Delays reporting errors to slow down brute force attacks
KeyInfo
The key management and naming service API all return a KeyInfo object. The id is a universally unique identifier for the key. The name is local to the key chain.
A private key is stored as an encrypted PKCS 8 structure in the PEM format. It is protected by a key generated from the key chain's pass phrase using PBKDF2.
The default options for generating the derived encryption key are in the dek object. This, along with the pass phrase, is the input to a PBKDF2 function.
constdefaultOptions = { // See https://cryptosense.com/parameter-choice-for-pbkdf2/ dek: { keyLength:512 / 8, iterationCount:1000, salt:'at least 16 characters long', hash:'sha2-512' } }
Physical storage
The actual physical storage of an encrypted key is left to implementations of interface-datastore.
A key benefit is that now the key chain can be used in browser with the js-datastore-level implementation.
KeyInfo
The key management and naming service API all return a
KeyInfo
object. Theid
is a universally unique identifier for the key. Thename
is local to the key chain.The key id is the SHA-256 multihash of its public key.
The public key is a protobuf encoding containing a type and the DER encoding of the PKCS SubjectPublicKeyInfo.
Private key storage
A private key is stored as an encrypted PKCS 8 structure in the PEM format. It is protected by a key generated from the key chain's pass phrase using PBKDF2.
The default options for generating the derived encryption key are in the
dek
object. This, along with the pass phrase, is the input to aPBKDF2
function.Physical storage
The actual physical storage of an encrypted key is left to implementations of interface-datastore.
A key benefit is that now the key chain can be used in browser with the js-datastore-level implementation.