vulpemventures / tdex-cli

Non-custodial Liquid Wallet CLI to make trades on TDex Network via atomic swaps
MIT License
3 stars 4 forks source link

[WIP] replace private key identity by mnemonic #2

Closed louisinger closed 3 years ago

louisinger commented 3 years ago

This PR aims to replace all the Private key identity stuffs by the Mnemonic identity

TL;DR

Why store the identity instead of addresses ? We need the identity object to avoid restoration from the explorer each time we need to recreate the Identity object (when we sign the tx for example).

Why it is a problem ? The Identity object contains sensitive data and is not encrypted! Everybody can use it to sign the transactions even if the keystore type is encrypted.

What are the solutions ? first solution: encrypt all the state instead of just the private key. second solution: store a set of addresses instead of the identity itself and overwrite the IdentityRestorer to restore addresses from the state each time we recreate the Identity.

@tiero I need your opinion about that

it closes #1

tiero commented 3 years ago

As per discussed offline, I think we should encrypt the whole Identity instance and whenever we need to interact with the wallet (either reading the addresses or signing) we will ask the password to decrypt.

tiero commented 3 years ago

In the end I think a custom restorer would be the cleanest solution, for initializing from a set of cached addresses @louisinger