codechain-keystore-js
codechain-keystore-js copied to clipboard
CodeChain-io
Clear secret keys when they are not needed anymore
Currently, private key type is string but string type variables cannot be explicitly dropped or cleared. Change the type of secret key to Buffer and clear(fill zeros to the memory it holds) when the necessity of them ends to enhance security.
To Apply this change, we should consider all the dependencies using secret keys' data from the bottom. codechain-keystore-js is dependent on codechain-primitives-js which is dependent on the indutny's elliptic curve library
One similar issue is here: https://github.com/ethereumjs/ethereumjs-wallet/issues/89. I failed to find some guidelines about keeping private information secret in javascript implementations. Currently, many external libraries are using immutable string type to store private keys. As long as keystore is dependent on those libraries, the copies of secret keys cannot be cleared.