feat(sdk-core): align DKLS safe VRF keygen with the HSM

[s84krish]

Ticket: WCN-3084

• Safe ecdsaMpc keygen fails at R1: the HSM returns 400 because the VRF messages are sent as unsigned base64(JSON) strings.
• Sign each party's VRF message with its GPG key (DklsComms.detachSignData), in the {from, message, signature} shape the HSM verifies.
• Verify BitGo's signature on bitgoVrfMsg1. Decrypt and verify bitgoVrfMsgToUser / bitgoVrfMsgToBackup.
• R2 sends only each party's opening addressed to BitGo, signed.
• Remove the nonexistent bitgoVrfMsg2 assertion, the local opaque VRF types, and the serialize helpers.
• Bump @bitgo/public-types 6.83.0 to 6.88.0 in all eight modules, for the new DKLS VRF codecs.
• Merge after the matching WP PR is deployed: each side rejects the other's old format (safe ecdsaMpc only; it already fails today).
• Tests: the fake HSM now follows the hsm-api contract, with new cases for a forged R1 commitment and forged R2 openings. Not run against a real HSM.

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run

[s84krish]

@claude review this PR focusing on correctness, implementation, and code quality. Give an approval score

[github-actions]

Claude finished @s84krish's task —— View job

---

PR Review: DKLS Safe VRF Keygen HSM Alignment

Todo List:

• Analyze core DKLS VRF implementation changes
• Review cryptographic security aspects
• Examine test updates and coverage
• Check package.json dependency updates
• Evaluate code quality and best practices
• Provide approval score and summary

---

Summary

This PR successfully aligns the DKLS safe VRF keygen implementation with HSM requirements by replacing unsigned base64 JSON serialization with properly signed GPG messages. The changes are well-implemented, secure, and thoroughly tested.

Key Strengths ✅

Security & Cryptography

• Proper Message Signing: All VRF messages now signed with party GPG keys using DklsComms.detachSignData
• HSM Contract Compliance: Matches expected {from, message, signature} format for client messages
• Strong Verification: BitGo signatures verified before processing with proper error handling
• Secure Encryption: BitGo openings encrypted to recipient GPG keys and signed over plaintext

Code Quality

• Clean Refactoring: Removed complex serialization helpers in favor of focused utility functions
• Good Error Messages: Clear assertions with descriptive error messages ("Failed to authenticate BitGo VRF message 1")
• Type Safety: Proper TypeScript usage with runtime assertions
• Consistent Dependencies: Clean bump of @bitgo/public-types across all 8 modules

Test Coverage

• Security Testing: New tests for forged commitments and openings with tamper detection
• HSM Simulation: Realistic fake HSM following the actual hsm-api contract
• Edge Cases: Comprehensive verification failure scenarios
• Maintainability: Well-structured test helpers for different attack vectors

Technical Details

Core Changes (modules/sdk-core/src/bitgo/utils/tss/ecdsa/ecdsaVrfMPCv2.ts)

• Replaced serializeVrfMessages/deserializeVrfMessages with direct GPG signing
• Added signVrfMessage, verifyBitgoVrfBroadcast, decryptBitgoVrfOpening utilities
• Round 2 now sends only BitGo-addressed openings (signed), not full batch
• Proper verification of BitGo's encrypted/signed VRF openings

Type System Cleanup (typesMPCv2.ts)

• Removed unused MpcV2VrfKeyGenRequestFields and MpcV2VrfKeyGenResponseFields types
• Cleaner type definitions aligned with actual API contracts

Minor Observations

• CI Status: Node 26.x tests failing (non-blocking, not LTS yet)
• Dependency Consistency: All 8 modules properly updated to @bitgo/[email protected]
• Backwards Compatibility: Safe deployment strategy noted - each side rejects old format

Approval Score: 9/10 ⭐

Rationale: This is excellent cryptographic work with proper security practices, comprehensive testing, and clean implementation. The -1 point is only due to the Node 26.x test failures, though these are non-blocking for an unreleased Node version.

Recommendation: ✅ APPROVE - Ready for merge after matching WP PR deployment

---

View CI Status | Branch: sibikrishnan/wcn-3084-dkls-vrf-keygen-signed-messages

[davidkaplanbitgo]

nit

[davidkaplanbitgo]

Suggested change

* hsm-api (`test/dkls_vrf_keygen.js`) is the contract: client VRF messages are signed

Don't mention hsm-api

[davidkaplanbitgo]

Being merged into #9983