[sui-node] Add epochs to key signed structures

[gdanezis]

This PR moves Sui towards being aware of epochs. This is necessary to support reconfiguration.

Epochs: committees are only valid within an epoch, denoted using an EpochId. Authority Signatures are only valid with respect to a specific epoch and are tied to the epoch. Furthermore, certificates can only aggregate signatures from the same epoch. Execution happens within a specific epoch for all nodes, and uses this epochId, gas price etc from the epoch.

This PR:

• Adds epochs to committee.
• Adds epoch to signed transactions (signature not transaction itself), and the certified transaction.
• Adds checks for epoch in certificate verification.

Future:

• Need to determine if we assume validators rotate keys between epochs (so signatures are not valid by themselves between epochs), or if they may re-use signatures, so we need to add epoch in the signed payload.

[kchalkias]

We could you use #[serde(skip)] for transient fields (in a future PR).

[gdanezis]

Yes, we should -- but right now this stuct is not Serde Serizalize / Deserialize hence why we just have a comment.

[kchalkias]

Ideally we want to log both used and expected epochs (not a PR blocker).

[lxfind]

Why do we need epoch in unsigned transaction effects?

[gdanezis]

Why do we need epoch in unsigned transaction effects?

Yes, I think we do, but I would love to get your feedback on how to do this @lxfind :

• A transaction is not tied to an epoch, it can be executed in any epoch.
• An authority signature and certificate on a transaction is tied to an epoch, in that the signature and cert are tied to a committee within an epoch.
• An execution is tied to an epoch. As we discussed elsewhere it depends on the gas price and other epoch specific things. So if we want to use down the line transaction effects to contain all information necessary to re-construct the state we need to have a sense of the epoch.

So I went for the simple option of adding the epoch into the effects structure to make sure we have it. However, one could also (a) just include it in the effects signature and (b) implicitly get it through the checkpoint in which the transaction is included (adding to checkpoint = executed in this epoch).

I am open minded about this -- down the line we might reconsider. But ultimately the tl;dr to the question is: when you execute based on effects you need to know the epoch to get gas price etc.

[lxfind]

Not sure what it means by "execute based on the effects". Transaction effects never show up alone, right? i.e. on authorities we always only store signed transaction effects. Only gateway stores the unsigned ones, but we would have a cert at that point before applying the effects.

[kchalkias]

Transaction effects never show up alone, right?

iiuc, although protocol wise it might not show up alone, there might be external light clients that cannot run a full Sui VM, but will be convinced by the results of a tx if they see a signed TxEffects. And these services might need to know at which epoch it was submitted (got the cert) as a timestamp reference, even before you see the tx included in a checkpoint.

In that sense, external services that use the fastX finality property as a light client evidence might be benefited from that. That's the main difference between options a and b that George proposes (I guess, correct me if I'm wrong).
Also @gdanezis qq: do we have guarantees, that a tx which received a cert at EpochA, will be in the next checkpoint (or it might be many checkpoints after)?

[lxfind]

iiuc, although protocol wise it might not show up alone, there might be external light clients that cannot run a full Sui VM, but will be convinced by the results of a tx if they see a signed TxEffects. And these services might need to know at which epoch it was submitted (got the cert) as a timestamp reference, even before you see the tx included in a checkpoint.

A signed tx effect will have the epoch in its authority signature info. What I was asking is whether we need the epoch in an unsigned tx effect, which by itself is never authenticatable and hence would never show up alone

[kchalkias]

unsigned tx effect
if we include it in its authority signature, I think I agree we might not need it here. Good catch!

[gdanezis]

Thanks for the feedback -- I will ensure we have epoch in the AuthoritySignature signed struct rather than the effects structure then.

[gdanezis]

Update: now removed the epoch from the effects structure. And landing once all is good with the tests here.