[BC/CWC] Wallet private key updates [1]

packages/bitcore-client/src/encryption.ts

@@ -23,33 +23,83 @@ export function encryptEncryptionKey(encryptionKey, password) {
   return encData;
 }
 
-export function decryptEncryptionKey(encEncryptionKey, password) {
+export function decryptEncryptionKey(encEncryptionKey, password, toBuffer: true): Buffer;
+export function decryptEncryptionKey(encEncryptionKey, password, toBuffer: false): string;
+export function decryptEncryptionKey(encEncryptionKey, password, toBuffer?: boolean): Buffer | string {
   const password_hash = Buffer.from(SHA512(password));
   const key = password_hash.subarray(0, 32);
   const iv = password_hash.subarray(32, 48);
   const decipher = crypto.createDecipheriv(algo, key, iv);
-  const decrypted = decipher.update(encEncryptionKey, 'hex', 'hex' as any) + decipher.final('hex');
-  return decrypted;
+
+  let payload: Buffer | undefined;
+  let final: Buffer | undefined;
+  let output: Buffer | undefined;
+  try {
+    payload = decipher.update(encEncryptionKey, 'hex');
+    final = decipher.final();
+    output = Buffer.concat([payload, final]);
+    return toBuffer ? output : output.toString('hex');
+  } finally {
+    payload.fill(0);
+    final.fill(0);
+    if (!toBuffer) {
+      // Don't fill output if it's what's returned directly
+      output.fill(0);
+    }
+  }
 }
 
+/** @deprecated - Use encryptBuffer */
 export function encryptPrivateKey(privKey, pubKey, encryptionKey) {
-  const key = Buffer.from(encryptionKey, 'hex');
-  const doubleHash = Buffer.from(SHA256(SHA256(pubKey)), 'hex');
-  const iv = doubleHash.subarray(0, 16);
-  const cipher = crypto.createCipheriv(algo, key, iv);
-  const encData = cipher.update(privKey, 'utf8', 'hex') + cipher.final('hex');
-  return encData;
+  encryptionKey = Buffer.from(encryptionKey, 'hex');
+  privKey = Buffer.from(privKey, 'utf8');
+  return encryptBuffer(privKey, pubKey, encryptionKey).toString('hex');
 }
 
-function decryptPrivateKey(encPrivateKey: string, pubKey: string, encryptionKey: string) {
-  const key = Buffer.from(encryptionKey, 'hex');
+function decryptPrivateKey(encPrivateKey: string, pubKey: string, encryptionKey: Buffer | string) {
+  if (!Buffer.isBuffer(encryptionKey)) {
+    encryptionKey = Buffer.from(encryptionKey, 'hex');
+  }
   const doubleHash = Buffer.from(SHA256(SHA256(pubKey)), 'hex');
   const iv = doubleHash.subarray(0, 16);
-  const decipher = crypto.createDecipheriv(algo, key, iv);
+  const decipher = crypto.createDecipheriv(algo, encryptionKey, iv);
   const decrypted = decipher.update(encPrivateKey, 'hex', 'utf8') + decipher.final('utf8');
   return decrypted;
 }
 
+function encryptBuffer(data: Buffer, pubKey: string, encryptionKey: Buffer): Buffer {
+  let payload: Buffer | undefined;
+  try {
+    const iv = Buffer.from(SHA256(SHA256(pubKey)), 'hex').subarray(0, 16);
+    const cipher = crypto.createCipheriv(algo, encryptionKey, iv);
+    payload = cipher.update(data);
+    return Buffer.concat([payload, cipher.final()]);
+  } finally {
+    if (Buffer.isBuffer(payload)) {
+      payload.fill(0);
+    }
+  }
+}
+
+function decryptToBuffer(encHex: string, pubKey: string, encryptionKey: Buffer): Buffer {
+  let decrypted: Buffer | undefined;
+  let final: Buffer | undefined;
+  try {
+    const iv = Buffer.from(SHA256(SHA256(pubKey)), 'hex').subarray(0, 16);
+    const decipher = crypto.createDecipheriv(algo, encryptionKey, iv);
+    decrypted = decipher.update(encHex, 'hex');
+    final = decipher.final();
+    return Buffer.concat([decrypted, final]);
+  } finally {
+    if (Buffer.isBuffer(decrypted)) {
+      decrypted.fill(0);
+    }
+    if (Buffer.isBuffer(final)) {
+      final.fill(0);
+    }
+  }
+}
+
 function sha512KDF(passphrase: string, salt: Buffer, derivationOptions: { rounds?: number }): string {
   const rounds = derivationOptions.rounds || 1;
   // if salt was sent in as a string, we will have to assume the default encoding type
@@ -134,6 +184,8 @@ export const Encryption = {
   decryptEncryptionKey,
   encryptPrivateKey,
   decryptPrivateKey,
+  encryptBuffer,
+  decryptToBuffer,
   generateEncryptionKey,
   bitcoinCoreDecrypt
 };

packages/bitcore-client/src/storage.ts

@@ -57,8 +57,11 @@ export class Storage {
     (this.storageType as Mongo)?.close?.();
   }
 
-  async loadWallet(params: { name: string }): Promise<void | IWallet> {
-    const { name } = params;
+  async loadWallet(params: { name: string }): Promise<void | IWallet>
+  async loadWallet(params: { name: string; raw: true }): Promise<void | string>
+  async loadWallet(params: { name: string; raw: false }): Promise<void | IWallet>
+  async loadWallet(params: { name: string; raw?: boolean }): Promise<void | IWallet | string> {
+    const { name, raw } = params;
     let wallet: string | void;
     for (const db of await this.verifyDbs(this.db)) {
       try {
@@ -72,7 +75,7 @@ export class Storage {
     if (!wallet) {
       return;
     }
-    return JSON.parse(wallet) as IWallet;
+    return raw ? wallet : JSON.parse(wallet) as IWallet;
   }
 
   async deleteWallet(params: { name: string }) {
@@ -113,6 +116,7 @@ export class Storage {
     return this.storageType.saveWallet({ wallet });
   }
 
+  /** @deprecated - Use getStoredKey */
   async getKey(params: {
     address: string;
     name: string;
@@ -132,6 +136,7 @@ export class Storage {
     }
   }
 
+  /** @deprecated - Use getStoredKeys */
   async getKeys(params: { addresses: string[]; name: string; encryptionKey: string }): Promise<Array<KeyImport>> {
     const { addresses, name, encryptionKey } = params;
     const keys = new Array<KeyImport>();
@@ -158,6 +163,7 @@ export class Storage {
     return keys;
   }
 
+  /** @deprecated - Use addKeysSafe */
   async addKeys(params: { name: string; keys: KeyImport[]; encryptionKey: string }) {
     const { name, keys, encryptionKey } = params;
     let open = true;
@@ -189,4 +195,64 @@ export class Storage {
     const { name, limit, skip } = params;
     return this.storageType.getAddresses({ name, limit, skip });
   }
+
+  async addKeysSafe(params: { name: string; keys: KeyImport[] }) {
+    const { name, keys } = params;
+    let i = 0;
+    for (const key of keys) {
+      const { path } = key;
+      const pubKey = key.pubKey;
+      // key.privKey is encrypted - cannot be directly used to retrieve pubKey if required
+      if (!pubKey) {
+        throw new Error(`pubKey is undefined for ${name}. Keys not added to storage`);
+      }
+      let payload = {};
+      if (pubKey) {
+        payload = { key: JSON.stringify(key), pubKey, path };
+      }
+      const toStore = JSON.stringify(payload);
+      // open on first, close on last
+      await this.storageType.addKeys({ name, key, toStore, open: i === 0, keepAlive: i < keys.length - 1 });
+      ++i;
+    }
+  }
+
+  async getStoredKeys(params: { addresses: string[]; name: string }): Promise<Array<any>> {
+    const { addresses, name } = params;
+    const keys = new Array<any>();
+    let i = 0;
+    for (const address of addresses) {
+      try {
+        const key = await this.getStoredKey({
+          name,
+          address,
+          open: i === 0, // open on first
+          keepAlive: i < addresses.length - 1, // close on last
+        });
+        keys.push(key);
+      } catch (err) {
+        // don't continue from catch - i must be incremented
+        console.error(err);
+      }
+      ++i;
+    }
+    return keys;
+  }
+
+  private async getStoredKey(params: {
+    address: string;
+    name: string;
+    keepAlive: boolean;
+    open: boolean;
+  }): Promise<any> {
+    const { address, name, keepAlive, open } = params;
+    const payload = await this.storageType.getKey({ name, address, keepAlive, open });
+    const json = JSON.parse(payload) || payload;
+    const { key } = json; // pubKey available - not needed
+    if (key) {
+      return JSON.parse(key);
+    } else {
+      return json;
+    }
+  }
 }