Encrypt master key with a password before storing

.github/workflows/lint.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v3
         with:
-          node-version: 18.2.x
+          node-version: 20.9.x
           cache: npm
       - name: Cache node modules
         id: cache-node-modules

.github/workflows/test.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v3
         with:
-          node-version: 18.2.x
+          node-version: 20.9.x
           cache: npm
       - name: Cache node modules
         id: cache-node-modules

.nvmrc

@@ -0,0 +1 @@
+v20.9.0

package.json

@@ -54,6 +54,7 @@
     "tiny-secp256k1": "^2.2.3"
   },
   "devDependencies": {
+    "@types/bip38": "^3.1.2",
     "@types/create-hash": "^1.2.3",
     "@types/jest": "^29.5.3",
     "@types/node": "^20.5.0",

src/wallet/db/db.interface.ts

@@ -1,4 +1,3 @@
-import { Buffer } from 'buffer';
 import { Coin } from '../coin.ts';
 
 export type DbInterface = {
@@ -7,8 +6,14 @@ export type DbInterface = {
     getStatus(): string;
     getVersion(): Promise<number>;
     setVersion(version: number): Promise<void>;
-    getMasterKey(): Promise<{ privateKey: Buffer; chaincode: Buffer }>;
-    setMasterKey(privateKey: Buffer, chaincode: Buffer): Promise<void>;
+    getMasterKey(): Promise<{
+        encryptedPrivateKey: string;
+        encryptedChainCode: string;
+    }>;
+    setMasterKey(
+        encryptedPrivateKey: string,
+        encryptedChainCode: string,
+    ): Promise<void>;
     saveAddress(address: string, path: string): Promise<void>;
     getAddress(address: string): Promise<string>;
     hasAddress(address: string): Promise<boolean>;

src/wallet/db/level/db.ts

@@ -1,7 +1,6 @@
 import { Level } from 'level';
 import { wdb } from './layout.ts';
 import { DbInterface } from '../db.interface.ts';
-import { Buffer } from 'buffer';
 import { Coin } from '../../coin.ts';
 
 export type LevelDBConfigOptions = {
@@ -39,24 +38,20 @@ export class WalletDB implements DbInterface {
         await this.db.put(wdb.V, version.toString());
     }
 
-    public async getMasterKey(): Promise<{
-        privateKey: Buffer;
-        chaincode: Buffer;
-    }> {
+    public async getMasterKey() {
         const masterKey = await this.db.get(wdb.M);
-        const privateKey = Buffer.from(masterKey.slice(0, 64), 'hex');
-        const chaincode = Buffer.from(masterKey.slice(64), 'hex');
+        const [encryptedPrivateKey, encryptedChainCode] = masterKey.split(':');
 
-        return { privateKey, chaincode };
+        return { encryptedPrivateKey, encryptedChainCode };
     }
 
     public async setMasterKey(
-        privateKey: Buffer,
-        chaincode: Buffer,
+        encryptedPrivateKey: string,
+        encryptedChainCode: string,
     ): Promise<void> {
         await this.db.put(
             wdb.M,
-            Buffer.concat([privateKey, chaincode]).toString('hex'),
+            `${encryptedPrivateKey}:${encryptedChainCode}`,
         );
     }
 
@@ -73,19 +68,19 @@ export class WalletDB implements DbInterface {
     }
 
     async getReceiveDepth(): Promise<number> {
-        return parseInt(await this.db.sublevel(wdb.A).get('receiveDepth'));
+        return parseInt(await this.db.sublevel(wdb.D).get('receiveDepth'));
     }
 
     async setReceiveDepth(depth: number): Promise<void> {
-        await this.db.sublevel(wdb.A).put('receiveDepth', depth.toString());
+        await this.db.sublevel(wdb.D).put('receiveDepth', depth.toString());
     }
 
     async getChangeDepth(): Promise<number> {
-        return parseInt(await this.db.sublevel(wdb.A).get('changeDepth'));
+        return parseInt(await this.db.sublevel(wdb.D).get('changeDepth'));
     }
 
     async setChangeDepth(depth: number): Promise<void> {
-        await this.db.sublevel(wdb.A).put('changeDepth', depth.toString());
+        await this.db.sublevel(wdb.D).put('changeDepth', depth.toString());
     }
 
     async getAllAddresses(): Promise<string[]> {

src/wallet/db/level/layout.ts

@@ -3,6 +3,7 @@ export const wdb = {
     V: 'V', // Version
     M: 'M', // Master key
     A: 'A', // Address
+    D: 'D', // Address depth
     C: 'C', // Coins
     SP: 'SP', // Silent payment address
 };

src/wallet/wallet.ts

@@ -11,6 +11,7 @@ import { Coin } from './coin.ts';
 import { ECPairFactory } from 'ecpair';
 import { createOutputs, encodeSilentPaymentAddress } from '../core';
 import { toXOnly } from 'bitcoinjs-lib/src/psbt/bip371';
+import { encrypt, decrypt } from 'bip38';
 
 initEccLib(ecc);
 const ECPair = ECPairFactory(ecc);
@@ -21,6 +22,8 @@ export type WalletConfigOptions = {
     networkClient: NetworkInterface;
 };
 
+const DEFAULT_ENCRYPTION_PASSWORD = '12345678';
+
 export class Wallet {
     private readonly db: DbInterface;
     private readonly network: NetworkInterface;
@@ -33,19 +36,29 @@ export class Wallet {
         this.network = config.networkClient;
     }
 
-    async init(mnemonic?: string) {
+    async init(params?: { mnemonic?: string; password?: string }) {
+        const { mnemonic, password } = params;
         await this.db.open();
 
         if (mnemonic) {
             const seed = mnemonicToSeedSync(mnemonic).toString('hex');
             this.masterKey = bip32.fromSeed(Buffer.from(seed, 'hex'));
-            await this.db.setMasterKey(
-                this.masterKey.privateKey,
-                this.masterKey.chainCode,
-            );
+            this.setPassword(password ?? DEFAULT_ENCRYPTION_PASSWORD);
         } else {
-            const { privateKey, chaincode } = await this.db.getMasterKey();
-            this.masterKey = bip32.fromPrivateKey(privateKey, chaincode);
+            const { encryptedPrivateKey, encryptedChainCode } =
+                await this.db.getMasterKey();
+            const { privateKey: decryptedPrivateKey } = decrypt(
+                encryptedPrivateKey,
+                password ?? DEFAULT_ENCRYPTION_PASSWORD,
+            );
+            const { privateKey: decryptedChainCode } = decrypt(
+                encryptedChainCode,
+                password ?? DEFAULT_ENCRYPTION_PASSWORD,
+            );
+            this.masterKey = bip32.fromPrivateKey(
+                decryptedPrivateKey,
+                decryptedChainCode,
+            );
         }
     }
 
@@ -56,6 +69,26 @@ export class Wallet {
         await this.db.close();
     }
 
+    async setPassword(newPassword: string) {
+        if (!this.masterKey) {
+            throw new Error(
+                'Wallet not initialized. Please call wallet.init()',
+            );
+        } else {
+            const encryptedPrivateKey = encrypt(
+                this.masterKey.privateKey,
+                false,
+                newPassword,
+            );
+            const encryptedChainCode = encrypt(
+                this.masterKey.chainCode,
+                false,
+                newPassword,
+            );
+            await this.db.setMasterKey(encryptedPrivateKey, encryptedChainCode);
+        }
+    }
+
     private async deriveAddress(path: string): Promise<string> {
         const child = this.masterKey.derivePath(path);
         const { address } = payments.p2wpkh({

test/wallet-db.spec.ts

@@ -24,6 +24,16 @@ describe('Wallet DB', () => {
         expect(await walletDB.getVersion()).toBe(1);
     });
 
+    it('should set and retrieve encryptedPrivateKey and encryptedChainCode', async () => {
+        const samplePrivateKey = 'samplePrivateKey';
+        const sampleChainCode = 'sampleChainCode';
+        await walletDB.setMasterKey(samplePrivateKey, sampleChainCode);
+        const { encryptedPrivateKey, encryptedChainCode } =
+            await walletDB.getMasterKey();
+        expect(encryptedPrivateKey).toStrictEqual(samplePrivateKey);
+        expect(encryptedChainCode).toStrictEqual(sampleChainCode);
+    });
+
     afterAll(async () => {
         await walletDB.close();
         fs.rmSync('./test/wallet-db', { recursive: true, force: true });

test/wallet.spec.ts

@@ -32,9 +32,17 @@ describe('Wallet', () => {
     });
 
     it('should initialise the wallet', async () => {
-        await wallet.init(
-            'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about',
-        );
+        await wallet.init({
+            mnemonic:
+                'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about',
+        });
+    });
+
+    it('should set a new password, close and reopen the wallet with the same password', async () => {
+        const password = 'notSoSecretPassword';
+        await wallet.setPassword(password);
+        await wallet.close();
+        await wallet.init({ password });
     });
 
     it('should derive first receive address', async () => {