@P3b7_ Yes, that's exactly what you want
The master private key (known only by the true wallet owner) is used to derive (in a ZK circuit) down to the affected address
This proves they know the parent hardened private key for a leaked address key
This skips the expensive BIP39 step
The recovery phrase is used to generate a "master key" (called m) with a one-way function (see BIP39 / CIP3 for more info)
Afterwards, BIP32/CIP1852 is used to derive child keys
Only the address key (the last one) leaked, so proving ownership of the master key is sufficient
Given the current week, it felt timely to do a refresher on the details of how Cardano wallet key generation works.
So we double-checked the different specs and summarized what we found in this thread.
From raw randomness to a shareable address 🧵
@AshiyaPool@IOHK_Charles@Quantumplation Unfortunately you can't use biometrics to solve this
In wallets, biometrics usually encrypt the master key, but you still have to prove (ex: ZKP) the master key is the correct key for the funds
In biometrics 2FA you'd be right, but that's not the case in non-custodial wallets
@adamKDean Fortunately, you don't need to derive another address index to sign. The account key is a valid key (just drop the chaincode), so you can sign with it directly
Option 1 is the very conservative approach:
Key idea: deriving a secret key from a recovery phrase is a one-way operation
Therefore, even if your secret key is compromised, you can prove you're the owner of the wallet by creating a ZK proof that you know it's recovery phrase
@PhilippeVleLong Just by knowing the private key of an address,
- You don't know private keys higher up the hierarchy (cip1852)
- You don't know the recovery phrase (bip39)
@PhilippeVleLong No, the output would likely be the public address (you're proving you know a recovery phrase (input) for an address (output))
The fact that you've generated a proof shows that you know the private key (no need to output it)
@PhilippeVleLong This is what privacy-preserving ZK proofs give you
You can prove the result of a computation without making its inputs public
For example, in Midnight, input arguments to a smart contract are private by default
@Bastian_SHARE I'm not in contact with the team, so I can't say anything definitely. Their codebase is not the same I worked on many years ago
Currently, it sounds like if you've signed a transaction using their app this year, you may be affected
@maxalexweber Of course, they could put all the custodian's funds in a smart contract and do the recovery process onchain if they want to
but that's not the approach they're taking at the moment
@maxalexweber Recovery from the custodian is an offchain process, so you don't need to settle anything on Midnight's chain
You can leverage Midnight's cryptography if you want, but not need to settle it onchain as an offchain generated proof is sufficient
@Rizzabeast Fortunately, yes you can in this case!
Option #1 (prove you know the recovery phrase) is doable even if your master key is compromised
Option #2 should also work in SecondFi's case (where only the address key is compromised)
@Rizzabeast A KYC route would require massive coordination with exchanges, and would only help you for wallets directly funded from exchanges (not true for a lot of them)
Proving you own the wallet is the only generically viable route
So it's possible SecondFi only requires proof that you know the private key for the account's public key (very easy: just sign a message with it)
this means the recovery process may not be complicated cryptographically speaking (ofc, cryptography isn't the only hard part)
That means you can prove you own the wallet by sharing a key above it in the hierarchy
Address key leaked (like SecondFi)? You can just prove you know the account's key