Skip to content

84 default password encryption v2#94

Closed
andycreed0x wants to merge 4 commits into
developfrom
84-default-password-encryption
Closed

84 default password encryption v2#94
andycreed0x wants to merge 4 commits into
developfrom
84-default-password-encryption

Conversation

@andycreed0x

Copy link
Copy Markdown
Collaborator

No description provided.

…ssword

All mnemonics are now encrypted on disk even when the user provides no
password. New prefix-tagged storage format (`default:1:`, `user:`, `plain:`
legacy read-only, untagged legacy) makes each blob self-describing.
Lazy migration converts existing `plain:` wallets to `default:1:` on next
read via a single choke point (`Storage.read_and_migrate_mnemonic`).
Renames `is_mnemonic_encrypted` → `requires_user_password` across all
9 production + 7 test call sites to correctly distinguish on-disk encryption
from user-password requirement. Adds 21 unit tests covering prefix detection,
migration round-trip, truth table, signing flows, atomicity, and write-failure
tolerance.
Cover the four malformed prefix shapes that retrieve_mnemonic must
reject with a "Malformed default-encrypted mnemonic prefix" error
("default:", "default:novalidversion", "default::blob", "default:abc:blob"),
plus a regression test that the error message truncates arbitrarily
long inputs to avoid leaking ciphertext in logs.
@andycreed0x andycreed0x closed this Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant