Encrypted keystore #6232

ChristopherDedominici · 2025-02-06T13:36:26Z

For a list of follow-up tasks related to user experience improvements (not security improvements), see the parent issue here

QUESTIONS:

user inputs are handled via requestSecretInput from hre.interruptions, but outputs are not currently managed by hre.interruptions. I believe they should be. Should we address this in this PR, or should I add it to the follow-up tasks?

vercel · 2025-02-06T13:36:30Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
hardhat	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Feb 11, 2025 3:26pm

changeset-bot · 2025-02-06T13:36:32Z

⚠️ No Changeset found

Latest commit: e2f9b77

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

github-actions · 2025-02-06T13:38:17Z

hardhat

Total size of the bundle: 213M
Total number of dependencies (including transitive): 54

List of dependencies (sorted by size)

208M	total
29M	@ignored/edr-optimism-linux-x64-musl
29M	@ignored/edr-optimism-linux-x64-gnu
26M	@ignored/edr-optimism-linux-arm64-musl
26M	@ignored/edr-optimism-linux-arm64-gnu
22M	@ignored/edr-optimism-win32-x64-msvc
20M	esbuild
20M	@ignored/edr-optimism-darwin-x64
19M	@ignored/edr-optimism-darwin-arm64
2.8M	@sentry/tracing
2.5M	micro-eth-signer
1.9M	@noble/curves
1.7M	undici
1.2M	@sentry/types
1.2M	@noble/hashes
932K	@sentry/node
920K	@sentry/utils
856K	zod
844K	@ignored/hardhat-vnext-utils
624K	micro-packed
576K	tsx
548K	@sentry/core
544K	fast-equals
492K	@scure/bip39
368K	ethereum-cryptography
344K	@sentry/hub
336K	@ignored/edr
324K	@ignored/hardhat-vnext-errors
320K	enquirer
288K	semver
264K	@ignored/edr-optimism
192K	ws
168K	@scure/base
136K	get-tsconfig
136K	adm-zip
96K	@scure/bip32
92K	chalk
88K	tslib
88K	@sentry/minimal
76K	agent-base
72K	@nomicfoundation/solidity-analyzer
68K	debug
64K	lru_map
64K	https-proxy-agent
60K	@ignored/hardhat-vnext-zod-utils
56K	rfdc
48K	ansi-colors
44K	resolve.exports
40K	resolve-pkg-maps
36K	p-map
32K	cookie
24K	strip-ansi
24K	env-paths
24K	ansi-regex
20K	ms

…ypted-keystore

ChristopherDedominici · 2025-02-11T14:16:31Z

v-next/hardhat-errors/src/descriptors.ts

@@ -706,25 +706,12 @@ Try using another mnemonic or deriving less keys.`,
    },
  },
  KEYSTORE: {
-    INVALID_KEYSTORE_FILE_FORMAT: {


Removed because it is no longer needed, as user input is now handled via the requestSecretInput hook.

ChristopherDedominici · 2025-02-11T14:20:49Z

v-next/hardhat-keystore/src/internal/hook-handlers/configuration-variables.ts

@@ -39,7 +41,16 @@ export default async (): Promise<Partial<ConfigurationVariableHooks>> => {
        return next(context, variable);
      }

-      return keystore.readValue(variable.name);
+      const password = await askPassword(
+        context.interruptions.requestSecretInput.bind(context.interruptions),


bind is needed because requestSecretInput is a method of hre.interruptions, and when passed as an argument, it loses its original this context. Since method calls rely on the object reference for this, passing it as a standalone function removes that association. To ensure it retains the correct context, we need to explicitly bind this using .bind(hre.interruptions).

This approach will be used also later in other files

ChristopherDedominici · 2025-02-11T14:22:04Z

v-next/hardhat-keystore/src/internal/keystores/encryption.ts

+  password: string;
+  salt: Uint8Array;
+}): Uint8Array {
+  password = password.normalize(PASSWORD_NORMALIZATION_FORM);


I need a double check that the normalization is only required here

ChristopherDedominici · 2025-02-11T14:23:57Z

v-next/hardhat-keystore/src/internal/keystores/encryption.ts

@@ -0,0 +1,630 @@
+import { siv } from "@noble/ciphers/aes";


We need a decision on this comment

ChristopherDedominici · 2025-02-11T14:26:18Z

v-next/hardhat-keystore/src/internal/keystores/keystore.ts

+    return this.#keystoreData;
+  }
+
+  public async listKeys(): Promise<string[]> {


When listing the keys, HMAC file validation is not performed. Is this acceptable, or do we want to validate it? If we choose to validate, we will need to request the password. I suggest keeping it as is, without validation.

ChristopherDedominici · 2025-02-11T14:27:43Z

v-next/hardhat-keystore/src/internal/keystores/password.ts

+  ) => Promise<string>,
+  consoleLog: (text: string) => void = console.log,
+): Promise<string> {
+  const PASSWORD_REGEX = /^.{8,}$/;


Currently, we only require a minimum of 8 characters. Do we want to introduce additional rules?

ChristopherDedominici · 2025-02-11T14:28:37Z

v-next/hardhat-keystore/src/internal/keystores/password.ts

+): Promise<string> {
+  const PASSWORD_REGEX = /^.{8,}$/;
+
+  consoleLog(UserDisplayMessages.keystoreBannerMessage());


How it currently looks like:

ChristopherDedominici · 2025-02-11T14:32:52Z

v-next/hardhat-keystore/src/internal/keystores/password.ts

+  }
+
+  let confirmPassword: string | undefined;
+  while (confirmPassword === undefined) {


This loop will continue indefinitely until the confirmation password matches the original password.
This check ensures that the user saves the correct password, preventing spelling mistakes.

ChristopherDedominici · 2025-02-11T14:34:20Z

v-next/hardhat-keystore/src/internal/loaders/keystore-file-loader.ts

@@ -43,23 +34,28 @@ export class KeystoreFileLoader implements KeystoreLoader {
      this.#keystoreFilePath,
    );

-    this.#throwIfInvalidKeystoreFormat(keystoreFile);


The keystore validation file has been removed since HMAC validation now handles the validation process.

ChristopherDedominici · 2025-02-11T15:53:04Z

v-next/hardhat-keystore/test/keystores/encryption.ts

+  });
+});
+
+describe("password normalization", () => {


I added this additional test to validate that the normalization is working

alcuadrado added 4 commits February 2, 2025 20:42

Add @noble dependencies to hardhat-keystore

7917813

[hardhat-test-utils] Make assertThrows easier to debug

5dfb14c

Add an encryption module to hardhat-keystore

999d228

Resuse the empty keystore in the tests

5d5a22d

github-actions bot added the status:triaging label Feb 6, 2025

github-actions bot assigned kanej Feb 6, 2025

set task: ask for/configure password

ad157e6

kanej linked an issue Feb 10, 2025 that may be closed by this pull request

encrypted keystore #5722

Open

2 tasks

ChristopherDedominici added 2 commits February 11, 2025 13:52

add encryption for all tasks and update tests accordingly

d514fb0

Merge branch 'v-next' of github.com:NomicFoundation/hardhat into encr…

b3f9d8f

…ypted-keystore

vercel bot deployed to Preview February 11, 2025 12:56 View deployment

fix range number in error descriptors

94df5cb

vercel bot deployed to Preview February 11, 2025 13:01 View deployment

add password normalization + test

23f9d4c

vercel bot deployed to Preview February 11, 2025 13:49 View deployment

remove TODOs comments

00a6db5

ChristopherDedominici added no changeset needed This PR doesn't require a changeset and removed status:triaging labels Feb 11, 2025

vercel bot deployed to Preview February 11, 2025 14:00 View deployment

ChristopherDedominici commented Feb 11, 2025

View reviewed changes

rename unencrypted keystore references to keystore

a04ca29

vercel bot deployed to Preview February 11, 2025 14:44 View deployment

ChristopherDedominici added 2 commits February 11, 2025 15:59

fix test to validate file is corrupted

4444e7a

add error message in assertRejects

d0fd7a9

vercel bot deployed to Preview February 11, 2025 15:05 View deployment

ChristopherDedominici marked this pull request as ready for review February 11, 2025 15:15

ChristopherDedominici added the v-next A Hardhat v3 development task label Feb 11, 2025

ChristopherDedominici added this to the Public Alpha milestone Feb 11, 2025

ChristopherDedominici requested review from alcuadrado and agostbiro February 11, 2025 15:15

fix user messages

e2f9b77

vercel bot deployed to Preview February 11, 2025 15:26 View deployment

ChristopherDedominici commented Feb 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Encrypted keystore #6232

Encrypted keystore #6232

ChristopherDedominici commented Feb 6, 2025 •

edited

Loading

vercel bot commented Feb 6, 2025 •

edited

Loading

changeset-bot bot commented Feb 6, 2025 •

edited

Loading

github-actions bot commented Feb 6, 2025 •

edited

Loading

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

ChristopherDedominici Feb 11, 2025

Encrypted keystore #6232

Are you sure you want to change the base?

Encrypted keystore #6232

Conversation

ChristopherDedominici commented Feb 6, 2025 • edited Loading

QUESTIONS:

vercel bot commented Feb 6, 2025 • edited Loading

changeset-bot bot commented Feb 6, 2025 • edited Loading

⚠️ No Changeset found

github-actions bot commented Feb 6, 2025 • edited Loading

hardhat

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ChristopherDedominici commented Feb 6, 2025 •

edited

Loading

vercel bot commented Feb 6, 2025 •

edited

Loading

changeset-bot bot commented Feb 6, 2025 •

edited

Loading

github-actions bot commented Feb 6, 2025 •

edited

Loading