Key management and cryptographically protected messages
About
- Manages the lifecycle of a key
- Keys are encrypted at rest
- Enforces the use of safe key names
- Uses encrypted PKCS 8 for key storage
- Uses PBKDF2 for a "stetched" key encryption key
- Enforces NIST SP 800-131A and NIST SP 800-132
- Delays reporting errors to slow down brute force attacks
KeyInfo
The key management and naming service API all return a KeyInfo
object. The id
is a universally unique identifier for the key. The name
is local to the key chain.
{
name: 'rsa-key',
id: 'QmYWYSUZ4PV6MRFYpdtEDJBiGs4UrmE6g8wmAWSePekXVW'
}
The key id is the SHA-256 multihash of its public key.
The public key is a protobuf encoding containing a type and the DER encoding of the PKCS SubjectPublicKeyInfo.
Private key storage
A private key is stored as an encrypted PKCS 8 structure in the PEM format. It is protected by a key generated from the key chain's passPhrase using PBKDF2.
The default options for generating the derived encryption key are in the dek
object. This, along with the passPhrase, is the input to a PBKDF2
function.
const defaultOptions = {
// See https://cryptosense.com/parameter-choice-for-pbkdf2/
dek: {
keyLength: 512 / 8,
iterationCount: 1000,
salt: 'at least 16 characters long',
hash: 'sha2-512'
}
}
Physical storage
The actual physical storage of an encrypted key is left to implementations of interface-datastore.
A key benefit is that now the key chain can be used in browser with the js-datastore-level implementation.
Install
$ npm i @libp2p/keychain
<script>
tag
Browser Loading this module through a script tag will make it's exports available as Libp2pKeychain
in the global namespace.
<script src="https://unpkg.com/@libp2p/keychain/dist/index.min.js"></script>
API Docs
License
Licensed under either of
- Apache 2.0, (LICENSE-APACHE / http://www.apache.org/licenses/LICENSE-2.0)
- MIT (LICENSE-MIT / http://opensource.org/licenses/MIT)
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.