Skip to content

Commit e82ee2d

Browse files
ethankonkethankonk
committed
added more authoritative reference links for the pkcs8 prefixes
1 parent 905ecf5 commit e82ee2d

7 files changed

Lines changed: 31 additions & 12 deletions

‎export-and-sign/dist/bundle.3f29bf7d8e30fb1dd823.js‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎export-and-sign/dist/bundle.3f29bf7d8e30fb1dd823.js.map‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎export-and-sign/dist/bundle.801fe7bbee4484b5f44c.js‎

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

export-and-sign/dist/bundle.3f29bf7d8e30fb1dd823.js.LICENSE.txt renamed to export-and-sign/dist/bundle.801fe7bbee4484b5f44c.js.LICENSE.txt

File renamed without changes.

‎export-and-sign/dist/bundle.801fe7bbee4484b5f44c.js.map‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎export-and-sign/dist/index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
<!doctype html><html class="no-js"><head><link rel="icon" type="image/svg+xml" href="./favicon.svg"/><meta charset="utf-8"/><title>Turnkey Export</title><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="turnkey-signer-environment" content="__TURNKEY_SIGNER_ENVIRONMENT__"/><meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; object-src 'none'; form-action 'none'"><link href="/styles.e084a69a94c0575bc6ba.css" rel="stylesheet" integrity="sha384-uIrxQTbBoDAwjgotQ+GUHgbxFM2iajB5QKNa4WuL9wn/Ou+2383e3dM2FCWOAq9m" crossorigin="anonymous"></head><body><h2>Export Key Material</h2><p><em>This public key will be sent along with a private key ID or wallet ID inside of a new <code>EXPORT_PRIVATE_KEY</code> or <code>EXPORT_WALLET</code> activity</em></p><form><label>Embedded key</label> <input name="embedded-key" id="embedded-key" disabled="disabled"/> <button id="reset">Reset Key</button></form><br/><br/><br/><h2>Inject Key Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="key-export-bundle" id="key-export-bundle"/> <button id="inject-key">Inject Bundle</button><br/><label>Key Format</label> <select id="key-export-format" name="key-export-format"><option value="HEXADECIMAL">Hexadecimal (Default)</option><option value="SOLANA">Solana</option></select><br/><label>Organization Id</label> <input name="key-organization-id" id="key-organization-id"/></form><br/><br/><h2>Inject Wallet Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="wallet-export-bundle" id="wallet-export-bundle"/> <button id="inject-wallet">Inject Bundle</button><br/><label>Organization Id</label> <input name="wallet-organization-id" id="wallet-organization-id"/></form><br/><br/><h2>Sign Transaction</h2><p><em>Input a serialized transaction to sign.</em></p><form><label>Transaction</label> <input name="transaction-to-sign" id="transaction-to-sign"/> <button id="sign-transaction">Sign</button></form><br/><br/><h2>Sign Message</h2><p><em>Input a serialized message to sign.</em></p><form><label>Message</label> <input name="message-to-sign" id="message-to-sign"/> <button id="sign-message">Sign</button></form><br/><br/><h2>Message log</h2><p><em>Below we display a log of the messages sent / received. The forms above send messages, and the code communicates results by sending events via the <code>postMessage</code> API.</em></p><div id="message-log"></div><div id="key-div"></div><script defer="defer" src="/bundle.921b01a774677f8e2da8.js" integrity="sha384-P/yUGeA+YjATjB94JS/FcpAKrqBRW/oFjpTPQJAEZMy2zDCV+2mfOqsTbuxZkCcy" crossorigin="anonymous"></script><script defer="defer" src="/bundle.3f29bf7d8e30fb1dd823.js" integrity="sha384-2FahO+4Ckv/SX/ymp4E9OL0qChHU6KW6jUewg//yvqWnWvCOMJVHD1HLeBZUAB0G" crossorigin="anonymous"></script></body></html>
1+
<!doctype html><html class="no-js"><head><link rel="icon" type="image/svg+xml" href="./favicon.svg"/><meta charset="utf-8"/><title>Turnkey Export</title><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="turnkey-signer-environment" content="__TURNKEY_SIGNER_ENVIRONMENT__"/><meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; base-uri 'self'; object-src 'none'; form-action 'none'"><link href="/styles.e084a69a94c0575bc6ba.css" rel="stylesheet" integrity="sha384-uIrxQTbBoDAwjgotQ+GUHgbxFM2iajB5QKNa4WuL9wn/Ou+2383e3dM2FCWOAq9m" crossorigin="anonymous"></head><body><h2>Export Key Material</h2><p><em>This public key will be sent along with a private key ID or wallet ID inside of a new <code>EXPORT_PRIVATE_KEY</code> or <code>EXPORT_WALLET</code> activity</em></p><form><label>Embedded key</label> <input name="embedded-key" id="embedded-key" disabled="disabled"/> <button id="reset">Reset Key</button></form><br/><br/><br/><h2>Inject Key Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="key-export-bundle" id="key-export-bundle"/> <button id="inject-key">Inject Bundle</button><br/><label>Key Format</label> <select id="key-export-format" name="key-export-format"><option value="HEXADECIMAL">Hexadecimal (Default)</option><option value="SOLANA">Solana</option></select><br/><label>Organization Id</label> <input name="key-organization-id" id="key-organization-id"/></form><br/><br/><h2>Inject Wallet Export Bundle</h2><p><em>The export bundle comes from the parent page and is composed of a public key and an encrypted payload. The payload is encrypted to this document's embedded key (stored in local storage and displayed above). The scheme relies on <a target="_blank" href="https://datatracker.ietf.org/doc/rfc9180/">HPKE (RFC 9180)</a></em>.</p><form><label>Bundle</label> <input name="wallet-export-bundle" id="wallet-export-bundle"/> <button id="inject-wallet">Inject Bundle</button><br/><label>Organization Id</label> <input name="wallet-organization-id" id="wallet-organization-id"/></form><br/><br/><h2>Sign Transaction</h2><p><em>Input a serialized transaction to sign.</em></p><form><label>Transaction</label> <input name="transaction-to-sign" id="transaction-to-sign"/> <button id="sign-transaction">Sign</button></form><br/><br/><h2>Sign Message</h2><p><em>Input a serialized message to sign.</em></p><form><label>Message</label> <input name="message-to-sign" id="message-to-sign"/> <button id="sign-message">Sign</button></form><br/><br/><h2>Message log</h2><p><em>Below we display a log of the messages sent / received. The forms above send messages, and the code communicates results by sending events via the <code>postMessage</code> API.</em></p><div id="message-log"></div><div id="key-div"></div><script defer="defer" src="/bundle.921b01a774677f8e2da8.js" integrity="sha384-P/yUGeA+YjATjB94JS/FcpAKrqBRW/oFjpTPQJAEZMy2zDCV+2mfOqsTbuxZkCcy" crossorigin="anonymous"></script><script defer="defer" src="/bundle.801fe7bbee4484b5f44c.js" integrity="sha384-Y3daiqb/giuJ3A47VcQjdqby9sZ8UQvtWG9V1WBE2t8NLgebEXKTo4q2B5KgiirW" crossorigin="anonymous"></script></body></html>

‎export-and-sign/src/event-handlers.js‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@ async function verifyAndParseBundleData(bundle, organizationId) {
4747
bundleObj.data
4848
);
4949
if (!verified) {
50-
throw new Error(`failed to verify enclave signature: ${bundle}`);
50+
throw new Error(
51+
`failed to verify enclave signature: ${bundleObj.dataSignature}`
52+
);
5153
}
5254

5355
const signedData = JSON.parse(
@@ -413,12 +415,29 @@ async function rawP256PrivateKeyToJwk(rawPrivateKeyBytes) {
413415
);
414416
}
415417

416-
// PKCS8 DER prefix for a P-256 private key (without optional public key field)
417-
// SEQUENCE {
418-
// INTEGER 0 (version)
419-
// SEQUENCE { OID ecPublicKey, OID P-256 }
420-
// OCTET STRING { SEQUENCE { INTEGER 1, OCTET STRING(32) <key> } }
421-
// }
418+
// Fixed PKCS#8 DER prefix for a P-256 private key (36 bytes).
419+
// This wraps a raw 32-byte scalar into the PrivateKeyInfo structure
420+
// that WebCrypto's importKey("pkcs8", ...) expects.
421+
//
422+
// Structure (per RFC 5958 §2 / RFC 5208 §5):
423+
// SEQUENCE {
424+
// INTEGER 0 -- version (v1)
425+
// SEQUENCE { -- AlgorithmIdentifier (RFC 5480 §2.1.1)
426+
// OID 1.2.840.10045.2.1 -- id-ecPublicKey
427+
// OID 1.2.840.10045.3.1.7 -- secp256r1 (P-256)
428+
// }
429+
// OCTET STRING { -- privateKey (SEC 1 §C.4 / RFC 5915 §3)
430+
// SEQUENCE {
431+
// INTEGER 1 -- version
432+
// OCTET STRING (32 bytes) -- raw private key scalar
433+
// }
434+
// }
435+
// }
436+
//
437+
// References:
438+
// - RFC 5958 / RFC 5208: PKCS#8 PrivateKeyInfo
439+
// - RFC 5480 §2.1.1: ECC AlgorithmIdentifier (OIDs)
440+
// - RFC 5915 / SEC 1 v2 §C.4: ECPrivateKey encoding
422441
const pkcs8Prefix = new Uint8Array([
423442
0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48,
424443
0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03,

0 commit comments

Comments
 (0)