NEP-649: Deterministic ML-DSA-65 Key Derivation from BIP-39 Seeds (SLIP-0010) - #649
NEP-649: Deterministic ML-DSA-65 Key Derivation from BIP-39 Seeds (SLIP-0010)#649vsavchyn-dev wants to merge 14 commits into
Conversation
vsavchyn-dev
changed the title
birchmd
left a comment
birchmd
left a comment
There was a problem hiding this comment.
Nice work on this NEP @vsavchyn-dev ! I only have a few minor comments.
| 2. Split I into two 32-byte sequences, I<sub>L</sub> and I<sub>R</sub>. | ||
| 3. The returned child node secret k<sub>i</sub> is I<sub>L</sub>. The returned chain code c<sub>i</sub> is I<sub>R</sub>. | ||
|
|
||
| The HMAC-SHA512 function is specified in [RFC 4231](https://datatracker.ietf.org/doc/html/rfc4231). |
There was a problem hiding this comment.
The HMAC-SHA512 function is also used in the Master Key Generation section above. The citation for the function should appear after its first usage, instead of here.
There was a problem hiding this comment.
Moved citation a bit higher in e8664ae#diff-e514832a368228580b962a3a87f14be3812d43f9682fba381e6de8e4cc3f991cR80
|
|
||
| Account discovery is out of scope (see [Scope](#scope)). However, wallets that discover accounts via the existing Ed25519 flow are encouraged to check if the same seed phrase produces Ed25519 and ML-DSA-65 keys. Note that wallets might need to compute ML-DSA-65 hash per [NEP-645] for discovering the account. Additionally, it is worth checking if the key has a `FullAccess` permission to allow for a full usage of account. | ||
|
|
||
| ### Master Key Generation |
There was a problem hiding this comment.
Nit: can Generation and Derivation be used interchangeably?
There was a problem hiding this comment.
In this section, I tried to follow the SLIP-10 paper, which stated Master Key Generation. I think by definition Generation and Derivation can be used interchangeably: HMAC-SHA512 generates a hash, but at the same time, the hash is derived from the domain-separator seed and mnemonic. However, in the context of this NEP, you are right; it is confusing to write Generation anywhere except parts with mention of ML-DSA.KeyGen, as we derive the seed to generate ML-DSA key.
Following this, I just wrote "Master key derivation MUST..." instead of "Master key generation MUST..." (70cf84f), everything else in the paper already states things properly.
| - Wallets MUST accept any valid [BIP-39] mnemonic (12-24 words) for recovery. | ||
| - The default path to derive ML-DSA-65 key from MUST be the same as Ed25519 recovery path. | ||
|
|
||
| Also, wallets MAY generate a new [BIP-39] mnemonic for ML-DSA-65 keys, at the cost of a second backup and loss of single-mnemonic recovery. See [Mnemonic as a security bottleneck](#mnemonic-as-a-security-bottleneck) on why the new mnemonic MUST be from 18 to 24 words. |
There was a problem hiding this comment.
I initially thought there was a discrepancy between the minimum length of 18 here and 12 above, but then I realized the difference is in the accepted minimum for a user-provided mnemonic vs a new mnemonic generated by the wallet. I think this could be made a little more clear (it is clearer in the security section below, but should also be clear here).
There was a problem hiding this comment.
I merged this whole paragraph into a list and reworded it a bit - it should be more clear now: e8664ae#diff-e514832a368228580b962a3a87f14be3812d43f9682fba381e6de8e4cc3f991cR66-R70
b99a085 to
d4a264b
Compare
|
@near/nep-moderators I believe this nep is ready for the review - Additionally, @darioush, I am curious if this NEP have any significant implications for |
|
thanks @vsavchyn-dev, this NEP is ready for review. @walnut-the-cat could you help by selecting two SME to give their review? Maybe Simon and Darioush, who reviewed the original ML-DSA-65 NEP. |
4 participants
ML-DSA-65 key derivation for wallets
NEP text: https://github.com/vsavchyn-dev/NEPs/blob/feat/mldsa-derivation/neps/nep-0649.md
Reference implementation: https://github.com/vsavchyn-dev/NEPs/blob/feat/mldsa-derivation/neps/nep-0649.md#reference-implementation