Open felicio opened 2 years ago
My notes
How
Status: draft Disclaimer: now only in theory and without research and security teams' review Disclaimer: grades are subjective
In-app key generation | In-app key generation from wallet signature | In-app key generation with wallet encryption and decentralized backup | In-wallet key generation returned as value | In-extension key generation with RPC methods for per-session signing and encrypting | In-native key generation with Vac protocol pairing | In-app key generation with password manager import via <input> |
In-native key generation via RCP method and WalletConnect protocol pairing | |
---|---|---|---|---|---|---|---|---|
ID | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
Status | Stable | Stable | Stable | Idea | Idea | Idea | Stable | Idea |
Estimation | XS | S | L | L | XL | M | S | L |
Supported wallets | - | - | - | - | ||||
Exposes private key | No | Yes | No | No | No | Yes | Yes | Yes |
Preserves identity across in-house clients | No | No | No | No | Yes | Yes | No | Yes |
Domain binding/origin checking | No | No | No | Yes | Yes | - | ||
Backed up | - | Yes | No | No | - | No | ||
Recoverable | Yes | Yes | Yes | Yes | - | No | ||
Exposes wallet account | No | Yes | No | No | No | No | ||
Encryption | AES-256-GCM, ECIES (secp256k1) | |||||||
Key generation | ECDSA (secp256k1), Crypto.getRandomValues(new Uint8Array(40)) (hash) |
ECDSA (secp256k1) | ||||||
Key derivation path | BIP43, EIP-1581 | |||||||
Signing | ECDSA (secp256k1), PBKDF2, SHA-3-256 (keccak256) | |||||||
Key exchange | - | - | - | Return value | - | X3DH, 35/WAKU2-NOISE, 37/WAKU2-NOISE-SESSIONS | - | |
Identity encoding | base58 | |||||||
Security grade | B | B | B | A | B | C | ||
Usability grade | B | A | ||||||
Ecosystem fit grade | A | B | C | A | B | C | ||
Ecosystem outlook adoption grade | A | B | C | - | A | C | ||
Signing message format | EIP-712 | |||||||
Derived from a user seed phrase | No | No | Yes | Yes | Yes | No | ||
Deterministic key generation | Yes | - | Yes | Yes | - | - | ||
References | EIP-2224, EIP-712, EIP-4361 | EIP-1775 | 2/ACCOUNT, 26/WAKU-PAYLOAD | |||||
Demo | ||||||||
Review | ||||||||
Personal inclination at the moment (see last edited date) | ☝️ |
key management, private, public, secret, account, sign, log, auth, origin, identity, federated authentication, backup, webauthn, passkey, sync, verification code, issuer, phishing, domain binding, password, cryptographic key pairs, end-to-end encryption, phishing resistance, cross-platform, public key cryptography, credentials, proximity proof, local key agreement, CTAP operation, factors, scope, cookies, secure context
https://ethereum-magicians.org/t/meta-we-should-value-privacy-more/2475
https://specs.status.im/spec/10#keys-management
https://eips.ethereum.org/EIPS/eip-712 https://ethereum-magicians.org/t/eip-712-eth-signtypeddata-as-a-standard-for-machine-verifiable-and-human-readable-typed-data-signing/397/6
https://ethereum-magicians.org/t/automatic-authentication-signature/2429 https://medium.com/@wighawag/automatic-authentication-signatures-for-web3-dcbcbc64d6b5 https://medium.com/@wighawag/3-proposals-for-making-web3-a-better-experience-974f97765700
https://eips.ethereum.org/EIPS/eip-1581
https://eips.ethereum.org/EIPS/eip-1775
https://ethereum-magicians.org/t/eip-1024-cross-client-encrypt-decrypt/505 https://ethereum-magicians.org/t/the-ux-of-eip-1024-encrypt-decrypt/1243 https://github.com/ethereum/EIPs/pull/1098
Contracted by Ethereum Foundation and ENS to an org called Spruce in an open "tender", funded with 40M+ USD by many investor, to do... https://eips.ethereum.org/EIPS/eip-4361 https://ethereum-magicians.org/t/eip-4361-sign-in-with-ethereum/7263
https://eips.ethereum.org/EIPS/eip-1056
https://ethereum-magicians.org/t/extensible-crypto-for-wallets/2546
Status: draft
See table above for detailed comparison, following only lists main reasons which I think should help with picking a proposal.
Pros
Cons
eth_sign
)Cons
Cons
Pros
Cons
Status: draft
What
How (for example)
Prerequisities