Mina-signer support for keystore files

src/mina-signer/package.json

@@ -39,7 +39,9 @@
   ],
   "dependencies": {
     "blakejs": "^1.2.1",
-    "js-sha256": "^0.9.0"
+    "hash-wasm": "^4.12.0",
+    "js-sha256": "^0.9.0",
+    "tweetnacl": "^1.0.3"
   },
   "devDependencies": {
     "pkg-pr-new": "^0.0.9"

src/mina-signer/src/secure-box.ts

@@ -0,0 +1,44 @@
+import { argon2i } from 'hash-wasm';
+import nacl from 'tweetnacl';
+import { versionBytes } from '../../bindings/crypto/constants.js';
+import { fromBase58Check, toBase58Check } from '../../lib/util/base58.js';
+import { PrivateKey, PublicKey } from './curve-bigint.js';
+
+export { KeystoreJson, secureBoxToBase58 };
+
+const VERSION_BYTE = 2;
+type KeystoreJson = {
+  box_primitive: string;
+  pw_primitive: string;
+  nonce: string;
+  pwsalt: string;
+  pwdiff: [number, number];
+  ciphertext: string;
+};
+
+async function secureBoxToBase58(
+  keyfile: KeystoreJson,
+  password: string
+): Promise<{ publicKey: string; privateKey: string }> {
+  let pwsalt = Uint8Array.from(fromBase58Check(keyfile.pwsalt, VERSION_BYTE));
+
+  let key = await argon2i({
+    password,
+    salt: pwsalt,
+    parallelism: 1,
+    iterations: keyfile.pwdiff[1],
+    memorySize: Math.max(8, Math.floor(keyfile.pwdiff[0] / 1024)),
+    hashLength: 32,
+    outputType: 'binary',
+  });
+
+  let ciphertext = Uint8Array.from(fromBase58Check(keyfile.ciphertext, VERSION_BYTE));
+  let nonce = Uint8Array.from(fromBase58Check(keyfile.nonce, VERSION_BYTE));
+  let privateKeyBytes = nacl.secretbox.open(ciphertext, nonce, key);
+  if (privateKeyBytes === null) throw new Error('Invalid password or corrupt secure box');
+  let privateKey = toBase58Check(privateKeyBytes, versionBytes.privateKey);
+  let privateKeyBigint = PrivateKey.fromBytes([...privateKeyBytes]);
+  let publicKeyBigint = PrivateKey.toPublicKey(privateKeyBigint);
+  let publicKey = PublicKey.toBase58(publicKeyBigint);
+  return { privateKey, publicKey };
+}

src/mina-signer/src/secure-box.unit-test.ts

@@ -0,0 +1,19 @@
+import assert from 'assert';
+import { KeystoreJson, secureBoxToBase58 } from './secure-box.js';
+
+const keyfileExample: KeystoreJson = {
+  box_primitive: 'xsalsa20poly1305',
+  pw_primitive: 'argon2i',
+  nonce: '7bhBLFhx8v8uR9N9gVxbK721VZRqQ9X4zEh4xAq',
+  pwsalt: 'AnJ9HJKcGdiWpssG76s7p3Hzh3TG',
+  pwdiff: [134217728, 6],
+  ciphertext: 'BRKKEJcPFrcmsJjkWunysYrpb65hQgBeqzBDRbzrRPhS49CEHVgn48X21Peq9MwAzKeEPdFFB',
+};
+const keyFilePassword = '123456';
+const result = {
+  privateKey: 'EKF4XaKafQXHUHTxSA9qTYsBxk9VV5oGDe4CmcZY52bsQFs1GnRs',
+  publicKey: 'B62qkhhWkJdZx9MAZHd67VqBAX7FVbzSizqsFYqMKvQu4kPNyFxxCmB',
+};
+
+let actualResult = await secureBoxToBase58(keyfileExample, keyFilePassword);
+assert.deepStrictEqual(actualResult, result, 'secureBoxToBase58 did not produce expected result');