Extract json encryption functions (#917)

* Extract json encryption functions

* Opt

* adjust

* Adjust

* Adjust imports

* callback error

packages/keyring/src/keyring.ts

@@ -1,8 +1,9 @@
 // Copyright 2017-2021 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+import type { EncryptedJsonEncoding } from '@polkadot/util-crypto/json/types';
 import type { Keypair, KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringInstance, KeyringOptions, KeyringPair, KeyringPair$Json, KeyringPair$JsonEncodingTypes, KeyringPair$Meta } from './types';
+import type { KeyringInstance, KeyringOptions, KeyringPair, KeyringPair$Json, KeyringPair$Meta } from './types';
 
 import { assert, hexToU8a, isHex, isUndefined, stringToU8a } from '@polkadot/util';
 import { base64Decode, decodeAddress, encodeAddress, ethereumEncode, hdEthereum, keyExtractSuri, keyFromPath, mnemonicToLegacySeed, mnemonicToMiniSecret, naclKeypairFromSeed as naclFromSeed, schnorrkelKeypairFromSeed as schnorrkelFromSeed, secp256k1KeypairFromSeed as secp256k1FromSeed } from '@polkadot/util-crypto';
@@ -90,7 +91,7 @@ export class Keyring implements KeyringInstance {
    * of an account backup), and then generates a keyring pair from them that it passes to
    * `addPair` to stores in a keyring pair dictionary the public key of the generated pair as a key and the pair as the associated value.
    */
-  public addFromAddress (address: string | Uint8Array, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, type: KeypairType = this.type, ignoreChecksum?: boolean, encType?: KeyringPair$JsonEncodingTypes[]): KeyringPair {
+  public addFromAddress (address: string | Uint8Array, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, type: KeypairType = this.type, ignoreChecksum?: boolean, encType?: EncryptedJsonEncoding[]): KeyringPair {
     const publicKey = this.decodeAddress(address, ignoreChecksum);
 
     return this.addPair(createPair({ toSS58: this.encodeAddress, type }, { publicKey, secretKey: new Uint8Array() }, meta, encoded, encType));
@@ -146,13 +147,18 @@ export class Keyring implements KeyringInstance {
    * @description Creates a pair from a JSON keyfile
    */
   public createFromJson ({ address, encoded, encoding: { content, type, version }, meta }: KeyringPair$Json, ignoreChecksum?: boolean): KeyringPair {
+    assert(version !== '3' || content[0] === 'pkcs8', () => `Unable to decode non-pkcs8 type, [${content.join(',')}] found}`);
+
     const cryptoType = version === '0' || !Array.isArray(content)
       ? this.type
       : content[1];
     const encType = !Array.isArray(type)
       ? [type]
       : type;
-      // Here the address and publicKey are 32 bytes and isomorphic. This is why the address field needs to be the public key for ethereum type pairs
+
+    assert(['ed25519', 'sr25519', 'ecdsa', 'ethereum'].includes(cryptoType), `Unknown crypto type ${cryptoType}`);
+
+    // Here the address and publicKey are 32 bytes and isomorphic. This is why the address field needs to be the public key for ethereum type pairs
     const publicKey = isHex(address)
       ? hexToU8a(address)
       : this.decodeAddress(address, ignoreChecksum);
@@ -160,7 +166,7 @@ export class Keyring implements KeyringInstance {
       ? hexToU8a(encoded)
       : base64Decode(encoded);
 
-    return createPair({ toSS58: this.encodeAddress, type: cryptoType }, { publicKey, secretKey: new Uint8Array() }, meta, decoded, encType);
+    return createPair({ toSS58: this.encodeAddress, type: cryptoType as KeypairType }, { publicKey, secretKey: new Uint8Array() }, meta, decoded, encType);
   }
 
   /**

packages/keyring/src/pair/decode.ts

@@ -1,13 +1,13 @@
 // Copyright 2017-2021 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringPair$JsonEncodingTypes } from '../types';
+import type { EncryptedJsonEncoding } from '@polkadot/util-crypto/json/types';
 import type { PairInfo } from './types';
 
-import { assert, stringToU8a, u8aFixLength } from '@polkadot/util';
-import { naclDecrypt, scryptEncode, scryptFromU8a } from '@polkadot/util-crypto';
+import { assert, u8aEq } from '@polkadot/util';
+import { jsonDecryptData } from '@polkadot/util-crypto';
 
-import { ENCODING, NONCE_LENGTH, PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SCRYPT_LENGTH, SEC_LENGTH, SEED_LENGTH } from './defaults';
+import { PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SEC_LENGTH, SEED_LENGTH } from './defaults';
 
 const SEED_OFFSET = PKCS8_HEADER.length;
 
@@ -15,59 +15,30 @@ type DecodeResult = PairInfo & {
   secretKey: Uint8Array;
 };
 
-function decodePkcs8 (encoded: Uint8Array): DecodeResult {
-  const header = encoded.subarray(0, PKCS8_HEADER.length);
+export function decodePair (passphrase?: string, encrypted?: Uint8Array | null, encType?: EncryptedJsonEncoding[]): DecodeResult {
+  const decrypted = jsonDecryptData(encrypted, passphrase, encType);
+  const header = decrypted.subarray(0, PKCS8_HEADER.length);
 
-  assert(header.toString() === PKCS8_HEADER.toString(), 'Invalid Pkcs8 header found in body');
+  assert(u8aEq(header, PKCS8_HEADER), 'Invalid Pkcs8 header found in body');
 
-  let secretKey = encoded.subarray(SEED_OFFSET, SEED_OFFSET + SEC_LENGTH);
+  let secretKey = decrypted.subarray(SEED_OFFSET, SEED_OFFSET + SEC_LENGTH);
   let divOffset = SEED_OFFSET + SEC_LENGTH;
-  let divider = encoded.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
+  let divider = decrypted.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
 
   // old-style, we have the seed here
-  if (divider.toString() !== PKCS8_DIVIDER.toString()) {
+  if (!u8aEq(divider, PKCS8_DIVIDER)) {
     divOffset = SEED_OFFSET + SEED_LENGTH;
-    secretKey = encoded.subarray(SEED_OFFSET, divOffset);
-    divider = encoded.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
+    secretKey = decrypted.subarray(SEED_OFFSET, divOffset);
+    divider = decrypted.subarray(divOffset, divOffset + PKCS8_DIVIDER.length);
+
+    assert(u8aEq(divider, PKCS8_DIVIDER), 'Invalid Pkcs8 divider found in body');
   }
 
-  assert(divider.toString() === PKCS8_DIVIDER.toString(), 'Invalid Pkcs8 divider found in body');
-
   const pubOffset = divOffset + PKCS8_DIVIDER.length;
-  const publicKey = encoded.subarray(pubOffset, pubOffset + PUB_LENGTH);
+  const publicKey = decrypted.subarray(pubOffset, pubOffset + PUB_LENGTH);
 
   return {
     publicKey,
     secretKey
   };
 }
-
-export function decodePair (passphrase?: string, encrypted?: Uint8Array | null, encType: KeyringPair$JsonEncodingTypes[] = ENCODING): DecodeResult {
-  assert(encrypted, 'No encrypted data available to decode');
-  assert(passphrase || !encType.includes('xsalsa20-poly1305'), 'Password required to decode encypted data');
-
-  let encoded: Uint8Array | null = encrypted;
-
-  if (passphrase) {
-    let password: Uint8Array;
-
-    if (encType.includes('scrypt')) {
-      const { params, salt } = scryptFromU8a(encrypted);
-
-      password = scryptEncode(passphrase, salt, params).password;
-      encrypted = encrypted.subarray(SCRYPT_LENGTH);
-    } else {
-      password = stringToU8a(passphrase);
-    }
-
-    encoded = naclDecrypt(
-      encrypted.subarray(NONCE_LENGTH),
-      encrypted.subarray(0, NONCE_LENGTH),
-      u8aFixLength(password, 256, true)
-    );
-  }
-
-  assert(encoded, 'Unable to decode using the supplied passphrase');
-
-  return decodePkcs8(encoded);
-}

packages/keyring/src/pair/defaults.ts

@@ -1,14 +1,9 @@
 // Copyright 2017-2021 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import type { KeyringPair$JsonEncodingTypes } from '../types';
-
-export const ENCODING: KeyringPair$JsonEncodingTypes[] = ['scrypt', 'xsalsa20-poly1305'];
-export const NONCE_LENGTH = 24;
 export const PKCS8_DIVIDER = new Uint8Array([161, 35, 3, 33, 0]);
 export const PKCS8_HEADER = new Uint8Array([48, 83, 2, 1, 1, 48, 5, 6, 3, 43, 101, 112, 4, 34, 4, 32]);
 export const PUB_LENGTH = 32;
 export const SALT_LENGTH = 32;
 export const SEC_LENGTH = 64;
 export const SEED_LENGTH = 32;
-export const SCRYPT_LENGTH = SALT_LENGTH + (3 * 4);

packages/keyring/src/pair/encode.spec.ts

@@ -1,8 +1,10 @@
 // Copyright 2017-2021 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+import { NONCE_LENGTH, SCRYPT_LENGTH } from '@polkadot/util-crypto/json/constants';
+
 import { createTestPairs } from '../testingPairs';
-import { NONCE_LENGTH, PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SCRYPT_LENGTH, SEC_LENGTH } from './defaults';
+import { PKCS8_DIVIDER, PKCS8_HEADER, PUB_LENGTH, SEC_LENGTH } from './defaults';
 
 const PKCS8_LENGTH = PKCS8_DIVIDER.length + PKCS8_HEADER.length + PUB_LENGTH + SEC_LENGTH;
 const ENCODED_LENGTH = 16 + PKCS8_LENGTH + NONCE_LENGTH + SCRYPT_LENGTH;

packages/keyring/src/pair/index.ts

@@ -1,8 +1,9 @@
 // Copyright 2017-2021 @polkadot/keyring authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
+import type { EncryptedJsonEncoding } from '@polkadot/util-crypto/json/types';
 import type { Keypair, KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringPair, KeyringPair$Json, KeyringPair$JsonEncodingTypes, KeyringPair$Meta, SignOptions } from '../types';
+import type { KeyringPair, KeyringPair$Json, KeyringPair$Meta, SignOptions } from '../types';
 import type { PairInfo } from './types';
 
 import { assert, u8aConcat, u8aEq, u8aToHex, u8aToU8a } from '@polkadot/util';
@@ -87,7 +88,7 @@ function vrfHash (proof: Uint8Array, context?: string | Uint8Array, extra?: stri
  * an `encoded` property that is assigned with the encoded public key in hex format, and an `encoding`
  * property that indicates whether the public key value of the `encoded` property is encoded or not.
  */
-export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: PairInfo, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, encTypes?: KeyringPair$JsonEncodingTypes[]): KeyringPair {
+export function createPair ({ toSS58, type }: Setup, { publicKey, secretKey }: PairInfo, meta: KeyringPair$Meta = {}, encoded: Uint8Array | null = null, encTypes?: EncryptedJsonEncoding[]): KeyringPair {
   const decodePkcs8 = (passphrase?: string, userEncoded?: Uint8Array | null): void => {
     const decoded = decodePair(passphrase, userEncoded || encoded, encTypes);
 

packages/keyring/src/pair/toJson.ts

@@ -2,34 +2,19 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import type { KeypairType } from '@polkadot/util-crypto/types';
-import type { KeyringPair$Json, KeyringPair$JsonEncodingTypes, KeyringPair$Meta } from '../types';
+import type { KeyringPair$Json, KeyringPair$Meta } from '../types';
 
-import { base64Encode } from '@polkadot/util-crypto';
-
-import { ENCODING } from './defaults';
+import { jsonEncryptFormat } from '@polkadot/util-crypto';
 
 interface PairStateJson {
   address: string;
   meta: KeyringPair$Meta;
 }
 
-// version 2 - nonce, encoded (previous)
-// version 3 - salt, nonce, encoded
-const VERSION = '3';
-
-const ENC_NONE: KeyringPair$JsonEncodingTypes[] = ['none'];
-
 export function pairToJson (type: KeypairType, { address, meta }: PairStateJson, encoded: Uint8Array, isEncrypted: boolean): KeyringPair$Json {
   return {
+    ...jsonEncryptFormat(encoded, ['pkcs8', type], isEncrypted),
     address,
-    encoded: base64Encode(encoded),
-    encoding: {
-      content: ['pkcs8', type],
-      type: isEncrypted
-        ? ENCODING
-        : ENC_NONE,
-      version: VERSION
-    },
     meta
   };
 }

packages/keyring/src/types.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import type { Prefix } from '@polkadot/util-crypto/address/types';
+import type { EncryptedJson } from '@polkadot/util-crypto/json/types';
 import type { KeypairType } from '@polkadot/util-crypto/types';
 
 export interface KeyringOptions {
@@ -11,20 +12,8 @@ export interface KeyringOptions {
 
 export type KeyringPair$Meta = Record<string, unknown>;
 
-export type KeyringPair$JsonVersion = '0' | '1' | '2' | '3';
-
-export type KeyringPair$JsonEncodingTypes = 'none' | 'scrypt' | 'xsalsa20-poly1305';
-
-export interface KeyringPair$JsonEncoding {
-  content: ['pkcs8', KeypairType];
-  type: KeyringPair$JsonEncodingTypes | KeyringPair$JsonEncodingTypes[];
-  version: KeyringPair$JsonVersion;
-}
-
-export interface KeyringPair$Json {
+export interface KeyringPair$Json extends EncryptedJson {
   address: string;
-  encoded: string;
-  encoding: KeyringPair$JsonEncoding;
   meta: KeyringPair$Meta;
 }
 

packages/util-crypto/src/index.ts

@@ -16,6 +16,7 @@ export * from './crypto';
 export * from './ethereum';
 export * from './hd';
 export * from './hmac';
+export * from './json';
 export * from './keccak';
 export * from './key';
 export * from './mnemonic';

packages/util-crypto/src/json/constants.ts

@@ -0,0 +1,11 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJsonEncoding, EncryptedJsonVersion } from './types';
+
+export const ENCODING: EncryptedJsonEncoding[] = ['scrypt', 'xsalsa20-poly1305'];
+export const ENCODING_NONE: EncryptedJsonEncoding[] = ['none'];
+export const ENCODING_VERSION: EncryptedJsonVersion = '3';
+
+export const NONCE_LENGTH = 24;
+export const SCRYPT_LENGTH = 32 + (3 * 4);

packages/util-crypto/src/json/decrypt.ts

@@ -0,0 +1,23 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJson } from './types';
+
+import { assert, hexToU8a, isHex } from '@polkadot/util';
+
+import { base64Decode } from '../base64';
+import { jsonDecryptData } from './decryptData';
+
+export function jsonDecrypt ({ encoded, encoding }: EncryptedJson, passphrase?: string | null): Uint8Array {
+  assert(encoded, 'No encrypted data available to decode');
+
+  return jsonDecryptData(
+    isHex(encoded)
+      ? hexToU8a(encoded)
+      : base64Decode(encoded),
+    passphrase,
+    Array.isArray(encoding.type)
+      ? encoding.type
+      : [encoding.type]
+  );
+}

packages/util-crypto/src/json/decryptData.ts

@@ -0,0 +1,40 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJsonEncoding } from './types';
+
+import { assert, stringToU8a, u8aFixLength } from '@polkadot/util';
+
+import { naclDecrypt } from '../nacl';
+import { scryptEncode, scryptFromU8a } from '../scrypt';
+import { ENCODING, NONCE_LENGTH, SCRYPT_LENGTH } from './constants';
+
+export function jsonDecryptData (encrypted?: Uint8Array | null, passphrase?: string | null, encType: EncryptedJsonEncoding[] = ENCODING): Uint8Array {
+  assert(encrypted, 'No encrypted data available to decode');
+  assert(passphrase || !encType.includes('xsalsa20-poly1305'), 'Password required to decode encypted data');
+
+  let encoded: Uint8Array | null = encrypted;
+
+  if (passphrase) {
+    let password: Uint8Array;
+
+    if (encType.includes('scrypt')) {
+      const { params, salt } = scryptFromU8a(encrypted);
+
+      password = scryptEncode(passphrase, salt, params).password;
+      encrypted = encrypted.subarray(SCRYPT_LENGTH);
+    } else {
+      password = stringToU8a(passphrase);
+    }
+
+    encoded = naclDecrypt(
+      encrypted.subarray(NONCE_LENGTH),
+      encrypted.subarray(0, NONCE_LENGTH),
+      u8aFixLength(password, 256, true)
+    );
+  }
+
+  assert(encoded, 'Unable to decode using the supplied passphrase');
+
+  return encoded;
+}

packages/util-crypto/src/json/encrypt.ts

@@ -0,0 +1,25 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJson } from './types';
+
+import { u8aConcat } from '@polkadot/util';
+
+import { naclEncrypt } from '../nacl';
+import { scryptEncode, scryptToU8a } from '../scrypt';
+import { jsonEncryptFormat } from './encryptFormat';
+
+export function jsonEncrypt (data: Uint8Array, contentType: string[], passphrase?: string | null): EncryptedJson {
+  let isEncrypted = false;
+  let encoded = data;
+
+  if (passphrase) {
+    const { params, password, salt } = scryptEncode(passphrase);
+    const { encrypted, nonce } = naclEncrypt(encoded, password.subarray(0, 32));
+
+    isEncrypted = true;
+    encoded = u8aConcat(scryptToU8a(salt, params), nonce, encrypted);
+  }
+
+  return jsonEncryptFormat(encoded, contentType, isEncrypted);
+}

packages/util-crypto/src/json/encryptFormat.ts

@@ -0,0 +1,20 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+import type { EncryptedJson } from './types';
+
+import { base64Encode } from '../base64';
+import { ENCODING, ENCODING_NONE, ENCODING_VERSION } from './constants';
+
+export function jsonEncryptFormat (encoded: Uint8Array, contentType: string[], isEncrypted: boolean): EncryptedJson {
+  return {
+    encoded: base64Encode(encoded),
+    encoding: {
+      content: contentType,
+      type: isEncrypted
+        ? ENCODING
+        : ENCODING_NONE,
+      version: ENCODING_VERSION
+    }
+  };
+}

packages/util-crypto/src/json/index.ts

@@ -0,0 +1,7 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+export { jsonDecrypt } from './decrypt';
+export { jsonDecryptData } from './decryptData';
+export { jsonEncrypt } from './encrypt';
+export { jsonEncryptFormat } from './encryptFormat';

packages/util-crypto/src/json/types.ts

@@ -0,0 +1,17 @@
+// Copyright 2017-2021 @polkadot/util-crypto authors & contributors
+// SPDX-License-Identifier: Apache-2.0
+
+export type EncryptedJsonVersion = '0' | '1' | '2' | '3';
+
+export type EncryptedJsonEncoding = 'none' | 'scrypt' | 'xsalsa20-poly1305';
+
+export interface EncryptedJsonDescriptor {
+  content: string[];
+  type: EncryptedJsonEncoding | EncryptedJsonEncoding[];
+  version: EncryptedJsonVersion;
+}
+
+export interface EncryptedJson {
+  encoded: string;
+  encoding: EncryptedJsonDescriptor;
+}