A standard for more user friendly secret key storage about stellar-protocol

[jedmccaleb]

This is probably what we used for the stellar wallet years ago. Is there any thing you would want different than that?

[irisli]

Stellar Wallet was a hosted wallet. It would be nice to have something that you could use offline without depending on anything else.

[antb123]

Stellar Desktop uses an AES encrypted text file when you download and run it...

I am not a huge fan of giant Mnemonic passphrases

[bartekn]

Thats not very user friendly. It'd be nice to have a standard for either:

1. Passphrase plus encrypted key file (like in myetherwallet)
2. Mnemonic passphrase

I think these are two different things. The former is secure file storage of a secret key and the latter is a secret key derivation method.

For a secure storage, I'd vote for something like Ethereum's https://github.com/ethereum/wiki/wiki/Web3-Secret-Storage-Definition. I agree it would be super useful for transferring accounts between different apps.

[irisli]

@bartekn Oh, the web3 looks interesting. In fact, thats what myetherewallet uses. Perhaps i'll just take that and port it to Stellar. Seems like I can just import their module
https://github.com/ethereum/web3.js But it seems like web3.js actually is a whole suite of things for the ethereum network

For mnemonic passphrases, they'd be good for pen+paper office cold wallet storage but I do agree it is cumbersome. I wouldn't exactly say that the mnemonic passphrase is for derivation since it will still be randomly generated; it's more like a base512. I just want to follow a defined standard since I'm sure many other there have spent hours working on it.

[irisli]

A simple way would be to use:
https://github.com/bitcoinjs/bip39

[irisli]

With a mnemonic phrase, you can also use a password. So storing it would be similar to the web3. The only difference is that with web3, you can pick a salt.

Trezor uses a 24 word mnemonic (https://doc.satoshilabs.com/trezor-faq/threats.html#what-if-i-run-the-trezor-recovery-process-on-an-infected-computer) which gives over 256 bits of entropy and has protection against keyloggers if the user enters them in random order

[bartekn]

Closing in favour of #63.

Let's open another issue for the encrypted file format discussion.