ETH lightwallet lib, password is required but not used

Question

I'm using eth-lightwallet for personal purpose but I think I'm doing something wrong. When I create a new lightwallet keystore, I do this:

eth_lightwallet.keystore.createVault({
  password: password,
  seedPhrase: seed,
  hdPathString: "m/0'/0'/0'"
}, function (err, ks) {
  ks.keyFromPassword(password, function (err, pwDerivedKey) {
    ...
  })
})

Inside the callback I use keyFromPassword method to return the appropriate pwDerivedKey.

The first time I run the code it worked great. I've always used "abc123" as password. After that I sent ethers to this address to have some balance.

The second time I run the same code, I used the same seed, but I did change the password to see what will happen. It was a "great surprise" to see that the transaction was sent and the balance of ethers have decreased. So... in this case, the password is required but isn't used? Or I didn't understand something...

Answer 1

The password is not static. each instance of the keystore you create, takes on a new password.The password is just used to encrypt the seed phrase soo you can move it around. what is important is that at the point of creating the vault, the password you used, must be the same password when you try to send a new transaction. because thats when you need to decrypt the seed to generate private keys.

In essence its safe for one vault instance, to generate a seed, use it to create a keystore with password1. and for another vault instance using the same seed, create a keystore with password2. when it all comes into play is when you need to send a transaction or any activity that requires the privatekeys. then the password used to create the vault instance mst be supplied to decrypt it, to generate back the same seed