read and write the quantus-cli keystore file format #15

New Issue

grenade · 2026-09-15T12:37:40Z

grenade commented

2026-09-15 12:37:40 +00:00

Parent: #2

Scope

A Keystore port in wallet-core and an implementation in wallet-data that reads and writes quantus-cli's EncryptedWallet JSON: Argon2id with the stored PHC params (never the digest), AES-256-GCM, the kyber_* reserved fields preserved, encryption_version honoured, scheme defaulting to ML-DSA-87 when absent (legacy files). On open, re-derive the address from the decrypted key and refuse the file if it differs, as the CLI does. Wallet files live under the platform app-data directory; import from and export to ~/.quantus/wallets paths.

Acceptance

Round trip against real files: a wallet written here lists in quantus wallet list (CLI 2.x) with the right address, scheme and checkphrase; a CLI-created wallet of each scheme opens here. A file with a tampered address is refused with a clear error. No plaintext key or mnemonic is ever written to disk, verified by a test that greps the app-data directory after every operation.

Depends on

The ML-DSA key schemes child.

Parent: #2 ## Scope A `Keystore` port in `wallet-core` and an implementation in `wallet-data` that reads and writes quantus-cli's `EncryptedWallet` JSON: Argon2id with the stored PHC params (never the digest), AES-256-GCM, the `kyber_*` reserved fields preserved, `encryption_version` honoured, `scheme` defaulting to ML-DSA-87 when absent (legacy files). On open, re-derive the address from the decrypted key and refuse the file if it differs, as the CLI does. Wallet files live under the platform app-data directory; import from and export to `~/.quantus/wallets` paths. ## Acceptance Round trip against real files: a wallet written here lists in `quantus wallet list` (CLI 2.x) with the right address, scheme and checkphrase; a CLI-created wallet of each scheme opens here. A file with a tampered address is refused with a clear error. No plaintext key or mnemonic is ever written to disk, verified by a test that greps the app-data directory after every operation. ## Depends on The ML-DSA key schemes child.

grenade added the child label 2026-09-15 12:38:56 +00:00

grenade referenced this issue

2026-09-15 12:39:26 +00:00

onboarding: create a wallet, restore a phrase, or open a quantus-cli file #26

grenade referenced this issue

2026-09-15 12:41:19 +00:00

secret handling audit and a test that greps for known test secrets #50

grenade referenced this issue

2026-09-15 12:42:33 +00:00

epic: keys and keystore #2

grenade referenced this issue from a commit

2026-09-15 15:19:32 +00:00