feat(sdk-core): add verifyPeerMessageRoundThree to EddsaDSGMethods

Add verifyPeerMessageRoundThree to
modules/sdk-core/src/bitgo/tss/eddsa/eddsaMPCv2.ts, mirroring the
call signature of verifyPeerMessageRoundOne and
verifyPeerMessageRoundTwo. It decodes and GPG-verifies the MPS DSG
round-3 message via MPSComms.verifyMpsMessage.

Round 3 previously had no such helper, forcing callers to inline
MPSComms.verifyMpsMessage directly instead of using the symmetric
round1/round2 helpers already exposed by EddsaDSGMethods.

Ticket: WCI-1191
Session-Id: 0716649e-75cb-46dd-8d6a-ae0a701167d6
Task-Id: 3a82317d-853d-4878-97a8-50cf6fa938c5

Author: vibhavgo

modules/sdk-core/src/bitgo/tss/eddsa/eddsaMPCv2.ts

@@ -6,6 +6,7 @@ import {
   EddsaMPCv2SignatureShareRound2Input,
   EddsaMPCv2SignatureShareRound2Output,
   EddsaMPCv2SignatureShareRound3Input,
+  EddsaMPCv2SignedMessage,
 } from '@bitgo/public-types';
 import { SignatureShareRecord, SignatureShareType } from '../../utils/tss/baseTypes';
 import { MPCv2PartiesEnum } from '../../utils/tss/ecdsa/typesMPCv2';
@@ -100,6 +101,19 @@ export async function verifyPeerMessageRoundTwo(
   };
 }
 
+/**
+ * Verifies the peer's round-3 PGP signature and returns the raw deserialized
+ * message ready for `DSG.handleIncomingMessages`.
+ */
+export async function verifyPeerMessageRoundThree(
+  parsedRound3Output: { data: { msg3: EddsaMPCv2SignedMessage } },
+  peerGpgKey: openpgp.Key,
+  peerPartyId: MPCv2PartiesEnum = MPCv2PartiesEnum.BITGO
+): Promise<MPSTypes.DeserializedMessage> {
+  const rawBytes = await MPSComms.verifyMpsMessage(parsedRound3Output.data.msg3, peerGpgKey);
+  return { from: peerPartyId, payload: new Uint8Array(rawBytes) };
+}
+
 /**
  * Builds the round-3 signature share record (final signer message).
  *

modules/sdk-core/test/unit/bitgo/utils/tss/eddsa/eddsaMPCv2.ts

@@ -34,6 +34,7 @@ import {
   getSignatureShareRoundThree,
   verifyPeerMessageRoundOne,
   verifyPeerMessageRoundTwo,
+  verifyPeerMessageRoundThree,
 } from '../../../../../../src/bitgo/tss/eddsa/eddsaMPCv2';
 import { getInitializedMpcInstance } from '../../../../../../src/bitgo/tss/eddsa/eddsa';
 import { getBitgoSignatureShare } from '../../../../../../src/bitgo/tss/common';
@@ -344,6 +345,54 @@ describe('EdDSA MPS DSG helper functions', async () => {
     assert.ok(parsed.data.msg3.message, 'msg3.message should be set');
     assert.ok(parsed.data.msg3.signature, 'msg3.signature should be set');
   });
+
+  it('verifyPeerMessageRoundThree should verify a valid BitGo round-3 message', async () => {
+    const messageBuffer = Buffer.from(signableHex, 'hex');
+    const userDsg = new EddsaMPSDsg.DSG(MPCv2PartiesEnum.USER);
+    await userDsg.initDsg(userKeyShare, messageBuffer, derivationPath, MPCv2PartiesEnum.BITGO);
+    const userMsg1 = userDsg.getFirstMessage();
+
+    const bitgoDsg = new EddsaMPSDsg.DSG(MPCv2PartiesEnum.BITGO);
+    await bitgoDsg.initDsg(bitgoKeyShare, messageBuffer, derivationPath, MPCv2PartiesEnum.USER);
+    const bitgoMsg1 = bitgoDsg.getFirstMessage();
+
+    const [bitgoMsg2] = bitgoDsg.handleIncomingMessages([bitgoMsg1, userMsg1]);
+    const bitgoSignedMsg1 = await MPSComms.detachSignMpsMessage(Buffer.from(bitgoMsg1.payload), bitgoGpgPrivKey);
+    const bitgoDeserializedMsg1 = await verifyPeerMessageRoundOne(
+      { type: 'round1Output', data: { msg1: bitgoSignedMsg1 } },
+      bitgoGpgPubKey
+    );
+    const [userMsg2] = userDsg.handleIncomingMessages([userMsg1, bitgoDeserializedMsg1]);
+    const [bitgoMsg3] = bitgoDsg.handleIncomingMessages([bitgoMsg2, userMsg2]);
+    const bitgoSignedMsg3 = await MPSComms.detachSignMpsMessage(Buffer.from(bitgoMsg3.payload), bitgoGpgPrivKey);
+
+    const round3Output = {
+      type: 'round3Output' as const,
+      data: { msg3: bitgoSignedMsg3 },
+    };
+
+    const result = await verifyPeerMessageRoundThree(round3Output, bitgoGpgPubKey);
+
+    assert.strictEqual(result.from, MPCv2PartiesEnum.BITGO);
+    assert.ok(result.payload.length > 0, 'payload should be non-empty');
+  });
+
+  it('verifyPeerMessageRoundThree should throw on a tampered message', async () => {
+    const round3Output = {
+      type: 'round3Output' as const,
+      data: {
+        msg3: {
+          message: Buffer.from('tampered').toString('base64'),
+          signature: '-----BEGIN PGP SIGNATURE-----\n\nINVALID\n-----END PGP SIGNATURE-----\n',
+        },
+      },
+    };
+
+    await assert.rejects(
+      verifyPeerMessageRoundThree(round3Output, bitgoGpgPubKey),
+      'should throw on invalid signature'
+    );
+  });
 });
 
 describe('getEddsaMPCv2RecoveryKeyShares', () => {