Provide method for unlocking keyring by decrypted key

.eslintrc.js

@@ -1,6 +1,9 @@
 module.exports = {
  root: true,
  extends: ['@metamask/eslint-config'],
+ globals: {
+ window: 'readonly',
+ },
  env: {
  commonjs: true,
  },

index.js

@@ -4,16 +4,21 @@ const bip39 = require('@metamask/bip39');
 const ObservableStore = require('obs-store');
 const encryptor = require('browser-passworder');
 const { normalize: normalizeAddress } = require('eth-sig-util');
+//const { sha256 } = require('ethereum-cryptography/sha256');
+//const { utf8ToBytes, toHex } = require('ethereum-cryptography/utils');
 
 const SimpleKeyring = require('eth-simple-keyring');
 const HdKeyring = require('@metamask/eth-hd-keyring');
 
 const keyringTypes = [SimpleKeyring, HdKeyring];
 
+const VAULT_SEPARATOR = ':::';
+
 const KEYRINGS_TYPE_MAP = {
  HD_KEYRING: 'HD Key Tree',
  SIMPLE_KEYRING: 'Simple Key Pair',
 };
+
 /**
  * Strip the hex prefix from an address, if present
  * @param {string} address - The address that might be hex prefixed.
@@ -125,6 +130,7 @@ class KeyringController extends EventEmitter {
  mnemonic: seedPhraseAsBuffer,
  numberOfAccounts: 1,
  },
+ password,
  );
  const [firstAccount] = await firstKeyring.getAccounts();
  if (!firstAccount) {
@@ -145,8 +151,8 @@ class KeyringController extends EventEmitter {
  */
  async setLocked() {
  // set locked
- this.password = null;
  this.memStore.updateState({ isUnlocked: false });
+ delete this.encryptionKey;
  // remove keyrings
  this.keyrings = [];
  await this._updateMemStoreKeyrings();
@@ -168,7 +174,29 @@ class KeyringController extends EventEmitter {
  * @returns {Promise<Object>} A Promise that resolves to the state.
  */
  async submitPassword(password) {
+ await this.verifyPassword(password);
  this.keyrings = await this.unlockKeyrings(password);
+
+ // We should persist keyrings so that we can either
+ // (1) migrate or (2) create a new salt
+ await this.persistAllKeyrings(password);
+
+ this.setUnlocked();
+ this.fullUpdate();
+
+ return this.encryptionKey;
+ }
+
+ /**
+ * Submit Encrypted Key
+ *
+ * Attempts to decrypt the current vault with a given encryption key
+ * and loads its keyrings into memory
+ *
+ * @param {string} password
+ */
+ async submitEncryptionKey(encryptionKey) {
+ this.keyrings = await this.unlockKeyrings(undefined, encryptionKey);
  this.setUnlocked();
  this.fullUpdate();
  }
@@ -186,7 +214,12 @@ class KeyringController extends EventEmitter {
  if (!encryptedVault) {
  throw new Error('Cannot unlock without a previous vault.');
  }
- await this.encryptor.decrypt(password, encryptedVault);
+
+ const result = await this.attemptGetDecryptedVault(
+ encryptedVault,
+ password,
+ );
+ return result;
  }
 
  /**
@@ -202,7 +235,7 @@ class KeyringController extends EventEmitter {
  * @param {Object} opts - The constructor options for the keyring.
  * @returns {Promise<Keyring>} The new keyring.
  */
- async addNewKeyring(type, opts) {
+ async addNewKeyring(type, opts, password) {
  const Keyring = this.getKeyringClassForType(type);
  const keyring = new Keyring(opts);
  if ((!opts || !opts.mnemonic) && type === KEYRINGS_TYPE_MAP.HD_KEYRING) {
@@ -214,7 +247,7 @@ class KeyringController extends EventEmitter {
  await this.checkForDuplicate(type, accounts);
 
  this.keyrings.push(keyring);
- await this.persistAllKeyrings();
+ await this.persistAllKeyrings(password);
 
  await this._updateMemStoreKeyrings();
  this.fullUpdate();
@@ -491,10 +524,13 @@ class KeyringController extends EventEmitter {
  * @returns {Promise<void>} - A promise that resolves if the operation was successful.
  */
  async createFirstKeyTree(password) {
- this.password = password;
  this.clearKeyrings();
 
- const keyring = await this.addNewKeyring(KEYRINGS_TYPE_MAP.HD_KEYRING);
+ const keyring = await this.addNewKeyring(
+ KEYRINGS_TYPE_MAP.HD_KEYRING,
+ {},
+ password,
+ );
  const [firstAccount] = await keyring.getAccounts();
  if (!firstAccount) {
  throw new Error('KeyringController - No account found on keychain.');
@@ -516,12 +552,37 @@ class KeyringController extends EventEmitter {
  * @param {string} password - The keyring controller password.
  * @returns {Promise<boolean>} Resolves to true once keyrings are persisted.
  */
- async persistAllKeyrings(password = this.password) {
- if (typeof password !== 'string') {
+ async persistAllKeyrings(password) {
+ if (password && typeof password !== 'string') {
  throw new Error('KeyringController - password is not a string');
  }
 
- this.password = password;
+ // Since we also allow persisting without a password,
+ // we should require this.encryptionKey
+ if (password === undefined && this.encryptionKey === undefined) {
+ throw new Error(
+ 'KeyringController - a password or encryptionKey must exist to persist keyrings',
+ );
+ }
+
+ let salt = null;
+ if (password) {
+ // If this is a migration or new password-driven login, we should
+ // create or rotate the salt
+ salt = this.encryptor.generateSalt();
+
+ // Since there's a new salt, we need to generate a new encrypted key
+ // for use in the
+ this.encryptionKey = await this._generateEncryptionKey(password, salt);
+ } else {
+ const encryptedVault = this.store.getState().vault;
+ if (!encryptedVault) {
+ throw new Error('Cannot unlock without a previous vault.');
+ }
+ // We can use an existing salt if one exists in the encrypted key
+ salt = this.parseVault(encryptedVault).salt;
+ }
+
  const serializedKeyrings = await Promise.all(
  this.keyrings.map(async (keyring) => {
  const [type, data] = await Promise.all([
@@ -531,14 +592,50 @@ class KeyringController extends EventEmitter {
  return { type, data };
  }),
  );
+
  const encryptedString = await this.encryptor.encrypt(
- this.password,
+ this.encryptionKey,
  serializedKeyrings,
  );
- this.store.updateState({ vault: encryptedString });
+
+ if (!encryptedString || !salt) {
+ throw new Error(
+ 'Cannot persist vault without salt or encrypted vault string',
+ );
+ }
+
+ const newVault = [encryptedString, VAULT_SEPARATOR, salt].join('');
+
+ // The encrypted string gets concatenated with a separator and salt
+ this.store.updateState({ vault: newVault });
  return true;
  }
 
+ async attemptGetDecryptedVault(encryptedVault, password, encryptionKey) {
+ if (password === undefined && encryptionKey === undefined) {
+ throw new Error(
+ 'No way to decrypt a salted vault without a password or encryption key',
+ );
+ }
+
+ // If the separator string is in the vault string, the user has already migrated
+ // from the previous password-only model
+ if (encryptedVault.includes(VAULT_SEPARATOR)) {
+ const { salt, vault } = this.parseVault(encryptedVault);
+
+ if (encryptionKey) {
+ this.encryptionKey = encryptionKey;
+ } else {
+ this.encryptionKey = await this._generateEncryptionKey(password, salt);
+ }
+
+ //return await this.encryptor.decrypt(this.encryptionKey, vault);
+ return await this.encryptor.decryptWithKey(this.encryptionKey, encryptedVault);
+ }
+
+ return await this.encryptor.decrypt(password, encryptedVault);
+ }
+
  /**
  * Unlock Keyrings
  *
@@ -548,20 +645,71 @@ class KeyringController extends EventEmitter {
  * @param {string} password - The keyring controller password.
  * @returns {Promise<Array<Keyring>>} The keyrings.
  */
- async unlockKeyrings(password) {
+ async unlockKeyrings(password, encryptionKey) {
  const encryptedVault = this.store.getState().vault;
  if (!encryptedVault) {
  throw new Error('Cannot unlock without a previous vault.');
  }
 
+ if (password === undefined && encryptionKey === undefined) {
+ throw new Error(
+ 'No way to decrypt a salted vault without a password or encrypted key',
+ );
+ }
+
  await this.clearKeyrings();
- const vault = await this.encryptor.decrypt(password, encryptedVault);
- this.password = password;
+
+ const vault = await this.attemptGetDecryptedVault(
+ encryptedVault,
+ password,
+ encryptionKey,
+ );
+
  await Promise.all(vault.map(this._restoreKeyring.bind(this)));
+
  await this._updateMemStoreKeyrings();
+
  return this.keyrings;
  }
 
+ /**
+ * Parse Vault
+ *
+ * Parses the vault string for vault and salt
+ *
+ * @param {string} encryptedVault - The stored, encrypted vault
+ * @returns {Boject} Contains salt and vault properties
+ */
+ parseVault(encryptedVault) {
+ const [vault, salt] = encryptedVault.split(VAULT_SEPARATOR);
+ return { vault, salt };
+ }
+
+ /**
+ * Generate Encryption Key
+ *
+ * Generates an encryption key which will be used to decrypt
+ * the vault.
+ *
+ * @param {Object} password - The user's submitted password
+ * @param {Object} salt - Salt to generate the encryption key
+ * @returns {string} The encryption key
+ */
+ async _generateEncryptionKey(password, salt) {
+ //return toHex(sha256(utf8ToBytes(password + salt)));
+ const key = await encryptor.keyFromPassword(password, salt);
+ const exportedKey = await window.crypto.subtle.exportKey('jwk', key);
+ const keyString = JSON.stringify(exportedKey);
+ console.log("key is: ", key, exportedKey);
+ console.log("keystring is: ", keyString);
+
+ // recreate the key?
+ const restoredKey = await window.crypto.subtle.importKey('jwk', JSON.parse(keyString), 'AES-GCM', true, ['encrypt', 'decrypt']);
+ console.log('restored key is: ', restoredKey);
+
+ return keyString;
+ }
+
  /**
  * Restore Keyring
  *
@@ -762,4 +910,4 @@ class KeyringController extends EventEmitter {
  }
 }
 
-module.exports = KeyringController;
+module.exports = KeyringController;

package.json

@@ -36,6 +36,7 @@
  "browser-passworder": "^2.0.3",
  "eth-sig-util": "^3.0.1",
  "eth-simple-keyring": "^4.2.0",
+ "ethereum-cryptography": "^1.1.2",
  "obs-store": "^4.0.3"
  },
  "devDependencies": {