Bluewallet: store encryption key with Android's keystore

[nioncode]

If I'm not mistaken, BlueWallet on Android does NOT use Android's KeyStore to store the wallet's encryption key, but derives an encryption key from the wallet passphrase that is then used to decrypt the wallet. Is my understanding correct?

If this is the case, then I strongly suggest that the encryption key should be stored with Android's KeyStore, which is backed by hardware security for many Android devices and is thus significantly harder to extract or bruteforce than the software key derivation (which can be performed via an offline attack on much more powerful hardware after getting hold of the encrypted wallet).

[marcosrdz]

The storage password is provided by the user. BlueWallet encrypts all wallet information with said password and stores the encrypted information in iOS's Keychain and Android's Keystore.

[marcosrdz]

More information can be found here:

https://github.com/pradeep1991singh/react-native-secure-key-store

[vesparny]

Any reason why you chose that lib over react-native-keychain which is more popular?

[marcosrdz]

If I'm not mistaken, the time of implementation react native keychain was using sharedpreference.

[nioncode]

Thanks for the fast response. I have not checked the details from your linked library, but I assume that it takes the provided data blob of BlueWallet and encrypts it with a key from the KeyStore and stores the result in the private files of the app, since you cannot store arbitrary data in the KeyStore on Android afaik.

So the flow is:

• BlueWallet encrypts the wallet with the user provided password (using a key derivation)
• BlueWallet asks react-native-secure-key-store to store the resulting data blob
  
  
  
  • which then encrypts the blob with an additional key from the KeyStore
  
  
  • and then stores the result in the app's private files
  
  

If you can confirm that this is the case, then all seems good and I just did not see how the KeyStore is actually being used while searching for it in this repo, sorry.

[marcosrdz]

That is correct. The file class/app-storage.js is where this takes place.

[Overtorment]

if youre intereted, transaction data (which contains no secrets) is offloaded to Realm database (that's faster) and this tx data is encrypted via the same user's password or default password.
all encryption is AES256.