Encryption support for the statement store #14440
Conversation
arkpar
added
A0-please_review
arkpar
changed the title
arkpar
added
the
D5-nicetohaveaudit ⚠️
client/keystore/src/local.rs
Outdated
| key_type: KeyTypeId, | ||
| public: &ed25519::Public, | ||
| f: &mut dyn FnMut(&ed25519::Pair), | ||
| ) -> std::result::Result<bool, TraitError> { |
There was a problem hiding this comment.
I remember doing a similar function in a branch.
One possible issue is that this is maybe not appropriate for a future hardware keystore, so a specialized function may be more suitable, but at this point I don't know if it is worth doing (given this would mean putting eceis in keystore and I think it was a point that was not suitable from previous PR).
Since it is explicitely a Statement store key that would not be possible to run on HSM, it may not be such an issue.
client/statement-store/src/lib.rs
Outdated
| HexDisplay::from(&statement.hash()) | ||
| ), | ||
| }, | ||
| ) { |
There was a problem hiding this comment.
We can have with_ed25519_key use a function that return an error as param, and potentially have posted clear report this in its list for results.
client/keystore/src/local.rs
Outdated
| @@ -196,6 +196,21 @@ impl Keystore for LocalKeystore { | |||
| self.sign::<ed25519::Pair>(key_type, public, msg) | |||
| } | |||
|
|
|||
| fn with_ed25519_key( | |||
There was a problem hiding this comment.
We already provide key_pair in the local key store. You can directly use this?
bin/node/cli/src/service.rs
Outdated
| @@ -233,6 +233,7 @@ pub fn new_partial( | |||
| &config.data_path, | |||
| Default::default(), | |||
| client.clone(), | |||
| keystore_container.keystore(), | |||
There was a problem hiding this comment.
| keystore_container.keystore(), | |
| keystore_container.local_keystore(), |
|
@bkchr Changed to use local keystore. |
| let hkdf = hkdf::Hkdf::<sha2::Sha256>::new(None, shared_secret); | ||
| let mut aes_key = [0u8; AES_KEY_LEN]; | ||
| hkdf.expand(b"", &mut aes_key) | ||
| .expect("There's always enough data for derivation."); |
|
bot merge |
* Added ECIES encryption * tweaks * fmt * Make clippy happy * Use local keystore * qed
* Added ECIES encryption * tweaks * fmt * Make clippy happy * Use local keystore * qed
This implements simple encryption scheme that uses ed25519 key exchange and AEAD for the statement store. See https://github.com/paritytech/labs/issues/3 and #13893
cumulus companion: paritytech/cumulus#2876