Skip to content

Add support for specifying per-key password #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

Add support for specifying per-key password #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
309acdf
Add support for specifying per-key password
kamsz May 8, 2024
d310ba7
Make the change backward compatible
kamsz May 8, 2024
022ef4c
Fixes accordingly to the review
kamsz May 8, 2024
c0f6cff
Add AliasedEcdsaPrivateKey flag
kamsz May 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions cmd/operatorcli/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ var commandEncrypt = &cli.Command{
flag.EcdsaPrivateKeyFlag,
flag.BlsPrivateKeyFlag,
flag.PassphraseFlag,
flag.BlsPassphraseFlag,
flag.EcdsaPassphraseFlag,
flag.KeyStorePathFlag,
},
}
Expand All @@ -26,6 +28,9 @@ var commandDecrypt = &cli.Command{
Action: runDecrypt,
Flags: []cli.Flag{
flag.PassphraseFlag,
flag.BlsPassphraseFlag,
flag.EcdsaPassphraseFlag,
flag.AliasedEcdsaPassphraseFlag,
flag.KeyStorePathFlag,
},
}
Expand All @@ -38,6 +43,8 @@ var commandRegister = &cli.Command{
flag.EthRPCFlag,
flag.RegistryCoordinatorFlag,
flag.PassphraseFlag,
flag.BlsPassphraseFlag,
flag.EcdsaPassphraseFlag,
flag.KeyStorePathFlag,
flag.SaltFlag,
flag.ExpiryFlag,
Expand All @@ -56,7 +63,7 @@ var commandDeregister = &cli.Command{
Flags: []cli.Flag{
flag.EthRPCFlag,
flag.RegistryCoordinatorFlag,
flag.PassphraseFlag,
flag.EcdsaPassphraseFlag,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to support the old PassphraseFlag (for backward compatibility)

flag.KeyStorePathFlag,
flag.EcdsaPrivateKeyFlag,
flag.QuorumNumberFlag,
Expand All @@ -70,7 +77,7 @@ var commandPrintStatus = &cli.Command{
Flags: []cli.Flag{
flag.EthRPCFlag,
flag.RegistryCoordinatorFlag,
flag.PassphraseFlag,
flag.EcdsaPassphraseFlag,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to support the old PassphraseFlag (for backward compatibility)

flag.KeyStorePathFlag,
flag.EcdsaPrivateKeyFlag,
flag.QuorumNumberFlag,
Expand All @@ -89,8 +96,8 @@ var commandGenerateAlias = &cli.Command{
Description: "Create or Import an ECDSA private key only for oracle chain",
Action: runGenerateAlias,
Flags: []cli.Flag{
flag.EcdsaPrivateKeyFlag,
flag.PassphraseFlag,
flag.AliasedEcdsaPrivateKeyFlag,
flag.AliasedEcdsaPassphraseFlag,
flag.KeyStorePathFlag,
flag.OverrideFlag,
},
Expand All @@ -102,6 +109,8 @@ var commandDeclareAlias = &cli.Command{
Action: runDeclareAlias,
Flags: []cli.Flag{
flag.PassphraseFlag,
flag.EcdsaPassphraseFlag,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Declare alias requires the ecdsa private key to sign and submit the transaction. The alias ecdsa is used to get the address of the alias

flag.AliasedEcdsaPassphraseFlag,
flag.KeyStorePathFlag,
flag.EOChainEthRPCFlag,
flag.EOConfigAddressFlag,
Expand Down
20 changes: 20 additions & 0 deletions internal/flag/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,11 @@ var (
Usage: "ecdsa private key",
EnvVars: []string{"EO_ECDSA_PRIVATE_KEY"},
}
AliasedEcdsaPrivateKeyFlag = &cli.StringFlag{
Name: "aliased-ecdsa-private-key",
Usage: "aliased ecdsa private key",
EnvVars: []string{"EO_ALIASED_ECDSA_PRIVATE_KEY"},
}
BlsPrivateKeyFlag = &cli.StringFlag{
Name: "bls-private-key",
Usage: "bls private key",
Expand All @@ -60,6 +65,21 @@ var (
Usage: "passphrase to open the encrypted private key",
EnvVars: []string{"EO_PASSPHRASE"},
}
BlsPassphraseFlag = &cli.StringFlag{
Name: "bls-passphrase",
Usage: "passphrase to open the encrypted BLS private key",
EnvVars: []string{"EO_BLS_PASSPHRASE"},
}
EcdsaPassphraseFlag = &cli.StringFlag{
Name: "ecdsa-passphrase",
Usage: "passphrase to open the encrypted ECDSA private key",
EnvVars: []string{"EO_ECDSA_PASSPHRASE"},
}
AliasedEcdsaPassphraseFlag = &cli.StringFlag{
Name: "aliased-ecdsa-passphrase",
Usage: "passphrase to open the encrypted aliased ECDSA private key",
EnvVars: []string{"EO_ALIASED_ECDSA_PASSPHRASE"},
}
ValidatorRoleFlag = &cli.StringFlag{
Name: "validator-role",
Usage: "role of the operator",
Expand Down
93 changes: 63 additions & 30 deletions internal/operatorcli/operator_cli.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,16 @@ type avsClient struct {

func RunEncrypt(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
blsPassphrase := c.String(flag.BlsPassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)

if passphrase == "" {
return cli.Exit("passphrase is required", 1)
if blsPassphrase == "" || ecdsaPassphrase == "" {
return cli.Exit("either passphrase or bls/ecdsa passphrase is required", 1)
}
} else {
blsPassphrase = passphrase
ecdsaPassphrase = passphrase
}
Comment on lines 54 to 61
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need to change the order of checking the flags.
first checks the new flags (the configuration we want to have)
second check the backward compatbility


keyStorePath := c.String(flag.KeyStorePathFlag.Name)
Expand All @@ -63,7 +71,7 @@ func RunEncrypt(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("Invalid EDCSA private key %v", err), 1)
}

if err = eigensdkecdsa.WriteKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPair, passphrase); err != nil {
if err = eigensdkecdsa.WriteKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPair, ecdsaPassphrase); err != nil {
return cli.Exit(fmt.Sprintf("Error writing the ecdsaEncryptedWallet.json file %v", err), 1)
}
fmt.Println("ecdsa address ", crypto.PubkeyToAddress(ecdsaPair.PublicKey), "saved")
Expand All @@ -74,7 +82,7 @@ func RunEncrypt(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("Invalid BLS private key %v", err), 1)
}

if err = blsKeyPair.SaveToFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), passphrase); err != nil {
if err = blsKeyPair.SaveToFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), blsPassphrase); err != nil {
return cli.Exit(fmt.Sprintf("Error writing the blsEncryptedWallet.json file %v", err), 1)
}
fmt.Println("bls address G1, G2 ", blsKeyPair.GetPubKeyG1().String(), ", ", blsKeyPair.GetPubKeyG2().String(), "saved")
Expand All @@ -84,28 +92,38 @@ func RunEncrypt(c *cli.Context) error {

func RunDecrypt(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
blsPassphrase := c.String(flag.BlsPassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)
aliasedEcdsaPassphrase := c.String(flag.AliasedEcdsaPassphraseFlag.Name)

if passphrase == "" {
return cli.Exit("passphrase is required", 1)
if blsPassphrase == "" || ecdsaPassphrase == "" || aliasedEcdsaPassphrase == "" {
return cli.Exit("either passphrase or bls/ecdsa/aliased ecdsa passphrase is required", 1)
}
} else {
blsPassphrase = passphrase
ecdsaPassphrase = passphrase
aliasedEcdsaPassphrase = passphrase
}
Comment on lines 99 to 107
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comment on checking first the new flags and later the backward compatibility


keyStorePath := c.String(flag.KeyStorePathFlag.Name)
if keyStorePath == "" {
return cli.Exit("keystore-path is required", 1)
}

ecdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), passphrase)
ecdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Error reading the ecdsaEncryptedWallet.json file %v", err), 1)
}
fmt.Println("ecdsa address ", crypto.PubkeyToAddress(ecdsaPair.PublicKey), "private key", hex.EncodeToString(ecdsaPair.D.Bytes()))

blsKeyPair, err := eigensdkbls.ReadPrivateKeyFromFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), passphrase)
blsKeyPair, err := eigensdkbls.ReadPrivateKeyFromFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), blsPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Error reading the blsEncryptedWallet.json file %v", err), 1)
}
fmt.Println("bls address G1, G2 ", blsKeyPair.GetPubKeyG1().String(), ", ", blsKeyPair.GetPubKeyG2().String(), "private key", blsKeyPair.PrivKey.String())

ecdsaEOChainPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), passphrase)
ecdsaEOChainPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), aliasedEcdsaPassphrase)
if err != nil {
if err == os.ErrNotExist {
fmt.Println("eochain alias was not set in the system")
Expand All @@ -120,6 +138,8 @@ func RunDecrypt(c *cli.Context) error {

func RunRegister(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
blsPassphrase := c.String(flag.BlsPassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)
keyStorePath := c.String(flag.KeyStorePathFlag.Name)

var ecdsaPair *ecdsa.PrivateKey
Expand All @@ -131,9 +151,14 @@ func RunRegister(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("error creating logger %v", err), 1)
}

if passphrase == "" || keyStorePath == "" {
if passphrase != "" {
blsPassphrase = passphrase
ecdsaPassphrase = passphrase
}
Comment on lines +154 to +157
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since there is default value to passphrase this will be true.
Need to reverse the order (or check if the new flags are empty)


if blsPassphrase == "" || ecdsaPassphrase == "" || keyStorePath == "" {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with the new approach of having a passphrase per key, need to spilt this if into smaller and unrelated it statements

if c.String(flag.EcdsaPrivateKeyFlag.Name) == "" || c.String(flag.BlsPrivateKeyFlag.Name) == "" {
return cli.Exit("either passphrase and keystore-path or ecdsa-private-key and bls-private-key are required", 1)
return cli.Exit("either general/ecdsa/bls passphrase and keystore-path or ecdsa-private-key and bls-private-key are required", 1)
}
ecdsaPair, err = crypto.HexToECDSA(c.String(flag.EcdsaPrivateKeyFlag.Name))
if err != nil {
Expand All @@ -144,11 +169,11 @@ func RunRegister(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("Invalid BLS private key %v", err), 1)
}
} else {
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), passphrase)
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read ecdsaEncryptedWallet.json file %v", err), 1)
}
blsKeyPair, err = eigensdkbls.ReadPrivateKeyFromFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), passphrase)
blsKeyPair, err = eigensdkbls.ReadPrivateKeyFromFile(filepath.Join(keyStorePath, "blsEncryptedWallet.json"), blsPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read blsEncryptedWallet.json file %v", err), 1)
}
Expand Down Expand Up @@ -287,7 +312,7 @@ func RunRegister(c *cli.Context) error {
}

func RunDeregister(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should only override the general passphrase if the dedicated one is not provided, like the encrypt command works no?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since deregister doesn't require more than one password i've left it as it is, but made it explicit with ecdsa passphrase flag that it is ecdsa key password

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should be backward compatibility, so we should pass the two passphrase flags use the backward compatibility flag if the correct flag is empty

keyStorePath := c.String(flag.KeyStorePathFlag.Name)

var ecdsaPair *ecdsa.PrivateKey
Expand All @@ -298,16 +323,16 @@ func RunDeregister(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("error creating logger %v", err), 1)
}

if passphrase == "" || keyStorePath == "" {
if ecdsaPassphrase == "" || keyStorePath == "" {
if c.String(flag.EcdsaPrivateKeyFlag.Name) == "" {
return cli.Exit("either passphrase and keystore-path or ecdsa-private-key are required", 1)
return cli.Exit("either ecdsa/bls passphrase and keystore-path or ecdsa-private-key are required", 1)
}
ecdsaPair, err = crypto.HexToECDSA(c.String(flag.EcdsaPrivateKeyFlag.Name))
if err != nil {
return cli.Exit(fmt.Sprintf("Invalid EDCSA private key %v", err), 1)
}
} else {
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), passphrase)
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read ecdsaEncryptedWallet.json file %v", err), 1)
}
Expand Down Expand Up @@ -375,7 +400,7 @@ func RunDeregister(c *cli.Context) error {
}

func RunPrintStatus(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same issue as decrypt

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same as above

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same feedback to the deregister

keyStorePath := c.String(flag.KeyStorePathFlag.Name)

var ecdsaPair *ecdsa.PrivateKey
Expand All @@ -386,7 +411,7 @@ func RunPrintStatus(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("error creating logger %v", err), 1)
}

if passphrase == "" || keyStorePath == "" {
if ecdsaPassphrase == "" || keyStorePath == "" {
if c.String(flag.EcdsaPrivateKeyFlag.Name) == "" {
return cli.Exit("either passphrase and keystore-path or ecdsa-private-key are required", 1)
}
Expand All @@ -395,7 +420,7 @@ func RunPrintStatus(c *cli.Context) error {
return cli.Exit(fmt.Sprintf("Invalid EDCSA private key %v", err), 1)
}
} else {
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), passphrase)
ecdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read ecdsaEncryptedWallet.json file %v", err), 1)
}
Expand Down Expand Up @@ -464,9 +489,9 @@ func RunGenerateBLSKey(c *cli.Context) error {
}

func RunGenerateAlias(c *cli.Context) error {
passphrase := c.String(flag.PassphraseFlag.Name)
if passphrase == "" {
return cli.Exit("passphrase is required", 1)
aliasedEcdsaPassphrase := c.String(flag.AliasedEcdsaPassphraseFlag.Name)
if aliasedEcdsaPassphrase == "" {
return cli.Exit("aliased ecdsa passphrase is required", 1)
}

keyStorePath := c.String(flag.KeyStorePathFlag.Name)
Expand All @@ -475,19 +500,19 @@ func RunGenerateAlias(c *cli.Context) error {
}

// The following summarizes the logic of setting the alias in the eochain
// An alias exists | specified as argument | override flag | expected behavior
// An alias exists | specified as argument | override flag | expected behavior
// yes | no | no | use the existing value
// yes | no | yes | use the existing value
// yes | yes | no | return an error
// yes | yes | yes | use the value from the cli
// no | no | no | generate a new value
// no | no | yes | generate a new value
// no | yes | no | use the value from the cli
// no | yes | yes | use the value from the cli
// no | yes | yes | use the value from the cli

var err error
var aliasEcdsaPair *ecdsa.PrivateKey
aliasEcdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), passphrase)
aliasEcdsaPair, err = eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), aliasedEcdsaPassphrase)
if err != nil {
// there was an error reading the alias key (either the file doesn't exist or it is corrupted), consider as if the alias doesn't exist
if c.String(flag.EcdsaPrivateKeyFlag.Name) != "" {
Expand All @@ -508,7 +533,7 @@ func RunGenerateAlias(c *cli.Context) error {
if c.String(flag.EcdsaPrivateKeyFlag.Name) != "" {
if !c.Bool(flag.OverrideFlag.Name) {
return cli.Exit("The alias key already exists, cannot override", 1)
}
}
// Use the private key passed in the command line
aliasEcdsaPair, err = crypto.HexToECDSA(c.String(flag.EcdsaPrivateKeyFlag.Name))
if err != nil {
Expand All @@ -518,10 +543,10 @@ func RunGenerateAlias(c *cli.Context) error {
}

// Save the private key to a file
if err = eigensdkecdsa.WriteKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), aliasEcdsaPair, passphrase); err != nil {
if err = eigensdkecdsa.WriteKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), aliasEcdsaPair, aliasedEcdsaPassphrase); err != nil {
return cli.Exit(fmt.Sprintf("Error writing the ecdsaAliasedEncryptedWallet.json file %v", err), 1)
}

fmt.Println("alias ecdsa address ", crypto.PubkeyToAddress(aliasEcdsaPair.PublicKey), "encrpyted and saved")

return nil
Expand All @@ -534,21 +559,29 @@ func RunDeclareAlias(c *cli.Context) error {
}

passphrase := c.String(flag.PassphraseFlag.Name)
ecdsaPassphrase := c.String(flag.EcdsaPassphraseFlag.Name)
aliasedEcdsaPassphrase := c.String(flag.AliasedEcdsaPassphraseFlag.Name)

if passphrase == "" {
return cli.Exit("passphrase is required", 1)
if ecdsaPassphrase == "" || aliasedEcdsaPassphrase == "" {
return cli.Exit("either passphrase or ecdsa/aliased ecdsa passphrase is required", 1)
}
} else {
ecdsaPassphrase = passphrase
aliasedEcdsaPassphrase = passphrase
Comment on lines 565 to +571
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comment on the order of the checks, first use the new flags

}

keyStorePath := c.String(flag.KeyStorePathFlag.Name)
if keyStorePath == "" {
return cli.Exit("keystore-path is required", 1)
}

ethEcdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), passphrase)
ethEcdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaEncryptedWallet.json"), ecdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read ecdsaEncryptedWallet.json file %v", err), 1)
}

aliasEcdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), passphrase)
aliasEcdsaPair, err := eigensdkecdsa.ReadKey(filepath.Join(keyStorePath, "ecdsaAliasedEncryptedWallet.json"), aliasedEcdsaPassphrase)
if err != nil {
return cli.Exit(fmt.Sprintf("Failed to read ecdsaAliasedEncryptedWallet.json file %v", err), 1)
}
Expand Down