Web Crypto Signature Provider and conversion methods #937

bradlhart · 2021-05-19T23:44:51Z

Change Description

The Web Crypto API, or otherwise referred as SubtleCrypto, has the ability to construct or import both public and private keys as well as sign data using the private key CryptoKey. The format of the CryptoKey and Signature are different than eosjs built-in format and elliptic format. This code adds functionality to convert from eosjs built-in format to CryptoKeys as well as CryptoKeys and Signature to eosjs format.

Lastly, this code also includes a Web Crypto Signature Provider that can be used to store keys and sign transactions before sending to nodeos.

API Changes

API Changes

Added:
PrivateKey.toWebCrypto(): converts PrivateKey to private CryptoKey
PrivateKey.fromWebCrypto(): converts private CryptoKey to PrivateKey
PrivateKey.webCryptoSign(): signs data in Web Crypto method (sha256 hashing is done within Web Crypto method)
PublicKey.toWebCrypto(): converts PublicKey to public CryptoKey
PublicKey.fromWebCrypto(): converts public CryptoKey to PublicKey
Signature.fromWebCrypto(): converts Web Crypto-created signature to Signature

New:
WebCryptoSignatureProvider signature provider
addCryptoKeyPair: convenient method to add a CryptoKeyPair to the signature provider, rather than populating keys and availableKeys manually
sign: creates a buffer to sign utilizing Web Crypto's sign method and converts the outputted signature to a Signature class

Documentation Additions

Documentation Additions

Added a concise section about the new WebCryptoSignatureProvider

Must use already constructed CryptoKey private keys

DominicTobias-b1

LGTM. This has been tested out in cornea

bogniq

LGTM. Just one comment for clarification.

bogniq · 2021-06-16T13:40:21Z

src/PublicKey.ts

+        const derHex = Buffer.from(extractedDecoded, 'binary').toString('hex');
+        const publicKeyHex = derHex.replace('3059301306072a8648ce3d020106082a8648ce3d030107034200', '');
+        const publicKeyEc = ec.keyFromPublic(publicKeyHex, 'hex');
+        return PublicKey.fromElliptic(publicKeyEc, KeyType.r1, ec);


Just to confirm, could ec be initially passed non-empty and of type secp256k1, or only p256 is supported here?

Only p256 is supported for the Web Crypto API but it is possible that someone could put a k1 ec object and the code would break. I think a check is likely needed, I'll add it.

Actually, turns out the elliptic library does not easily label the curve utilized in the object. It would not be as simple as checking ec.curve.label = 'p256';. I will remove the ability of providing an ec object to the functions.

Thanks! This looks more clear too me.

bogniq · 2021-06-16T14:18:32Z

src/Signature.ts

+        let recoveredKey: any;
+        for (let i = 0; i < 4; i++) {
+            try {
+                const keyPair = ec.recoverPubKey(digest, signature, i);


Name keyPair is a bit confusing as private key is not here.

Actually the recoverPubKey function will return an ec keyPair object, although the private will be empty and the public will be non-empty.

CI/CD changes for PRs #937/#963/#964 - merging per a request from Brad this is a bug with github actions, version 12.14.1 has been replaced by the v15.14.0 ones, can you override and merge it? It also might be because I have to copy the workflow files to master but I won't be certain until this one is merged Will be verified and can be reverted if something else breaks.

nksanthosh

Per BLU-20451 this is now ready for merge. Please address the docs change requested.

nksanthosh · 2021-09-02T19:05:58Z

docs/basic-usage/index.md

@@ -14,3 +14,6 @@ The SignatureProvider object must contain the private keys corresponding to the
 The Api constructor requires a SignatureProvider. SignatureProviders implement the `dist/eosjs-api-interfaces.SignatureProvider` interface. For development purpose only, a `JsSignatureProvider` object is also provided via the `dist/eosjs-jssig` import to stand-in for an easy option for a signature provider during development, but should only be used in development, as it is not secure.

 In production code, it is recommended that you use a secure vault outside of the context of the webpage (which will also implement the `eosjs-api-interfaces.SignatureProvider` interface) to ensure security when signing transactions.
+
+## WebCryptoSignatureProvider
+Additionally, `WebCryptoSignatureProvider` is available in `eosjs` as a more secure built-in `SignatureProvider` than `JsSignatureProvider`.  Utilizing the [SubtleCrypto interface of the Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto), the `WebCryptoSignatureProvider` provides functionality for signing transactions utilizing CryptoKeys created by Web Crypto.  There are several methods available as well to convert extractable CryptoKeys into PrivateKey/PublicKey `eosjs` formats, which can then be converted into string or `elliptic` keypairs.  The method `generateWebCryptoKeyPair` is also available to create a CryptoKeyPair where the private CryptoKey is non-extractable and the public CryptoKey is extractable.  This is intentional as an extractable private key is more insecure than a non-extractable private key.  There are several more security concerns that you will need to address when it comes to utilizing the Web Crypto API, such as secure key management, so only utilize the `WebCryptoSignatureProvider` if you are aware of these security requirements and the risks involved in insecure environments.


Please remove this section and provide a stub in its place and once the documentation is created and signed off by Product and Developer Relations - they can PR those changes in via a separate PR. Other than that this PR is now ready to merge per BLU-20451

alex-radulescu-b1 · 2021-09-06T08:33:08Z

@bradlhart What is the status of this PR?
I can see in Jira it is marked as Done, but still open here.

Bradley Hart and others added 11 commits May 19, 2021 19:30

Web Crypto Signature Provider

9b880ef

Updating package.json and yarn.lock

b8999f3

Hardening the Crypto Key Signature Provider

73e0c62

Must use already constructed CryptoKey private keys

Multiple changes and tests for web/node. More tests soon and docs

57ea202

Updating nodejs version in ci/cd to resolve web crypto issue

a3c7189

Correct high-S to low-s method

10c4f26

Switching to different method

561be1e

Remaining tests for Web Crypto

adca5aa

Updating package.json and yarn.lock

1d98c3e

Concise documentation for the WebCryptoSignatureProvider

69385c4

Merge remote-tracking branch 'origin/develop' into subtleCrypto

3652757

bradlhart marked this pull request as ready for review May 29, 2021 00:48

bradlhart requested a review from venu-block1 May 29, 2021 00:53

Bradley Hart and others added 3 commits May 30, 2021 22:10

Resolving a circular dependency issue

132e8f5

Updating package.json and yarn.lock

fd0d029

Removing constructElliptic to avoid more circular dependency issues

c18433b

bradlhart requested a review from bogniq June 14, 2021 15:13

DominicTobias-b1 approved these changes Jun 15, 2021

View reviewed changes

bogniq reviewed Jun 16, 2021

View reviewed changes

bradlhart requested review from praphael and removed request for venu-block1 June 21, 2021 15:59

Removing the possibility of proving an ec object to avoid issues

9f8eef5

praphael approved these changes Jul 1, 2021

View reviewed changes

Bradley Hart and others added 4 commits July 9, 2021 15:42

Merge branch 'develop' into subtleCrypto

4c1c1f0

Merge remote-tracking branch 'origin/develop' into subtleCrypto

93532da

Adding resources to generated account

caa965a

Updating package.json and yarn.lock

3a7cca5

bradlhart mentioned this pull request Aug 18, 2021

Circular dependency issues #969

Closed

Merge branch 'develop' into subtleCrypto

83b272e

nksanthosh self-requested a review September 2, 2021 18:57

nksanthosh approved these changes Sep 2, 2021

View reviewed changes

Bradley Hart and others added 2 commits September 7, 2021 09:32

Removing documentation

8cb9d6b

Updating package.json and yarn.lock

dedc6e4

bradlhart merged commit 22a1a05 into develop Sep 7, 2021

bradlhart deleted the subtleCrypto branch September 7, 2021 13:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Web Crypto Signature Provider and conversion methods #937

Web Crypto Signature Provider and conversion methods #937

bradlhart commented May 19, 2021 •

edited

Loading

DominicTobias-b1 left a comment •

edited

Loading

bogniq left a comment

bogniq Jun 16, 2021

bradlhart Jun 16, 2021

bradlhart Jun 23, 2021

bogniq Jun 24, 2021

bogniq Jun 16, 2021

bradlhart Jun 16, 2021

nksanthosh left a comment

nksanthosh Sep 2, 2021

alex-radulescu-b1 commented Sep 6, 2021

Web Crypto Signature Provider and conversion methods #937

Web Crypto Signature Provider and conversion methods #937

Conversation

bradlhart commented May 19, 2021 • edited Loading

Change Description

API Changes

Documentation Additions

DominicTobias-b1 left a comment • edited Loading

Choose a reason for hiding this comment

bogniq left a comment

Choose a reason for hiding this comment

bogniq Jun 16, 2021

Choose a reason for hiding this comment

bradlhart Jun 16, 2021

Choose a reason for hiding this comment

bradlhart Jun 23, 2021

Choose a reason for hiding this comment

bogniq Jun 24, 2021

Choose a reason for hiding this comment

bogniq Jun 16, 2021

Choose a reason for hiding this comment

bradlhart Jun 16, 2021

Choose a reason for hiding this comment

nksanthosh left a comment

Choose a reason for hiding this comment

nksanthosh Sep 2, 2021

Choose a reason for hiding this comment

alex-radulescu-b1 commented Sep 6, 2021

bradlhart commented May 19, 2021 •

edited

Loading

DominicTobias-b1 left a comment •

edited

Loading