Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use long derivation paths for App Private Keys (courtesy of blockstack.js) #1496

Open
wants to merge 9 commits into
base: develop
from

Conversation

@kantai
Copy link
Member

kantai commented Jul 3, 2018

This adds support for longer derivation paths for app private keys (#1367)

This maintains quasi-backwards compatibility by

  1. Checking whether or not a legacy public key was used (by checking the profile's apps key
  2. If so, using the legacy key, otherwise, uses the new derivation path.

To test this, you'll need to npm link in the wallet support branch on blockstack.js (or develop once it's merged).

wbobeirne added 2 commits Jul 10, 2018
… as much as possible to BlockstackWallet.
@wbobeirne
Copy link
Contributor

wbobeirne commented Jul 17, 2018

I've expanded this PR to use BlockstackWallet wherever possible.

@wbobeirne
Copy link
Contributor

wbobeirne commented Aug 1, 2018

Because blockstack.js has upgraded to bitcoinjs-lib@4.x.x, we'll need to do the same in this repo. Unfortunately that's going to be a lot of effort because all HDNode usage was replaced with bip32 usage.

@kantai kantai changed the title [WIP] Use long derivation paths for App Private Keys (courtesy of blockstack.js) Use long derivation paths for App Private Keys (courtesy of blockstack.js) Aug 7, 2018
@kantai kantai changed the title Use long derivation paths for App Private Keys (courtesy of blockstack.js) [WIP] Use long derivation paths for App Private Keys (courtesy of blockstack.js) Aug 7, 2018
@kantai kantai changed the title [WIP] Use long derivation paths for App Private Keys (courtesy of blockstack.js) Use long derivation paths for App Private Keys (courtesy of blockstack.js) Aug 7, 2018
@kantai
Copy link
Member Author

kantai commented Aug 7, 2018

This is updated to work with the latest from this PR: blockstack/blockstack.js#433

I recommend testing this by restoring an old account, logging into multiplayer apps (which should continue to work with the same app private key that you used before if you had previously logged in) and single player apps, and by creating a new user and logging in and out of apps.

@markmhx
Copy link

markmhx commented Mar 19, 2019

@kantai should this issue be considered resolved and closed out based on your PR? #1620

@kantai
Copy link
Member Author

kantai commented Mar 19, 2019

Nope -- as far as I understand, we still are using the short app derivation paths.

@markmhx
Copy link

markmhx commented Mar 19, 2019

@kantai What's the main benefit here? Stronger security or?

@kantai
Copy link
Member Author

kantai commented Mar 19, 2019

@kantai What's the main benefit here? Stronger security or?

Yep -- this would increase the security of the app-derived keys.

@markmhx
Copy link

markmhx commented Mar 20, 2019

@kantai Sounds good – it seems this PR is almost across the finish line and just needs a bit more testing. Is that the case? I'm moving this to the backlog so we can prioritize for the next sprint assuming that's the case.

@hstove
Copy link
Collaborator

hstove commented May 14, 2019

Unless I'm mistaken, this is not backwards compatible with single-player apps, because they aren't in the apps key. So if you login to a single-player app, your data and private key will not be the same.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Linked issues

Successfully merging this pull request may close these issues.

None yet

4 participants
You can’t perform that action at this time.