@libp2p/keychain
Version:
Key management and cryptographically protected messages
59 lines • 2.35 kB
JavaScript
/**
* @packageDocumentation
*
* - Manages the life cycle of a key
* - Keys are encrypted at rest
* - Enforces the use of safe key names
* - Uses encrypted PKCS 8 for key storage
* - Uses PBKDF2 for a "stretched" key encryption key
* - Enforces NIST SP 800-131A and NIST SP 800-132
* - Delays reporting errors to slow down brute force attacks
*
* ## KeyInfo
*
* The key management and naming service API all return a `KeyInfo` object. The `id` is a universally unique identifier for the key. The `name` is local to the key chain.
*
* ```JSON
* {
* "name": "rsa-key",
* "id": "QmYWYSUZ4PV6MRFYpdtEDJBiGs4UrmE6g8wmAWSePekXVW"
* }
* ```
*
* The **key id** is the SHA-256 [multihash](https://github.com/multiformats/multihash) of its public key.
*
* The *public key* is a [protobuf encoding](https://github.com/libp2p/js-libp2p/blob/main/packages/crypto/src/keys/keys.proto.js) containing a type and the [DER encoding](https://en.wikipedia.org/wiki/X.690) of the PKCS [SubjectPublicKeyInfo](https://www.ietf.org/rfc/rfc3279.txt).
*
* ## Private key storage
*
* A private key is stored as an encrypted PKCS 8 structure in the PEM format. It is protected by a key generated from the key chain's *pass phrase* using **PBKDF2**.
*
* The default options for generating the derived encryption key are in the `dek` object. This, along with the pass phrase, is the input to a `PBKDF2` function.
*
* ```TypeScript
* const defaultOptions = {
* // See https://cryptosense.com/parameter-choice-for-pbkdf2/
* dek: {
* keyLength: 512 / 8,
* iterationCount: 1000,
* salt: 'at least 16 characters long',
* hash: 'sha2-512'
* }
* }
* ```
*
* 
*
* ## Physical storage
*
* The actual physical storage of an encrypted key is left to implementations of [interface-datastore](https://github.com/ipfs/interface-datastore/).
*
* A key benefit is that now the key chain can be used in browser with the [js-datastore-level](https://github.com/ipfs/js-datastore-level) implementation.
*/
import { Keychain as KeychainClass } from './keychain.js';
export function keychain(init = {}) {
return (components) => {
return new KeychainClass(components, init);
};
}
//# sourceMappingURL=index.js.map