Don't use self implemented Passcode.

airgap-it / airgap-vault

The AirGap Vault is installed on a spare smartphone that has no connection to any network, thus it is air gapped. This app handles the private key.

MIT License

386 stars 109 forks source link

Don't use self implemented Passcode. #71

Closed Originalimoc closed 3 years ago

Originalimoc commented 3 years ago

Store Passcode using KeyStore. Properly call KeyStore to generate keystream "A" using input passcode. Then if Bio is not enabled, Provide "A" as decryption key and along with TX message to sign TX or show recovery phrase. If Bio is enabled, then you need chain these key together. When for example fingerprint get changed or disabled, then the chain is broken and recovery phrase is needed to re-enable accessing to private key/master phrase.