feat: switch default auth scheme to ECDSA for new accounts#229
Open
WiktorStarczewski wants to merge 2 commits intomainfrom
Open
feat: switch default auth scheme to ECDSA for new accounts#229WiktorStarczewski wants to merge 2 commits intomainfrom
WiktorStarczewski wants to merge 2 commits intomainfrom
Conversation
…Falcon for existing
NEW account creation now defaults to ECDSA. EXISTING accounts (created
under the historical Falcon default) keep working as Falcon — their
auth component is sealed at on-chain creation and can never rotate, so
the signing path uses whatever secret is stored in the keystore for
each account regardless of any current 'default'.
To keep restore paths correct in both directions, WalletAccount gains
an optional 'authScheme' field. Legacy records (written before this
change) have it absent on read; consumers treat missing as Falcon, the
historical default. New records stamp the scheme at creation.
Behavior matrix:
Scenario Outcome
-------- -------
In-place upgrade No change. Existing Falcon accounts
keep signing with Falcon. New account
creations switch to ECDSA.
Mnemonic-only restore Vault.spawn now PROBES both schemes
(no per-account metadata) against the chain (falcon first,
ecdsa second) to find the user's
real account at hdIndex=0. If neither
probe finds an on-chain account the
user's mnemonic is fresh — fall
through to a brand-new ECDSA create.
Encrypted-file restore Each WalletAccount in the file
(per-account metadata present) carries its scheme; restore uses it.
Old files lacking the field default
to Falcon, matching the historical
on-chain account.
Private-key import Scheme detected from the
deserialized AuthSecretKey via the
SDK's per-scheme accessor (throws
on type mismatch), stamped into the
new WalletAccount.
Files touched:
- src/lib/shared/types.ts: AuthScheme type + optional WalletAccount
field; legacy-on-read default documented inline.
- src/lib/miden/back/vault.ts: NEW_ACCOUNT_AUTH_SCHEME + LEGACY_AUTH_SCHEME
constants; getAccountAuthScheme / authSecretKeyFromSeed /
detectAuthScheme helpers. spawn / spawnFromMidenClient / createHDAccount
/ importAccountFromPrivateKey all stamp + thread the scheme correctly.
- src/lib/miden/sdk/miden-client-interface.ts: createMidenWallet and
importPublicMidenWalletFromSeed accept optional auth, forward to SDK
only when explicitly provided so unmigrated callers still get the SDK
default.
- src/lib/miden/back/vault.test.ts: updated mock for the now-multi-probe
spawn restore path; added 5 new tests covering each branch (probe
finds account under second scheme, probe finds under first scheme,
ECDSA secret stamped on import, ECDSA-derivation re-keying on
encrypted-file restore, falcon-fallback on legacy WalletAccount with
no authScheme).
1804/1804 tests pass; jest coverage gate clears at 95.67%/95.01%/95.46%/95.67%.
Encrypted-file format change is additive: old files restore as Falcon
(historical default), new files carry the per-account scheme. No
version bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches the wallet's default auth scheme to ECDSA for new accounts. Existing accounts keep working as Falcon — their auth component is sealed at on-chain creation and can never rotate, so the signing path keys off whichever secret is in the keystore for each account regardless of any current "default".
Won't this break existing wallets?
No, but only because each restore path is updated to do the right thing. Detail in the commit; tl;dr:
Vault.spawnPROBES both schemes (falcon first, ecdsa second) to find the user's actual on-chain account. Falls through to fresh ECDSA create only if neither probe matches (= "fresh" mnemonic with no history).WalletAccountcarries its scheme; restore re-derives the matching secret. Pre-migration files lack the field → treated as Falcon, matching the historical on-chain account.AuthSecretKeyvia the SDK's per-scheme accessor (throws on type mismatch). Stamped into the newWalletAccount.The
WalletAccountschema gets a new optionalauthScheme: 'falcon' | 'ecdsa'field. Missing-on-read →'falcon'(matches the historical default 1:1). Encrypted-file format change is additive — no version bump needed.Files
src/lib/shared/types.tsAuthSchemetype + optionalauthSchemefield onWalletAccount; legacy-on-read default documented inline.src/lib/miden/back/vault.tsNEW_ACCOUNT_AUTH_SCHEME = 'ecdsa',LEGACY_AUTH_SCHEME = 'falcon'; helpersgetAccountAuthScheme/authSecretKeyFromSeed/detectAuthScheme; all four creation paths thread the scheme correctly;Vault.spawnprobe loop.src/lib/miden/sdk/miden-client-interface.tscreateMidenWalletandimportPublicMidenWalletFromSeednow accept an optionalauthand forward only when explicitly provided.src/lib/miden/back/vault.test.tsAuthSecretKey.ecdsaWithRNG; +5 tests covering each new branch.Test plan
yarn jest— 1804/1804 passyarn test:coverage— gates clear (lines 95.67%, branches 95.01%, functions 95.46%, statements 95.67%)authSchemeper account; round-trips through restoreauthScheme='falcon'; ECDSA hex →authScheme='ecdsa'