search

bodhiproject / qrypto

Qtum light wallet and local transaction signing client
GNU General Public License v3.0
9 stars 12 forks source link

Implement encryption for storing mnemonic in Chrome storage #24

Closed dwalintukan closed 6 years ago

hayeah commented 6 years ago

It turns out that the web wallet does not store private keys.

But we can use BIP38: http://cryptocoinjs.com/modules/currency/bip38/

https://github.com/bitcoin/bips/blob/master/bip-0038.mediawiki

dwalintukan commented 6 years ago

cool 👍 just so were on the same page:

  1. encrypt wallet seed phrase with BIP38 and password
  2. store encrypted string in chrome storage
  3. user decrypt BIP38 with pw
  4. wallet unlocked!
scriptfans commented 6 years ago

@dwalintukan The new version of qtumjs-wallet (0.0.7) has been released:

network. fromEncryptedPrivateKey

wallet.toEncryptedPrivateKey

you can use these methods to encrypt/decrypt wallet private key.

dwalintukan commented 6 years ago

@scriptfans awesome, will implement this soon! thanks.

hayeah commented 6 years ago

@dwalintukan we set the parameters s.t. it takes about 3 seconds to decrypt.

dwalintukan commented 6 years ago

@hayeah got it. we will account for the lag with the loading screen.

hayeah commented 6 years ago

hmm. also considering unlocked session https://github.com/bodhiproject/qrypto/issues/68, we'll want to store the password (in fact, hash of the password) in memory so until timeout user can use the session without having to re-enter the password.

i thiiiink the password hash in memory could be bip38.encrypt(userPassword, "qrypto"), where "qrypto" is a fixed string. This should be enough to avoid rainbow table attack.

dwalintukan commented 6 years ago

70