perf!: Use mnemonic seed for state persistence key derivation (#3217)

FrederikBolding · web-flow · commit 74a252693594 · 2025-03-13T09:09:52.000Z
Bump key-tree to the latest version which includes a bunch of performance improvements. One of these performance improvements is the ability to use `.fromSeed`. This PR adds functionality to derive the keys used for state encryption using the mnemonic seed instead of the mnemonic phrase. This should save us more than half of the compute time required for deriving keys used for state persistence. This PR does not yet tackle `getEntropy` or `getBipEntropy` methods, these will be supported in a follow-up. Closes #3218 **Breaking changes** - `SnapController` now expects a `getMnemonicSeed` hook that must return the BIP39 seed for the user's primary mnemonic.
diff --git a/packages/examples/packages/bip32/package.json b/packages/examples/packages/bip32/package.json
@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/ed25519": "^1.6.0",
diff --git a/packages/examples/packages/bip32/snap.manifest.json b/packages/examples/packages/bip32/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "nS48OH2I7YacX70E4rPCF+870ZdKRaJb66DwFU6zu8M=",
+    "shasum": "HwrsD47LbsSGHt9MwKLSl50VI8lnsY1yxq/LPa1BBcc=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/examples/packages/bip44/package.json b/packages/examples/packages/bip44/package.json
@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/bls12-381": "^1.2.0"
diff --git a/packages/examples/packages/bip44/snap.manifest.json b/packages/examples/packages/bip44/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "AeCVkpJQuy7JZHh5vQioQzJIbeR2H9hjYWmuGH8rww0=",
+    "shasum": "slHRPz+TwwHJfPqaZKAwCmSUAbxi8aAvwkGWY5MJ1Fk=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/examples/packages/browserify-plugin/snap.manifest.json b/packages/examples/packages/browserify-plugin/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "mLWzf5XFmDFHwK9UjU+XBds5oRdj/uXwycZlVhpsyDc=",
+    "shasum": "M83EcfIuVLDGdfzDz6ydToeMztnTSLhjTHpkiGwi3Mo=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/examples/packages/browserify/snap.manifest.json b/packages/examples/packages/browserify/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "Yf282fJUrz51Ex+hWO9f+VobgiZHhX4MJD2mkEWYAdw=",
+    "shasum": "AEZW5peO3bzO6yrbWCplB1yo/tyNirb6bAUXwSuspBc=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/examples/packages/invoke-snap/packages/consumer-signer/package.json b/packages/examples/packages/invoke-snap/packages/consumer-signer/package.json
@@ -43,10 +43,10 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
-    "@noble/hashes": "^1.3.1"
+    "@noble/hashes": "^1.7.1"
   },
   "devDependencies": {
     "@jest/globals": "^29.5.0",
diff --git a/packages/examples/packages/invoke-snap/packages/consumer-signer/snap.manifest.json b/packages/examples/packages/invoke-snap/packages/consumer-signer/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "xs0Nhu0ONoHzoY0QfyPEutaBMwlMGQsoZgG88/bLxNQ=",
+    "shasum": "crdduVCAntL3FBIJw+t7ETyP9mbZLuXShtUyP4FXU5o=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/examples/packages/invoke-snap/packages/core-signer/package.json b/packages/examples/packages/invoke-snap/packages/core-signer/package.json
@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/curves": "^1.1.0",
@@ -55,7 +55,7 @@
     "@metamask/auto-changelog": "^4.1.0",
     "@metamask/snaps-cli": "workspace:^",
     "@metamask/snaps-jest": "workspace:^",
-    "@noble/hashes": "^1.3.1",
+    "@noble/hashes": "^1.7.1",
     "@swc/core": "1.3.78",
     "@swc/jest": "^0.2.26",
     "@types/node": "18.14.2",
diff --git a/packages/examples/packages/invoke-snap/packages/core-signer/snap.manifest.json b/packages/examples/packages/invoke-snap/packages/core-signer/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "uJbZD9CQgbJNvLk1lKmtfeWJNKAUf+vjZSNr+YK0Pak=",
+    "shasum": "4MKzJCtc1uh4GzIg60F9R7FBWD8LZW8LEMe9Au7UxWQ=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",
diff --git a/packages/snaps-controllers/package.json b/packages/snaps-controllers/package.json
@@ -83,7 +83,7 @@
     "@metamask/base-controller": "^8.0.0",
     "@metamask/json-rpc-engine": "^10.0.2",
     "@metamask/json-rpc-middleware-stream": "^8.0.7",
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/object-multiplex": "^2.1.0",
     "@metamask/permission-controller": "^11.0.6",
     "@metamask/phishing-controller": "^12.4.0",
@@ -115,6 +115,7 @@
     "@metamask/auto-changelog": "^4.1.0",
     "@metamask/browser-passworder": "^6.0.0",
     "@metamask/template-snap": "^0.7.0",
+    "@noble/hashes": "^1.7.1",
     "@swc/core": "1.3.78",
     "@swc/jest": "^0.2.26",
     "@ts-bridge/cli": "^0.6.1",
diff --git a/packages/snaps-controllers/src/snaps/SnapController.test.tsx b/packages/snaps-controllers/src/snaps/SnapController.test.tsx
@@ -52,17 +52,18 @@ import {
   MOCK_SNAP_NAME,
   DEFAULT_SOURCE_PATH,
   DEFAULT_ICON_PATH,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import type { SemVerRange, SemVerVersion, Json } from '@metamask/utils';
 import {
-  hexToBytes,
   assert,
   AssertionError,
   base64ToBytes,
   stringToBytes,
   createDeferredPromise,
 } from '@metamask/utils';
+import { hmac } from '@noble/hashes/hmac';
+import { sha512 } from '@noble/hashes/sha512';
 import { File } from 'buffer';
 import { webcrypto } from 'crypto';
 import fetchMock from 'jest-fetch-mock';
@@ -2134,9 +2135,9 @@ describe('SnapController', () => {
       DEFAULT_ENCRYPTION_KEY_DERIVATION_OPTIONS,
     );
 
-    const getMnemonic = jest
+    const getMnemonicSeed = jest
       .fn()
-      .mockReturnValue(TEST_SECRET_RECOVERY_PHRASE_BYTES);
+      .mockReturnValue(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES);
 
     const snapController = getSnapController(
       getSnapControllerOptions({
@@ -2149,14 +2150,14 @@ describe('SnapController', () => {
             [MOCK_SNAP_ID]: mockEncryptedState,
           },
         },
-        getMnemonic,
+        getMnemonicSeed,
       }),
     );
 
     expect(
       await messenger.call('SnapController:getSnapState', MOCK_SNAP_ID, true),
     ).toStrictEqual(state);
-    expect(getMnemonic).toHaveBeenCalledTimes(1);
+    expect(getMnemonicSeed).toHaveBeenCalledTimes(1);
 
     rootMessenger.publish('KeyringController:lock');
 
@@ -2168,7 +2169,7 @@ describe('SnapController', () => {
     // decrypt the state again. This is not an ideal way to test this, but it
     // is the easiest to test this without exposing the internal state of the
     // `SnapController`.
-    expect(getMnemonic).toHaveBeenCalledTimes(2);
+    expect(getMnemonicSeed).toHaveBeenCalledTimes(2);
 
     snapController.destroy();
   });
@@ -9628,9 +9629,11 @@ describe('SnapController', () => {
     it('uses custom client cryptography functions', async () => {
       const messenger = getSnapControllerMessenger();
 
-      const pbkdf2Sha512 = jest
+      const hmacSha512 = jest
         .fn()
-        .mockResolvedValue(hexToBytes(ENCRYPTION_KEY));
+        .mockImplementation((key: Uint8Array, data: Uint8Array) =>
+          hmac(sha512, key, data),
+        );
 
       const snapController = getSnapController(
         getSnapControllerOptions({
@@ -9639,7 +9642,7 @@ describe('SnapController', () => {
             snaps: getPersistedSnapsState(),
           },
           clientCryptography: {
-            pbkdf2Sha512,
+            hmacSha512,
           },
         }),
       );
@@ -9656,7 +9659,7 @@ describe('SnapController', () => {
 
       await promise;
 
-      expect(pbkdf2Sha512).toHaveBeenCalledTimes(1);
+      expect(hmacSha512).toHaveBeenCalledTimes(10);
 
       snapController.destroy();
     });
diff --git a/packages/snaps-controllers/src/snaps/SnapController.ts b/packages/snaps-controllers/src/snaps/SnapController.ts
@@ -747,11 +747,11 @@ type SnapControllerArgs = {
   encryptor: ExportableKeyEncryptor;
 
   /**
-   * A hook to access the mnemonic of the user's primary keyring.
+   * A hook to access the mnemonic seed of the user's primary keyring.
    *
-   * @returns The mnemonic as bytes.
+   * @returns The mnemonic seed as bytes.
    */
-  getMnemonic: () => Promise<Uint8Array>;
+  getMnemonicSeed: () => Promise<Uint8Array>;
 
   /**
    * A hook to get dynamic feature flags at runtime.
@@ -848,7 +848,7 @@ export class SnapController extends BaseController<
 
   readonly #encryptor: ExportableKeyEncryptor;
 
-  readonly #getMnemonic: () => Promise<Uint8Array>;
+  readonly #getMnemonicSeed: () => Promise<Uint8Array>;
 
   readonly #getFeatureFlags: () => DynamicFeatureFlags;
 
@@ -885,7 +885,7 @@ export class SnapController extends BaseController<
     detectSnapLocation: detectSnapLocationFunction = detectSnapLocation,
     preinstalledSnaps = null,
     encryptor,
-    getMnemonic,
+    getMnemonicSeed,
     getFeatureFlags = () => ({}),
     clientCryptography,
   }: SnapControllerArgs) {
@@ -941,7 +941,7 @@ export class SnapController extends BaseController<
     this.maxRequestTime = maxRequestTime;
     this.#detectSnapLocation = detectSnapLocationFunction;
     this.#encryptor = encryptor;
-    this.#getMnemonic = getMnemonic;
+    this.#getMnemonicSeed = getMnemonicSeed;
     this.#getFeatureFlags = getFeatureFlags;
     this.#clientCryptography = clientCryptography;
     this.#preinstalledSnaps = preinstalledSnaps;
@@ -1824,11 +1824,11 @@ export class SnapController extends BaseController<
     }
 
     const salt = passedSalt ?? this.#encryptor.generateSalt();
-    const mnemonicPhrase = await this.#getMnemonic();
+    const seed = await this.#getMnemonicSeed();
 
     const entropy = await getEncryptionEntropy({
       snapId,
-      mnemonicPhrase,
+      seed,
       cryptographicFunctions: this.#clientCryptography,
     });
 
diff --git a/packages/snaps-controllers/src/test-utils/controller.ts b/packages/snaps-controllers/src/test-utils/controller.ts
@@ -31,7 +31,7 @@ import {
   MOCK_LOCAL_SNAP_ID,
   MOCK_ORIGIN,
   MOCK_SNAP_ID,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import type { Json } from '@metamask/utils';
 
@@ -581,7 +581,8 @@ export const getSnapControllerOptions = (
     },
     state: undefined,
     fetchFunction: jest.fn(),
-    getMnemonic: async () => Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_BYTES),
+    getMnemonicSeed: async () =>
+      Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES),
     clientCryptography: {},
     encryptor: getSnapControllerEncryptor(),
     ...opts,
@@ -613,7 +614,8 @@ export const getSnapControllerWithEESOptions = ({
     closeAllConnections: jest.fn(),
     messenger: snapControllerMessenger,
     rootMessenger,
-    getMnemonic: async () => Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_BYTES),
+    getMnemonicSeed: async () =>
+      Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES),
     encryptor: getSnapControllerEncryptor(),
     fetchFunction: jest.fn(),
     ...options,
diff --git a/packages/snaps-rpc-methods/jest.config.js b/packages/snaps-rpc-methods/jest.config.js
@@ -10,10 +10,10 @@ module.exports = deepmerge(baseConfig, {
   ],
   coverageThreshold: {
     global: {
-      branches: 95.19,
-      functions: 98.62,
-      lines: 98.82,
-      statements: 98.5,
+      branches: 95.2,
+      functions: 98.63,
+      lines: 98.83,
+      statements: 98.51,
     },
   },
 });
diff --git a/packages/snaps-rpc-methods/package.json b/packages/snaps-rpc-methods/package.json
@@ -55,14 +55,14 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/permission-controller": "^11.0.6",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/snaps-utils": "workspace:^",
     "@metamask/superstruct": "^3.1.0",
     "@metamask/utils": "^11.2.0",
-    "@noble/hashes": "^1.3.1",
+    "@noble/hashes": "^1.7.1",
     "luxon": "^3.5.0"
   },
   "devDependencies": {
diff --git a/packages/snaps-rpc-methods/src/restricted/getEntropy.ts b/packages/snaps-rpc-methods/src/restricted/getEntropy.ts
@@ -14,7 +14,7 @@ import type { NonEmptyArray } from '@metamask/utils';
 import { assertStruct } from '@metamask/utils';
 
 import type { MethodHooksObject } from '../utils';
-import { getSecretRecoveryPhrase, deriveEntropy } from '../utils';
+import { getSecretRecoveryPhrase, deriveEntropyFromMnemonic } from '../utils';
 
 const targetName = 'snap_getEntropy';
 
@@ -141,7 +141,7 @@ function getEntropyImplementation({
       params.source,
     );
 
-    return deriveEntropy({
+    return deriveEntropyFromMnemonic({
       input: origin,
       salt: params.salt,
       mnemonicPhrase,
diff --git a/packages/snaps-rpc-methods/src/restricted/manageState.test.ts b/packages/snaps-rpc-methods/src/restricted/manageState.test.ts
@@ -2,7 +2,7 @@ import { PermissionType, SubjectType } from '@metamask/permission-controller';
 import { ManageStateOperation } from '@metamask/snaps-sdk';
 import {
   MOCK_SNAP_ID,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import { webcrypto } from 'crypto';
 
@@ -20,7 +20,7 @@ const ENCRYPTION_KEY =
 describe('getEncryptionEntropy', () => {
   it('returns the encryption entropy for the snap ID', async () => {
     const result = await getEncryptionEntropy({
-      mnemonicPhrase: TEST_SECRET_RECOVERY_PHRASE_BYTES,
+      seed: TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
       snapId: MOCK_SNAP_ID,
     });
 
@@ -29,7 +29,7 @@ describe('getEncryptionEntropy', () => {
 
   it('accepts custom cryptographic functions', async () => {
     const result = await getEncryptionEntropy({
-      mnemonicPhrase: TEST_SECRET_RECOVERY_PHRASE_BYTES,
+      seed: TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
       snapId: MOCK_SNAP_ID,
       cryptographicFunctions: {},
     });
diff --git a/packages/snaps-rpc-methods/src/restricted/manageState.ts b/packages/snaps-rpc-methods/src/restricted/manageState.ts
diff --git a/packages/snaps-rpc-methods/src/utils.test.ts b/packages/snaps-rpc-methods/src/utils.test.ts
diff --git a/packages/snaps-rpc-methods/src/utils.ts b/packages/snaps-rpc-methods/src/utils.ts
diff --git a/packages/snaps-sdk/package.json b/packages/snaps-sdk/package.json
diff --git a/packages/snaps-simulation/package.json b/packages/snaps-simulation/package.json
diff --git a/packages/snaps-simulator/package.json b/packages/snaps-simulator/package.json
diff --git a/packages/snaps-utils/package.json b/packages/snaps-utils/package.json
diff --git a/packages/snaps-utils/src/test-utils/common.ts b/packages/snaps-utils/src/test-utils/common.ts
diff --git a/yarn.lock b/yarn.lock
