Shulou(Shulou.com)06/01 Report--

What this article shares with you is about what is the Keystore file of Etay Square. The editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

There is a big obstacle to entering keystore to manage the private key of Ethernet Square, mainly because the Ethernet Square client hides most of the password complexity under the direct command line or graphical interface.

For example, use geth:

$geth account new Your new account is locked with a password. Please give a password. Do not forget this password. Passphrase: Repeat passphrase: Address: {008aeeda4d805471df9b2a5b0f38a0c3bcba786b} $geth account list Account # 0: {8a1c4d573cc29a96547816522cfe0b266e88abac} keystore:~/.ethereum/keystore/UTC---- 008aeeda4d805471df9b2a5b0f38a0c3bcba786b

I only need to enter 3 words to create a new account. Then enter the password twice, it's as simple as that! My ethernet square keystore file was created. You need to back up and store those very valuable keystore files in one or more secret locations so that only you can get these files and get the money. From experience, when I don't fully understand the subtleties of a new concept and rely too much on abstractions and existing tools to make my life easier, I'm more likely to forget something, take unnecessary shortcuts and screw it up. When I screw up, it may end up with my hard-earned etheric currency permanently locked (fortunately it hasn't happened yet! ). Fortunately, as an ethernet user, there are not many ways you can screw up: you lose your keystore file, you forget the password associated with the file, or you screw up both.

We will show you how the etheric Fong private key is calculated from the keystore file. We will discuss encryption functions (symmetric encryption, key generation function, SHA3 hash algorithm), but we will try to explain the above problems as succinctly and directly as possible.

What is a keystore file?

The keystore file of ethernet place (the Linux system is stored in ~ / .ethereum/keystore or the Windows system is stored in C:\ Users\ Appdata/Roaming/Ethereum/keystore) is your unique encrypted file of the ethernet square private key used to sign the transaction. If you lose this file, you lose your private key, which means you lose the ability to sign transactions, which means that your funds are permanently locked in your account. Of course, you can store your ethernet private key directly in an encrypted file, but your private key is vulnerable to attacks. Attackers can simply read your files, sign transactions with your private keys, and transfer money to their accounts. Your currency will be lost shortly before you realize what happened. This is why the etheric keystore file was created: it allows you to store keys in an encrypted way. This is the perfect tradeoff between security (an attacker needs keystore files and your password to steal your money) and availability (you only need keystore files and passwords to use your money). In order for you to send some ethernet coins, most ethersquare clients will ask you to enter a password (the same as when you created the account) to decrypt your ethernet private key. Once decrypted, the client program gets the private key to sign the transaction, allowing you to move the money.

What does the Keystore file look like?

If you open one of your account files, it looks like this (taken from here):

$cat ~ / .ethereum / keystore/UTC---- 008aeeda4d805471df9b2a5b0f38a0c3bcba786b {"crypto": {"cipher": "aes-128-ctr", "cipherparams": {"iv": "83dbcc02d8ccb40e466191a123791e0e"}, "ciphertext": "d172bf743a674da9cdad04534d56926ef8358534d458fffccd4e6ad2fbde479c", "kdf": "scrypt" "kdfparams": {"dklen": 32, "n": 262144, "r": 1, "p": 8, "salt": "ab0c7876052600dd703518d6fc3fe8984592145b591fc8fb5c6d43190334ba19"}, "mac": "2103ac29920d71da29f15d75b4a16dbe95cfd7ff8faea1056c33131d846e3097"} "id": "3198bc9c-6672-5ab3-d995-4942343ae5b6", "version": 3}

A clunky JSON file with many magical parameters seems to be associated with complex encryption operations. It's by no means attractive. Let's take a closer look at the structure of this keystore file, and you'll see that most of the content is in "crypto":

"crypto": {"cipher": "aes-128-ctr", "cipherparams": {"iv": "83dbcc02d8ccb40e466191a123791e0e"}, "ciphertext": "d172bf743a674da9cdad04534d56926ef8358534d458fffccd4e6ad2fbde479c", "kdf": "scrypt", "kdfparams": {"dklen": 32, "n": 262144, "r": 1 "p": 8, "salt": "ab0c7876052600dd703518d6fc3fe8984592145b591fc8fb5c6d43190334ba19"}, "mac": "2103ac29920d71da29f15d75b4a16dbe95cfd7ff8faea1056c33131d846e3097"}

This includes:

Cipher: the name of the symmetric AES algorithm

Cipherparams: the parameters required by the above cipher algorithm

Ciphertext: your ethernet private key is encrypted using the above cipher algorithm

Kdf: key generation function that allows you to encrypt keystore files with a password

Kdfparams: the parameters required by the above kdf algorithm

Mac: the code used to validate passwords.

Let's see how they work together and how to protect keystore files under your password.

Encrypt your private key

As mentioned earlier, an Ethernet Fong account is a private key  -public key pair used to encrypt signed transactions. To ensure that your private key is not stored in plain text in a file (that is, anyone who can get the file can read it), it is essential to use a strongly symmetric algorithm (cipher) to encrypt it. These symmetric algorithms use keys to encrypt data. The encrypted data can be decrypted using the same method and the same key, so the algorithm is named symmetric algorithm. In this article, we call this symmetric key a decryption key because it will be used to decrypt our Ethernet Square private key.

The following are the concepts corresponding to cipher,cipherparams and ciphertext:

Cipher is a symmetric encryption algorithm used to encrypt the private key of Ethernet Square. Here cipher uses aes-128-ctr encryption mode

Cipherparams is a parameter required by the aes-128-ctr encryption algorithm.

The only parameter used here, iv, is the initialization vector required by the aes-128-ctr encryption algorithm.

The Ciphertext ciphertext is the encrypted input to the aes-128-ctr function.

So, here, you have everything you need to decrypt the ethernet private key calculation. Wait. You need to retrieve your decryption key first.

Symmetric decryption of 1-ciphertex ciphertext-

two。 Use your password to protect it.

To make sure it's easy to unlock your account, you don't need to remember every long, non-user-friendly decryption key used to decrypt ciphertext ciphertext. Instead, Etay Fong developers chose password-based protection, which means you only need to enter a password to get the decryption key back.

In order to do this, Etay Fong uses a key generation function to calculate the decryption key by entering a password and a series of parameters. This is what kdf and kdfparams are for:

Kdf is a key generation function that calculates (or retrieves) the decryption key based on your password. Here, kdf uses the scrypt algorithm.

Kdfparams is a required parameter for the scrypt function. Here, in a nutshell, dklen, n, r, p, and salt are parameters to the kdf function.

More information about the scrypt function can be found here. Here, adjust the scrypt function with the kdfparams parameter, feed it back to our password, and you will get the decryption key, that is, the output of the key generation function.

2-generate a key with a password-

3. Make sure your password is correct.

We described everything you need to generate an Ethernet Square private key using passwords and keystore files. However, what happens if the wrong password is used to unlock the account?

According to what we have seen so far, all operations (password derivation and decryption) will be successful, but the final calculation of the Ethernet Square private key is not correct, which first goes against the original intention of using the key file!

We need to make sure that the password entered to unlock the account is correct, as it was when we first created the keystore file (recall that you entered the password twice when creating a new account under geth). This is where the mac value in the keystore file comes into play. After the key generation function is executed, its output (decryption key) and ciphertext ciphertext are processed [Note 1] and compared with mac (like an approved seal). If the result is the same as mac, then the password is correct and decryption can begin.

[note 1] it's a little brief here. Before comparing with mac, the decryption key (16 bytes starting with the second byte from the left) is concatenated with the ciphertext ciphertext and hashed (using the SHA3-256method). Please visit here for more information.

Put everything together and think about it!

If you have already done this, congratulations! Let's review the three functions we described.

First, you enter the password, which is used as input to the kdf key generation function to calculate the decryption key.

Then, the decryption key just calculated is connected to the ciphertext ciphertext and processed, and compared with mac to ensure that the password is correct.

Finally, the ciphertext ciphertext is decrypted with the decryption key through the cipher symmetry function. Look at that! The result of the decryption is your ethernet square private key.

You can see the whole process here:

As you can see from the figure, the whole process can be seen as a black box (but the picture is a gray box), your password is the only input, and your ethernet private key is the only output. All the other information you need can be found in the keystore file generated when your etherfang account was created. For this reason, make sure your password is strong enough (and remember it anyway! ) to ensure that even if an attacker steals your keystore file, it will not easily get your private key.

test data

Details:

Address: 008aeeda4d805471df9b2a5b0f38a0c3bcba786b

ICAP: XE542A5PZHH8PYIZUBEJEO0MFWRAPPIL67

UUID: 3198bc9c-6672-5ab3-d9954942343ae5b6

Password: testpassword

Secret: 7a28b5ba57c53603b0b07b56bba752f7784bf506fa95edc395f5cf6c7514fe9d

PBKDF2-SHA-256

Test vector using AES-128-CTR and PBKDF2-SHA-256:

File contents of ~ / .web3/keystore/3198bc9c-6672-5ab3-d9954942343ae5b6.json:

{"crypto": {"cipher": "aes-128-ctr", "cipherparams": {"iv": "6087dab2f9fdbbfaddc31a909735c1e6"}, "ciphertext": "5318b4d5bcd28de64ee5559e671353e16f075ecae9f99c7a79a38af5f869aa46", "kdf": "pbkdf2", "kdfparams": {"c": 262144, "dklen": 32 Prf: "hmac-sha256", "salt": "ae3cd4e7013836a3df6bd7241b12db061dbe2c6785853cce422d148a624ce0bd"}, "mac": "517ead924a9d0dc3124507e3393d175ce3ff7c1e96529c6c555ce9e51205e9b2"}, "id": "3198bc9c-6672-5ab3-d995-4942343ae5b6", "version": 3}

Intermediates:

Derived key: f06d69cdc7da0faffb1008270bca38f5e31891a3a773950e6d0fea48a7188551

MAC Body: e31891a3a773950e6d0fea48a71885515318b4d5bcd28de64ee5559e671353e16f075ecae9f99c7a79a38af5f869aa46

MAC 517ead924a9d0dc3124507e3393d175ce3ff7c1e96529c6c555ce9e51205e9b2

Cipher key: f06d69cdc7da0faffb1008270bca38f5

Scrypt

Test vector using AES-128-CTR and Scrypt:

{"crypto": {"cipher": "aes-128-ctr", "cipherparams": {"iv": "83dbcc02d8ccb40e466191a123791e0e"}, "ciphertext": "d172bf743a674da9cdad04534d56926ef8358534d458fffccd4e6ad2fbde479c", "kdf": "scrypt", "kdfparams": {"dklen": 32, "n": 262144 "r": 1, "p": 8, "salt": "ab0c7876052600dd703518d6fc3fe8984592145b591fc8fb5c6d43190334ba19"}, "mac": "2103ac29920d71da29f15d75b4a16dbe95cfd7ff8faea1056c33131d846e3097"}, "id": "3198bc9c-6672-5ab3-d995-4942343ae5b6", "version": 3}

Intermediates:

Derived key: fac192ceb5fd772906bea3e118a69e8bbb5cc24229e20d8766fd298291bba6bd

MAC Body bb5cc24229e20d8766fd298291bba6bdd172bf743a674da9cdad04534d56926ef8358534d458fffccd4e6ad2fbde479c

MAC: 2103ac29920d71da29f15d75b4a16dbe95cfd7ff8faea1056c33131d846e3097

Cipher key: fac192ceb5fd772906bea3e118a69e8b

Extract the source code of Private Key from keystore package mainimport ("encoding/hex"flag"fmt"io/ioutil"os"github.com/ethereum/go-ethereum/accounts/keystore"github.com/ethereum/go-ethereum/crypto") func main () {ksfilefullpath: = "" kstype: = "" kspassword: = " "" flags: = flag.NewFlagSet (os.Args [0]) Flag.ExitOnError) flags.StringVar (& ksfilefullpath, "keystore-src", "", "`path` to keystore to be processed") flags.StringVar (& kstype, "keystore-type", "", "keystore type: `pem`, `keystore`") flags.StringVar (& kspassword, "keystore-password", "", "keystore password") if err: = flags.Parse (os.Args [1:]) Err! = nil {fmt.Fprintln (os.Stderr, "Failed to parse flags:", err) os.Exit (1)} keyjson, err: = ioutil.ReadFile (ksfilefullpath) if err! = nil {fmt.Println (err)} / / Decrypt with the correct password key, err: = keystore.DecryptKey (keyjson Kspassword) if err! = nil {fmt.Println ("test: json key failed to decrypt:% v", err)} fmt.Println ("PrivateKey =" + hex.EncodeToString (crypto.FromECDSA (key.PrivateKey)}

Compile

Running

E:\ dev\ Coins\ keymanager > keymanager.exe-keystore-src=E:\ Gowork\ src\ discountedBackend\ keystore\ UTC--2019-12-05T04-57-19.853322540Z--a4e71aeeadaa01fd0f15455f67d7d2cad32ebfca-- keystore-type=keystore-- keystore-password=geth223

Private key= fe0e4d19f7690086acf252dcbdb04ef878c82969c8dcd4c7f2221c723e2d65f1

Extracted Private Key: ab979c2c4d092212af817802f31313bd6f4144b4b9cb289f659c29f5cabbd428

Go to https://www.myetherwallet.com/#view-wallet-info and upload keystore

Look at the results.

Hola, exactly the same.

Algorithm reference

Original text link

These are the Keystore documents of Etay Fong. The editor believes that there are some knowledge points that we may see or use in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.