使用iPhone安全外壳的钱包

当前没有使用安全区域的iOS钱包.但是tz3帐户使用p-256加密,主要用于支持iOS,Android和仅与p-256兼容的其他设备.旨在用于基于安全飞地的钱包的多重签名合同方面已有一些工作,我希望我们会很快看到.

主要挑战在于,与Ledger之类的硬件钱包设备不同,安全区域不允许导入/还原密钥.密钥是在内部创建的,永远不会离开飞地,因此不会导出.在丢失设备的情况下,这使备份/还原变得困难.最常见的解决方案是multisig,其中基于安全区的密钥仅为x的1.

这是Apple描述安全区域的方式:

Secure Enclave的优势与一些限制相平衡.特别是安全区域:

• 是Apple A7或更高版本A系列处理器的硬件功能.只有具有这些处理器之一的iOS设备或具有Touch Bar和Touch ID的MacBook Pro才支持此功能.

• 仅存储256位椭圆曲线私钥.这些密钥只能用于创建和验证密码签名,或用于椭圆曲线Diffie-Hellman密钥交换(并扩展为对称加密).

• 无法导入预先存在的密钥.您必须直接在Secure Enclave内部创建密钥.没有一种机制可以将密钥数据传入或传出Secure Enclave,这对其安全性至关重要.

(=" 源)

There isn't currently a wallet for iOS using the secure enclave. But the tz3 accounts use p-256 encryption and were put in primarily to support iOS, Android, and other devices which are only compatible with p-256. There has been some work toward multisig contracts intended for use with secure enclave based wallets, I would expect we will see something soon.

The main challenge is that unlike a hardware wallet device such as Ledger, the secure enclave does not allow the importing/restoring of a key. The keys are created internally and never leave the enclave so there is no export. This makes backup/restore challenging in the case of a lost device. The most common solution will be a multisig where the enclave based key is only 1 of x.

This is how Apple describes the secure enclave:

The benefits of the Secure Enclave are balanced against a few restrictions. In particular, the Secure Enclave:

• Is a hardware feature of the Apple A7 or later A-series processor. Only iOS devices with one of these processors or a MacBook Pro with the Touch Bar and Touch ID support this feature.

• Stores only 256-bit elliptic curve private keys. These keys can only be used for creating and verifying cryptographic signatures, or for elliptic curve Diffie-Hellman key exchange (and by extension, symmetric encryption).

• Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.

(source)

Taylor Keefer在2019年5月6日的中型文章" 使用iOS的Secure Enclave和Face ID签署Tezos交易".就像@cousinit描述的解决方案一样,此原型使用" 1 of 2多重签名智能合约"和第二个密钥,以防无法再访问安全区域中的密钥.

Taylor Keefer demonstrated a prototype iOS app on May 6, 2019 in a Medium article "Signing Tezos Transactions with iOS’s Secure Enclave and Face ID". As in the solution described by @cousinit, this prototype uses a "1 of 2 multi signature smart contract" with a second key used in case the access to the key in the secure enclave is not available anymore.