// IsValid returns true if the keyEnclave is valid
+func (k *keyEnclave) IsValid() bool {
+	return k.PubPoint != nil && k.ValShare != nil && k.UserShare != nil && k.Addr != ""
+}
+
+// PubKey returns the public key of the keyEnclave
+func (k *keyEnclave) PubKey() keys.PubKey {
 	return keys.NewPubKey(k.PubPoint)
 }
 
-func (k *KeyEnclave) Refresh() (Enclave, error) {
-	refreshFuncVal, err := k.valRefreshFunc()
+// Refresh returns a new keyEnclave
+func (k *keyEnclave) Refresh() (Enclave, error) {
+	refreshFuncVal, err := valRefreshFunc(k)
 	if err != nil {
 		return nil, err
 	}
-	refreshFuncUser, err := k.userRefreshFunc()
+	refreshFuncUser, err := userRefreshFunc(k)
 	if err != nil {
 		return nil, err
 	}
-	return ExecuteRefresh(refreshFuncVal, refreshFuncUser)
+	return ExecuteRefresh(refreshFuncVal, refreshFuncUser, k.nonce)
 }
 
-func (k *KeyEnclave) Sign(data []byte) ([]byte, error) {
-	userSign, err := k.userSignFunc(data)
+// Sign returns the signature of the data
+func (k *keyEnclave) Sign(data []byte) ([]byte, error) {
+	userSign, err := userSignFunc(k, data)
 	if err != nil {
 		return nil, err
 	}
-	valSign, err := k.valSignFunc(data)
+	valSign, err := valSignFunc(k, data)
 	if err != nil {
 		return nil, err
 	}
 	return ExecuteSigning(valSign, userSign)
 }
 
-func (k *KeyEnclave) Verify(data []byte, sig []byte) (bool, error) {
+// Verify returns true if the signature is valid
+func (k *keyEnclave) Verify(data []byte, sig []byte) (bool, error) {
 	edSig, err := deserializeSignature(sig)
 	if err != nil {
 		return false, err
@@ -121,31 +147,33 @@ func (k *KeyEnclave) Verify(data []byte, sig []byte) (bool, error) {
 		X:     ePub.X,
 		Y:     ePub.Y,
 	}
-	
+
 	// Hash the message using SHA3-256
 	hash := sha3.New256()
 	hash.Write(data)
 	digest := hash.Sum(nil)
-	
+
 	return ecdsa.Verify(pk, digest, edSig.R, edSig.S), nil
 }
 
-func (k *KeyEnclave) userSignFunc(bz []byte) (SignFunc, error) {
-	curve := curves.K256()
-	return dklsv1.NewBobSign(curve, sha3.New256(), bz, k.UserShare, protocol.Version1)
+// Marshal returns the JSON encoding of keyEnclave
+func (k *keyEnclave) Serialize() ([]byte, error) {
+	// Store compressed public point bytes before marshaling
+	k.PubBytes = k.PubPoint.ToAffineCompressed()
+	return json.Marshal(k)
 }
 
-func (k *KeyEnclave) userRefreshFunc() (RefreshFunc, error) {
+// Unmarshal parses the JSON-encoded data and stores the result
+func (k *keyEnclave) Unmarshal(data []byte) error {
+	if err := json.Unmarshal(data, k); err != nil {
+		return err
+	}
+	// Reconstruct Point from bytes
 	curve := curves.K256()
-	return dklsv1.NewBobRefresh(curve, k.UserShare, protocol.Version1)
-}
-
-func (k *KeyEnclave) valSignFunc(bz []byte) (SignFunc, error) {
-	curve := curves.K256()
-	return dklsv1.NewAliceSign(curve, sha3.New256(), bz, k.ValShare, protocol.Version1)
-}
-
-func (k *KeyEnclave) valRefreshFunc() (RefreshFunc, error) {
-	curve := curves.K256()
-	return dklsv1.NewAliceRefresh(curve, k.ValShare, protocol.Version1)
+	point, err := curve.NewIdentityPoint().FromAffineCompressed(k.PubBytes)
+	if err != nil {
+		return err
+	}
+	k.PubPoint = point
+	return nil
 }

crypto/mpc/protocol.go

@@ -1,14 +1,13 @@
 package mpc
 
 import (
-	"github.com/ipfs/kubo/client/rpc"
 	"github.com/onsonr/sonr/crypto/core/curves"
 	"github.com/onsonr/sonr/crypto/core/protocol"
 	"github.com/onsonr/sonr/crypto/tecdsa/dklsv1"
 )
 
 // GenEnclave generates a new MPC keyshare
-func GenEnclave() (Enclave, error) {
+func GenEnclave(nonce []byte) (Enclave, error) {
 	curve := curves.K256()
 	valKs := dklsv1.NewAliceDkg(curve, protocol.Version1)
 	userKs := dklsv1.NewBobDkg(curve, protocol.Version1)
@@ -24,31 +23,7 @@ func GenEnclave() (Enclave, error) {
 	if err != nil {
 		return nil, err
 	}
-	return initKeyEnclave(valRes, userRes)
-}
-
-// GenEnclaveIPFS generates a new MPC keyshare
-func GenEnclaveIPFS(ipc *rpc.HttpApi) (Enclave, error) {
-	curve := curves.K256()
-	valKs := dklsv1.NewAliceDkg(curve, protocol.Version1)
-	userKs := dklsv1.NewBobDkg(curve, protocol.Version1)
-	aErr, bErr := RunProtocol(userKs, valKs)
-	if err := checkIteratedErrors(aErr, bErr); err != nil {
-		return nil, err
-	}
-	valRes, err := valKs.Result(protocol.Version1)
-	if err != nil {
-		return nil, err
-	}
-	userRes, err := userKs.Result(protocol.Version1)
-	if err != nil {
-		return nil, err
-	}
-	e, err := initKeyEnclave(valRes, userRes)
-	if err != nil {
-		return nil, err
-	}
-	return addEnclaveIPFS(e, ipc)
+	return newEnclave(valRes, userRes, nonce)
 }
 
 // ExecuteSigning runs the MPC signing protocol
@@ -73,7 +48,7 @@ func ExecuteSigning(signFuncVal SignFunc, signFuncUser SignFunc) ([]byte, error)
 }
 
 // ExecuteRefresh runs the MPC refresh protocol
-func ExecuteRefresh(refreshFuncVal RefreshFunc, refreshFuncUser RefreshFunc) (*KeyEnclave, error) {
+func ExecuteRefresh(refreshFuncVal RefreshFunc, refreshFuncUser RefreshFunc, nonce []byte) (Enclave, error) {
 	aErr, bErr := RunProtocol(refreshFuncVal, refreshFuncUser)
 	if err := checkIteratedErrors(aErr, bErr); err != nil {
 		return nil, err
@@ -86,7 +61,7 @@ func ExecuteRefresh(refreshFuncVal RefreshFunc, refreshFuncUser RefreshFunc) (*K
 	if err != nil {
 		return nil, err
 	}
-	return initKeyEnclave(valRefreshResult, userRefreshResult)
+	return newEnclave(valRefreshResult, userRefreshResult, nonce)
 }
 
 // For DKG bob starts first. For refresh and sign, Alice starts first.

crypto/mpc/spec/source.go

@@ -57,9 +57,10 @@ func (k ucanKeyshare) ChainCode() ([]byte, error) {
 
 // DefaultOriginToken returns a default token with the keyshare's issuer as the audience
 func (k ucanKeyshare) OriginToken() (*Token, error) {
-	att := ucan.NewSmartAccount(k.addr)
+	// att := ucan.NewSmartAccount(k.addr)
 	zero := time.Time{}
-	return k.NewOriginToken(k.issuerDID, att, nil, zero, zero)
+	// return k.NewOriginToken(k.issuerDID, att, nil, zero, zero)
+	return k.newToken(k.issuerDID, nil, nil, nil, zero, zero)
 }
 
 func (k ucanKeyshare) SignData(data []byte) ([]byte, error) {
@@ -101,7 +102,6 @@ func (k ucanKeyshare) UCANParser() *ucan.TokenParser {
 			if key == ucan.CapKey {
 				cap = val
 			} else {
-				rsc = ucan.NewStringLengthResource(key, val)
 			}
 		}
 

crypto/mpc/utils.go

@@ -1,34 +1,19 @@
 package mpc
 
 import (
-	"context"
-	"encoding/json"
+	"crypto/aes"
+	"crypto/cipher"
 	"errors"
 	"fmt"
 	"math/big"
 
 	"github.com/cosmos/cosmos-sdk/types/bech32"
-	"github.com/ipfs/boxo/files"
-	"github.com/ipfs/kubo/client/rpc"
 	"github.com/onsonr/sonr/crypto/core/curves"
 	"github.com/onsonr/sonr/crypto/core/protocol"
 	"github.com/onsonr/sonr/crypto/tecdsa/dklsv1"
+	"golang.org/x/crypto/sha3"
 )
 
-func addEnclaveIPFS(enclave *KeyEnclave, ipc *rpc.HttpApi) (Enclave, error) {
-	jsonEnclave, err := json.Marshal(enclave)
-	if err != nil {
-		return nil, err
-	}
-	// Save enclave to IPFS
-	cid, err := ipc.Unixfs().Add(context.Background(), files.NewBytesFile(jsonEnclave))
-	if err != nil {
-		return nil, err
-	}
-	enclave.VaultCID = cid.String()
-	return enclave, nil
-}
-
 func checkIteratedErrors(aErr, bErr error) error {
 	if aErr == protocol.ErrProtocolFinished && bErr == protocol.ErrProtocolFinished {
 		return nil
@@ -51,6 +36,47 @@ func computeSonrAddr(pp Point) (string, error) {
 	return sonrAddr, nil
 }
 
+func hashKey(key []byte) []byte {
+	hash := sha3.New256()
+	hash.Write(key)
+	return hash.Sum(nil)[:32] // Use first 32 bytes of hash
+}
+
+func decryptKeyshare(msg []byte, key []byte, nonce []byte) ([]byte, error) {
+	hashedKey := hashKey(key)
+	block, err := aes.NewCipher(hashedKey)
+	if err != nil {
+		return nil, err
+	}
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	plaintext, err := aesgcm.Open(nil, nonce, msg, nil)
+	if err != nil {
+		return nil, err
+	}
+	return plaintext, nil
+}
+
+func encryptKeyshare(msg Message, key []byte, nonce []byte) ([]byte, error) {
+	hashedKey := hashKey(key)
+	msgBytes, err := protocol.EncodeMessage(msg)
+	if err != nil {
+		return nil, err
+	}
+	block, err := aes.NewCipher(hashedKey)
+	if err != nil {
+		return nil, err
+	}
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	ciphertext := aesgcm.Seal(nil, nonce, []byte(msgBytes), nil)
+	return ciphertext, nil
+}
+
 func getAliceOut(msg *protocol.Message) (AliceOut, error) {
 	return dklsv1.DecodeAliceDkgResult(msg)
 }
@@ -122,3 +148,23 @@ func deserializeSignature(sigBytes []byte) (*curves.EcdsaSignature, error) {
 		S: s,
 	}, nil
 }
+
+func userSignFunc(k *keyEnclave, bz []byte) (SignFunc, error) {
+	curve := curves.K256()
+	return dklsv1.NewBobSign(curve, sha3.New256(), bz, k.UserShare, protocol.Version1)
+}
+
+func userRefreshFunc(k *keyEnclave) (RefreshFunc, error) {
+	curve := curves.K256()
+	return dklsv1.NewBobRefresh(curve, k.UserShare, protocol.Version1)
+}
+
+func valSignFunc(k *keyEnclave, bz []byte) (SignFunc, error) {
+	curve := curves.K256()
+	return dklsv1.NewAliceSign(curve, sha3.New256(), bz, k.ValShare, protocol.Version1)
+}
+
+func valRefreshFunc(k *keyEnclave) (RefreshFunc, error) {
+	curve := curves.K256()
+	return dklsv1.NewAliceRefresh(curve, k.ValShare, protocol.Version1)
+}