search

status-im / nim-blscurve

Nim implementation of BLS signature scheme (Boneh-Lynn-Shacham) over Barreto-Lynn-Scott (BLS) curve BLS12-381
Apache License 2.0
26 stars 11 forks source link

Tag SecretKey export as distinct type #67

Open mratsim opened 4 years ago

mratsim commented 4 years ago

This follows a discussion with an auditor on ED25519 in libp2p.

We need to use all measures possible to prevent leaking private keys, hence I recommend that all private keys use distinct byte. We should also prevent toHex, == on them or for toHex output a SecretHex / SecretString.

In nim-beacon-chain this should prevent introducing private key logging by mistake: https://github.com/status-im/nim-beacon-chain/blob/40c2714ff30c811978fcc234f438ddd473851009/beacon_chain/spec/crypto.nim#L312-L314

Even though some thoughts was given to prevent that: https://github.com/status-im/nim-beacon-chain/blob/40c2714ff30c811978fcc234f438ddd473851009/beacon_chain/spec/crypto.nim#L186-L187