You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
One of the core crypto operations that should be performed by the key management layer is computing a shared secret.
This would, for example, enable JWE [de]encrypters to use Veramo key management layer instead of requiring direct access to private key material.
key-manager plugin needs to expose a keyManagerSharedSecret() method
AbstractKeyManagementSystem class should have a new abstract method computeSharedSecret()
The basic API would be something like: computeSharedSecret(myKey: Partial<IKey>, theirKey: Partial<IKey>)
using Partial<> since the user may wish to provide more key information that would ensure correctness.
Examples:
myKey.privateKeyHex + theirKey.publicKeyHex + at least one key has type direct ECDH
The result is the RAW shared secret (scalar multiplication in the case of ECC).
To use this for symmetric encryption, one would need to hash it to arrive at a shared Symmetric Key
The key-manager plugin is expected to perform all (or most) of the checks regarding key compatibility and encoding.
The KMS implementations are expected to work mostly on raw Uint8Array data (and key handle in the case of myKey).
The text was updated successfully, but these errors were encountered:
One of the core crypto operations that should be performed by the key management layer is computing a shared secret.
This would, for example, enable JWE [de]encrypters to use Veramo key management layer instead of requiring direct access to private key material.
key-manager
plugin needs to expose akeyManagerSharedSecret()
methodAbstractKeyManagementSystem
class should have a new abstract methodcomputeSharedSecret()
The basic API would be something like:
computeSharedSecret(myKey: Partial<IKey>, theirKey: Partial<IKey>)
using
Partial<>
since the user may wish to provide more key information that would ensure correctness.Examples:
myKey.privateKeyHex
+theirKey.publicKeyHex
+ at least one key hastype
direct ECDHmyKey.type.isCompatible(theirKey.type) && (myKey.privateKeyHex || myKey.kid)
=> KMS computes ECDHThe result is the RAW shared secret (scalar multiplication in the case of ECC).
To use this for symmetric encryption, one would need to hash it to arrive at a shared Symmetric Key
The
key-manager
plugin is expected to perform all (or most) of the checks regarding key compatibility and encoding.The KMS implementations are expected to work mostly on raw Uint8Array data (and key handle in the case of
myKey
).The text was updated successfully, but these errors were encountered: