@@ -261,7 +261,7 @@ func (h *Handler) EncryptSecrets(rawSecrets UpsertSecretsInputs) ([]*vault.Encry
261261
262262 encryptedSecrets := make ([]* vault.EncryptedSecret , 0 , len (rawSecrets ))
263263 for _ , item := range rawSecrets {
264- cipherHex , err := EncryptSecret (item .Value , pubKeyHex )
264+ cipherHex , err := EncryptSecret (item .Value , pubKeyHex , h . OwnerAddress )
265265 if err != nil {
266266 return nil , fmt .Errorf ("failed to encrypt secret (key=%s ns=%s): %w" , item .ID , item .Namespace , err )
267267 }
@@ -278,7 +278,7 @@ func (h *Handler) EncryptSecrets(rawSecrets UpsertSecretsInputs) ([]*vault.Encry
278278 return encryptedSecrets , nil
279279}
280280
281- func EncryptSecret (secret , masterPublicKeyHex string ) (string , error ) {
281+ func EncryptSecret (secret , masterPublicKeyHex string , ownerAddress string ) (string , error ) {
282282 masterPublicKey := tdh2easy.PublicKey {}
283283 masterPublicKeyBytes , err := hex .DecodeString (masterPublicKeyHex )
284284 if err != nil {
@@ -287,7 +287,11 @@ func EncryptSecret(secret, masterPublicKeyHex string) (string, error) {
287287 if err = masterPublicKey .Unmarshal (masterPublicKeyBytes ); err != nil {
288288 return "" , fmt .Errorf ("failed to unmarshal master public key: %w" , err )
289289 }
290- cipher , err := tdh2easy .Encrypt (& masterPublicKey , []byte (secret ))
290+
291+ addr := common .HexToAddress (ownerAddress ) // canonical 20-byte address
292+ var label [32 ]byte
293+ copy (label [12 :], addr .Bytes ()) // left-pad with 12 zero bytes
294+ cipher , err := tdh2easy .EncryptWithLabel (& masterPublicKey , []byte (secret ), label )
291295 if err != nil {
292296 return "" , fmt .Errorf ("failed to encrypt secret: %w" , err )
293297 }
0 commit comments