Veramo: Use existing private key or store the private key in mobile TEE environment

[anurag-iitk]

Is there a way to use an existing private key instead of generating a new one? If not, is it possible to store the private key directly in a TEE environment (such as Keychain or Keystore) without using the KMS?

[mirceanis]

The KMS abstraction is designed to allow various providers of crypto functionality to be used together regardless of the underlying implementation. We provide a kms-local and a kms-web3 implementation in this repository as examples of key management systems that either store the keys in a local database and implement some of the possible algorithms in the application space (kms-local) or use the (limited) functionality of an external web3 wallet such as MetaMask as a Veramo KMS (kms-web3).

It should be similarly possible to wrap other TEE-based crypto functionality as a KMS to use seamlessly with the rest of Veramo. I am aware of KMS implementations that use HSM, for example.

Is there a way to use an existing private key instead of generating a new one?

If you're OK with using the kms-local implementation, then you can import existing private keys instead of creating new ones.

If not, is it possible to store the private key directly in a TEE environment (such as Keychain or Keystore) without using the KMS?

You would have to implement an AbstractKeyManagementSystem that wraps the TEE functionality.

[mirceanis]

When I call the Veramo identifier method, it doesn’t return the private key—it stores it directly in the KMS. How can I retrieve the private key and store it in the TEE instead?

The Veramo KMS API is not designed to allow extracting the private keys, mostly because Veramo does not use the key material directly but relies on algorithms to be implemented by each KMS.
This way, Veramo does not care how the KMS is implemented or what is being stored and where.

If you do need to use a key in Veramo AND in another place (like you're asking about a TEE) then the best option is to implement a new KMS that uses the key directly from the other place.
Otherwise another option is to generate the key outside of Veramo and import it both to Veramo as well as the other place.

[anurag-iitk]

Okh, Thanks!
And how to import the keys in Veramo?

[mirceanis]

Here's a test case that can be used as an example for importing a key:

veramo/__tests__/shared/keyManager.ts

Line 199 in f5e14b0

const result = await agent.keyManagerImport(keyData)

[anurag-iitk]

Thanks!

[anurag-iitk]

Hi @mirceanis ,

I've added this:
credentialStatus: {
id: urn:uuid:${randomUUID()},
type: "CredentialStatusList2017",
},
While creating credentials, But when I verify i got this issue:
Expected error unknown_method: credentialStatus method CredentialStatusList2017 unknown. Validity can not be determined.

[anurag-iitk]

Thanks, This issue is fixed.

[anurag-iitk]

If possible can you please give discord access. I don't have access and I want to launch in production environment. My discord username: iamanuragsaini

[mirceanis]

Try this link https://discord.gg/huwyNfVkhe

[anurag-iitk]

Thanks @mirceanis !! Is there any functions to update credential status.

[anurag-iitk]

Access issue.

[anurag-iitk]

Hi @mirceanis , Is there any method to use Selective disclosure

[anurag-iitk]

Any code reference will be very helpful.