0

I'm using eth-lightwallet for personal purpose but I think I'm doing something wrong. When I create a new lightwallet keystore, I do this:

eth_lightwallet.keystore.createVault({
  password: password,
  seedPhrase: seed,
  hdPathString: "m/0'/0'/0'"
}, function (err, ks) {
  ks.keyFromPassword(password, function (err, pwDerivedKey) {
    ...
  })
})

Inside the callback I use keyFromPassword method to return the appropriate pwDerivedKey.

The first time I run the code it worked great. I've always used "abc123" as password. After that I sent ethers to this address to have some balance.

The second time I run the same code, I used the same seed, but I did change the password to see what will happen. It was a "great surprise" to see that the transaction was sent and the balance of ethers have decreased. So... in this case, the password is required but isn't used? Or I didn't understand something...

  • How did you use pwDerivedKey? It is my understanding that keyFromPassword return the key used to encrypt/decrypt the wallet, it is not the private key. – Ismael Nov 30 '17 at 6:41
2

The password is not static. each instance of the keystore you create, takes on a new password.The password is just used to encrypt the seed phrase soo you can move it around. what is important is that at the point of creating the vault, the password you used, must be the same password when you try to send a new transaction. because thats when you need to decrypt the seed to generate private keys.

In essence its safe for one vault instance, to generate a seed, use it to create a keystore with password1. and for another vault instance using the same seed, create a keystore with password2. when it all comes into play is when you need to send a transaction or any activity that requires the privatekeys. then the password used to create the vault instance mst be supplied to decrypt it, to generate back the same seed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.