*: prohibit TZ hashing

CHANGELOG.md

@@ -63,6 +63,7 @@ a huge list of updates and fixes.
 - SN no longer accepts objects with invocation or verification script bigger than 1KiB (#3887)
 - Every object with non-zero payload is now paid, not only regular ones (#3856)
 - Separate policer placement state from replica shortage (#3901)
+- Storage nodes do not calculate homomorphic hashes for objects (#3847)
 
 ### Removed
 - `node.persistent_sessions.path` config option from SN config (#3846)

cmd/neofs-adm/internal/modules/config/config.go

@@ -14,16 +14,15 @@ import (
 )
 
 type configTemplate struct {
-	Endpoint                string
-	AlphabetDir             string
-	MaxObjectSize           int
-	EpochDuration           int
-	BasicIncomeRate         int
-	ContainerFee            int
-	ContainerAliasFee       int
-	WithdrawFee             int
-	AlphabetNames           []string
-	HomomorphicHashDisabled bool
+	Endpoint          string
+	AlphabetDir       string
+	MaxObjectSize     int
+	EpochDuration     int
+	BasicIncomeRate   int
+	ContainerFee      int
+	ContainerAliasFee int
+	WithdrawFee       int
+	AlphabetNames     []string
 }
 
 const configTxtTemplate = `rpc-endpoint: {{ .Endpoint}}
@@ -32,7 +31,6 @@ network:
   max_object_size: {{ .MaxObjectSize}}
   epoch_duration: {{ .EpochDuration}}
   basic_income_rate: {{ .BasicIncomeRate}}
-  homomorphic_hash_disabled: {{ .HomomorphicHashDisabled}}
   fee:
     container: {{ .ContainerFee}}
     container_alias: {{ .ContainerAliasFee }}
@@ -103,15 +101,14 @@ func defaultConfigPath() (string, error) {
 // some comments as well.
 func generateConfigExample(appDir string, credSize int) (string, error) {
 	tmpl := configTemplate{
-		Endpoint:                "https://neo.rpc.node:30333",
-		MaxObjectSize:           67108864,    // 64 MiB
-		EpochDuration:           240,         // 1 hour with 15s per block
-		BasicIncomeRate:         1_0000_0000, // 0.0001 GAS per GiB (Fixed12)
-		HomomorphicHashDisabled: false,       // object homomorphic hash is enabled
-		ContainerFee:            1000,        // 0.000000001 * 7 GAS per container (Fixed12)
-		ContainerAliasFee:       500,         // ContainerFee / 2
-		WithdrawFee:             1_0000_0000, // 1.0 GAS (Fixed8)
-		AlphabetNames:           make([]string, 0, credSize),
+		Endpoint:          "https://neo.rpc.node:30333",
+		MaxObjectSize:     67108864,    // 64 MiB
+		EpochDuration:     240,         // 1 hour with 15s per block
+		BasicIncomeRate:   1_0000_0000, // 0.0001 GAS per GiB (Fixed12)
+		ContainerFee:      1000,        // 0.000000001 * 7 GAS per container (Fixed12)
+		ContainerAliasFee: 500,         // ContainerFee / 2
+		WithdrawFee:       1_0000_0000, // 1.0 GAS (Fixed8)
+		AlphabetNames:     make([]string, 0, credSize),
 	}
 
 	appDir, err := filepath.Abs(appDir)

cmd/neofs-adm/internal/modules/fschain/config.go

@@ -76,13 +76,6 @@ func dumpNetworkConfig(cmd *cobra.Command, _ []string) error {
 			_, _ = fmt.Fprintf(tw, "%s:\t%d (int)\n", k, n)
 		case netmapEigenTrustAlphaKey:
 			_, _ = fmt.Fprintf(tw, "%s:\t%s (str)\n", k, v)
-		case netmapHomomorphicHashDisabledKey:
-			vBool, err := tuple[1].TryBool()
-			if err != nil {
-				return invalidConfigValueErr(k)
-			}
-
-			_, _ = fmt.Fprintf(tw, "%s:\t%t (bool)\n", k, vBool)
 		default:
 			_, _ = fmt.Fprintf(tw, "%s:\t%s (hex)\n", k, hex.EncodeToString(v))
 		}
@@ -167,12 +160,6 @@ func parseConfigPair(kvStr string, force bool) (key string, val any, err error)
 		}
 
 		val = valRaw
-	case netmapHomomorphicHashDisabledKey:
-		val, err = strconv.ParseBool(valRaw)
-		if err != nil {
-			err = fmt.Errorf("invalid value for %s key, expected bool, got '%s'", key, valRaw)
-		}
-
 	default:
 		if !force {
 			return "", nil, fmt.Errorf(

cmd/neofs-adm/internal/modules/fschain/initialize_deploy.go

@@ -43,15 +43,14 @@ const (
 )
 
 const (
-	netmapEpochKey                   = "EpochDuration"
-	netmapMaxObjectSizeKey           = "MaxObjectSize"
-	netmapContainerFeeKey            = "ContainerFee"
-	netmapContainerAliasFeeKey       = "ContainerAliasFee"
-	netmapEigenTrustIterationsKey    = "EigenTrustIterations"
-	netmapEigenTrustAlphaKey         = "EigenTrustAlpha"
-	netmapBasicIncomeRateKey         = "BasicIncomeRate"
-	netmapWithdrawFeeKey             = "WithdrawFee"
-	netmapHomomorphicHashDisabledKey = "HomomorphicHashingDisabled"
+	netmapEpochKey                = "EpochDuration"
+	netmapMaxObjectSizeKey        = "MaxObjectSize"
+	netmapContainerFeeKey         = "ContainerFee"
+	netmapContainerAliasFeeKey    = "ContainerAliasFee"
+	netmapEigenTrustIterationsKey = "EigenTrustIterations"
+	netmapEigenTrustAlphaKey      = "EigenTrustAlpha"
+	netmapBasicIncomeRateKey      = "BasicIncomeRate"
+	netmapWithdrawFeeKey          = "WithdrawFee"
 
 	defaultEigenTrustIterations = 4
 	defaultEigenTrustAlpha      = "0.1"
@@ -420,18 +419,6 @@ func (c *initializeContext) getContractDeployData(ctrHash util.Uint160, ctrName
 			}
 			configParam = append(configParam, kf.key, i64)
 		}
-		for _, kf := range []struct {
-			key  string
-			flag string
-		}{
-			{netmapHomomorphicHashDisabledKey, homomorphicHashDisabledInitFlag},
-		} {
-			bval, err := unwrap.Bool(c.ReadOnlyInvoker.Call(ctrHash, "config", kf.key))
-			if err != nil {
-				bval = viper.GetBool(kf.flag)
-			}
-			configParam = append(configParam, kf.key, bval)
-		}
 		configParam = append(configParam, netmapEigenTrustIterationsKey, int64(defaultEigenTrustIterations),
 			netmapEigenTrustAlphaKey, defaultEigenTrustAlpha,
 		)

cmd/neofs-adm/internal/modules/fschain/root.go

@@ -13,37 +13,36 @@ import (
 )
 
 const (
-	alphabetWalletsFlag             = "alphabet-wallets"
-	alphabetSizeFlag                = "size"
-	endpointFlag                    = "rpc-endpoint"
-	storageWalletFlag               = "storage-wallet"
-	storageWalletLabelFlag          = "label"
-	storageWalletsNumber            = "wallets-number"
-	storageGasCLIFlag               = "initial-gas"
-	storageGasConfigFlag            = "storage.initial_gas"
-	contractsInitFlag               = "contracts"
-	maxObjectSizeInitFlag           = "network.max_object_size"
-	epochDurationInitFlag           = "network.epoch_duration"
-	incomeRateInitFlag              = "network.basic_income_rate"
-	containerFeeInitFlag            = "network.fee.container"
-	containerAliasFeeInitFlag       = "network.fee.container_alias"
-	homomorphicHashDisabledInitFlag = "network.homomorphic_hash_disabled"
-	withdrawFeeInitFlag             = "network.fee.withdraw"
-	containerDumpFlag               = "dump"
-	containerContractFlag           = "container-contract"
-	containerIDsFlag                = "cid"
-	refillGasAmountFlag             = "gas"
-	walletAccountFlag               = "account"
-	notaryDepositTillFlag           = "till"
-	walletAddressFlag               = "wallet-address"
-	domainFlag                      = "domain"
-	neoAddressesFlag                = "neo-addresses"
-	publicKeysFlag                  = "public-keys"
-	walletFlag                      = "wallet"
-	containerIDFlag                 = "cid"
-	mintNeofsAmountFlag             = "amount"
-	mintTxHashFlag                  = "deposit-tx"
-	quotasSoftLimitFlag             = "soft"
+	alphabetWalletsFlag       = "alphabet-wallets"
+	alphabetSizeFlag          = "size"
+	endpointFlag              = "rpc-endpoint"
+	storageWalletFlag         = "storage-wallet"
+	storageWalletLabelFlag    = "label"
+	storageWalletsNumber      = "wallets-number"
+	storageGasCLIFlag         = "initial-gas"
+	storageGasConfigFlag      = "storage.initial_gas"
+	contractsInitFlag         = "contracts"
+	maxObjectSizeInitFlag     = "network.max_object_size"
+	epochDurationInitFlag     = "network.epoch_duration"
+	incomeRateInitFlag        = "network.basic_income_rate"
+	containerFeeInitFlag      = "network.fee.container"
+	containerAliasFeeInitFlag = "network.fee.container_alias"
+	withdrawFeeInitFlag       = "network.fee.withdraw"
+	containerDumpFlag         = "dump"
+	containerContractFlag     = "container-contract"
+	containerIDsFlag          = "cid"
+	refillGasAmountFlag       = "gas"
+	walletAccountFlag         = "account"
+	notaryDepositTillFlag     = "till"
+	walletAddressFlag         = "wallet-address"
+	domainFlag                = "domain"
+	neoAddressesFlag          = "neo-addresses"
+	publicKeysFlag            = "public-keys"
+	walletFlag                = "wallet"
+	containerIDFlag           = "cid"
+	mintNeofsAmountFlag       = "amount"
+	mintTxHashFlag            = "deposit-tx"
+	quotasSoftLimitFlag       = "soft"
 )
 
 var (

cmd/neofs-cli/modules/netmap/netinfo.go

@@ -51,7 +51,7 @@ var netInfoCmd = &cobra.Command{
 		cmd.Printf(format, "Epoch duration", netInfo.EpochDuration())
 		cmd.Printf(format, "Maximum object size", netInfo.MaxObjectSize())
 		cmd.Printf(format, "Withdrawal fee", netInfo.WithdrawalFee())
-		cmd.Printf(format, "Homomorphic hashing disabled", netInfo.HomomorphicHashingDisabled())
+		cmd.Printf(format, "Homomorphic hashing disabled", netInfo.HomomorphicHashingDisabled()) //nolint:staticcheck // networks may still have this setting
 
 		cmd.Println("NeoFS network configuration (other)")
 		for name, value := range netInfo.RawNetworkParameters() {

cmd/neofs-cli/modules/object/hash.go

@@ -9,7 +9,6 @@ import (
 	"github.com/nspcc-dev/neofs-node/cmd/neofs-cli/internal/common"
 	"github.com/nspcc-dev/neofs-node/cmd/neofs-cli/internal/commonflags"
 	"github.com/nspcc-dev/neofs-node/cmd/neofs-cli/internal/key"
-	"github.com/nspcc-dev/neofs-sdk-go/checksum"
 	"github.com/nspcc-dev/neofs-sdk-go/client"
 	cid "github.com/nspcc-dev/neofs-sdk-go/container/id"
 	oid "github.com/nspcc-dev/neofs-sdk-go/object/id"
@@ -21,7 +20,6 @@ const getRangeHashSaltFlag = "salt"
 
 const (
 	hashSha256 = "sha256"
-	hashTz     = "tz"
 	rangeSep   = ":"
 )
 
@@ -46,7 +44,7 @@ func initObjectHashCmd() {
 	_ = objectHashCmd.MarkFlagRequired(commonflags.OIDFlag)
 
 	flags.String("range", "", "Range to take hash from in the form offset1:length1,... Full object payload length if not specified")
-	flags.String("type", hashSha256, "Hash type. Either 'sha256' or 'tz'")
+	flags.String("type", hashSha256, "Hash type. Deprecated: can be omitted, only 'sha256' is currently supported")
 	flags.String(getRangeHashSaltFlag, "", "Salt in hex format")
 }
 
@@ -63,7 +61,8 @@ func getObjectHash(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return err
 	}
-	typ, err := getHashType(cmd)
+	// only validation of deprecated no-op flag
+	_, err = getHashType(cmd)
 	if err != nil {
 		return err
 	}
@@ -89,7 +88,6 @@ func getObjectHash(cmd *cobra.Command, _ []string) error {
 	}
 	defer cli.Close()
 
-	tz := typ == hashTz
 	fullHash := len(ranges) == 0
 	if fullHash {
 		common.PrintVerbose(cmd, "Get the hash of the full object payload.")
@@ -105,15 +103,7 @@ func getObjectHash(cmd *cobra.Command, _ []string) error {
 			return fmt.Errorf("rpc error: read object header via client: %w", err)
 		}
 
-		var cs checksum.Checksum
-		var csSet bool
-
-		if tz {
-			cs, csSet = hdr.PayloadHomomorphicHash()
-		} else {
-			cs, csSet = hdr.PayloadChecksum()
-		}
-
+		cs, csSet := hdr.PayloadChecksum()
 		if csSet {
 			cmd.Println(hex.EncodeToString(cs.Value()))
 		} else {
@@ -141,10 +131,6 @@ func getObjectHash(cmd *cobra.Command, _ []string) error {
 	}
 	hashPrm.SetRangeList(rngs...)
 
-	if tz {
-		hashPrm.TillichZemorAlgo()
-	}
-
 	hs, err := cli.ObjectHash(ctx, cnr, obj, user.NewAutoIDSigner(*pk), hashPrm)
 	if err != nil {
 		return fmt.Errorf("rpc error: read payload hashes via client: %w", err)
@@ -160,7 +146,7 @@ func getObjectHash(cmd *cobra.Command, _ []string) error {
 func getHashType(cmd *cobra.Command) (string, error) {
 	rawType := cmd.Flag("type").Value.String()
 	switch typ := strings.ToLower(rawType); typ {
-	case hashSha256, hashTz:
+	case hashSha256:
 		return typ, nil
 	default:
 		return "", fmt.Errorf("invalid hash type: %s", typ)

cmd/neofs-cli/modules/object/head.go

@@ -167,7 +167,7 @@ func printHeader(cmd *cobra.Command, obj *object.Object) error {
 	cmd.Printf("Owner: %s\n", obj.Owner())
 	cmd.Printf("CreatedAt: %d\n", obj.CreationEpoch())
 	cmd.Printf("Size: %d\n", obj.PayloadSize())
-	common.PrintChecksum(cmd, "HomoHash", obj.PayloadHomomorphicHash)
+	common.PrintChecksum(cmd, "HomoHash", obj.PayloadHomomorphicHash) //nolint:staticcheck // old objects may still have it
 	common.PrintChecksum(cmd, "Checksum", obj.PayloadChecksum)
 	cmd.Printf("Type: %s\n", obj.Type())
 

cmd/neofs-cli/modules/object/search.go

@@ -202,6 +202,13 @@ func parseSearchFilters(cmd *cobra.Command) (object.SearchFilters, error) {
 		fs.AddPhyFilter()
 	}
 
+	// nolint:staticcheck // deprecated but that is what is checked there
+	for _, f := range fs {
+		if f.Header() == object.FilterPayloadHomomorphicHash {
+			return nil, fmt.Errorf("%s filter target is prohibited starting from API 2.23", object.FilterPayloadHomomorphicHash)
+		}
+	}
+
 	return fs, nil
 }
 

cmd/neofs-node/netmap.go

@@ -484,10 +484,6 @@ func (c *cfg) GetNetworkInfo() (netmapSDK.NetworkInfo, error) {
 	ni.SetEigenTrustAlpha(netInfoMorph.EigenTrustAlpha)
 	ni.SetWithdrawalFee(netInfoMorph.WithdrawalFee)
 
-	if netInfoMorph.HomomorphicHashingDisabled {
-		ni.DisableHomomorphicHashing()
-	}
-
 	for i := range netInfoMorph.Raw {
 		ni.SetRawNetworkParameter(netInfoMorph.Raw[i].Name, netInfoMorph.Raw[i].Value)
 	}

go.mod

@@ -2,6 +2,8 @@ module github.com/nspcc-dev/neofs-node
 
 go 1.25.0
 
+replace github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.17.0.20260325133051-c1dbddc28fdf => ../neofs-sdk-go
+
 require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/cheggaaa/pb v1.0.29
@@ -21,7 +23,7 @@ require (
 	github.com/nspcc-dev/neo-go v0.118.0
 	github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea
 	github.com/nspcc-dev/neofs-contract v0.26.1
-	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.18
+	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.17.0.20260327202214-2179ca1cb8d8
 	github.com/nspcc-dev/tzhash v1.8.4
 	github.com/panjf2000/ants/v2 v2.11.5
 	github.com/prometheus/client_golang v1.23.2

go.sum

@@ -191,8 +191,8 @@ github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea h1:mK
 github.com/nspcc-dev/neofs-api-go/v2 v2.14.1-0.20240827150555-5ce597aa14ea/go.mod h1:YzhD4EZmC9Z/PNyd7ysC7WXgIgURc9uCG1UWDeV027Y=
 github.com/nspcc-dev/neofs-contract v0.26.1 h1:7Ii7Q4L3au408LOsIWKiSgfnT1g8G9jo3W7381d41T8=
 github.com/nspcc-dev/neofs-contract v0.26.1/go.mod h1:pevVF9OWdEN5bweKxOu6ryZv9muCEtS1ppzYM4RfBIo=
-github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.18 h1:2hsOgVEFCAT/vy+1WStNqk//XujMdHAtJ2n08vT+ITQ=
-github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.18/go.mod h1:aUnzNCaipQZUQaai9lcapG90OwYx7g9s4UsrvcVkBoo=
+github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.17.0.20260327202214-2179ca1cb8d8 h1:VhGG+9qrBaQ+tS3u+hmX5OjZTzEjAz2PU3rvMiEyK4g=
+github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.17.0.20260327202214-2179ca1cb8d8/go.mod h1:aUnzNCaipQZUQaai9lcapG90OwYx7g9s4UsrvcVkBoo=
 github.com/nspcc-dev/rfc6979 v0.2.4 h1:NBgsdCjhLpEPJZqmC9rciMZDcSY297po2smeaRjw57k=
 github.com/nspcc-dev/rfc6979 v0.2.4/go.mod h1:86ylDw6Kss+P6v4QAJqo1Sp3mC0/Zr9G97xSjQ9TuFg=
 github.com/nspcc-dev/tzhash v1.8.4 h1:lvuPGWsqEo9dVEvo/kdNLKv/Cy0yxRs9z5hJp8VcBuo=

internal/crypto/object_test.go

@@ -226,7 +226,7 @@ func getUnsignedObject() object.Object {
 	par.SetOwner(mainAcc)
 	par.SetCreationEpoch(creationEpoch)
 	par.SetType(typ)
-	par.SetPayloadHomomorphicHash(checksum.NewTillichZemor(tz.Sum(payload)))
+	par.SetPayloadHomomorphicHash(checksum.NewTillichZemor(tz.Sum(payload))) //nolint:staticcheck // this is a test and such objects are possible
 	par.SetPayloadChecksum(checksum.NewSHA256(sha256.Sum256(payload)))
 	par.SetAttributes(object.NewAttribute("690530953", "39483258"), object.NewAttribute("7208331", "31080424839"))
 	par.SetID(oid.ID{156, 209, 245, 87, 177, 145, 183, 8, 181, 92, 171, 193, 58, 125, 77, 11, 28, 161, 217, 151, 17, 212, 232, 88, 6,
@@ -240,7 +240,7 @@ func getUnsignedObject() object.Object {
 	child.SetOwner(mainAcc)
 	child.SetCreationEpoch(creationEpoch)
 	child.SetType(typ)
-	child.SetPayloadHomomorphicHash(checksum.NewTillichZemor(tz.Sum(childPayload)))
+	child.SetPayloadHomomorphicHash(checksum.NewTillichZemor(tz.Sum(childPayload))) //nolint:staticcheck // this is a test and such objects are possible
 	child.SetPayloadChecksum(checksum.NewSHA256(sha256.Sum256(childPayload)))
 	child.SetAttributes(object.NewAttribute("31429585", "689450942"), object.NewAttribute("129849325", "859384298"))
 	child.SetParent(&par)