|
1 | | -# README: Entity Secret Generation and Encryption |
| 1 | +# Entity Secret Generation and Encryption |
| 2 | + |
| 3 | +This repository demonstrates Entity Secret generation and encryption for the Circle Wallets API. |
| 4 | + |
| 5 | +The process involves two steps: |
| 6 | + |
| 7 | + 1. **Generation (one-time)**: Generate a cryptographically secure 32-byte entity secret and encode it as a 64-character hex string. |
| 8 | + |
| 9 | + 2. **Encryption (per API request)**: Encrypt the 32-byte entity secret using RSA-OAEP (with SHA-256 for both the OAEP hash and MGF1), then base64-encode the resulting ciphertext for API requests. |
2 | 10 |
|
3 | 11 | ## Getting Started |
4 | 12 |
|
5 | 13 | To generate an entity secret and encrypt with the entity public key, and register the entity secret ciphertext follow the steps below: |
6 | 14 |
|
7 | | -1. Choose a programming language: Select the programming language you are using for your application. We provide sample code snippets for Python and Golang. |
| 15 | +1. Choose a programming language: Select the programming language you are using for your application. We provide sample code snippets for Python, Golang and Node.js. For other languages, you will have to adapt the code accordingly. |
8 | 16 |
|
9 | 17 | 2. Use the sample code (`generate_hex_encoded_entity_secret`) to generate a hex-encoded entity secret. You can also generate a 32 byte data and hex-encode it by yourselves. |
10 | 18 |
|
11 | | -Python |
12 | | -```bash |
13 | | -python python/generate_hex_encoded_entity_secret.py |
14 | | -``` |
15 | | - |
16 | | -Golang |
17 | | -```bash |
18 | | -go run golang/generate_hex_encoded_entity_secret.go |
19 | | -``` |
| 19 | + **Python** |
| 20 | + ```bash |
| 21 | + python python/generate_hex_encoded_entity_secret.py |
| 22 | + ``` |
20 | 23 |
|
21 | | -Node.js |
22 | | -```bash |
23 | | -node nodejs/generate_hex_encoded_entity_secret.js |
24 | | -``` |
| 24 | + **Golang** |
| 25 | + ```bash |
| 26 | + go run golang/generate_hex_encoded_entity_secret.go |
| 27 | + ``` |
25 | 28 |
|
| 29 | + **Node.js** |
| 30 | + ```bash |
| 31 | + node nodejs/generate_hex_encoded_entity_secret.js |
| 32 | + ``` |
26 | 33 |
|
27 | 34 | 3. Acquire the entity public key: Use the provided API endpoint `GET /config/entity/publicKey` to obtain the entity public key securely. This public key is required for the encryption process. |
28 | 35 |
|
29 | 36 | 4. Replace the entity public key and hex-encoded entity secret in the sample code (`generate_entity_secret_ciphertext`), the sample code will encrypt and encode the entity secret in base64, and you will get the **entity secret ciphertext** accordingly. |
30 | 37 |
|
31 | | -Python |
32 | | -```bash |
33 | | -python python/generate_entity_secret_ciphertext.py |
34 | | -``` |
| 38 | + **Python** |
| 39 | + ```bash |
| 40 | + python python/generate_entity_secret_ciphertext.py |
| 41 | + ``` |
35 | 42 |
|
36 | | -Golang |
37 | | -```bash |
38 | | -go run golang/generate_entity_secret_ciphertext.go |
39 | | -``` |
| 43 | + **Golang** |
| 44 | + ```bash |
| 45 | + go run golang/generate_entity_secret_ciphertext.go |
| 46 | + ``` |
40 | 47 |
|
41 | | -Node.js |
42 | | -```bash |
43 | | -node nodejs/generate_entity_secret_ciphertext.js |
44 | | -``` |
| 48 | + **Node.js** |
| 49 | + ```bash |
| 50 | + node nodejs/generate_entity_secret_ciphertext.js |
| 51 | + ``` |
45 | 52 |
|
46 | 53 | 5. Register the **entity secret ciphertext** in the Configurator Page in the [developer dashboard](https://console.circle.com/wallets/dev/configurator) and click Register. The entity secret ciphertext only needs to be registered once, unless you need to rotate the entity secret. |
47 | 54 |
|
48 | | -6. Now you can append an **entity secret ciphertext** in the API request body for developer-controlled wallets. Note that the encryption and encoding of entity secret needs to be executed every time you append in an API request to prevent replay attack. There is no need to register an updated entity secret ciphertext; simply use the entity secret ciphertext as a variable in your API request and obtain the latest ciphertext generated by rerunning the sample code (`generate_entity_secret_ciphertext`). Here’s the sample API request for reference: |
| 55 | +6. Now you can append an **entity secret ciphertext** in the API request body for developer-controlled wallets. Note that the encryption and encoding of entity secret needs to be executed every time you append in an API request to prevent replay attack. |
| 56 | + |
| 57 | + There is no need to register an updated entity secret ciphertext; simply use the entity secret ciphertext as a variable in your API request and obtain the latest ciphertext generated by rerunning the sample code (`generate_entity_secret_ciphertext`). |
| 58 | + |
| 59 | + Here’s the sample API request for reference: |
49 | 60 |
|
50 | | -```bash |
51 | | -curl --location --request POST 'https://api.circle.com/v1/w3s/developer/walletSets' \ |
52 | | ---header 'Content-Type: application/json' \ |
53 | | ---header 'Authorization: Bearer [TEST_API_KEY]' \ |
54 | | ---data '{ \ |
55 | | - "idempotencyKey": "b1433df1-8676-4610-b8c9-ef8b5de3c79d", \ |
56 | | - "name": "Entity WalletSet A", \ |
57 | | - "entitySecretCiphertext": "[ENTITY_SECRET_CIPHERTEXT]" \ |
58 | | -}' |
59 | | -``` |
| 61 | + ```bash |
| 62 | + curl --location --request POST 'https://api.circle.com/v1/w3s/developer/walletSets' \ |
| 63 | + --header 'Content-Type: application/json' \ |
| 64 | + --header 'Authorization: Bearer [TEST_API_KEY]' \ |
| 65 | + --data '{ \ |
| 66 | + "idempotencyKey": "b1433df1-8676-4610-b8c9-ef8b5de3c79d", \ |
| 67 | + "name": "Entity WalletSet A", \ |
| 68 | + "entitySecretCiphertext": "[ENTITY_SECRET_CIPHERTEXT]" \ |
| 69 | + }' |
| 70 | + ``` |
60 | 71 |
|
61 | | -**Note**: Make sure to install related libraries for encryption before using the sample code. For Python sample code please first `pip install pycryptodome`. For Node.js sample code please first `npm install node-forge` |
| 72 | +**Note**: Make sure to install related libraries for encryption before using the sample code. For Python sample code, first run `pip install pycryptodome`. For Node.js sample code, first run `npm install node-forge` |
62 | 73 |
|
63 | 74 | **Note**: Please store the hex-encoded entity secret carefully by yourself, as it is required for critical API requests and Circle does not store the information. |
64 | 75 |
|
|
0 commit comments