From 757a59c5c9c4b56120446cae1ac495773b9905c8 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Wed, 8 Apr 2026 22:33:43 -0700 Subject: breez style passkey derivation --- src/lib/keyWrapping.ts | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) (limited to 'src/lib/keyWrapping.ts') diff --git a/src/lib/keyWrapping.ts b/src/lib/keyWrapping.ts index 31cb1e5c..cd68947f 100644 --- a/src/lib/keyWrapping.ts +++ b/src/lib/keyWrapping.ts @@ -28,9 +28,20 @@ export async function resolveCanonicalKey( oldPrfKey: ArrayBuffer, ): Promise<{ canonicalKey: ArrayBuffer; encryptedKeys: Record }> { if (encryptedKeys && encryptedKeys[methodId]) { - const canonicalKey = await unwrapCanonicalKey(wrappingKey, encryptedKeys[methodId]); - rememberPrfKey(canonicalKey, defaultRememberForMs); - return { canonicalKey, encryptedKeys }; + try { + // Try new wrapping key first (e.g. PRF-derived) + const canonicalKey = await unwrapCanonicalKey(wrappingKey, encryptedKeys[methodId]); + rememberPrfKey(canonicalKey, defaultRememberForMs); + return { canonicalKey, encryptedKeys }; + } catch { + // Fallback: try old key (e.g. SHA-256(credentialId)) and re-wrap with new key + const canonicalKey = await unwrapCanonicalKey(oldPrfKey, encryptedKeys[methodId]); + const wrapped = await wrapCanonicalKey(wrappingKey, canonicalKey); + const updated = { ...encryptedKeys, [methodId]: wrapped }; + await saveEncryptedKeys(updated); + rememberPrfKey(canonicalKey, defaultRememberForMs); + return { canonicalKey, encryptedKeys: updated }; + } } // Migration: old PRF key becomes canonical key -- cgit v1.2.3