You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In a gist, other fields of keychain.Key relies on the PrivateKey field since they are derived from the private key.
Currently, the fields of keychain.Key are publicly exported.
It has a potential risk that a consumer of the keychain component may unintentionally change the value of each field. It would corrupts integrity of keychain.Key (e.g. digital signature operation like signing and verify would not working, the association of public key and id of the key would be broken).
This risk seems to me severe since most debugging for this bug gonna be hard.
Motivation
In a gist, other fields of
keychain.Key
relies on thePrivateKey
field since they are derived from the private key.Currently, the fields of
keychain.Key
are publicly exported.It has a potential risk that a consumer of the
keychain
component may unintentionally change the value of each field. It would corrupts integrity ofkeychain.Key
(e.g. digital signature operation like signing and verify would not working, the association of public key and id of the key would be broken).This risk seems to me severe since most debugging for this bug gonna be hard.
Possible approach
keychain.Key
to privatekeychain.Store
interface: see feat: keychain component #33The text was updated successfully, but these errors were encountered: