keystore KDF called inside loops; makes it difficult to make stretching longer
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.6k
- Forks
- 3.5k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 61
Description
When signing a transaction, if the keystore is encrypted, the key to sign each input is independently decrypted using the password.
Since https://github.com/spesmilo/electrum/pull/4838, this now became noticeable.
The PBKDF is redone for every key.
This is due to calling self.get_private_key in the loop below:
https://github.com/spesmilo/electrum/blob/762082e13d7e9db7c1ca603a04d9dc1aebe8b0af/electrum/keystore.py#L113-L124
This is easily fixable for seeded wallets but not for imported.
For seeded wallets, all leaf keys are derived from the encrypted xprv, and so the decrypted xprv can be moved out of the loop.
For imported, this trick does not apply. The random nonce for each key seemingly kills any possible optimisation.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in electrum/keystore.py around lines 113-124 and trace the signing loop into self.get_private_key. Compare the seeded-wallet and imported-key paths, focusing on where PBKDF work is repeated and which constraints the imported path imposes. Done means transaction signing avoids unnecessary KDF repetition where supported without changing key or signature behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100