Pin encrypt secrets #633

New Issue

Kieran · 2023-09-17T10:53:09Z

Kieran commented

2023-09-17 10:53:09 +00:00

Use PBKDF2 to encrypt nsec / wallet details in session

Private key encryption
Wallet encryption

Use PBKDF2 to encrypt nsec / wallet details in session - [x] Private key encryption - [ ] Wallet encryption

Kieran added the

enhancement

label 2023-09-17 10:53:09 +00:00

Giszmo commented

2023-10-06 17:25:03 +00:00

Wait, what? "Pin" sounds like something that's trivial to brute-force and if you mean "passphrase", ... I'm curious to know what you are working on here but I'm too paranoid to consider exposing nsecs to nostr clients a good idea anyway, so I'd prefer the removal of nsec handling over some pin/passphrase protection that any browser extension can work around by reading the nsec once the user provided the pin.

Kieran commented

2023-10-06 20:52:14 +00:00

Yes a pin, 4 or more digits, then using Scrypt to generate to a key and encrypting with xchacha20+hmac-sha256

It offers some protection, which is better than nothing

Yes a pin, 4 or more digits, then using Scrypt to generate to a key and encrypting with xchacha20+hmac-sha256 It offers some protection, which is better than nothing

Kieran closed this issue

2024-05-27 14:27:58 +00:00

Sign in to join this conversation.