Support Cardano key derivation according to CIP3-Icarus

PeterBenc commented 9 months ago

currently, this lib supports secp256k1 and ed25519
while developing a Snap for Cardano, we realized that keys derived by snap, using (getBip32Entropy) are different from keys that would standard Cardano wallet give, for the same mnemonic
this inconsistency could lead to confusion and interoperability issues
currently developed Cardano snap, relies on these changes, and is blocked by this. (note that changes need to be made also to metamask-snaps and metamask-extension repos, which are ready, awaiting feedback on this)

by supporting derivation which is consistent with Cardano standard, we enable current Cardano users to use their existing mnemonics in Metamask and get the same wallet they used until now.
similarily, we would enable current Metamask users to use their mnemonic in standard Cardano wallets and retrieve same addresses as they would through Cardano-Metamask snap.

For this reasons

we add a new derivation curve, called ed25519Bip32, this curve implements a slight modification of how standard ed25519 is used in SLIP10.
we add a new deriver, called cip3Icarus which derives keys according to CIP3 (which is the standard for Cardano)
from the interface point of view, these changes allow us to call
```
await deriveKeyFromPath({
 path: ["cip3Icarus:1852'", "cip3Icarus: 1815'"],
 curve: 'ed25519Bip32',
})
```
which returns keys consistent with Cardano derivation standard

A longer explanation, also present in the code

CIP-3 defines standards for deriving keys on Cardano.

Key attributes

Root/Master key is derived from entropy, not seed. For this implementation we work with Icarus standard as it is the most widely used. See https://github.com/cardano-foundation/CIPs/blob/09d7d8ee1bd64f7e6b20b5a6cae088039dce00cb/CIP-0003/Icarus.md.
HD node consists of a 64 byte private key, 32 byte public key and 32 byte chain code. See https://github.com/cardano-foundation/CIPs/blob/09d7d8ee1bd64f7e6b20b5a6cae088039dce00cb/CIP-0003/CIP-0003.md#master-key-generation.
For derivation of BIP32 HD nodes, it uses modified implementation of ed25519 called BIP32-Ed25519. See https://input-output-hk.github.io/adrestia/static/Ed25519_BIP.pdf.

All sources are referenced in the code, and explained quite extensively, namely

Reference implementations

Mrtenz commented 7 months ago

At first glance this looks great. I will be doing a proper review next week, thanks for your patience!

PeterBenc commented 6 months ago

@Mrtenz have you had time to look into cip3? PS: all relevant links are in the PR description :)

Mrtenz commented 6 months ago

@Mrtenz have you had time to look into cip3? PS: all relevant links are in the PR description :)

Not yet, sorry about that. Will make time to look into this more this week!

Mrtenz commented 6 months ago

Can you rebase your branch?

PeterBenc commented 6 months ago

@Mrtenz the last couple of issues should be resolved. Should I squash the commits or do you want to do it yourself?

Mrtenz commented 6 months ago

src/index.ts is missing coverage(?), and you need to run yarn lint:fix. Looks good to me other than that!

PeterBenc commented 6 months ago

Should be fixed

Should I squash the commits into some reasonable chunks, would that be relevant for audit too? do you want to do it yourself? Let me know :)

Mrtenz commented 6 months ago

No need to. We want to do an audit for some other smaller changes since the last audit anyway, so I will just squash when merging this PR.

MetaMask / key-tree