Light OS and SDK crypto tools?

[BoltyBolterson]

The SDK is Kotlin/Compose, but Light is broadly restricting which Android APIs and third-party libraries can be used. Can anyone speak to whether the allowlist will accommodate crypto primitives and local network binding?

[BoltyBolterson]

ed25519/curve25519 signing and X25519 key agreement — which library, or is BouncyCastle/Tink acceptable?

ChaCha20-Poly1305 / XSalsa20-Poly1305 for message encryption

Android Keystore, and whether StrongBox-backed keys are reachable

Is NDK/JNI allowed at all, or Kotlin/Java only?

Binding a listener on loopback or a VPN interface for local device pairing

Also, given that community tools must be open source and Light-signed, is a wallet or payments tool categorically out of scope for approval?

[dupontgu]

Hey!

• Local network should be fine using the okhttp currently? Let me know if I'm missing something there.
• I'd be curious what the surface area would look like to allow VPN stuff but my hunch is that it's a bit more than we'd want to maintain for a pretty limited set of tools.
• NDK/JNI currently not allowed for similar reason ^, open to it in the future but no work currently planned to support.
• Android KeyStore is already allowed (and being used in the 2FA example tool) but I don't think the LP3 supports StrongBox? Will look into that.
• I don't think the open source requirement would block a wallet/payment tool, but the piece that may be unclear is that we are going to have a place for developers to submit secrets to be injected into the build of their tool, so those can be kept out of the source.
• As for libraries - feel free to propose any that you think would work. If it's open source, maintained, and mature, we're likely to approve.

[BoltyBolterson]

Thanks for the response. What I’d be interested to build:
Simple wallet for core chains (btc, eth, sol),
QR generator and scanner via camera to receive/send, Solana Pay (tap to pay via nfc/hce access) Possible?
Easy sol to usdc swap tool, local key generation/import
Android key store backed at rest (strongbox if lp3 supports it)

would omit (to follow ethos of the platform):
No Defi beyond in and out of stablecoin for payment
No Staking
No Browser and mwa function
No charts/portfolio management interface
No push notification function

omitting VPN/loopback binding is fine, it just makes the app more of an actual cash on hand type of app

two things I’d want to confirm before starting: nfc access and would BouncyCastle (jvm, no ndk) cover the crypto primitives?

anyways cool product, been a fan of it for a while.
Bolt

[dupontgu]

• NFC access is planned/good, but we haven't yet built out an API wrapper for it. Feel free to take a stab at that to get started (we won't get to it for a little bit) but know that we might want to tweak the API down the road.
• BouncyCastle is fine, you can add it to the allowlist.

[BoltyBolterson]

thanks, I’ll take a look at NFC — BouncyCastle unblocks the crypto side.