You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The rln credentials should be encrypted before being written to the rlnCredentials.txt file. A potential solution is to use Keystore similar to how it is used by nimbus.
Alternatives considered
NA
Additional context
Acceptance criteria
At a high level, the rlnCredentials.txt should only contain encrypted credentials but not plain ones. The decryption power should be given to the user to unlock the file when needed. The use of Keystore is one way to achieve so.
The text was updated successfully, but these errors were encountered:
Problem
The rln credential file contains privacy-sensitive membership information of the user and should be encrypted. Currently, it is a plaintext file. This would not cause any serious issue as long as we are running on the Ethereum testnet, but when moving to the mainnet then membership credentials will have actual financial value.
Relevant part of the code https://github.com/status-im/nwaku/blob/982fb08c7735c131ecacc801f21ac56d15286567/waku/v2/protocol/waku_rln_relay/waku_rln_relay_utils.nim#L1131
Suggested solution
The rln credentials should be encrypted before being written to the
rlnCredentials.txt
file. A potential solution is to use Keystore similar to how it is used by nimbus.Alternatives considered
NA
Additional context
Acceptance criteria
rlnCredentials.txt
should only contain encrypted credentials but not plain ones. The decryption power should be given to the user to unlock the file when needed. The use of Keystore is one way to achieve so.The text was updated successfully, but these errors were encountered: