fix: remove secp256k1_prehashed from GetKey (meaningless for key derivation)

kvinwang · kvinwang · commit 30241056bcc3 · 2026-02-11T03:03:11.000Z
diff --git a/guest-agent/src/rpc_service.rs b/guest-agent/src/rpc_service.rs
@@ -282,7 +282,7 @@ impl DstackGuestRpc for InternalRpcHandler {
                 let pubkey_hex = hex::encode(signing_key.verifying_key().as_bytes());
                 (derived_key, pubkey_hex)
             }
-            "secp256k1" | "secp256k1_prehashed" | "" => {
+            "secp256k1" | "" => {
                 let derived_key = derive_key(k256_app_key, &[request.path.as_bytes()], 32)
                     .context("Failed to derive k256 key")?;
 
diff --git a/sdk/go/dstack/client.go b/sdk/go/dstack/client.go
@@ -372,7 +372,7 @@ func (c *DstackClient) GetTlsKey(
 // requiresVersionCheck returns true for algorithms that need OS >= 0.5.7.
 func requiresVersionCheck(algorithm string) bool {
 	switch algorithm {
-	case "secp256k1", "secp256k1_prehashed", "k256", "":
+	case "secp256k1", "k256", "":
 		return false
 	default:
 		return true
diff --git a/sdk/js/src/index.ts b/sdk/js/src/index.ts
@@ -177,7 +177,7 @@ export interface TlsKeyOptions {
   usageClientAuth?: boolean;
 }
 
-const SECP256K1_ALGORITHMS = new Set(['secp256k1', 'secp256k1_prehashed', 'k256', ''])
+const SECP256K1_ALGORITHMS = new Set(['secp256k1', 'k256', ''])
 
 export class DstackClient<T extends TcbInfo = TcbInfoV05x> {
   protected endpoint: string
diff --git a/sdk/python/src/dstack_sdk/dstack_client.py b/sdk/python/src/dstack_sdk/dstack_client.py
@@ -382,7 +382,7 @@ async def __aexit__(self, exc_type, exc_val, exc_tb):
 
     async def _ensure_algorithm_supported(self, algorithm: str) -> None:
         """Check OS version when a non-secp256k1 algorithm is requested."""
-        if algorithm in ("secp256k1", "secp256k1_prehashed", "k256", ""):
+        if algorithm in ("secp256k1", "k256", ""):
             return
         try:
             await self.version()

Original file line number	Diff line number	Diff line change
`@@ -282,7 +282,7 @@ impl DstackGuestRpc for InternalRpcHandler {`
`282`	`282`	`let pubkey_hex = hex::encode(signing_key.verifying_key().as_bytes());`
`283`	`283`	`(derived_key, pubkey_hex)`
`284`	`284`	`}`
`285`		`- "secp256k1" \| "secp256k1_prehashed" \| "" => {`
	`285`	`+ "secp256k1" \| "" => {`
`286`	`286`	`let derived_key = derive_key(k256_app_key, &[request.path.as_bytes()], 32)`
`287`	`287`	`.context("Failed to derive k256 key")?;`
`288`	`288`
Original file line number	Diff line number	Diff line change
`@@ -177,7 +177,7 @@ export interface TlsKeyOptions {`
`177`	`177`	`usageClientAuth?: boolean;`
`178`	`178`	`}`
`179`	`179`
`180`		`-const SECP256K1_ALGORITHMS = new Set(['secp256k1', 'secp256k1_prehashed', 'k256', ''])`
	`180`	`+const SECP256K1_ALGORITHMS = new Set(['secp256k1', 'k256', ''])`
`181`	`181`
`182`	`182`	`export class DstackClient<T extends TcbInfo = TcbInfoV05x> {`
`183`	`183`	`protected endpoint: string`