Encryption support for the statement store#14440
Encryption support for the statement store#14440paritytech-processbot[bot] merged 8 commits intomasterfrom
Conversation
arkpar
added
A0-please_review
arkpar
changed the title
arkpar
added
the
D5-nicetohaveaudit ⚠️
client/keystore/src/local.rs
Outdated
| key_type: KeyTypeId, | ||
| public: &ed25519::Public, | ||
| f: &mut dyn FnMut(&ed25519::Pair), | ||
| ) -> std::result::Result<bool, TraitError> { |
There was a problem hiding this comment.
I remember doing a similar function in a branch.
One possible issue is that this is maybe not appropriate for a future hardware keystore, so a specialized function may be more suitable, but at this point I don't know if it is worth doing (given this would mean putting eceis in keystore and I think it was a point that was not suitable from previous PR).
Since it is explicitely a Statement store key that would not be possible to run on HSM, it may not be such an issue.
client/statement-store/src/lib.rs
Outdated
| HexDisplay::from(&statement.hash()) | ||
| ), | ||
| }, | ||
| ) { |
There was a problem hiding this comment.
We can have with_ed25519_key use a function that return an error as param, and potentially have posted clear report this in its list for results.
client/keystore/src/local.rs
Outdated
| self.sign::<ed25519::Pair>(key_type, public, msg) | ||
| } | ||
|
|
||
| fn with_ed25519_key( |
There was a problem hiding this comment.
We already provide key_pair in the local key store. You can directly use this?
bin/node/cli/src/service.rs
Outdated
| &config.data_path, | ||
| Default::default(), | ||
| client.clone(), | ||
| keystore_container.keystore(), |
There was a problem hiding this comment.
| keystore_container.keystore(), | |
| keystore_container.local_keystore(), |
|
@bkchr Changed to use local keystore. |
bkchr
left a comment
bkchr
left a comment
There was a problem hiding this comment.
No idea about the crypto, but looks good.
| let hkdf = hkdf::Hkdf::<sha2::Sha256>::new(None, shared_secret); | ||
| let mut aes_key = [0u8; AES_KEY_LEN]; | ||
| hkdf.expand(b"", &mut aes_key) | ||
| .expect("There's always enough data for derivation."); |
|
bot merge |
* Added ECIES encryption * tweaks * fmt * Make clippy happy * Use local keystore * qed
* Added ECIES encryption * tweaks * fmt * Make clippy happy * Use local keystore * qed
3 participants
This implements simple encryption scheme that uses ed25519 key exchange and AEAD for the statement store. See https://github.com/paritytech/labs/issues/3 and #13893
cumulus companion: paritytech/cumulus#2876