Extract child key derivation function selection into separate function for reuse...

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index efe4d7f2228543d7cf9241638c43de4b455f81b8..39fc3ae429db3af01a97ad4c8b2b400478363ca5 100644 (file)
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -173,14 +173,10 @@ async function derive (index?: number): Promise<Record<string, number | ArrayBuf
                if (typeof index !== 'number') {
                        throw new Error('Invalid wallet account index')
                }
-               const derive = _type === 'BIP-44'
-                       ? Bip44.ckd('ed25519 seed', _seed, BIP44_COIN_NANO, index)
-                       : _type === 'Exodus'
-                               ? Bip44.ckd('Bitcoin seed', _seed, 0x100, index, 0, 0)
-                               : Blake2b.ckd(_seed, index)
-               return derive.then(result => {
+               return _ckd(index).then(result => {
                        const prv = new Uint8Array(result)
                        const pub = nano25519_derive(prv)
+                       prv.fill(0)
                        _timer = new VaultTimer(() => lock(), _timeout)
                        return { index, publicKey: pub.buffer }
                })
@@ -242,13 +238,11 @@ async function sign (index?: number, data?: ArrayBuffer): Promise<Record<string,
                if (data == null) {
                        throw new Error('Data to sign not found')
                }
-               const derive = _type === 'BLAKE2b'
-                       ? Blake2b.ckd(_seed, index)
-                       : Bip44.ckd(_type === 'Exodus' ? 'Bitcoin seed' : 'ed25519 seed', _seed, BIP44_COIN_NANO, index)
-               return derive.then(result => {
+               return _ckd(index).then(result => {
                        const prv = new Uint8Array(result)
                        const pub = nano25519_derive(prv)
                        const sig = nano25519_sign(new Uint8Array(data), new Uint8Array([...prv, ...pub]))
+                       prv.fill(0)
                        _timer = new VaultTimer(() => lock(), _timeout)
                        return { signature: sig.buffer }
                })
@@ -478,6 +472,23 @@ function _extractData (action: string, data: Record<string, unknown>) {
        }
 }
 
+function _ckd (index: number): Promise<ArrayBuffer> {
+       if (_seed == null) {
+               throw new Error('Wallet seed not found')
+       }
+       switch (_type) {
+               case ('BIP-44'): {
+                       return Bip44.ckd('ed25519 seed', _seed, BIP44_COIN_NANO, index)
+               }
+               case ('Exodus'): {
+                       return Bip44.ckd('Bitcoin seed', _seed, 0x100, index, 0, 0)
+               }
+               default: {
+                       return Blake2b.ckd(_seed, index)
+               }
+       }
+}
+
 /**
 * Encrypts an existing seed or mnemonic+salt and returns the initialization
 * vector, salt, and encrypted data representing the wallet in a locked state.