timohanke / icvault Goto Github PK

I've been looking through the code and I have a question. The private key used to do the original encryption to store data in the key sync canister...how is that key shared on other devices?

So if I log in the II and generate an encryption key, and then I completely delete my local storage and log in again with II, how am I able to generate the same key pair so as to decrypt any data stored in the key sync canister?

Hi there, I watched DFINIHack on YouTube and came here to know how it works because I'm being interested in IC Vault!

During reading, I found that clear and leak methods in kv_store are still there.

https://github.com/timohanke/hack13/blob/2b85aefa78870952d3de243ef1d8b864b8c6d0cc/kv_store/src/kv_store/main.mo#L56-L62

https://github.com/timohanke/hack13/blob/2b85aefa78870952d3de243ef1d8b864b8c6d0cc/kv_store/src/kv_store/main.mo#L141-L154

I'm new to here, so I might be wrong, but I'm wondering if it is dangerous to have such methods in canister deployed on IC.

I'm trying to understand whether this vault can be relied upon to store private keys generated client-side. What are the vulnerabilities here? If access can be limited only to the Internet Identity anchor owner and if that can be guaranteed, I imagine this should theoretically be a completely secure and private place to store sensitive private keys.

@timohanke could you please help us understand how true that is?