keymanager: Allow one epoch in the future during validation

This avoids an issue where a key manager node that is slightly behind would return an error during an epoch transition.
oasisprotocol · May 7, 2024 · ee9c570 · ee9c570
1 parent dcaef17
commit ee9c570
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/.changelog/5686.bugfix.md b/.changelog/5686.bugfix.md
@@ -0,0 +1,4 @@
+keymanager: Allow one epoch in the future during validation
+
+This avoids an issue where a key manager node that is slightly behind
+would return an error during an epoch transition.
diff --git a/keymanager/src/runtime/secrets.rs b/keymanager/src/runtime/secrets.rs
@@ -534,10 +534,10 @@ impl Secrets {
     }
 
     /// Validate that the epoch used for derivation of ephemeral private keys is not
-    /// in the future or too far back in the past.
+    /// too far in the future or too far back in the past.
     fn validate_ephemeral_key_epoch(&self, epoch: EpochTime) -> Result<()> {
         let consensus_epoch = self.consensus_epoch()?;
-        if consensus_epoch < epoch || consensus_epoch > epoch + MAX_EPHEMERAL_KEY_AGE {
+        if consensus_epoch + 1 < epoch || consensus_epoch > epoch + MAX_EPHEMERAL_KEY_AGE {
             return Err(KeyManagerError::InvalidEpoch(consensus_epoch, epoch).into());
         }
         Ok(())