Code Monkey home page Code Monkey logo

bls-keystore's Introduction

@ChainSafe/bls-keystore

npm Discord License: MIT es-version node-version

Typescript implementation of EIP 2335 for node and browser.

How to use?

Functional interface

import {Buffer} from "buffer";
import {
  IKeystore,
  create,
  decrypt,
  verifyPassword,
  isValidKeystore,
  validateKeystore,
} from "@chainsafe/bls-keystore";

// encrypt private key
const password: string | Uint8Array = "SomePassword123"; 
const privateKey: Uint8Array = ...;
const publicKey: Uint8Array = ...;
const path: string = "m/12381/60/0/0";

// keystore is an `object` that follows the EIP-2335 schema
const keystore: IKeystore = await create(password, privateKey, publicKey, path);

// verify password
await verifyPassword(keystore, password); //true | false

// decrypt
const decryptedPrivateKey: Buffer = await decrypt(keystore, password);

// convert to string
JSON.stringify(keystore); //string

// determine if unsanitized data fits the EIP-2335 schema
const data: unknown = ...;
isValidKeystore(data); // true | false

validateKeystore(data); // throws if invalid

Class-based interface

import {Buffer} from "buffer";
import {
  Keystore,
} from "@chainsafe/bls-keystore";

// encrypt private key
const password: string | Uint8Array = "SomePassword123"; 
const privateKey: Uint8Array = ...;
const publicKey: Uint8Array = ...;
const path: string = "m/12381/60/0/0";

// keystore is a `Keystore` instance that follows the EIP-2335 schema with additional convenience methods
const keystore: Keystore = await Keystore.create(password, privateKey, publicKey, path);

// verify password
await keystore.verifyPassword(password); //true | false

// decrypt
const decryptedPrivateKey: Buffer = await keystore.decrypt(password);

// convert to string
keystore.stringify(); //string

// determine if unsanitized data fits the EIP-2335 schema
const data: unknown = ...;
Keystore.fromObject(data); // returns a Keystore or throws if data is invalid

For key derivation checkout @chainsafe/bls-keygen

Contribute

  • get yarn
  • yarn install
  • yarn test

bls-keystore's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

bls-keystore's Issues

upgrade uuid (and other packages, probably)

when upgrading this package in https://github.com/chainsafe/bls-keygen-app, I saw the following warning

warning @chainsafe/bls-keystore > [email protected]: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.

We also have a few dependabot PRs that have popped up so it would probably be good to try and upgrade other deps where possible/needed.

Lock down UUID package

I think the version should be locked, because it can be changed in the future by hacker etc.

Keystore generates cipher message that is too long

If you generate keystore and then try to import it as an object

Keystore.fromObject(JSON.parse(keystore.stringify()));

It generates error:
Error: .crypto.cipher.message: should match pattern "^([A-Fa-f0-9]{2}){32}$"

For example, a generated keystore looks like

{
  "version": 4,
  "uuid": "9c2ed357-910f-4c0d-95be-3959abb7ba23",
  "path": "m/12381/3600/0/0/0",
  "pubkey": "0c71111d4d27fe2cf9a2163c48a75a2f715cf12bbb2b609a8d1a1a00d8f18f4d",
  "crypto": {
    "kdf": {
      "function": "pbkdf2",
      "params": {
        "dklen": 32,
        "c": 262144,
        "prf": "hmac-sha256",
        "salt": "ab057cd3192eff53fbe13dcd2aa91bdc000f12b44b26cbf0bdddd142c6c6b663"
      },
      "message": ""
    },
    "checksum": {
      "function": "sha256",
      "params": {},
      "message": "cc29ccff7e37dab8c2229360693b3bdd66e3d74d999b56fc52cb35a06022b3b6"
    },
    "cipher": {
      "function": "aes-128-ctr",
      "params": {
        "iv": "54492a730ca676c52eaf4712938e8356"
      },
      "message": "42c1608033a60f93e562a3bba591ebdffa772e8824331f4405f64388c277c29099487c77fb17325ef37be4cf19c24e5b"
    }
  }
}

It appears the cipher.message should be hashed?

EIP 2335 - keystore password parsing

Use EIP 2335 password Control codes removal as defined in https://eips.ethereum.org/EIPS/eip-2335

The C0, C1, and Delete control codes are not valid characters in the password and should therefore be stripped from the password. C0 are the control codes between 0x00 - 0x1F (inclusive) and C1 codes lie between 0x80 and 0x9F (inclusive). Delete, commonly known as “backspace”, is the UTF-8 character 7F which must also be stripped. Note that space (Sp UTF-8 0x20) is a valid character in passwords despite it being a pseudo-control character.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.