refactor(keysplit): Use eth2_keystore from LH instead of reimplementing it (#449)

Author: dknopik

Cargo.lock

@@ -5,24 +5,20 @@ edition = { workspace = true }
 authors = ["Sigma Prime <[email protected]>"]
 
 [dependencies]
-aes = "0.8.4"
 alloy = { workspace = true }
 base64 = { workspace = true }
 bls_lagrange = { workspace = true }
 chrono = { version = "0.4.39", features = ["serde"] }
 clap = { workspace = true }
-ctr = "0.9.2"
 database = { workspace = true }
 eth = { workspace = true }
+eth2_keystore = { workspace = true }
 global_config = { workspace = true }
 hex = { workspace = true }
 openssl = { workspace = true }
 operator_key = { workspace = true }
-pbkdf2 = { workspace = true }
-scrypt = "0.11.0"
 serde = { workspace = true }
 serde_json = { workspace = true }
-sha2 = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 types = { workspace = true }

anchor/keysplit/Cargo.toml

@@ -1,94 +1,8 @@
-use aes::{
-    Aes128,
-    cipher::{InnerIvInit, KeyInit, StreamCipherCore},
-};
 use bls_lagrange::{KeyId, split};
-use ctr::cipher;
 use openssl::{encrypt::Encrypter, pkey::PKey};
-use pbkdf2::{hmac::Hmac, pbkdf2};
-use scrypt::{Params as ScryptParams, scrypt};
-use sha2::{Digest, Sha256, digest::Update};
 use types::SecretKey;
 
-use crate::{
-    EncryptedKeyShare, KeyShare, KeysplitError, ValidatorKeys,
-    cli::SharedKeygenOptions,
-    keystore::{KdfparamsType, Keystore},
-};
-
-struct Aes128Ctr {
-    inner: ctr::CtrCore<Aes128, ctr::flavors::Ctr128BE>,
-}
-
-impl Aes128Ctr {
-    fn new(key: &[u8], iv: &[u8]) -> Result<Self, cipher::InvalidLength> {
-        let cipher = aes::Aes128::new_from_slice(key).expect("Key has already been validated");
-        let inner = ctr::CtrCore::inner_iv_slice_init(cipher, iv).expect("Cipher is valid");
-        Ok(Self { inner })
-    }
-
-    fn apply_keystream(self, buf: &mut [u8]) {
-        self.inner.apply_keystream_partial(buf.into());
-    }
-}
-
-// From the keystore file, extract the decrypted validator keys
-pub fn extract_key(keystore: &Keystore, password: &str) -> Result<ValidatorKeys, KeysplitError> {
-    let derived_key = match &keystore.crypto.kdf.params {
-        KdfparamsType::Pbkdf2 {
-            c,
-            dklen,
-            prf: _,
-            salt,
-        } => {
-            let mut key = vec![0u8; *dklen as usize];
-            pbkdf2::<Hmac<Sha256>>(password.as_ref(), salt, *c, key.as_mut_slice()).map_err(
-                |e| KeysplitError::Pbkdf2(format!("Faild to run key derivation function: {e}")),
-            )?;
-            key
-        }
-        KdfparamsType::Scrypt {
-            dklen,
-            n,
-            p,
-            r,
-            salt,
-        } => {
-            let mut key = vec![0u8; *dklen as usize];
-            let scrypt_params = ScryptParams::new((*n as f64).log2() as u8, *r, *p, salt.len())
-                .map_err(|e| {
-                    KeysplitError::Scrypt(format!("Failed to construct scrypt params: {e}"))
-                })?;
-
-            scrypt(password.as_ref(), salt, &scrypt_params, &mut key).map_err(|e| {
-                KeysplitError::Scrypt(format!("Faild to run key derivation function: {e}"))
-            })?;
-            key
-        }
-    };
-
-    let derived_mac = Sha256::new()
-        .chain(&derived_key[16..32])
-        .chain(&keystore.crypto.cipher.message)
-        .finalize();
-
-    if derived_mac.as_slice() != keystore.crypto.checksum.message.as_slice() {
-        return Err(KeysplitError::Password("Invalid password".to_string()));
-    }
-
-    let decryptor = Aes128Ctr::new(&derived_key[..16], &keystore.crypto.cipher.params.iv[..16])
-        .expect("invalid length");
-
-    let mut pk = keystore.crypto.cipher.message.clone();
-    decryptor.apply_keystream(&mut pk);
-
-    let deser_pk = SecretKey::deserialize(pk.as_slice())
-        .map_err(|e| KeysplitError::Misc(format!("Failed to deserialize secret key: {e:?}")))?;
-    Ok(ValidatorKeys {
-        public_key: deser_pk.public_key(),
-        secret_key: deser_pk,
-    })
-}
+use crate::{EncryptedKeyShare, KeyShare, KeysplitError, cli::SharedKeygenOptions};
 
 // Given a secret key, split it into parts
 pub fn split_keys(

anchor/keysplit/src/crypto.rs

@@ -4,13 +4,8 @@ pub enum KeysplitError {
     Keystore(String),
     InvalidKeyLen(String),
     InvalidOperator(String),
-    Password(String),
     Output(String),
-    Operator(u32),
-    RpcEndpoint,
     Database(String),
     SplitFailure(String),
     Misc(String),
-    Scrypt(String),
-    Pbkdf2(String),
 }