1
$\begingroup$

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an encryption key (as well as iv/salt) anywhere on user device. Instead, I would like to use MetaMask connection and the private key hold by MetaMask. Because MetaMask does not provide a direct access to private keys, I can use it indirectly by signing a known message (using "personal_sign" request). The generated signature will never leave the device, being effectively a key material. Then I use PKDF2 to derive AES key and iv from this signature. This scheme would allow me to encrypt/decrypt user data by just running MetaMask to sign some pre-defined string, e.g. "Hello world".

For now I do not see any obvious security breaches here, except if the signature can be intercepted. The reason to not persist anything on the device (e.g. localStorage) is because I want to enable seamless user access from any browser where the same MetaMask account is present. Also, for now I do not want to add a second factor like additional user password.

Questions:

  • is it safe to derive an encryption key with PKDF2 from a ECDSA signature?
  • is it possible to intercept/steal a MetaMask generated signature with "personal_sign"?

Thank you very much!

Improve this question
$\endgroup$
8
  • 2
    $\begingroup$ Signing the same message twice with a conformant ECDSA signing library or device returns different signatures. I'm afraid that dooms the idea from a functional standpoint. $\endgroup$
    – fgrieu ♦
    Sep 12, 2022 at 7:55
  • $\begingroup$ This is weird, I tried MetaMask on different devices for the same seed phrase and it produced the same signature for the same input message. Maybe MetaMask is not ECDSA conformant... Anyway, thank you for letting me know this important aspect. I would rather consider use to enter a password in-app. $\endgroup$
    – pinebitter
    Sep 12, 2022 at 10:15
  • 2
    $\begingroup$ Maybe you are using deterministic ECDSA or the random see same on them.... $\endgroup$
    – kelalaka
    Sep 12, 2022 at 11:33
  • 1
    $\begingroup$ A signature is generated by one party, which doesn't need to be secret. The very fact that you are using a public value that only one party can generate is detrimental to te idea. Yes, you can use a secure channel to communicate a "signature", but if you have that, why not use a (signed) random value instead? This would therefore only work with deterministic signatures for local data, and assuming that an attacker cannot force you to create a signature over the same data. $\endgroup$
    – Maarten Bodewes ♦
    Sep 12, 2022 at 12:52
  • 2
    $\begingroup$ "I use PKDF2 to derive AES key and iv from this signature"; actually, most modes of operation assumes that you select a different iv for each encryption operation; the requirements on 'different' varies between the various modes, however they all agree that selecting the same one (with the same key to encrypt different messages) isn't a good idea $\endgroup$
    – poncho
    Sep 12, 2022 at 12:54

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.