Skip to content

Commit b9970fb

Browse files
mirceanismirceanis
committed
feat: add encryption capabilities
fixes #101
1 parent b5ddf44 commit b9970fb

10 files changed

+2204
-3
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,5 @@ node_modules/
7575
!.yarn/releases
7676
!.yarn/sdks
7777
!.yarn/versions
78+
79+
.idea/

‎snap.manifest.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"url": "https://github.com/MetaMask/message-signing-snap.git"
88
},
99
"source": {
10-
"shasum": "MVxPWtAZ1Sdw63kwfZswKlYQ6dddnr7vvbj4V7j/Fc4=",
10+
"shasum": "WwjAlInXlGmhYmPE2iWLXj4UWwZecHhC0gIrwLqDLk0=",
1111
"location": {
1212
"npm": {
1313
"filePath": "dist/bundle.js",

‎src/entropy-keys.test.ts

+31-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1-
import { getPublicEntropyKey, signMessageWithEntropyKey } from './entropy-keys';
1+
import {
2+
decryptMessage,
3+
getEncryptionPublicKey,
4+
getPublicEntropyKey,
5+
signMessageWithEntropyKey,
6+
} from './entropy-keys';
27

38
const MOCK_PRIVATE_KEY =
49
'0xec180de430cef919666c2009b91ca3d3b7f6c471136abc9937fa40b89357bbb9';
@@ -26,6 +31,31 @@ describe('signMessageWithEntropyKey() tests', () => {
2631
});
2732
});
2833

34+
describe('getEncryptionPublicKey() tests', () => {
35+
it('gets the expected encryption key', async () => {
36+
mockSnapGetEntropy();
37+
38+
const publicEncryptionKey = await getEncryptionPublicKey();
39+
const EXPECTED_KEY =
40+
'0x50cbcf3915730e501b7476e92157307f6e9aade2a2798cf3832f73cd4990281b';
41+
expect(publicEncryptionKey).toBe(EXPECTED_KEY);
42+
});
43+
44+
it('decrypts a message intended for this public encryption key', async () => {
45+
mockSnapGetEntropy();
46+
47+
const encrypted = {
48+
version: 'x25519-xsalsa20-poly1305',
49+
nonce: 'h63LvxvCOBP3x3Oou2n5JYgCM1p4p+DF',
50+
ephemPublicKey: 'lmIBlLKUuSBIRjlo+/hL7ngWYpMWQ7biqk7Y6pDsaXY=',
51+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
52+
};
53+
54+
const decrypted = await decryptMessage(encrypted);
55+
expect(decrypted).toBe('hello world');
56+
});
57+
});
58+
2959
function mockSnapGetEntropy() {
3060
const mockSnapRequest = jest
3161
.fn()

‎src/entropy-keys.ts

+39
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1+
import type { Eip1024EncryptedData, Hex } from '@metamask/utils';
2+
import { bytesToHex, concatBytes } from '@metamask/utils';
3+
import { utf8ToBytes } from '@noble/ciphers/utils';
4+
import { x25519 } from '@noble/curves/ed25519';
15
import { secp256k1 } from '@noble/curves/secp256k1';
26
import { sha256 } from '@noble/hashes/sha256';
37

48
import { addressToBytes, bytesToAddress } from './utils/address-conversion';
9+
import { ERC1024 } from './utils/ERC1024';
510

611
/**
712
* Retrieve the snap entropy private key.
@@ -37,6 +42,40 @@ export async function getPublicEntropyKey(): Promise<string> {
3742
return bytesToAddress(secp256k1.getPublicKey(privateKey));
3843
}
3944

45+
// This is used to derive an encryption key from the entropy, to avoid key reuse.
46+
const staticSalt = 'metamask:snaps:encryption';
47+
48+
/**
49+
* Retrieve the secret encryption key for this snap.
50+
* The key is derived from the entropy key and a static salt as sha256(entropy | staticSalt).
51+
* @returns Secret Key Bytes.
52+
*/
53+
async function getEncryptionSecretKey(): Promise<Uint8Array> {
54+
const privateEntropy = await getPrivateEntropyKey();
55+
return sha256(concatBytes([privateEntropy, utf8ToBytes(staticSalt)]));
56+
}
57+
58+
/**
59+
* Retrieve the public encryption key for this snap.
60+
* @returns Public Key Hex.
61+
*/
62+
export async function getEncryptionPublicKey(): Promise<Hex> {
63+
const secretKeyBytes = await getEncryptionSecretKey();
64+
return bytesToHex(x25519.getPublicKey(secretKeyBytes));
65+
}
66+
67+
/**
68+
* Decrypt an encrypted message using the snap specific encryption key.
69+
* @param encryptedMessage - The encrypted message, encoded as a `Eip1024EncryptedData` object.
70+
* @returns The decrypted message (string).
71+
*/
72+
export async function decryptMessage(
73+
encryptedMessage: Eip1024EncryptedData,
74+
): Promise<string> {
75+
const secretKeyBytes = await getEncryptionSecretKey();
76+
return ERC1024.decrypt(encryptedMessage, secretKeyBytes);
77+
}
78+
4079
/**
4180
* Signs a message and returns the signature.
4281
* @param message - Message to sign.

‎src/index.test.ts

+143
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,11 @@
11
import { installSnap } from '@metamask/snaps-jest';
2+
import type { Hex } from '@metamask/utils';
23
import { hexToBytes } from '@noble/ciphers/utils';
34
import { secp256k1 } from '@noble/curves/secp256k1';
45
import { sha256 } from '@noble/hashes/sha256';
56

7+
import { ERC1024 } from './utils/ERC1024';
8+
69
describe('onRpcRequest - getPublicKey', () => {
710
it('should return this snaps public key', async () => {
811
const snap = await installSnap();
@@ -19,6 +22,146 @@ describe('onRpcRequest - getPublicKey', () => {
1922
});
2023
});
2124

25+
describe('onRpcRequest - getEncryptionPublicKey', () => {
26+
it('should return this snaps encryption public key', async () => {
27+
const snap = await installSnap();
28+
const response = await snap.request({
29+
method: 'getEncryptionPublicKey',
30+
});
31+
32+
// E.g. length = 66 chars
33+
// E.g. starts with '0x'
34+
const result = 'result' in response.response && response.response.result;
35+
expect(result?.toString().length).toBe(66);
36+
expect(result?.toString().startsWith('0x')).toBe(true);
37+
});
38+
});
39+
40+
describe('onRpcRequest - decryptMessage', () => {
41+
it('should decrypt a message intended for the snaps public key', async () => {
42+
const snap = await installSnap();
43+
const pkResponse = await snap.request({
44+
method: 'getEncryptionPublicKey',
45+
});
46+
const publicKey = (
47+
'result' in pkResponse.response && pkResponse.response.result
48+
)?.toString() as Hex;
49+
const message = 'hello world';
50+
const encryptedMessage = ERC1024.encrypt(publicKey, message);
51+
const response = await snap.request({
52+
method: 'decryptMessage',
53+
params: { data: encryptedMessage },
54+
});
55+
56+
const result = 'result' in response.response && response.response.result;
57+
expect(result?.toString()).toBe('hello world');
58+
});
59+
60+
it('should fail to decrypt a message intended for a different recipient', async () => {
61+
const snap = await installSnap();
62+
const encryptedMessage = {
63+
version: 'x25519-xsalsa20-poly1305',
64+
nonce: 'h63LvxvCOBP3x3Oou2n5JYgCM1p4p+DF',
65+
ephemPublicKey: 'lmIBlLKUuSBIRjlo+/hL7ngWYpMWQ7biqk7Y6pDsaXY=',
66+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
67+
};
68+
const response = await snap.request({
69+
method: 'decryptMessage',
70+
params: { data: encryptedMessage },
71+
});
72+
73+
expect(response).toRespondWithError({
74+
code: -32603,
75+
message: 'invalid tag',
76+
stack: expect.any(String),
77+
});
78+
});
79+
80+
it('should reject a message with invalid version', async () => {
81+
const snap = await installSnap();
82+
const encryptedMessage = {
83+
version: '1', // invalid version
84+
nonce: 'h63LvxvCOBP3x3Oou2n5JYgCM1p4p+DF',
85+
ephemPublicKey: 'lmIBlLKUuSBIRjlo+/hL7ngWYpMWQ7biqk7Y6pDsaXY=',
86+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
87+
};
88+
const response = await snap.request({
89+
method: 'decryptMessage',
90+
params: { data: encryptedMessage },
91+
});
92+
93+
expect(response).toRespondWithError({
94+
code: -32602,
95+
message:
96+
'`decryptMessage`, must take a `data` parameter that must match the Eip1024EncryptedData schema',
97+
stack: expect.any(String),
98+
});
99+
});
100+
101+
it('should reject a message with invalid nonce', async () => {
102+
const snap = await installSnap();
103+
const encryptedMessage = {
104+
version: 'x25519-xsalsa20-poly1305',
105+
nonce: 'tooshort',
106+
ephemPublicKey: 'lmIBlLKUuSBIRjlo+/hL7ngWYpMWQ7biqk7Y6pDsaXY=',
107+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
108+
};
109+
const response = await snap.request({
110+
method: 'decryptMessage',
111+
params: { data: encryptedMessage },
112+
});
113+
114+
expect(response).toRespondWithError({
115+
code: -32602,
116+
message:
117+
'`decryptMessage`, must take a `data` parameter that must match the Eip1024EncryptedData schema',
118+
stack: expect.any(String),
119+
});
120+
});
121+
122+
it('should reject a message with invalid ephemPublicKey', async () => {
123+
const snap = await installSnap();
124+
const encryptedMessage = {
125+
version: 'x25519-xsalsa20-poly1305',
126+
nonce: 'h63LvxvCOBP3x3Oou2n5JYgCM1p4p+DF',
127+
ephemPublicKey: 'invalid base 64',
128+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
129+
};
130+
const response = await snap.request({
131+
method: 'decryptMessage',
132+
params: { data: encryptedMessage },
133+
});
134+
135+
expect(response).toRespondWithError({
136+
code: -32602,
137+
message:
138+
'`decryptMessage`, must take a `data` parameter that must match the Eip1024EncryptedData schema',
139+
stack: expect.any(String),
140+
});
141+
});
142+
143+
it('should reject a message with invalid params', async () => {
144+
const snap = await installSnap();
145+
const encryptedMessage = JSON.stringify({
146+
version: 'x25519-xsalsa20-poly1305',
147+
nonce: 'h63LvxvCOBP3x3Oou2n5JYgCM1p4p+DF',
148+
ephemPublicKey: 'lmIBlLKUuSBIRjlo+/hL7ngWYpMWQ7biqk7Y6pDsaXY=',
149+
ciphertext: 'g+TpY8OlU0AS9VPvaTIIqpFnWNKvWw2COSJY',
150+
});
151+
const response = await snap.request({
152+
method: 'decryptMessage',
153+
params: { data: encryptedMessage },
154+
});
155+
156+
expect(response).toRespondWithError({
157+
code: -32602,
158+
message:
159+
'`decryptMessage`, must take a `data` parameter that must match the Eip1024EncryptedData schema',
160+
stack: expect.any(String),
161+
});
162+
});
163+
});
164+
22165
describe('onRpcRequest - signMessage', () => {
23166
it('should return a signature that can be verified', async () => {
24167
const snap = await installSnap();

‎src/index.ts

+42-1
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,26 @@ import { rpcErrors } from '@metamask/rpc-errors';
22
import type { OnRpcRequestHandler } from '@metamask/snaps-sdk';
33
import { z } from 'zod';
44

5-
import { getPublicEntropyKey, signMessageWithEntropyKey } from './entropy-keys';
5+
import {
6+
decryptMessage,
7+
getEncryptionPublicKey,
8+
getPublicEntropyKey,
9+
signMessageWithEntropyKey,
10+
} from './entropy-keys';
611

712
const SignMessageParamsSchema = z.object({
813
message: z.string().startsWith('metamask:'),
914
});
1015

16+
const DecryptMessageParamsSchema = z.object({
17+
data: z.object({
18+
version: z.string().regex(/^x25519-xsalsa20-poly1305$/u),
19+
nonce: z.string().length(32).base64(), // 24 bytes, base64 encoded
20+
ephemPublicKey: z.string().length(44).base64(), // 32 bytes, base64 encoded
21+
ciphertext: z.string().base64(),
22+
}),
23+
});
24+
1125
/**
1226
* Asserts the shape of the `signMessage` request.
1327
* @param params - Any method params to assert.
@@ -26,6 +40,24 @@ function assertSignMessageParams(
2640
}
2741
}
2842

43+
/**
44+
* Asserts the shape of the `decryptMessage` request matches the expected {data: Eip1024EncryptedData}.
45+
* @param params - The input params to assert.
46+
* @returns {never} Returns nothing, but will throw error if params don't match what is required.
47+
*/
48+
function assertDecryptMessageParams(
49+
params: unknown,
50+
): asserts params is z.infer<typeof DecryptMessageParamsSchema> {
51+
try {
52+
DecryptMessageParamsSchema.parse(params);
53+
} catch (error: any) {
54+
throw rpcErrors.invalidParams({
55+
message:
56+
'`decryptMessage`, must take a `data` parameter that must match the Eip1024EncryptedData schema',
57+
});
58+
}
59+
}
60+
2961
export const onRpcRequest: OnRpcRequestHandler = async ({ request }) => {
3062
switch (request.method) {
3163
case 'getPublicKey': {
@@ -37,6 +69,15 @@ export const onRpcRequest: OnRpcRequestHandler = async ({ request }) => {
3769
const { message } = params;
3870
return await signMessageWithEntropyKey(message);
3971
}
72+
case 'getEncryptionPublicKey': {
73+
return getEncryptionPublicKey();
74+
}
75+
case 'decryptMessage': {
76+
const { params } = request;
77+
assertDecryptMessageParams(params);
78+
const { data } = params;
79+
return await decryptMessage(data);
80+
}
4081
default:
4182
throw rpcErrors.methodNotFound({
4283
data: { method: request.method },

0 commit comments

Comments
 (0)