Update identity 0.6 to Stronghold 2.0

identity_account_storage/Cargo.toml

@@ -20,7 +20,7 @@ identity_core = { version = "=0.6.2", path = "../identity_core", default-feature
 identity_did = { version = "=0.6.2", path = "../identity_did", default-features = false }
 identity_iota_core = { version = "=0.6.2", path = "../identity_iota_core", default-features = false }
 iota-crypto = { version = ">=0.7, <0.10", default-features = false, features = ["hmac", "pbkdf", "sha", "std", "aes", "aes-kw"] }
-iota_stronghold = { version = "1.0.5", default-features = false, features = ["std"], optional = true }
+# iota_stronghold = { version = "1.0.5", default-features = false, features = ["std"], optional = true }
 once_cell = { version = "1.7", default-features = false, features = ["std"], optional = true }
 parking_lot = { version = "0.12" }
 rand = { version = "0.8", default-features = false, features = ["std", "std_rng"], optional = true }
@@ -31,6 +31,13 @@ thiserror = { version = "1.0" }
 tokio = { version = "1.17.0", default-features = false, features = ["sync", "fs"], optional = true }
 zeroize = { version = "1.5.7" }
 
+[dependencies.iota_stronghold]
+git = "https://github.com/iotaledger/stronghold.rs.git"
+branch = "snapshot-migration-v3age-2.0"
+default-features = false
+features = ["std"]
+optional = true
+
 [dev-dependencies]
 rusty-fork = { version = "0.3" }
 tokio = { version = "1.17.0", default-features = false, features = ["macros", "rt", "rt-multi-thread", "sync"] }

identity_account_storage/src/storage/stronghold.rs

@@ -29,6 +29,7 @@ use rand::distributions::DistString;
 use tokio::sync::RwLockReadGuard;
 use tokio::sync::RwLockWriteGuard;
 use zeroize::Zeroize;
+use zeroize::Zeroizing;
 
 use crate::error::Error;
 use crate::error::Result;
@@ -468,7 +469,7 @@ pub(crate) fn insert_private_key(client: &Client, mut private_key: PrivateKey, l
   private_key.zeroize();
 
   vault
-    .write_secret(stronghold_location, private_key_vec)
+    .write_secret(stronghold_location, Zeroizing::new(private_key_vec))
     .map_err(|err| StrongholdError::Vault(VaultOperation::WriteSecret, err))
     .map_err(Into::into)
 }

identity_account_storage/src/stronghold/error.rs

@@ -31,6 +31,8 @@ pub enum StrongholdError {
   Snapshot(SnapshotOperation, SnapshotPath, #[source] ClientError),
   #[error("failed to load password into key provider")]
   Memory(#[source] MemoryError),
+  #[error("failed to construct a key provider from a password")]
+  Key(#[source] ClientError),
 }
 
 #[non_exhaustive]

identity_account_storage/src/stronghold/tests.rs

@@ -14,6 +14,7 @@ use iota_stronghold::procedures::GenerateKey;
 use iota_stronghold::Client;
 use iota_stronghold::ClientVault;
 use iota_stronghold::Location;
+use zeroize::Zeroizing;
 
 use crate::storage::stronghold::aead_decrypt;
 use crate::storage::stronghold::aead_encrypt;
@@ -54,7 +55,7 @@ async fn test_mutate_client_persists_client_into_snapshot() {
       let vault: ClientVault = client.vault(b"vault");
 
       vault
-        .write_secret(location.into(), keypair.private().as_ref().to_vec())
+        .write_secret(location.into(), Zeroizing::new(keypair.private().as_ref().to_vec()))
         .unwrap();
 
       Ok(())

identity_account_storage/src/stronghold/wrapper.rs

@@ -10,15 +10,12 @@ use iota_stronghold::KeyProvider;
 use iota_stronghold::SnapshotPath;
 use iota_stronghold::Stronghold as IotaStronghold;
 use tokio::sync::RwLock;
-use zeroize::Zeroize;
 
 use crate::stronghold::error::ClientOperation;
 use crate::stronghold::error::SnapshotOperation;
 use crate::stronghold::error::StrongholdError;
 use crate::stronghold::ClientPath;
 use crate::stronghold::StrongholdResult;
-use crate::utils::derive_encryption_key;
-use crate::utils::EncryptionKey;
 use crate::Result;
 
 /// The implementation of the `Storage` interface using `Stronghold`.
@@ -44,17 +41,14 @@ impl Stronghold {
   /// * `password`: password for the Stronghold snapshot file. If this is cloned from a reference,
   /// zeroization of that reference is strongly recommended.
   /// * `dropsave`: persist all changes when the instance is dropped. Default: true.
-  pub async fn new<T>(path: &T, mut password: String, dropsave: Option<bool>) -> Result<Self>
+  pub async fn new<T>(path: &T, password: String, dropsave: Option<bool>) -> Result<Self>
   where
     T: AsRef<Path> + ?Sized,
   {
     let stronghold: IotaStronghold = IotaStronghold::default();
 
-    let mut key: EncryptionKey = derive_encryption_key(&password);
-    password.zeroize();
-
-    let key_provider = KeyProvider::try_from(key.to_vec()).map_err(StrongholdError::Memory)?;
-    key.zeroize();
+    let key_provider =
+      KeyProvider::with_passphrase_hashed_blake2b(password).map_err(|err| StrongholdError::Key(err))?;
 
     // If the snapshot file exists, we load it.
     // If it doesn't we write data into the in memory `Stronghold` and only persist to disk on first write.

identity_iota/src/lib.rs

@@ -138,4 +138,4 @@ pub mod prelude {
   pub use identity_iota_client::tangle::Client;
   pub use identity_iota_client::Result;
   pub use identity_iota_core::document::IotaDocument;
-}
+}