Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // FieldSecp256k1OrderID covers secrets that are secp256k1 scalars, which // are below the group order by construction. FieldSecp256k1OrderID = utils.ToHash("secp256k1-group-order") // FieldPrimeAbove256ID covers secrets that are arbitrary 32-byte values, // such as wallet seeds, which have no upper bound below 2^256. FieldPrimeAbove256ID = utils.ToHash("prime-above-2^256") )
Field identifiers. These are recorded in backups and must not change value once any backup carrying them exists.
Functions ¶
func WalletFromKeyDirectBackupPayload ¶ added in v0.0.21
func WalletFromKeyDirectBackupPayload(p *KeyDirectBackupPayload, privateKey []byte) (*wallets.Wallet, error)
WalletFromKeyDirectBackupPayload reconstructs a wallets.Wallet from a direct-backup payload. The caller decrypts EncryptedPrivateKey out-of-band (typically with the destination TEE's ECIES key) and passes the plaintext private-key bytes in. The decrypted public key must match BackupID.PublicKey. The resulting wallet is marked Restored with a zero status.
Types ¶
type EncryptedShares ¶
type EncryptedShares struct {
}
func (*EncryptedShares) Check ¶
func (e *EncryptedShares) Check() error
Check ensures the encrypted shares meet threshold and weighting requirements.
type Field ¶ added in v0.0.26
type Field struct {
ID common.Hash
Modulus *bigmod.Modulus
// Size is the width in bytes of every field element in serialized form.
Size int
// contains filtered or unexported fields
}
Field is the prime field a wallet's secret is shared over. Secret sharing is only injective when every possible secret is smaller than the modulus, so the field is selected from the key's metadata rather than fixed globally: a secp256k1 scalar is always below the group order, while a raw 32-byte seed is not.
ID is recorded in the backup so that reconstruction resolves the same field the backup was written with, rather than re-deriving it from a mapping that may have changed.
func FieldFor ¶ added in v0.0.26
FieldFor selects the field a key's secret must be shared over. Unknown combinations are rejected rather than defaulting, because sharing a secret over a field too small for it silently reconstructs a different value.
func FieldForID ¶ added in v0.0.26
FieldForID resolves the field a backup was written with.
func (*Field) Bytes ¶ added in v0.0.26
Bytes serializes a field element to the field's fixed width, so a share's encoded length never depends on its value.
func (*Field) Element ¶ added in v0.0.26
Element converts a secret into a field element, rejecting values the field cannot represent injectively.
func (*Field) ElementFromUint64 ¶ added in v0.0.26
ElementFromUint64 converts a small integer, such as a share index, into a field element.
type KeyDirectBackupPayload ¶ added in v0.0.21
type KeyDirectBackupPayload struct {
BackupID wallets.WalletBackupID `json:"backupId"`
// EncryptedPrivateKey is ECIES(destinationPub, w.PrivateKey).
EncryptedPrivateKey hexutil.Bytes `json:"encryptedPrivateKey"`
AdminPublicKeys []types.PublicKey `json:"adminPublicKeys"`
AdminsThreshold uint64 `json:"adminsThreshold"`
Cosigners []common.Address `json:"cosigners"`
CosignersThreshold uint64 `json:"cosignersThreshold"`
SettingsVersion common.Hash `json:"settingsVersion"`
Settings hexutil.Bytes `json:"settings"`
Status wallets.WalletStatus `json:"status"`
}
KeyDirectBackupPayload is the JSON-serializable form of a wallet produced by KEY_DIRECT_BACKUP. BackupID identifies the wallet+key and binds it to the source TEE, the reward epoch, and a per-backup random nonce. EncryptedPrivateKey is ECIES under the destination's public key; the remaining wallet-configuration fields are plaintext and are covered by the source TEE's signature over the payload.
func NewKeyDirectBackupPayload ¶ added in v0.0.21
func NewKeyDirectBackupPayload( w *wallets.Wallet, sourceTeeID common.Address, encryptedPrivateKey hexutil.Bytes, rewardEpochID uint32, randomNonce common.Hash, ) (*KeyDirectBackupPayload, error)
NewKeyDirectBackupPayload assembles the wire-format direct-backup payload. The caller supplies encryptedPrivateKey (typically ECIES of w.PrivateKey under the destination's public key); the helper derives the secp256k1 public key for BackupID, copies slices defensively, and stamps the freshness markers. Only signing algorithms in wallets.Algos are supported.
type KeySplit ¶
type KeySplit struct {
KeySplitData
Signature []byte
}
func DecryptSplit ¶
func DecryptSplit(encryptedShare []byte, privKeyECDSA *ecdsa.PrivateKey, chainID uint64) (*KeySplit, error)
DecryptSplit decrypts an encrypted key split and verifies its integrity.
func (*KeySplit) VerifySignature ¶
VerifySignature checks that the key split signature matches the owner key.
type KeySplitData ¶
type KeySplitData struct {
PartialWalletBackupID
OwnerPublicKey types.PublicKey
}
func (*KeySplitData) HashForSigning ¶
func (ksd *KeySplitData) HashForSigning() (common.Hash, error)
HashForSigning computes the hash used when signing the key split data.
type PartialWalletBackupID ¶
type PartialWalletBackupID struct {
wallets.WalletBackupID
IsAdmin bool
}
PartialWalletBackupID identifies one of the two additive parts of a backed-up key. IsAdmin selects the part, so a share can only be reconstructed against the group it was issued to.
func (*PartialWalletBackupID) Equal ¶
func (pwid *PartialWalletBackupID) Equal(w *PartialWalletBackupID) bool
type ShamirShare ¶
type ShamirShare struct {
}
ShamirShare is one point on the sharing polynomial. X is the evaluation index, which is public and assigned sequentially. Y is the field element at that index, serialized to the field's fixed width so that a share's encoded length never reveals anything about its value.
func (*ShamirShare) ID ¶
func (s *ShamirShare) ID() string
ID returns the string identifier for the Shamir share.
type WalletBackup ¶
type WalletBackup struct {
WalletBackupMetaData
AdminEncryptedParts *EncryptedShares
ProviderEncryptedParts *EncryptedShares
Signature hexutil.Bytes
TEESignature hexutil.Bytes
}
func (*WalletBackup) Check ¶
func (wb *WalletBackup) Check(chainID uint64) error
Check validates the metadata and share alignment in the wallet backup.
func (*WalletBackup) HashForSigning ¶
func (wb *WalletBackup) HashForSigning() (common.Hash, error)
HashForSigning produces the hash over the wallet backup content.
func (*WalletBackup) OwnerSignHash ¶ added in v0.0.21
func (wb *WalletBackup) OwnerSignHash(chainID uint64) (common.Hash, error)
OwnerSignHash returns the domain-separated, chain-bound preimage signed by the wallet (owner) key over the backup: signing.Payload{csigning.PMWWalletBackup, chainID, HashForSigning()}.Hash().
func (*WalletBackup) TEESignHash ¶ added in v0.0.21
func (wb *WalletBackup) TEESignHash(chainID uint64) (common.Hash, error)
TEESignHash returns the domain-separated, chain-bound preimage signed by the TEE identity key over the backup: signing.Payload{csigning.TEEWalletBackup, chainID, HashForSigning()}.Hash().
type WalletBackupMetaData ¶
type WalletBackupMetaData struct {
wallets.WalletBackupID
// FieldID identifies the prime field the key was shared over. It is
// recorded rather than re-derived at restore so that a backup stays
// readable if the mapping from key metadata to field ever changes.
FieldID common.Hash
AdminsPublicKeys []types.PublicKey
AdminsThreshold uint64
ProvidersThreshold uint64
Cosigners []common.Address
CosignersThreshold uint64
}
Source Files