Solana: CLI should support reading key pairs for seed strings

[t-nelson]

Problem

Our CLI tools don't facilitate inputting key pairs directly from seed

Proposed Solution

Special case the string "ask-seed" that, when specified as a keypair file, queries the seed from stdin via a masked prompt

TODO

• [x] solana-validator
• [x] solana-archiver
• [x] solana --keypair
• [x] solana create-stake-account
• [x] solana create-vote-account
• [x] solana create-archiver-storage-account
• [x] solana create-validator-storage-account

SKIP

• bench clients
• drone
• solana-install deploy

[mvines]

I'd rather we hook this up as an officially supported cli argument rather than shoehorning it in as a magic ask-seed pub key. Perhaps an --ask-seed <pubkey> argument to the affected CLI commands (do you have that list perchance?) that indicates the pubkey for each keypair that needs to be queried from stdin

[t-nelson]

I chose the ask-seed route so that it could easily be applied to any of the other key roles (stake, vote, storage, etc).

I didn't tabulate the list but browsing the code, more subcommands take some sort of key than don't. This is what lead me to ask-seed. The prompting can take place in a helper mostly generically.

[jstarry]

So is the idea that instead of solana balance -k ./my_keypair.json you could do solana balance --ask-seed keypair? And something like solana-validator --ask-seed storage-keypair --ask-seed voting-keypair when there is more than one keypair argument?

EDIT: Used mvines' suggested syntax

[t-nelson]

It seems like that would get unwieldy pretty quickly, but @mvines wasn't too keen on my ask-seed sentinel keyfile string idea either. I'll take a peek at clap's docs and see if anything stands out as helpful

[t-nelson]

There _is_ an ArgMatches::indices_of(), so we _could_ do somthing like check for an instances of --ask-seed immediately after each role keypair flag. Ergonomics may not be great though

[jstarry]

I think I'll move forward with vines' suggestion

[jstarry]

@t-nelson are we intending the seed strings to be BIP39 style mnemonic seed phrases?

[t-nelson]

That's correct

[jstarry]

@t-nelson to understand the scope of the commands that should be updated, can you help me understand why "Our CLI tools don't facilitate inputting key pairs directly from seed" is a problem? In what cases does someone not want to store the keypair on a device?

[t-nelson]

This is to support custodial solutions, offline signing, paper wallets,
etc. It will likely be applicable for all key roles, depending on the
user's security model

[jstarry]

@t-nelson @mvines thoughts on also adding support for seed passphrases (the optional salt used with the mnemonic)? If we are aiming to have a secure interface, I think it would be a good idea to support it.

Something like this, perhaps?

solana-validator --ask-seed-and-passphrase identity --ask-seed voting ...

But pretty wordy 🤔

[mvines]

(I'm ok with wordy in this area)

[jstarry]

I suppose we could always prompt for an optional passphrase right after the user enters the mnemonic

> solana-validator --ask-seed identity voting ...
[identity keypair] bip39 mnemonic: 🔒 
[identity keypair] bip39 (optional) passphrase: 🔒 
[voting keypair] bip39 mnemonic: 🔒 
[voting keypair] bip39 (optional) passphrase: 🔒 

[jstarry]

I think we are using the wrong term for the argument. BIP39 refers to the user input as the "mnemonic" and then that mnemonic (along with the optional passphrase) is used to generate the "seed". We aren't asking the user directly for a seed, so I think we should go with --ask-mnemonic or --mnemonic-stdin

[t-nelson]

thoughts on also adding support for seed passphrases

Isn't the BIP39 "passphrase" usually done by appending another "word" to the mnemonic that's user-chosen and not from the wordlist (ie. supported implicitly)? I'm not sure if the user would expect to be prompted for it separately.

I think we should go with --ask-mnemonic or --mnemonic-stdin

👍

[jstarry]

Isn't the BIP39 "passphrase" usually done by appending another "word" to the mnemonic

Nope, PBKDF2 takes a salt and uses it for each iteration of hashing afaict. Also, BIP39 specifies that the salt passed to PBKDF2 is always prefixed with the string "mnemonic".

[t-nelson]

Ah weird, typically a "salt" isn't intended to be secret. Carry on! 🙂

[jstarry]

I just updated the description to include a list of CLI commands that will need to be updated and a list that read keypairs that we probably don't need secure input for at this time.

[jstarry]

I think we are using the wrong term for the argument. BIP39 refers to the user input as the "mnemonic"

Looks like I was mistaken..

Seed phrases are sometimes called "mnemonic phrases" especially in older literature. This is a bad name because the word mnemonic implies that the phrase should be memorized. It is less misleading to call them seed phrases.
https://en.bitcoin.it/wiki/Seed_phrase#Alternative_name_.22Mnemonic_Phrase.22

Will go with --ask-seed-phrase and --skip-seed-phrase-validation unless there are any objections