search

statechannels / go-nitro

Implementation of nitro-protocol in Go
Other
39 stars 19 forks source link

Do not pass private key directly to p2p messaging service. #1075

Open geoknee opened 1 year ago

geoknee commented 1 year ago

This doesn't align with best practices around handling private keys:

https://github.com/statechannels/go-nitro/blob/92d6f4d92c4e567181216a0517b631e7f6f65e05/client/engine/messageservice/p2p-message-service/service.go#L76

See https://www.notion.so/statechannels/RFC-8-Securing-Private-StateChannel-Key-c4f2945172d84db2b84220d64502e38c for details.

Apparently the motivation was to create a deterministic message key from the channel signing key. I believe the message key is used to encrypt or sign messages.

Alternatives are:

These retain the desired property of a deterministic message key.

lalexgap commented 1 year ago

This is related to #1495, passing in the SC key directly allows us to recover the SC address from the peer ID.