perf!: Use mnemonic seed for state persistence key derivation

packages/examples/packages/bip32/package.json

@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/ed25519": "^1.6.0",

packages/examples/packages/bip32/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "nS48OH2I7YacX70E4rPCF+870ZdKRaJb66DwFU6zu8M=",
+    "shasum": "HwrsD47LbsSGHt9MwKLSl50VI8lnsY1yxq/LPa1BBcc=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/examples/packages/bip44/package.json

@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/bls12-381": "^1.2.0"

packages/examples/packages/bip44/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "AeCVkpJQuy7JZHh5vQioQzJIbeR2H9hjYWmuGH8rww0=",
+    "shasum": "slHRPz+TwwHJfPqaZKAwCmSUAbxi8aAvwkGWY5MJ1Fk=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/examples/packages/browserify-plugin/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "mLWzf5XFmDFHwK9UjU+XBds5oRdj/uXwycZlVhpsyDc=",
+    "shasum": "M83EcfIuVLDGdfzDz6ydToeMztnTSLhjTHpkiGwi3Mo=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/examples/packages/browserify/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "Yf282fJUrz51Ex+hWO9f+VobgiZHhX4MJD2mkEWYAdw=",
+    "shasum": "AEZW5peO3bzO6yrbWCplB1yo/tyNirb6bAUXwSuspBc=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/examples/packages/invoke-snap/packages/consumer-signer/package.json

@@ -43,10 +43,10 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
-    "@noble/hashes": "^1.3.1"
+    "@noble/hashes": "^1.7.1"
   },
   "devDependencies": {
     "@jest/globals": "^29.5.0",

packages/examples/packages/invoke-snap/packages/consumer-signer/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "xs0Nhu0ONoHzoY0QfyPEutaBMwlMGQsoZgG88/bLxNQ=",
+    "shasum": "crdduVCAntL3FBIJw+t7ETyP9mbZLuXShtUyP4FXU5o=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/examples/packages/invoke-snap/packages/core-signer/package.json

@@ -43,7 +43,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/utils": "^11.2.0",
     "@noble/curves": "^1.1.0",
@@ -55,7 +55,7 @@
     "@metamask/auto-changelog": "^4.1.0",
     "@metamask/snaps-cli": "workspace:^",
     "@metamask/snaps-jest": "workspace:^",
-    "@noble/hashes": "^1.3.1",
+    "@noble/hashes": "^1.7.1",
     "@swc/core": "1.3.78",
     "@swc/jest": "^0.2.26",
     "@types/node": "18.14.2",

packages/examples/packages/invoke-snap/packages/core-signer/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snaps.git"
   },
   "source": {
-    "shasum": "uJbZD9CQgbJNvLk1lKmtfeWJNKAUf+vjZSNr+YK0Pak=",
+    "shasum": "4MKzJCtc1uh4GzIg60F9R7FBWD8LZW8LEMe9Au7UxWQ=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/snaps-controllers/package.json

@@ -83,7 +83,7 @@
     "@metamask/base-controller": "^8.0.0",
     "@metamask/json-rpc-engine": "^10.0.2",
     "@metamask/json-rpc-middleware-stream": "^8.0.7",
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/object-multiplex": "^2.1.0",
     "@metamask/permission-controller": "^11.0.6",
     "@metamask/phishing-controller": "^12.4.0",
@@ -115,6 +115,7 @@
     "@metamask/auto-changelog": "^4.1.0",
     "@metamask/browser-passworder": "^6.0.0",
     "@metamask/template-snap": "^0.7.0",
+    "@noble/hashes": "^1.7.1",
     "@swc/core": "1.3.78",
     "@swc/jest": "^0.2.26",
     "@ts-bridge/cli": "^0.6.1",

packages/snaps-controllers/src/snaps/SnapController.test.tsx

@@ -52,17 +52,18 @@ import {
   MOCK_SNAP_NAME,
   DEFAULT_SOURCE_PATH,
   DEFAULT_ICON_PATH,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import type { SemVerRange, SemVerVersion, Json } from '@metamask/utils';
 import {
-  hexToBytes,
   assert,
   AssertionError,
   base64ToBytes,
   stringToBytes,
   createDeferredPromise,
 } from '@metamask/utils';
+import { hmac } from '@noble/hashes/hmac';
+import { sha512 } from '@noble/hashes/sha512';
 import { File } from 'buffer';
 import { webcrypto } from 'crypto';
 import fetchMock from 'jest-fetch-mock';
@@ -2134,9 +2135,9 @@ describe('SnapController', () => {
       DEFAULT_ENCRYPTION_KEY_DERIVATION_OPTIONS,
     );
 
-    const getMnemonic = jest
+    const getMnemonicSeed = jest
       .fn()
-      .mockReturnValue(TEST_SECRET_RECOVERY_PHRASE_BYTES);
+      .mockReturnValue(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES);
 
     const snapController = getSnapController(
       getSnapControllerOptions({
@@ -2149,14 +2150,14 @@ describe('SnapController', () => {
             [MOCK_SNAP_ID]: mockEncryptedState,
           },
         },
-        getMnemonic,
+        getMnemonicSeed,
       }),
     );
 
     expect(
       await messenger.call('SnapController:getSnapState', MOCK_SNAP_ID, true),
     ).toStrictEqual(state);
-    expect(getMnemonic).toHaveBeenCalledTimes(1);
+    expect(getMnemonicSeed).toHaveBeenCalledTimes(1);
 
     rootMessenger.publish('KeyringController:lock');
 
@@ -2168,7 +2169,7 @@ describe('SnapController', () => {
     // decrypt the state again. This is not an ideal way to test this, but it
     // is the easiest to test this without exposing the internal state of the
     // `SnapController`.
-    expect(getMnemonic).toHaveBeenCalledTimes(2);
+    expect(getMnemonicSeed).toHaveBeenCalledTimes(2);
 
     snapController.destroy();
   });
@@ -9628,9 +9629,11 @@ describe('SnapController', () => {
     it('uses custom client cryptography functions', async () => {
       const messenger = getSnapControllerMessenger();
 
-      const pbkdf2Sha512 = jest
+      const hmacSha512 = jest
         .fn()
-        .mockResolvedValue(hexToBytes(ENCRYPTION_KEY));
+        .mockImplementation((key: Uint8Array, data: Uint8Array) =>
+          hmac(sha512, key, data),
+        );
 
       const snapController = getSnapController(
         getSnapControllerOptions({
@@ -9639,7 +9642,7 @@ describe('SnapController', () => {
             snaps: getPersistedSnapsState(),
           },
           clientCryptography: {
-            pbkdf2Sha512,
+            hmacSha512,
           },
         }),
       );
@@ -9656,7 +9659,7 @@ describe('SnapController', () => {
 
       await promise;
 
-      expect(pbkdf2Sha512).toHaveBeenCalledTimes(1);
+      expect(hmacSha512).toHaveBeenCalledTimes(10);
 
       snapController.destroy();
     });

packages/snaps-controllers/src/snaps/SnapController.ts

@@ -747,11 +747,11 @@ type SnapControllerArgs = {
   encryptor: ExportableKeyEncryptor;
 
   /**
-   * A hook to access the mnemonic of the user's primary keyring.
+   * A hook to access the mnemonic seed of the user's primary keyring.
    *
-   * @returns The mnemonic as bytes.
+   * @returns The mnemonic seed as bytes.
    */
-  getMnemonic: () => Promise<Uint8Array>;
+  getMnemonicSeed: () => Promise<Uint8Array>;
 
   /**
    * A hook to get dynamic feature flags at runtime.
@@ -848,7 +848,7 @@ export class SnapController extends BaseController<
 
   readonly #encryptor: ExportableKeyEncryptor;
 
-  readonly #getMnemonic: () => Promise<Uint8Array>;
+  readonly #getMnemonicSeed: () => Promise<Uint8Array>;
 
   readonly #getFeatureFlags: () => DynamicFeatureFlags;
 
@@ -885,7 +885,7 @@ export class SnapController extends BaseController<
     detectSnapLocation: detectSnapLocationFunction = detectSnapLocation,
     preinstalledSnaps = null,
     encryptor,
-    getMnemonic,
+    getMnemonicSeed,
     getFeatureFlags = () => ({}),
     clientCryptography,
   }: SnapControllerArgs) {
@@ -941,7 +941,7 @@ export class SnapController extends BaseController<
     this.maxRequestTime = maxRequestTime;
     this.#detectSnapLocation = detectSnapLocationFunction;
     this.#encryptor = encryptor;
-    this.#getMnemonic = getMnemonic;
+    this.#getMnemonicSeed = getMnemonicSeed;
     this.#getFeatureFlags = getFeatureFlags;
     this.#clientCryptography = clientCryptography;
     this.#preinstalledSnaps = preinstalledSnaps;
@@ -1824,11 +1824,11 @@ export class SnapController extends BaseController<
     }
 
     const salt = passedSalt ?? this.#encryptor.generateSalt();
-    const mnemonicPhrase = await this.#getMnemonic();
+    const seed = await this.#getMnemonicSeed();
 
     const entropy = await getEncryptionEntropy({
       snapId,
-      mnemonicPhrase,
+      seed,
       cryptographicFunctions: this.#clientCryptography,
     });
 

packages/snaps-controllers/src/test-utils/controller.ts

@@ -31,7 +31,7 @@ import {
   MOCK_LOCAL_SNAP_ID,
   MOCK_ORIGIN,
   MOCK_SNAP_ID,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import type { Json } from '@metamask/utils';
 
@@ -581,7 +581,8 @@ export const getSnapControllerOptions = (
     },
     state: undefined,
     fetchFunction: jest.fn(),
-    getMnemonic: async () => Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_BYTES),
+    getMnemonicSeed: async () =>
+      Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES),
     clientCryptography: {},
     encryptor: getSnapControllerEncryptor(),
     ...opts,
@@ -613,7 +614,8 @@ export const getSnapControllerWithEESOptions = ({
     closeAllConnections: jest.fn(),
     messenger: snapControllerMessenger,
     rootMessenger,
-    getMnemonic: async () => Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_BYTES),
+    getMnemonicSeed: async () =>
+      Promise.resolve(TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES),
     encryptor: getSnapControllerEncryptor(),
     fetchFunction: jest.fn(),
     ...options,

packages/snaps-rpc-methods/jest.config.js

@@ -10,10 +10,10 @@ module.exports = deepmerge(baseConfig, {
   ],
   coverageThreshold: {
     global: {
-      branches: 95.19,
-      functions: 98.62,
-      lines: 98.82,
-      statements: 98.5,
+      branches: 95.2,
+      functions: 98.63,
+      lines: 98.83,
+      statements: 98.51,
     },
   },
 });

packages/snaps-rpc-methods/package.json

@@ -55,14 +55,14 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@metamask/key-tree": "^10.0.2",
+    "@metamask/key-tree": "^10.1.0",
     "@metamask/permission-controller": "^11.0.6",
     "@metamask/rpc-errors": "^7.0.2",
     "@metamask/snaps-sdk": "workspace:^",
     "@metamask/snaps-utils": "workspace:^",
     "@metamask/superstruct": "^3.1.0",
     "@metamask/utils": "^11.2.0",
-    "@noble/hashes": "^1.3.1",
+    "@noble/hashes": "^1.7.1",
     "luxon": "^3.5.0"
   },
   "devDependencies": {

packages/snaps-rpc-methods/src/restricted/getEntropy.ts

@@ -14,7 +14,7 @@ import type { NonEmptyArray } from '@metamask/utils';
 import { assertStruct } from '@metamask/utils';
 
 import type { MethodHooksObject } from '../utils';
-import { getSecretRecoveryPhrase, deriveEntropy } from '../utils';
+import { getSecretRecoveryPhrase, deriveEntropyFromMnemonic } from '../utils';
 
 const targetName = 'snap_getEntropy';
 
@@ -141,7 +141,7 @@ function getEntropyImplementation({
       params.source,
     );
 
-    return deriveEntropy({
+    return deriveEntropyFromMnemonic({
       input: origin,
       salt: params.salt,
       mnemonicPhrase,

packages/snaps-rpc-methods/src/restricted/manageState.test.ts

@@ -2,7 +2,7 @@ import { PermissionType, SubjectType } from '@metamask/permission-controller';
 import { ManageStateOperation } from '@metamask/snaps-sdk';
 import {
   MOCK_SNAP_ID,
-  TEST_SECRET_RECOVERY_PHRASE_BYTES,
+  TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
 } from '@metamask/snaps-utils/test-utils';
 import { webcrypto } from 'crypto';
 
@@ -20,7 +20,7 @@ const ENCRYPTION_KEY =
 describe('getEncryptionEntropy', () => {
   it('returns the encryption entropy for the snap ID', async () => {
     const result = await getEncryptionEntropy({
-      mnemonicPhrase: TEST_SECRET_RECOVERY_PHRASE_BYTES,
+      seed: TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
       snapId: MOCK_SNAP_ID,
     });
 
@@ -29,7 +29,7 @@ describe('getEncryptionEntropy', () => {
 
   it('accepts custom cryptographic functions', async () => {
     const result = await getEncryptionEntropy({
-      mnemonicPhrase: TEST_SECRET_RECOVERY_PHRASE_BYTES,
+      seed: TEST_SECRET_RECOVERY_PHRASE_SEED_BYTES,
       snapId: MOCK_SNAP_ID,
       cryptographicFunctions: {},
     });