feat(web-client): add Diffie-Hellman key agreement #345
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for nautilus-wallet-staging ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
jdvlio
changed the title
|
|
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
3 times, most recently
from
f5f3766 to
112c8b0
Compare
Codecov Report
@@ Coverage Diff @@
## main #345 +/- ##
==========================================
- Coverage 53.55% 53.28% -0.27%
==========================================
Files 124 124
Lines 1813 1824 +11
Branches 338 339 +1
==========================================
+ Hits 971 972 +1
- Misses 842 852 +10
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
|
Please add the HMAC functionality. |
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
4 times, most recently
from
0dce201 to
1668140
Compare
jdvlio
changed the title
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
from
1668140 to
ba21fac
Compare
billguo99
reviewed
Aug 30, 2022
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
2 times, most recently
from
ab09bac to
835e69e
Compare
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
2 times, most recently
from
568c30e to
6ebfd03
Compare
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
3 times, most recently
from
2098b99 to
4bcab33
Compare
billguo99
requested changes
Sep 7, 2022
|
Rebase branch with |
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
5 times, most recently
from
a8644e5 to
8e4839e
Compare
billguo99
requested changes
Sep 8, 2022
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
from
8e4839e to
0936b29
Compare
jdvlio
force-pushed
the
feat-client-diffie-hellman
branch
from
0936b29 to
9272012
Compare
billguo99
approved these changes
Sep 12, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Diffie-Hellman key agreement in order to establish shared secrets. This allows us to establish "session keys" for the authentication of multi-step exchanges between the client and server. Refer to the sequence diagram below.
Aim
The original intent of this functionality is to serve as a foundation for the wallet PIN reset feature (#316), as facilitated by the implementation of #344. However, it is possible to re-use the provided interface to instantiate an authenticated session with the wallet enclave. despite the stateless nature of SGX enclaves.
Context
PIN reset functionality is a two-step process:
Upon receiving the second message, it is the responsibility of the enclave to verify that the newly proposed PIN was sent by the same user that correctly answered the security questions in the previous exchange. The enclave has no inherent state that it may rely on but is, however, capable of deterministically deriving secrets from any provided context. These can then be used to participate in a Diffie-Hellman key agreement in order to establish a shared secret between the user and the wallet enclave.
As a result, the shared secret can be used to calculate a MAC of the PIN which it sends as part of the follow-up request to the enclave server. All that remains is for the enclave to use this shared secret to authenticate the newly acquired PIN before finally resetting the user's wallet PIN.
Patches
The upstream stablelib library does not, in its present state, support ESM. Since ESM support is required by Jasmine, our testing framework, the changes outlined in StableLib/stablelib#51 had to be patched in. Once the aforementioned changes are merged upstream, we may remove the patches from our version control.