Merge branch 'release/v1.1.20'

Reduce SHUTDOWN_TIMEOUT to 3 sec

CHANGELOG.md

@@ -4,6 +4,36 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [v1.1.20] (2023-06-06)
+
+- Explorer - Fix SP supported apps list ([#3458])
+- Investigate if we need to lower `SHUTDOWN_TIMEOUT` in  socks5 to zero (or almost zero) ([#3438])
+- Explorer - show all gateways in the default view regardless of the version number ([#3427])
+- service-provider-directory: add signature check when announcing ([#3360])
+- Support functionality for nym-name-service (nym-api, nym-cli, etc) ([#3355])
+- Edit the nym-network-requester to support the enabled-credentials-mode flag ([#3101])
+- [BUG] network requester documentation update ([#3493])
+- removing hardcoded version numbers ([#3485])
+- [BUG] network requester documentation update ([#3481])
+- [BUG] network requester documentation update ([#3469])
+- Sign when announcing service providers to the directory contract ([#3459])
+- mixnode documentation update ([#3435])
+- updated readme with new developer chat links + new docs links ([#3141])
+
+[#3458]: https://github.com/nymtech/nym/issues/3458
+[#3438]: https://github.com/nymtech/nym/issues/3438
+[#3427]: https://github.com/nymtech/nym/issues/3427
+[#3360]: https://github.com/nymtech/nym/issues/3360
+[#3355]: https://github.com/nymtech/nym/issues/3355
+[#3101]: https://github.com/nymtech/nym/issues/3101
+[#3493]: https://github.com/nymtech/nym/pull/3493
+[#3485]: https://github.com/nymtech/nym/pull/3485
+[#3481]: https://github.com/nymtech/nym/pull/3481
+[#3469]: https://github.com/nymtech/nym/pull/3469
+[#3459]: https://github.com/nymtech/nym/pull/3459
+[#3435]: https://github.com/nymtech/nym/pull/3435
+[#3141]: https://github.com/nymtech/nym/pull/3141
+
 ## [v1.1.19] (2023-05-16)
 
 - nym-name-service endpoint in nym-api ([#3403])

Cargo.toml

@@ -112,19 +112,22 @@ license = "Apache-2.0"
 
 [workspace.dependencies]
 async-trait = "0.1.64"
+anyhow = "1.0.71"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 cfg-if = "1.0.0"
 cosmwasm-derive = "=1.0.0"
 cosmwasm-schema = "=1.0.0"
 cosmwasm-std = "=1.0.0"
 cosmwasm-storage = "=1.0.0"
-cw-utils = "=0.13.4"
+cw-controllers = "=0.13.4"
 cw-storage-plus = "=0.13.4"
+cw-utils = "=0.13.4"
 cw2 = { version = "=0.13.4" }
 cw3 = { version = "=0.13.4" }
 cw3-fixed-multisig = { version = "=0.13.4" }
 cw4 = { version = "=0.13.4" }
 dotenvy = "0.15.6"
+generic-array = "0.14.7"
 lazy_static = "1.4.0"
 log = "0.4"
 once_cell = "1.7.2"
@@ -135,3 +138,4 @@ tap = "1.0.1"
 thiserror = "1.0.38"
 tokio = "1.24.1"
 url = "2.2"
+zeroize = "1.6.0"

README.md

@@ -21,8 +21,8 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 
 ### Building
 
-Platform build instructions are available on [our docs site](https://nymtech.net/docs/binaries/building-nym.html).
-Wallet build instructions are also available on [our docs site](https://nymtech.net/docs/stable/nym-apps/wallet#for-developers).
+Platform build instructions are available on [our docs site](https://nymtech.net/docs/binaries/build-nym.html).
+Wallet build instructions are also available on [our docs site](https://nymtech.net/docs/wallet/desktop-wallet.html).
 
 ### Developing
 
@@ -32,7 +32,11 @@ For Typescript components, please see [ts-packages](./ts-packages).
 
 ### Developer chat
 
-You can chat to us in [Keybase](https://keybase.io). Download their chat app, then click **Teams -> Join a team**. Type **nymtech.friends** into the team name and hit **continue**. For general chat, hang out in the **#general** channel. Our development takes places in the **#dev** channel. Node operators should be in the **#node-operators** channel.
+> We used to use Keybase for developer chats, but we have since migrated to Matrix and Discord. We no longer check the old **nymtech.friends** Keybase team. 
+
+You can chat to us in two places: 
+* The #dev channel on [Matrix](https://matrix.to/#/#dev:nymtech.chat)
+* The various developer channels on [Discord](https://discord.gg/nym)
 
 ### Rewards
 

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.19"
+version = "1.1.20"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/client/mod.rs

@@ -7,84 +7,53 @@ use crate::websocket;
 use futures::channel::mpsc;
 use log::*;
 use nym_bandwidth_controller::BandwidthController;
+use nym_client_core::client::base_client::non_wasm_helpers::create_bandwidth_controller;
+use nym_client_core::client::base_client::storage::OnDiskPersistent;
 use nym_client_core::client::base_client::{
     non_wasm_helpers, BaseClientBuilder, ClientInput, ClientOutput, ClientState,
 };
 use nym_client_core::client::inbound_messages::InputMessage;
+use nym_client_core::client::key_manager::persistence::OnDiskKeys;
 use nym_client_core::client::received_buffer::{
     ReceivedBufferMessage, ReceivedBufferRequestSender, ReconstructedMessagesReceiver,
 };
 use nym_client_core::config::persistence::key_pathfinder::ClientKeyPathfinder;
+use nym_credential_storage::persistent_storage::PersistentStorage;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_task::connections::TransmissionLane;
 use nym_task::TaskManager;
 use nym_validator_client::nyxd::QueryNyxdClient;
+use nym_validator_client::Client;
 use std::error::Error;
 use tokio::sync::watch::error::SendError;
 
-pub use nym_client_core::client::key_manager::KeyManager;
-use nym_credential_storage::persistent_storage::PersistentStorage;
 pub use nym_sphinx::addressing::clients::Recipient;
 pub use nym_sphinx::receiver::ReconstructedMessage;
-use nym_validator_client::Client;
 
 pub mod config;
 
+type NativeClientBuilder<'a> = BaseClientBuilder<'a, Client<QueryNyxdClient>, OnDiskPersistent>;
+
 pub struct SocketClient {
     /// Client configuration options, including, among other things, packet sending rates,
     /// key filepaths, etc.
     config: Config,
-
-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
 }
 
 impl SocketClient {
     pub fn new(config: Config) -> Self {
-        let pathfinder = ClientKeyPathfinder::new_from_config(config.get_base());
-        let key_manager = KeyManager::load_keys(&pathfinder).expect("failed to load stored keys");
-
-        SocketClient {
-            config,
-            key_manager,
-        }
-    }
-
-    pub fn new_with_keys(config: Config, key_manager: KeyManager) -> Self {
-        SocketClient {
-            config,
-            key_manager,
-        }
+        SocketClient { config }
     }
 
     async fn create_bandwidth_controller(
         config: &Config,
     ) -> BandwidthController<Client<QueryNyxdClient>, PersistentStorage> {
-        let details = nym_network_defaults::NymNetworkDetails::new_from_env();
-        let mut client_config =
-            nym_validator_client::Config::try_from_nym_network_details(&details)
-                .expect("failed to construct validator client config");
-        let nyxd_url = config
-            .get_base()
-            .get_validator_endpoints()
-            .pop()
-            .expect("No nyxd validator endpoint provided");
-        let api_url = config
-            .get_base()
-            .get_nym_api_endpoints()
-            .pop()
-            .expect("No validator api endpoint provided");
-        // overwrite env configuration with config URLs
-        client_config = client_config.with_urls(nyxd_url, api_url);
-        let client = nym_validator_client::Client::new_query(client_config)
-            .expect("Could not construct query client");
-        BandwidthController::new(
-            nym_credential_storage::initialise_persistent_storage(
-                config.get_base().get_database_path(),
-            )
-            .await,
-            client,
+        let storage = nym_credential_storage::initialise_persistent_storage(
+            config.get_base().get_database_path(),
         )
+        .await;
+
+        create_bandwidth_controller(config.get_base(), storage)
     }
 
     fn start_websocket_listener(
@@ -134,11 +103,13 @@ impl SocketClient {
         res
     }
 
-    pub async fn start_socket(self) -> Result<TaskManager, ClientError> {
-        if !self.config.get_socket_type().is_websocket() {
-            return Err(ClientError::InvalidSocketMode);
-        }
+    fn key_store(&self) -> OnDiskKeys {
+        let pathfinder = ClientKeyPathfinder::new_from_config(self.config.get_base());
+        OnDiskKeys::new(pathfinder)
+    }
 
+    // TODO: see if this could also be shared with socks5 client / nym-sdk maybe
+    async fn create_base_client_builder(&self) -> Result<NativeClientBuilder, ClientError> {
         // don't create bandwidth controller if credentials are disabled
         let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
             None
@@ -146,19 +117,28 @@ impl SocketClient {
             Some(Self::create_bandwidth_controller(&self.config).await)
         };
 
-        let base_builder = BaseClientBuilder::new_from_base_config(
+        let base_client = BaseClientBuilder::new_from_base_config(
             self.config.get_base(),
-            self.key_manager,
+            self.key_store(),
             bandwidth_controller,
             non_wasm_helpers::setup_fs_reply_surb_backend(
-                Some(self.config.get_base().get_reply_surb_database_path()),
-                self.config.get_debug_settings(),
+                self.config.get_base().get_reply_surb_database_path(),
+                &self.config.get_debug_settings().reply_surbs,
             )
             .await?,
         );
 
-        let self_address = base_builder.as_mix_recipient();
+        Ok(base_client)
+    }
+
+    pub async fn start_socket(self) -> Result<TaskManager, ClientError> {
+        if !self.config.get_socket_type().is_websocket() {
+            return Err(ClientError::InvalidSocketMode);
+        }
+
+        let base_builder = self.create_base_client_builder().await?;
         let mut started_client = base_builder.start_base().await?;
+        let self_address = started_client.address;
         let client_input = started_client.client_input.register_producer();
         let client_output = started_client.client_output.register_consumer();
         let client_state = started_client.client_state;
@@ -173,7 +153,7 @@ impl SocketClient {
         );
 
         info!("Client startup finished!");
-        info!("The address of this client is: {}", self_address);
+        info!("The address of this client is: {self_address}");
 
         Ok(started_client.task_manager)
     }
@@ -183,27 +163,9 @@ impl SocketClient {
             return Err(ClientError::InvalidSocketMode);
         }
 
-        // don't create bandwidth controller if credentials are disabled
-        let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
-            None
-        } else {
-            Some(Self::create_bandwidth_controller(&self.config).await)
-        };
-
-        let base_client = BaseClientBuilder::new_from_base_config(
-            self.config.get_base(),
-            self.key_manager,
-            bandwidth_controller,
-            non_wasm_helpers::setup_fs_reply_surb_backend(
-                Some(self.config.get_base().get_reply_surb_database_path()),
-                self.config.get_debug_settings(),
-            )
-            .await?,
-        );
-
-        let address = base_client.as_mix_recipient();
-
-        let mut started_client = base_client.start_base().await?;
+        let base_builder = self.create_base_client_builder().await?;
+        let mut started_client = base_builder.start_base().await?;
+        let address = started_client.address;
         let client_input = started_client.client_input.register_producer();
         let client_output = started_client.client_output.register_consumer();
 

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.19"
+version = "1.1.20"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

clients/webassembly/Cargo.toml

@@ -17,6 +17,7 @@ default = ["console_error_panic_hook"]
 offline-test = []
 
 [dependencies]
+async-trait = "0.1.68"
 bs58 = "0.4.0"
 futures = "0.3"
 js-sys = "0.3"
@@ -24,12 +25,13 @@ rand = { version = "0.7.3", features = ["wasm-bindgen"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 anyhow = "1.0"
-serde-wasm-bindgen = "0.4"
+serde-wasm-bindgen = "0.5"
 tokio = { version = "1.24.1", features = ["sync"] }
 url = "2.2"
 wasm-bindgen = { version = "=0.2.83", features = ["serde-serialize"]  }
 wasm-bindgen-futures = "0.4"
 thiserror = "1.0.40"
+zeroize = "1.6.0"
 
 wasm-timer = { git = "https://github.com/mmsinclair/wasm-timer", rev = "b9d1a54ad514c2f230a026afe0dde341e98cd7b6"}
 
@@ -40,13 +42,14 @@ nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-credentials = { path = "../../common/credentials" }
 nym-credential-storage = { path = "../../common/credential-storage" }
-nym-crypto = { path = "../../common/crypto" }
+nym-crypto = { path = "../../common/crypto", features = ["asymmetric", "serde"] }
 nym-sphinx = { path = "../../common/nymsphinx" }
+nym-sphinx-acknowledgements = { path = "../../common/nymsphinx/acknowledgements", features = ["serde"]}
 nym-topology = { path = "../../common/topology" }
 nym-gateway-client = { path = "../../common/client-libs/gateway-client", default-features = false, features = ["wasm"] }
 nym-validator-client = { path = "../../common/client-libs/validator-client", default-features = false }
-wasm-utils = { path = "../../common/wasm-utils" }
 nym-task = { path = "../../common/task" }
+wasm-utils = { path = "../../common/wasm-utils", features = ["storage"], default-features = false }
 # The `console_error_panic_hook` crate provides better debugging of panics by
 # logging them with `console.error`. This is great for development, but requires
 # all the `std::fmt` and `std::panicking` infrastructure, so isn't great for

clients/webassembly/internal-dev/worker.js

@@ -28,7 +28,10 @@ const {
     set_panic_hook,
     Config,
     GatewayEndpointConfig,
+    ClientStorage,
     current_network_topology,
+    make_key,
+    make_key2
 } = wasm_bindgen;
 
 let client = null;
@@ -270,6 +273,57 @@ async function normalNymClientUsage() {
             }
         }
     };
+}
+
+async function messWithStorage() {
+    self.onmessage = async event => {
+        if (event.data && event.data.kind) {
+            switch (event.data.kind) {
+                case 'TestPacket': {
+                    const { mixnodeIdentity } = event.data.args;
+                    console.log("button clicked...", mixnodeIdentity);
+
+                    let id1 = "one";
+                    let id2 = "two";
+
+                    console.log("making store1 NO-ENC");
+                    let _storage1 = await ClientStorage.new_unencrypted(id1);
+
+                    console.log("making store2 ENC")
+                    let _storage2 = await new ClientStorage(id2, "my-secret-password");
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store1 WITH PASSWORD")
+                    //     let _storage1_alt = await new ClientStorage(id1, "password");
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store2 WITHOUT PASSWORD")
+                    //     let _storage2_alt = await ClientStorage.new_unencrypted(id2);
+                    //
+                    //
+                    //
+                    //     console.log("attempting to use store2 with WRONG PASSWORD")
+                    //     let _storage2_bad = await new ClientStorage(id2, "bad-password")
+
+
+                    //
+                    // console.log("read1: ", await storage1.read());
+                    // console.log("read2: ", await storage2.read());
+                    //
+                    // console.log("store1: ", await storage1.store("FOOMP"));
+                    //
+                    // console.log("read1: ", await storage1.read());
+                    // console.log("read2: ", await storage2.read());
+                }
+            }
+        }
+    };
+
+
+
+
 }
 
 async function main() {
@@ -281,13 +335,13 @@ async function main() {
     set_panic_hook();
 
     // run test on simplified and dedicated tester:
-    await testWithTester()
+    // await testWithTester()
 
     // hook-up the whole client for testing
     // await testWithNymClient()
 
     // 'Normal' client setup (to send 'normal' messages)
-    // await normalNymClientUsage()
+    await normalNymClientUsage()
 }
 
 // Let's get started!

clients/webassembly/src/client/mod.rs

@@ -4,10 +4,11 @@
 use self::config::Config;
 use crate::client::helpers::{InputSender, NymClientTestRequest, WasmTopologyExt};
 use crate::client::response_pusher::ResponsePusher;
+use crate::constants::NODE_TESTER_CLIENT_ID;
 use crate::error::WasmClientError;
-use crate::helpers::{
-    parse_recipient, parse_sender_tag, setup_new_key_manager, setup_reply_surb_storage_backend,
-};
+use crate::helpers::{parse_recipient, parse_sender_tag, setup_reply_surb_storage_backend};
+use crate::storage::traits::FullWasmClientStorage;
+use crate::storage::ClientStorage;
 use crate::topology::WasmNymTopology;
 use js_sys::Promise;
 use nym_bandwidth_controller::wasm_mockups::{Client as FakeClient, DirectSigningNyxdClient};
@@ -15,8 +16,8 @@ use nym_bandwidth_controller::BandwidthController;
 use nym_client_core::client::base_client::{
     BaseClientBuilder, ClientInput, ClientOutput, ClientState, CredentialsToggle,
 };
+use nym_client_core::client::inbound_messages::InputMessage;
 use nym_client_core::client::replies::reply_storage::browser_backend;
-use nym_client_core::client::{inbound_messages::InputMessage, key_manager::KeyManager};
 use nym_client_core::config::{
     CoverTraffic, DebugConfig, GatewayEndpointConfig, Topology, Traffic,
 };
@@ -56,9 +57,7 @@ pub struct NymClientBuilder {
     config: Config,
     custom_topology: Option<NymTopology>,
 
-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
-
+    storage_passphrase: Option<String>,
     reply_surb_storage_backend: browser_backend::Backend,
 
     on_message: js_sys::Function,
@@ -72,13 +71,16 @@ pub struct NymClientBuilder {
 #[wasm_bindgen]
 impl NymClientBuilder {
     #[wasm_bindgen(constructor)]
-    pub fn new(config: Config, on_message: js_sys::Function) -> Self {
-        //, key_manager: Option<KeyManager>) {
+    pub fn new(
+        config: Config,
+        on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
+    ) -> Self {
         NymClientBuilder {
             reply_surb_storage_backend: setup_reply_surb_storage_backend(config.debug.reply_surbs),
             config,
             custom_topology: None,
-            key_manager: setup_new_key_manager(),
+            storage_passphrase,
             on_message,
             bandwidth_controller: None,
             disabled_credentials: true,
@@ -99,7 +101,7 @@ impl NymClientBuilder {
         }
 
         let full_config = Config {
-            id: "ephemeral-id".to_string(),
+            id: NODE_TESTER_CLIENT_ID.to_string(),
             nym_api_url: None,
             disabled_credentials_mode: true,
             gateway_endpoint: gateway_config,
@@ -126,12 +128,10 @@ impl NymClientBuilder {
             ),
             config: full_config,
             custom_topology: Some(topology.into()),
-            // TODO: once we make keys persistent, we'll require some kind of `init` method to generate
-            // a prior shared keypair between the client and the gateway
-            key_manager: setup_new_key_manager(),
             on_message,
             bandwidth_controller: None,
             disabled_credentials: true,
+            storage_passphrase: None,
         }
     }
 
@@ -162,10 +162,15 @@ impl NymClientBuilder {
             Some(endpoint) => vec![endpoint],
             None => Vec::new(),
         };
-        let mut base_builder = BaseClientBuilder::new(
+
+        // TODO: this will have to be re-used for surbs. but this is a problem for another PR.
+        let key_store =
+            ClientStorage::new_async(&self.config.id, self.storage_passphrase.take()).await?;
+
+        let mut base_builder: BaseClientBuilder<_, FullWasmClientStorage> = BaseClientBuilder::new(
             &self.config.gateway_endpoint,
             &self.config.debug,
-            self.key_manager,
+            key_store,
             self.bandwidth_controller,
             self.reply_surb_storage_backend,
             disabled_credentials,
@@ -175,8 +180,8 @@ impl NymClientBuilder {
             base_builder = base_builder.with_topology_provider(topology_provider);
         }
 
-        let self_address = base_builder.as_mix_recipient().to_string();
         let mut started_client = base_builder.start_base().await?;
+        let self_address = started_client.address.to_string();
 
         let client_input = started_client.client_input.register_producer();
         let client_output = started_client.client_output.register_consumer();
@@ -202,16 +207,25 @@ impl NymClient {
     async fn _new(
         config: Config,
         on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
     ) -> Result<NymClient, WasmClientError> {
-        NymClientBuilder::new(config, on_message)
+        NymClientBuilder::new(config, on_message, storage_passphrase)
             .start_client_async()
             .await
     }
 
     #[wasm_bindgen(constructor)]
     #[allow(clippy::new_ret_no_self)]
-    pub fn new(config: Config, on_message: js_sys::Function) -> Promise {
-        future_to_promise(async move { Self::_new(config, on_message).await.into_promise_result() })
+    pub fn new(
+        config: Config,
+        on_message: js_sys::Function,
+        storage_passphrase: Option<String>,
+    ) -> Promise {
+        future_to_promise(async move {
+            Self::_new(config, on_message, storage_passphrase)
+                .await
+                .into_promise_result()
+        })
     }
 
     pub fn self_address(&self) -> String {

clients/webassembly/src/constants.rs

@@ -0,0 +1,5 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub(crate) const NODE_TESTER_ID: &str = "_nym-node-tester";
+pub(crate) const NODE_TESTER_CLIENT_ID: &str = "_nym-node-tester-client";

clients/webassembly/src/error.rs

@@ -1,6 +1,7 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::storage::errors::ClientStorageError;
 use crate::topology::WasmTopologyError;
 use js_sys::Promise;
 use nym_client_core::error::ClientCoreError;
@@ -78,6 +79,12 @@ pub enum WasmClientError {
         raw: String,
         source: InvalidAnonymousSenderTagRepresentation,
     },
+
+    #[error(transparent)]
+    StorageError {
+        #[from]
+        source: ClientStorageError,
+    },
 }
 
 impl WasmClientError {

clients/webassembly/src/helpers.rs

@@ -4,24 +4,16 @@
 use crate::error::WasmClientError;
 use crate::topology::WasmNymTopology;
 use js_sys::Promise;
-use nym_client_core::client::key_manager::KeyManager;
 use nym_client_core::client::replies::reply_storage::browser_backend;
 use nym_client_core::config;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_topology::NymTopology;
 use nym_validator_client::NymApiClient;
-use rand::rngs::OsRng;
 use url::Url;
 use wasm_bindgen::prelude::wasm_bindgen;
 use wasm_bindgen_futures::future_to_promise;
-use wasm_utils::{console_log, PromisableResult};
-
-pub(crate) fn setup_new_key_manager() -> KeyManager {
-    let mut rng = OsRng;
-    console_log!("generated new set of keys");
-    KeyManager::new(&mut rng)
-}
+use wasm_utils::PromisableResult;
 
 // don't get too excited about the name, under the hood it's just a big fat placeholder
 // with no persistence

clients/webassembly/src/lib.rs

@@ -1,4 +1,4 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use wasm_bindgen::prelude::*;
@@ -7,10 +7,13 @@ use wasm_bindgen::prelude::*;
 mod client;
 #[cfg(target_arch = "wasm32")]
 pub mod encoded_payload_helper;
+#[cfg(target_arch = "wasm32")]
 pub mod error;
 #[cfg(target_arch = "wasm32")]
 pub mod gateway_selector;
 #[cfg(target_arch = "wasm32")]
+pub mod storage;
+#[cfg(target_arch = "wasm32")]
 pub mod tester;
 #[cfg(target_arch = "wasm32")]
 pub mod topology;
@@ -20,6 +23,8 @@ pub mod validation;
 #[cfg(target_arch = "wasm32")]
 mod helpers;
 
+mod constants;
+
 #[wasm_bindgen]
 pub fn set_panic_hook() {
     // When the `console_error_panic_hook` feature is enabled, we can call the

clients/webassembly/src/storage/errors.rs

@@ -0,0 +1,25 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use thiserror::Error;
+use wasm_bindgen::JsValue;
+use wasm_utils::simple_js_error;
+use wasm_utils::storage::error::StorageError;
+
+#[derive(Debug, Error)]
+pub enum ClientStorageError {
+    #[error("failed to use the storage: {source}")]
+    StorageError {
+        #[from]
+        source: StorageError,
+    },
+
+    #[error("{typ} cryptographic key is not available in storage")]
+    CryptoKeyNotInStorage { typ: String },
+}
+
+impl From<ClientStorageError> for JsValue {
+    fn from(value: ClientStorageError) -> Self {
+        simple_js_error(value.to_string())
+    }
+}

clients/webassembly/src/storage/mod.rs

@@ -0,0 +1,231 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::storage::errors::ClientStorageError;
+use js_sys::Promise;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_client::SharedKeys;
+use nym_sphinx::acknowledgements::AckKey;
+use std::sync::Arc;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen_futures::future_to_promise;
+use wasm_utils::storage::{IdbVersionChangeEvent, WasmStorage};
+use wasm_utils::PromisableResult;
+use zeroize::Zeroizing;
+
+pub(crate) mod errors;
+pub(crate) mod traits;
+
+const STORAGE_NAME_PREFIX: &str = "wasm-client-storage";
+const STORAGE_VERSION: u32 = 1;
+
+// v1 tables
+mod v1 {
+    // stores
+    pub const KEYS_STORE: &str = "keys";
+
+    // keys
+    pub const ED25519_IDENTITY_KEYPAIR: &str = "ed25519_identity_keypair";
+    pub const X25519_ENCRYPTION_KEYPAIR: &str = "x25519_encryption_key";
+
+    // TODO: for those we could actually use the subtle crypto storage
+    pub const AES128CTR_ACK_KEY: &str = "aes128ctr_ack_key";
+    pub const AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS: &str = "aes128ctr_blake3_hmac_gateway_keys";
+}
+
+#[wasm_bindgen]
+pub struct ClientStorage {
+    #[allow(dead_code)]
+    pub(crate) name: String,
+    pub(crate) inner: Arc<WasmStorage>,
+}
+
+#[wasm_bindgen]
+impl ClientStorage {
+    fn db_name(client_id: &str) -> String {
+        format!("{STORAGE_NAME_PREFIX}-{client_id}")
+    }
+
+    pub(crate) async fn new_async(
+        client_id: &str,
+        passphrase: Option<String>,
+    ) -> Result<Self, ClientStorageError> {
+        let name = Self::db_name(client_id);
+
+        // make sure the password is zeroized when no longer used, especially if we error out.
+        // special care must be taken on JS side to ensure it's correctly used there.
+        let passphrase = Zeroizing::new(passphrase);
+
+        let migrate_fn = Some(|evt: &IdbVersionChangeEvent| -> Result<(), JsValue> {
+            // Even if the web-sys bindings expose the version as a f64, the IndexedDB API
+            // works with an unsigned integer.
+            // See <https://github.com/rustwasm/wasm-bindgen/issues/1149>
+            let old_version = evt.old_version() as u32;
+
+            if old_version < 1 {
+                // migrating to version 1
+                let db = evt.db();
+
+                db.create_object_store(v1::KEYS_STORE)?;
+            }
+
+            Ok(())
+        });
+
+        let inner = WasmStorage::new(
+            &name,
+            STORAGE_VERSION,
+            migrate_fn,
+            passphrase.as_ref().map(|p| p.as_bytes()),
+        )
+        .await?;
+
+        Ok(ClientStorage {
+            inner: Arc::new(inner),
+            name,
+        })
+    }
+
+    #[wasm_bindgen(constructor)]
+    #[allow(clippy::new_ret_no_self)]
+    pub fn new(client_id: String, passphrase: String) -> Promise {
+        future_to_promise(async move {
+            Self::new_async(&client_id, Some(passphrase))
+                .await
+                .into_promise_result()
+        })
+    }
+
+    pub fn new_unencrypted(client_id: String) -> Promise {
+        future_to_promise(async move {
+            Self::new_async(&client_id, None)
+                .await
+                .into_promise_result()
+        })
+    }
+
+    async fn may_read_identity_keypair(
+        &self,
+    ) -> Result<Option<identity::KeyPair>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::ED25519_IDENTITY_KEYPAIR),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_encryption_keypair(
+        &self,
+    ) -> Result<Option<encryption::KeyPair>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::X25519_ENCRYPTION_KEYPAIR),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_ack_key(&self) -> Result<Option<AckKey>, ClientStorageError> {
+        self.inner
+            .read_value(v1::KEYS_STORE, JsValue::from_str(v1::AES128CTR_ACK_KEY))
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn may_read_gateway_shared_key(&self) -> Result<Option<SharedKeys>, ClientStorageError> {
+        self.inner
+            .read_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS),
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn must_read_identity_keypair(&self) -> Result<identity::KeyPair, ClientStorageError> {
+        self.may_read_identity_keypair()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::ED25519_IDENTITY_KEYPAIR.to_string(),
+            })
+    }
+
+    async fn must_read_encryption_keypair(
+        &self,
+    ) -> Result<encryption::KeyPair, ClientStorageError> {
+        self.may_read_encryption_keypair()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::X25519_ENCRYPTION_KEYPAIR.to_string(),
+            })
+    }
+
+    async fn must_read_ack_key(&self) -> Result<AckKey, ClientStorageError> {
+        self.may_read_ack_key()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::AES128CTR_ACK_KEY.to_string(),
+            })
+    }
+
+    async fn must_read_gateway_shared_key(&self) -> Result<SharedKeys, ClientStorageError> {
+        self.may_read_gateway_shared_key()
+            .await?
+            .ok_or(ClientStorageError::CryptoKeyNotInStorage {
+                typ: v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS.to_string(),
+            })
+    }
+
+    async fn store_identity_keypair(
+        &self,
+        keypair: &identity::KeyPair,
+    ) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::ED25519_IDENTITY_KEYPAIR),
+                keypair,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_encryption_keypair(
+        &self,
+        keypair: &encryption::KeyPair,
+    ) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::X25519_ENCRYPTION_KEYPAIR),
+                keypair,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_ack_key(&self, key: &AckKey) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_ACK_KEY),
+                key,
+            )
+            .await
+            .map_err(Into::into)
+    }
+
+    async fn store_gateway_shared_key(&self, key: &SharedKeys) -> Result<(), ClientStorageError> {
+        self.inner
+            .store_value(
+                v1::KEYS_STORE,
+                JsValue::from_str(v1::AES128CTR_BLAKE3_HMAC_GATEWAY_KEYS),
+                key,
+            )
+            .await
+            .map_err(Into::into)
+    }
+}

clients/webassembly/src/storage/traits.rs

@@ -0,0 +1,76 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::storage::errors::ClientStorageError;
+use crate::storage::ClientStorage;
+use async_trait::async_trait;
+use nym_client_core::client::base_client::storage::MixnetClientStorage;
+use nym_client_core::client::key_manager::persistence::KeyStore;
+use nym_client_core::client::key_manager::KeyManager;
+use nym_client_core::client::replies::reply_storage::browser_backend;
+use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
+use wasm_utils::console_log;
+
+// temporary until other variants are properly implemented (probably it should get changed into `ClientStorage`
+// implementing all traits and everything getting combined
+pub struct FullWasmClientStorage {
+    key_store: ClientStorage,
+    reply_storage: browser_backend::Backend,
+    credential_storage: EphemeralCredentialStorage,
+}
+
+impl MixnetClientStorage for FullWasmClientStorage {
+    type KeyStore = ClientStorage;
+    type ReplyStore = browser_backend::Backend;
+    type CredentialStore = EphemeralCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_storage, self.credential_storage)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_storage
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_storage
+    }
+}
+
+#[async_trait(?Send)]
+impl KeyStore for ClientStorage {
+    type StorageError = ClientStorageError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        console_log!("attempting to load cryptographic keys...");
+
+        // all keys implement `ZeroizeOnDrop`, so if we return an Error, whatever was already loaded will be cleared
+        let identity_keypair = self.must_read_identity_keypair().await?;
+        let encryption_keypair = self.must_read_encryption_keypair().await?;
+        let ack_keypair = self.must_read_ack_key().await?;
+        let gateway_shared_key = self.must_read_gateway_shared_key().await?;
+
+        Ok(KeyManager::from_keys(
+            identity_keypair,
+            encryption_keypair,
+            gateway_shared_key,
+            ack_keypair,
+        ))
+    }
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError> {
+        console_log!("attempting to store cryptographic keys...");
+
+        self.store_identity_keypair(&keys.identity_keypair())
+            .await?;
+        self.store_encryption_keypair(&keys.encryption_keypair())
+            .await?;
+        self.store_ack_key(&keys.ack_key()).await?;
+        self.store_gateway_shared_key(&keys.gateway_shared_key())
+            .await
+    }
+}

clients/webassembly/src/tester/mod.rs

@@ -1,8 +1,10 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::constants::NODE_TESTER_ID;
 use crate::error::WasmClientError;
-use crate::helpers::{current_network_topology_async, setup_new_key_manager};
+use crate::helpers::current_network_topology_async;
+use crate::storage::ClientStorage;
 use crate::tester::ephemeral_receiver::EphemeralTestReceiver;
 use crate::tester::helpers::{
     NodeTestResult, ReceivedReceiverWrapper, TestMarker, WasmTestMessageExt,
@@ -12,7 +14,7 @@ use futures::channel::mpsc;
 use js_sys::Promise;
 use nym_bandwidth_controller::wasm_mockups::{Client as FakeClient, DirectSigningNyxdClient};
 use nym_bandwidth_controller::BandwidthController;
-use nym_client_core::client::key_manager::KeyManager;
+use nym_client_core::client::key_manager::ManagedKeys;
 use nym_client_core::config::GatewayEndpointConfig;
 use nym_credential_storage::ephemeral_storage::EphemeralStorage;
 use nym_crypto::asymmetric::identity;
@@ -33,7 +35,7 @@ use std::time::Duration;
 use tokio::sync::Mutex as AsyncMutex;
 use wasm_bindgen::prelude::*;
 use wasm_bindgen_futures::future_to_promise;
-use wasm_utils::{check_promise_result, console_log, console_warn, PromisableResult};
+use wasm_utils::{check_promise_result, console_log, PromisableResult};
 
 mod ephemeral_receiver;
 pub(crate) mod helpers;
@@ -74,18 +76,15 @@ pub struct NymNodeTesterBuilder {
 
     base_topology: NymTopology,
 
-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
-
     // unimplemented
     bandwidth_controller:
         Option<BandwidthController<FakeClient<DirectSigningNyxdClient>, EphemeralStorage>>,
 }
 
-fn address(keys: &KeyManager, gateway_identity: NodeIdentity) -> Recipient {
+fn address(keys: &ManagedKeys, gateway_identity: NodeIdentity) -> Recipient {
     Recipient::new(
-        *keys.identity_keypair().public_key(),
-        *keys.encryption_keypair().public_key(),
+        *keys.identity_public_key(),
+        *keys.encryption_public_key(),
         gateway_identity,
     )
 }
@@ -100,7 +99,6 @@ impl NymNodeTesterBuilder {
         NymNodeTesterBuilder {
             gateway_config,
             base_topology: base_topology.into(),
-            key_manager: setup_new_key_manager(),
             bandwidth_controller: None,
         }
     }
@@ -122,29 +120,24 @@ impl NymNodeTesterBuilder {
     }
 
     async fn _setup_client(mut self) -> Result<NymNodeTester, WasmClientError> {
-        let rng = OsRng;
+        let mut rng = OsRng;
         let task_manager = TaskManager::default();
 
         let gateway_identity =
             identity::PublicKey::from_base58_string(self.gateway_config.gateway_id)
                 .map_err(|source| WasmClientError::InvalidGatewayIdentity { source })?;
 
-        // we **REALLY** need persistence...
-        let shared_key = if self.key_manager.is_gateway_key_set() {
-            Some(self.key_manager.gateway_shared_key())
-        } else {
-            console_warn!("Gateway key not set - will derive a fresh one.");
-            None
-        };
+        let key_store = ClientStorage::new_async(NODE_TESTER_ID, None).await?;
+        let mut managed_keys = ManagedKeys::load_or_generate(&mut rng, &key_store).await;
 
         let (mixnet_message_sender, mixnet_message_receiver) = mpsc::unbounded();
         let (ack_sender, ack_receiver) = mpsc::unbounded();
 
         let mut gateway_client = GatewayClient::new(
             self.gateway_config.gateway_listener,
-            self.key_manager.identity_keypair(),
+            managed_keys.identity_keypair(),
             gateway_identity,
-            shared_key,
+            managed_keys.gateway_shared_key(),
             mixnet_message_sender,
             ack_sender,
             Duration::from_secs(10),
@@ -154,26 +147,26 @@ impl NymNodeTesterBuilder {
 
         gateway_client.set_disabled_credentials_mode(true);
         let shared_keys = gateway_client.authenticate_and_start().await?;
-
-        // currently pointless but might as well do it for the future ¯\_(ツ)_/¯
-        self.key_manager.insert_gateway_shared_key(shared_keys);
+        managed_keys
+            .deal_with_gateway_key(shared_keys, &key_store)
+            .await?;
 
         // TODO: make those values configurable later
         let tester = NodeTester::new(
             rng,
             self.base_topology,
-            Some(address(&self.key_manager, gateway_identity)),
+            Some(address(&managed_keys, gateway_identity)),
             PacketSize::default(),
             Duration::from_millis(5),
             Duration::from_millis(5),
-            self.key_manager.ack_key(),
+            managed_keys.ack_key(),
         );
 
         let (processed_sender, processed_receiver) = mpsc::unbounded();
 
         let mut receiver = SimpleMessageReceiver::new_sphinx_receiver(
-            self.key_manager.encryption_keypair(),
-            self.key_manager.ack_key(),
+            managed_keys.encryption_keypair(),
+            managed_keys.ack_key(),
             mixnet_message_receiver,
             ack_receiver,
             processed_sender,

common/bandwidth-controller/src/acquire/mod.rs

@@ -55,11 +55,16 @@ where
     Ok(state)
 }
 
-pub async fn get_credential<C: DkgQueryClient + Send + Sync, St: Storage>(
+pub async fn get_credential<C, St>(
     state: &State,
     client: &C,
     storage: &St,
-) -> Result<(), BandwidthControllerError> {
+) -> Result<(), BandwidthControllerError>
+where
+    C: DkgQueryClient + Send + Sync,
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
     let epoch_id = client.get_current_epoch().await?.epoch_id;
     let threshold = client
         .get_current_epoch_threshold()
@@ -83,7 +88,6 @@ pub async fn get_credential<C: DkgQueryClient + Send + Sync, St: Storage>(
             signature.to_bs58(),
             epoch_id.to_string(),
         )
-        .await?;
-
-    Ok(())
+        .await
+        .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
 }

common/bandwidth-controller/src/error.rs

@@ -16,7 +16,11 @@ pub enum BandwidthControllerError {
     Nyxd(#[from] nym_validator_client::nyxd::error::NyxdError),
 
     #[error("There was a credential storage error - {0}")]
-    CredentialStorageError(#[from] StorageError),
+    CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
+
+    // this should really be fully incorporated into the above, but messing with coconut is the last thing I want to do now
+    #[error(transparent)]
+    StorageError(#[from] StorageError),
 
     #[error("Coconut error - {0}")]
     CoconutError(#[from] CoconutError),

common/bandwidth-controller/src/lib.rs

@@ -45,8 +45,13 @@ impl<C, St: Storage> BandwidthController<C, St> {
     ) -> Result<(nym_coconut_interface::Credential, i64), BandwidthControllerError>
     where
         C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
     {
-        let bandwidth_credential = self.storage.get_next_coconut_credential().await?;
+        let bandwidth_credential = self
+            .storage
+            .get_next_coconut_credential()
+            .await
+            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
         let voucher_value = u64::from_str(&bandwidth_credential.voucher_value)
             .map_err(|_| StorageError::InconsistentData)?;
         let voucher_info = bandwidth_credential.voucher_info.clone();
@@ -82,10 +87,16 @@ impl<C, St: Storage> BandwidthController<C, St> {
         ))
     }
 
-    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError> {
+    pub async fn consume_credential(&self, id: i64) -> Result<(), BandwidthControllerError>
+    where
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
         // JS: shouldn't we send some contract/validator/gateway message here to actually, you know,
         // consume it?
-        Ok(self.storage.consume_coconut_credential(id).await?)
+        self.storage
+            .consume_coconut_credential(id)
+            .await
+            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
     }
 }
 

common/client-core/Cargo.toml

@@ -23,6 +23,7 @@ url = { version ="2.2", features = ["serde"] }
 tungstenite = { version = "0.13.0", default-features = false }
 tokio = { version = "1.24.1", features = ["macros"]}
 time = "0.3.17"
+zeroize = { workspace = true }
 
 # internal
 nym-bandwidth-controller = { path = "../bandwidth-controller" }
@@ -38,6 +39,7 @@ nym-topology = { path = "../topology" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
+nym-network-defaults = { path = "../network-defaults" }
 
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
 path = "../client-libs/validator-client"

common/client-core/src/client/base_client/helpers.rs

@@ -1,6 +1,6 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
-//
+
 use crate::{client::replies::reply_storage, config::DebugConfig};
 
 pub fn setup_empty_reply_surb_backend(debug_config: &DebugConfig) -> reply_storage::Empty {

common/client-core/src/client/base_client/mod.rs

@@ -2,9 +2,11 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use super::received_buffer::ReceivedBufferMessage;
+use crate::client::base_client::storage::MixnetClientStorage;
 use crate::client::cover_traffic_stream::LoopCoverTrafficStream;
 use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputMessageSender};
-use crate::client::key_manager::KeyManager;
+use crate::client::key_manager::persistence::KeyStore;
+use crate::client::key_manager::ManagedKeys;
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
@@ -26,6 +28,7 @@ use crate::{config, spawn_future};
 use futures::channel::mpsc;
 use log::{debug, info};
 use nym_bandwidth_controller::BandwidthController;
+use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::{encryption, identity};
 use nym_gateway_client::{
     AcknowledgementReceiver, AcknowledgementSender, GatewayClient, MixnetMessageReceiver,
@@ -38,21 +41,21 @@ use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_task::{TaskClient, TaskManager};
 use nym_topology::provider_trait::TopologyProvider;
+use rand::thread_rng;
 use std::sync::Arc;
 use tap::TapFallible;
 use url::Url;
 
-use nym_credential_storage::storage::Storage;
-#[cfg(not(target_arch = "wasm32"))]
-use nym_validator_client::nyxd::traits::DkgQueryClient;
-
 #[cfg(target_arch = "wasm32")]
 use nym_bandwidth_controller::wasm_mockups::DkgQueryClient;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_validator_client::nyxd::traits::DkgQueryClient;
 
 #[cfg(all(not(target_arch = "wasm32"), feature = "fs-surb-storage"))]
 pub mod non_wasm_helpers;
 
 pub mod helpers;
+pub mod storage;
 
 #[derive(Clone)]
 pub struct ClientInput {
@@ -151,31 +154,32 @@ impl From<bool> for CredentialsToggle {
     }
 }
 
-pub struct BaseClientBuilder<'a, B, C, St: Storage> {
+pub struct BaseClientBuilder<'a, C, S: MixnetClientStorage> {
     // due to wasm limitations I had to split it like this : (
     gateway_config: &'a GatewayEndpointConfig,
     debug_config: &'a DebugConfig,
     disabled_credentials: bool,
     nym_api_endpoints: Vec<Url>,
-    reply_storage_backend: B,
+    reply_storage_backend: S::ReplyStore,
+    key_store: S::KeyStore,
 
     custom_topology_provider: Option<Box<dyn TopologyProvider>>,
-    bandwidth_controller: Option<BandwidthController<C, St>>,
-    key_manager: KeyManager,
+    bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+    managed_keys: ManagedKeys,
 }
 
-impl<'a, B, C, St> BaseClientBuilder<'a, B, C, St>
+impl<'a, C, S> BaseClientBuilder<'a, C, S>
 where
-    B: ReplyStorageBackend + Send + Sync + 'static,
-    C: DkgQueryClient + Sync + Send + 'static,
-    St: Storage + 'static,
+    S: MixnetClientStorage + 'static,
+    C: DkgQueryClient + Send + Sync + 'static,
 {
+    // TODO: combine all storages
     pub fn new_from_base_config<T>(
         base_config: &'a Config<T>,
-        key_manager: KeyManager,
-        bandwidth_controller: Option<BandwidthController<C, St>>,
-        reply_storage_backend: B,
-    ) -> BaseClientBuilder<'a, B, C, St> {
+        key_store: S::KeyStore,
+        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        reply_storage_backend: S::ReplyStore,
+    ) -> BaseClientBuilder<'a, C, S> {
         BaseClientBuilder {
             gateway_config: base_config.get_gateway_endpoint_config(),
             debug_config: base_config.get_debug_config(),
@@ -183,20 +187,22 @@ where
             nym_api_endpoints: base_config.get_nym_api_endpoints(),
             bandwidth_controller,
             reply_storage_backend,
-            key_manager,
+            key_store,
+            managed_keys: ManagedKeys::Invalidated,
             custom_topology_provider: None,
         }
     }
 
+    // TODO: combine all storages
     pub fn new(
         gateway_config: &'a GatewayEndpointConfig,
         debug_config: &'a DebugConfig,
-        key_manager: KeyManager,
-        bandwidth_controller: Option<BandwidthController<C, St>>,
-        reply_storage_backend: B,
+        key_store: S::KeyStore,
+        bandwidth_controller: Option<BandwidthController<C, S::CredentialStore>>,
+        reply_storage_backend: S::ReplyStore,
         credentials_toggle: CredentialsToggle,
         nym_api_endpoints: Vec<Url>,
-    ) -> BaseClientBuilder<'a, B, C, St> {
+    ) -> BaseClientBuilder<'a, C, S> {
         BaseClientBuilder {
             gateway_config,
             debug_config,
@@ -205,7 +211,8 @@ where
             reply_storage_backend,
             custom_topology_provider: None,
             bandwidth_controller,
-            key_manager,
+            key_store,
+            managed_keys: ManagedKeys::Invalidated,
         }
     }
 
@@ -214,10 +221,12 @@ where
         self
     }
 
-    pub fn as_mix_recipient(&self) -> Recipient {
+    // note: do **NOT** make this method public as its only valid usage is from within `start_base`
+    // because it relies on the crypto keys being already loaded
+    fn as_mix_recipient(&self) -> Recipient {
         Recipient::new(
-            *self.key_manager.identity_keypair().public_key(),
-            *self.key_manager.encryption_keypair().public_key(),
+            *self.managed_keys.identity_public_key(),
+            *self.managed_keys.encryption_public_key(),
             // TODO: below only works under assumption that gateway address == gateway id
             // (which currently is true)
             NodeIdentity::from_base58_string(&self.gateway_config.gateway_id).unwrap(),
@@ -307,7 +316,11 @@ where
         mixnet_message_sender: MixnetMessageSender,
         ack_sender: AcknowledgementSender,
         shutdown: TaskClient,
-    ) -> Result<GatewayClient<C, St>, ClientCoreError> {
+    ) -> Result<GatewayClient<C, S::CredentialStore>, ClientCoreError>
+    where
+        <S::KeyStore as KeyStore>::StorageError: Send + Sync + 'static,
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
         let gateway_id = self.gateway_config.gateway_id.clone();
         if gateway_id.is_empty() {
             return Err(ClientCoreError::GatewayIdUnknown);
@@ -320,19 +333,11 @@ where
         let gateway_identity = identity::PublicKey::from_base58_string(gateway_id)
             .map_err(ClientCoreError::UnableToCreatePublicKeyFromGatewayId)?;
 
-        // disgusting wasm workaround since there's no key persistence there (nor `client init`)
-        let shared_key = if self.key_manager.is_gateway_key_set() {
-            Some(self.key_manager.gateway_shared_key())
-        } else {
-            log::info!("Gateway key not set! Will proceed anyway.");
-            None
-        };
-
         let mut gateway_client = GatewayClient::new(
             gateway_address,
-            self.key_manager.identity_keypair(),
+            self.managed_keys.identity_keypair(),
             gateway_identity,
-            shared_key,
+            self.managed_keys.gateway_shared_key(),
             mixnet_message_sender,
             ack_sender,
             self.debug_config
@@ -344,12 +349,20 @@ where
 
         gateway_client.set_disabled_credentials_mode(self.disabled_credentials);
 
-        gateway_client
+        let shared_key = gateway_client
             .authenticate_and_start()
             .await
             .tap_err(|err| {
                 log::error!("Could not authenticate and start up the gateway connection - {err}")
             })?;
+
+        self.managed_keys
+            .deal_with_gateway_key(shared_key, &self.key_store)
+            .await
+            .map_err(|source| ClientCoreError::KeyStoreError {
+                source: Box::new(source),
+            })?;
+
         Ok(gateway_client)
     }
 
@@ -414,55 +427,62 @@ where
     // over it. Perhaps GatewayClient needs to be thread-shareable or have some channel for
     // requests?
     fn start_mix_traffic_controller(
-        gateway_client: GatewayClient<C, St>,
+        gateway_client: GatewayClient<C, S::CredentialStore>,
         shutdown: TaskClient,
-    ) -> BatchMixMessageSender {
+    ) -> BatchMixMessageSender
+    where
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
         info!("Starting mix traffic controller...");
         let (mix_traffic_controller, mix_tx) = MixTrafficController::new(gateway_client);
         mix_traffic_controller.start_with_shutdown(shutdown);
         mix_tx
     }
 
+    // TODO: rename it as it implies the data is persistent whilst one can use InMemBackend
     async fn setup_persistent_reply_storage(
-        backend: B,
+        backend: S::ReplyStore,
         shutdown: TaskClient,
     ) -> Result<CombinedReplyStorage, ClientCoreError>
     where
-        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+        <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
+        S::ReplyStore: Send + Sync,
     {
-        if backend.is_active() {
-            log::trace!("Setup persistent reply storage");
-            let persistent_storage = PersistentReplyStorage::new(backend);
-            let mem_store = persistent_storage
-                .load_state_from_backend()
+        log::trace!("Setup persistent reply storage");
+        let persistent_storage = PersistentReplyStorage::new(backend);
+        let mem_store = persistent_storage
+            .load_state_from_backend()
+            .await
+            .map_err(|err| ClientCoreError::SurbStorageError {
+                source: Box::new(err),
+            })?;
+
+        let store_clone = mem_store.clone();
+        spawn_future(async move {
+            persistent_storage
+                .flush_on_shutdown(store_clone, shutdown)
                 .await
-                .map_err(|err| ClientCoreError::SurbStorageError {
-                    source: Box::new(err),
-                })?;
+        });
 
-            let store_clone = mem_store.clone();
-            spawn_future(async move {
-                persistent_storage
-                    .flush_on_shutdown(store_clone, shutdown)
-                    .await
-            });
+        Ok(mem_store)
+    }
 
-            Ok(mem_store)
-        } else {
-            log::trace!("Setup inactive reply storage");
-            Ok(backend
-                .get_inactive_storage()
-                .map_err(|err| ClientCoreError::SurbStorageError {
-                    source: Box::new(err),
-                })?)
-        }
+    async fn initial_key_setup(&mut self) {
+        assert!(!self.managed_keys.is_valid());
+        let mut rng = thread_rng();
+        self.managed_keys = ManagedKeys::load_or_generate(&mut rng, &self.key_store).await;
     }
 
     pub async fn start_base(mut self) -> Result<BaseClient, ClientCoreError>
     where
-        <B as ReplyStorageBackend>::StorageError: Sync + Send,
+        <S::ReplyStore as ReplyStorageBackend>::StorageError: Sync + Send,
+        S::ReplyStore: Send + Sync,
+        <S::KeyStore as KeyStore>::StorageError: Send + Sync,
+        <S::CredentialStore as CredentialStorage>::StorageError: Send + Sync + 'static,
     {
         info!("Starting nym client");
+        self.initial_key_setup().await;
+
         // channels for inter-component communication
         // TODO: make the channels be internally created by the relevant components
         // rather than creating them here, so say for example the buffer controller would create the request channels
@@ -516,7 +536,7 @@ where
         .await?;
 
         Self::start_received_messages_buffer_controller(
-            self.key_manager.encryption_keypair(),
+            self.managed_keys.encryption_keypair(),
             received_buffer_request_receiver,
             mixnet_messages_receiver,
             reply_storage.key_storage(),
@@ -541,7 +561,7 @@ where
 
         let controller_config = real_messages_control::Config::new(
             self.debug_config,
-            self.key_manager.ack_key(),
+            self.managed_keys.ack_key(),
             self_address,
         );
 
@@ -566,7 +586,7 @@ where
         {
             Self::start_cover_traffic_stream(
                 self.debug_config,
-                self.key_manager.ack_key(),
+                self.managed_keys.ack_key(),
                 self_address,
                 shared_topology_accessor.clone(),
                 sphinx_message_sender,
@@ -578,6 +598,7 @@ where
         debug!("The address of this client is: {self_address}");
 
         Ok(BaseClient {
+            address: self_address,
             client_input: ClientInputStatus::AwaitingProducer {
                 client_input: ClientInput {
                     connection_command_sender: client_connection_tx,
@@ -600,6 +621,7 @@ where
 }
 
 pub struct BaseClient {
+    pub address: Recipient,
     pub client_input: ClientInputStatus,
     pub client_output: ClientOutputStatus,
     pub client_state: ClientState,

common/client-core/src/client/base_client/non_wasm_helpers.rs

@@ -1,19 +1,25 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::replies::reply_storage::{
     fs_backend, CombinedReplyStorage, ReplyStorageBackend,
 };
-use crate::config::DebugConfig;
+use crate::config;
+use crate::config::Config;
 use crate::error::ClientCoreError;
 use log::{error, info};
+use nym_bandwidth_controller::BandwidthController;
+use nym_credential_storage::storage::Storage as CredentialStorage;
+use nym_validator_client::nyxd::QueryNyxdClient;
+use nym_validator_client::Client;
 use std::path::Path;
 use std::{fs, io};
 use time::OffsetDateTime;
+use url::Url;
 
 async fn setup_fresh_backend<P: AsRef<Path>>(
     db_path: P,
-    debug_config: &DebugConfig,
+    surb_config: &config::ReplySurbs,
 ) -> Result<fs_backend::Backend, ClientCoreError> {
     info!("creating fresh surb database");
     let mut storage_backend = match fs_backend::Backend::init(db_path).await {
@@ -30,12 +36,8 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
     // it will only be happening on the very first run and in practice won't incur huge
     // costs since the storage is going to be empty
     let mem_store = CombinedReplyStorage::new(
-        debug_config
-            .reply_surbs
-            .minimum_reply_surb_storage_threshold,
-        debug_config
-            .reply_surbs
-            .maximum_reply_surb_storage_threshold,
+        surb_config.minimum_reply_surb_storage_threshold,
+        surb_config.maximum_reply_surb_storage_threshold,
     );
     storage_backend
         .init_fresh(&mem_store)
@@ -47,17 +49,13 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
     Ok(storage_backend)
 }
 
-fn setup_inactive_backend(debug_config: &DebugConfig) -> fs_backend::Backend {
-    info!("creating inactive surb database");
-    fs_backend::Backend::new_inactive(
-        debug_config
-            .reply_surbs
-            .minimum_reply_surb_storage_threshold,
-        debug_config
-            .reply_surbs
-            .maximum_reply_surb_storage_threshold,
-    )
-}
+// fn setup_inactive_backend(surb_config: &config::ReplySurbs) -> fs_backend::Backend {
+//     info!("creating inactive surb database");
+//     fs_backend::Backend::new_inactive(
+//         surb_config.minimum_reply_surb_storage_threshold,
+//         surb_config.maximum_reply_surb_storage_threshold,
+//     )
+// }
 
 fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
     let db_path = db_path.as_ref();
@@ -81,28 +79,56 @@ fn archive_corrupted_database<P: AsRef<Path>>(db_path: P) -> io::Result<()> {
 }
 
 pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
-    db_path: Option<P>,
-    debug_config: &DebugConfig,
+    db_path: P,
+    surb_config: &config::ReplySurbs,
 ) -> Result<fs_backend::Backend, ClientCoreError> {
-    if let Some(db_path) = db_path {
-        // if the database file doesnt exist, initialise fresh storage, otherwise attempt to load
-        // the existing one
-        let db_path = db_path.as_ref();
-        if db_path.exists() {
-            info!("loading existing surb database");
-            match fs_backend::Backend::try_load(db_path).await {
-                Ok(backend) => Ok(backend),
-                Err(err) => {
-                    error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
+    // if the database file doesnt exist, initialise fresh storage, otherwise attempt to load
+    // the existing one
+    let db_path = db_path.as_ref();
+    if db_path.exists() {
+        info!("loading existing surb database");
+        match fs_backend::Backend::try_load(db_path).await {
+            Ok(backend) => Ok(backend),
+            Err(err) => {
+                error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
 
-                    archive_corrupted_database(db_path)?;
-                    setup_fresh_backend(db_path, debug_config).await
-                }
+                archive_corrupted_database(db_path)?;
+                setup_fresh_backend(db_path, surb_config).await
             }
-        } else {
-            setup_fresh_backend(db_path, debug_config).await
         }
     } else {
-        Ok(setup_inactive_backend(debug_config))
+        setup_fresh_backend(db_path, surb_config).await
     }
 }
+
+pub fn create_bandwidth_controller<T, St: CredentialStorage>(
+    config: &Config<T>,
+    storage: St,
+) -> BandwidthController<Client<QueryNyxdClient>, St> {
+    let nyxd_url = config
+        .get_validator_endpoints()
+        .pop()
+        .expect("No nyxd validator endpoint provided");
+    let api_url = config
+        .get_nym_api_endpoints()
+        .pop()
+        .expect("No validator api endpoint provided");
+
+    create_bandwidth_controller_with_urls(nyxd_url, api_url, storage)
+}
+
+pub fn create_bandwidth_controller_with_urls<St: CredentialStorage>(
+    nyxd_url: Url,
+    nym_api_url: Url,
+    storage: St,
+) -> BandwidthController<Client<QueryNyxdClient>, St> {
+    let details = nym_network_defaults::NymNetworkDetails::new_from_env();
+    let mut client_config = nym_validator_client::Config::try_from_nym_network_details(&details)
+        .expect("failed to construct validator client config");
+    // overwrite env configuration with config URLs
+    client_config = client_config.with_urls(nyxd_url, nym_api_url);
+    let client = nym_validator_client::Client::new_query(client_config)
+        .expect("Could not construct query client");
+
+    BandwidthController::new(storage, client)
+}

common/client-core/src/client/base_client/storage/mod.rs

@@ -0,0 +1,115 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// TODO: combine those more closely. Perhaps into a single underlying store.
+// Like for persistent, on-disk, storage, what's the point of having 3 different databases?
+
+use crate::client::key_manager::persistence::{InMemEphemeralKeys, KeyStore};
+use crate::client::replies::reply_storage;
+use crate::client::replies::reply_storage::ReplyStorageBackend;
+use nym_credential_storage::ephemeral_storage::{
+    EphemeralStorage as EphemeralCredentialStorage, EphemeralStorage,
+};
+use nym_credential_storage::storage::Storage as CredentialStorage;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::key_manager::persistence::OnDiskKeys;
+
+#[cfg(not(target_arch = "wasm32"))]
+use nym_credential_storage::persistent_storage::PersistentStorage as PersistentCredentialStorage;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::replies::reply_storage::fs_backend;
+
+pub trait MixnetClientStorage {
+    type KeyStore: KeyStore;
+    type ReplyStore: ReplyStorageBackend;
+    type CredentialStore: CredentialStorage;
+
+    // this is a TERRIBLE name...
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore);
+
+    fn key_store(&self) -> &Self::KeyStore;
+    fn reply_store(&self) -> &Self::ReplyStore;
+    fn credential_store(&self) -> &Self::CredentialStore;
+}
+
+#[derive(Default)]
+pub struct Ephemeral {
+    key_store: InMemEphemeralKeys,
+    reply_store: reply_storage::Empty,
+    credential_store: EphemeralStorage,
+}
+
+impl Ephemeral {
+    pub fn new() -> Self {
+        Default::default()
+    }
+}
+
+impl MixnetClientStorage for Ephemeral {
+    type KeyStore = InMemEphemeralKeys;
+    type ReplyStore = reply_storage::Empty;
+    type CredentialStore = EphemeralCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_store, self.credential_store)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_store
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_store
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub struct OnDiskPersistent {
+    pub(crate) key_store: OnDiskKeys,
+    pub(crate) reply_store: fs_backend::Backend,
+    pub(crate) credential_store: PersistentCredentialStorage,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl OnDiskPersistent {
+    pub fn new(
+        key_store: OnDiskKeys,
+        reply_store: fs_backend::Backend,
+        credential_store: PersistentCredentialStorage,
+    ) -> Self {
+        Self {
+            key_store,
+            reply_store,
+            credential_store,
+        }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl MixnetClientStorage for OnDiskPersistent {
+    type KeyStore = OnDiskKeys;
+    type ReplyStore = fs_backend::Backend;
+    type CredentialStore = PersistentCredentialStorage;
+
+    fn into_split(self) -> (Self::KeyStore, Self::ReplyStore, Self::CredentialStore) {
+        (self.key_store, self.reply_store, self.credential_store)
+    }
+
+    fn key_store(&self) -> &Self::KeyStore {
+        &self.key_store
+    }
+
+    fn reply_store(&self) -> &Self::ReplyStore {
+        &self.reply_store
+    }
+
+    fn credential_store(&self) -> &Self::CredentialStore {
+        &self.credential_store
+    }
+}

common/client-core/src/client/key_manager.rs

@@ -1,227 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::config::persistence::key_pathfinder::ClientKeyPathfinder;
-use log::*;
-use nym_crypto::asymmetric::{encryption, identity};
-use nym_gateway_requests::registration::handshake::SharedKeys;
-use nym_sphinx::acknowledgements::AckKey;
-use rand::{CryptoRng, RngCore};
-use std::io;
-use std::sync::Arc;
-
-// Note: to support key rotation in the future, all keys will require adding an extra smart pointer,
-// most likely an AtomicCell, or if it doesn't work as I think it does, a Mutex. Although I think
-// AtomicCell includes a Mutex implicitly if the underlying type does not work atomically.
-// And I guess there will need to be some mechanism for a grace period when you can still
-// use the old key after new one was issued.
-
-// Remember that Arc<T> has Deref implementation for T
-#[derive(Clone)]
-pub struct KeyManager {
-    /// identity key associated with the client instance.
-    identity_keypair: Arc<identity::KeyPair>,
-
-    /// encryption key associated with the client instance.
-    encryption_keypair: Arc<encryption::KeyPair>,
-
-    /// shared key derived with the gateway during "registration handshake"
-    gateway_shared_key: Option<Arc<SharedKeys>>,
-
-    /// key used for producing and processing acknowledgement packets.
-    ack_key: Arc<AckKey>,
-}
-
-// The expected flow of a KeyManager "lifetime" is as follows:
-/*
-   1. ::new() is called during client-init
-   2. after gateway registration is completed [in init] ::insert_gateway_shared_key() is called
-   3. ::store_keys() is called before init finishes execution.
-   4. ::load_keys() is called at the beginning of each subsequent client-run
-   5. [not implemented] ::rotate_keys() is called periodically during client-run I presume?
-*/
-
-impl KeyManager {
-    /// Creates new instance of a [`KeyManager`]
-    pub fn new<R>(rng: &mut R) -> Self
-    where
-        R: RngCore + CryptoRng,
-    {
-        KeyManager {
-            identity_keypair: Arc::new(identity::KeyPair::new(rng)),
-            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
-            gateway_shared_key: None,
-            ack_key: Arc::new(AckKey::new(rng)),
-        }
-    }
-
-    pub fn from_keys(
-        id_keypair: identity::KeyPair,
-        enc_keypair: encryption::KeyPair,
-        gateway_shared_key: SharedKeys,
-        ack_key: AckKey,
-    ) -> Self {
-        Self {
-            identity_keypair: Arc::new(id_keypair),
-            encryption_keypair: Arc::new(enc_keypair),
-            gateway_shared_key: Some(Arc::new(gateway_shared_key)),
-            ack_key: Arc::new(ack_key),
-        }
-    }
-
-    /// Loads previously stored client keys from the disk.
-    fn load_client_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
-        let identity_keypair: identity::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_identity_key().to_owned(),
-                client_pathfinder.public_identity_key().to_owned(),
-            ))?;
-        let encryption_keypair: encryption::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_encryption_key().to_owned(),
-                client_pathfinder.public_encryption_key().to_owned(),
-            ))?;
-
-        let ack_key: AckKey = nym_pemstore::load_key(client_pathfinder.ack_key())?;
-
-        Ok(KeyManager {
-            identity_keypair: Arc::new(identity_keypair),
-            encryption_keypair: Arc::new(encryption_keypair),
-            gateway_shared_key: None,
-            ack_key: Arc::new(ack_key),
-        })
-    }
-
-    /// Loads previously stored keys from the disk. Fails if not all, including the shared gateway
-    /// key, is available.
-    pub fn load_keys(client_pathfinder: &ClientKeyPathfinder) -> io::Result<Self> {
-        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
-
-        let gateway_shared_key: SharedKeys =
-            nym_pemstore::load_key(client_pathfinder.gateway_shared_key())?;
-
-        key_manager.gateway_shared_key = Some(Arc::new(gateway_shared_key));
-
-        Ok(key_manager)
-    }
-
-    /// Loads previously stored keys from the disk. Fails if client keys are not availabe, but the
-    /// shared gateway key is optional.
-    pub fn load_keys_but_gateway_is_optional(
-        client_pathfinder: &ClientKeyPathfinder,
-    ) -> io::Result<Self> {
-        let mut key_manager = Self::load_client_keys(client_pathfinder)?;
-
-        let gateway_shared_key: Result<SharedKeys, io::Error> =
-            nym_pemstore::load_key(client_pathfinder.gateway_shared_key());
-
-        // It's ok if the gateway key was not found
-        let gateway_shared_key = match gateway_shared_key {
-            Err(err) if err.kind() == io::ErrorKind::NotFound => Ok(None),
-            Err(err) => Err(err),
-            Ok(key) => Ok(Some(key)),
-        }?;
-
-        key_manager.gateway_shared_key = gateway_shared_key.map(Arc::new);
-
-        Ok(key_manager)
-    }
-
-    /// Stores all available keys on the disk.
-    // While perhaps there is no much point in storing the `AckKey` on the disk,
-    // it is done so for the consistency sake so that you wouldn't require an rng instance
-    // during `load_keys` to generate the said key.
-    pub fn store_keys(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
-        nym_pemstore::store_keypair(
-            self.identity_keypair.as_ref(),
-            &nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_identity_key().to_owned(),
-                client_pathfinder.public_identity_key().to_owned(),
-            ),
-        )?;
-        nym_pemstore::store_keypair(
-            self.encryption_keypair.as_ref(),
-            &nym_pemstore::KeyPairPath::new(
-                client_pathfinder.private_encryption_key().to_owned(),
-                client_pathfinder.public_encryption_key().to_owned(),
-            ),
-        )?;
-
-        nym_pemstore::store_key(self.ack_key.as_ref(), client_pathfinder.ack_key())?;
-
-        match self.gateway_shared_key.as_ref() {
-            None => debug!("No gateway shared key available to store!"),
-            Some(gate_key) => {
-                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
-            }
-        }
-
-        Ok(())
-    }
-
-    pub fn store_gateway_key(&self, client_pathfinder: &ClientKeyPathfinder) -> io::Result<()> {
-        match self.gateway_shared_key.as_ref() {
-            None => {
-                return Err(io::Error::new(
-                    io::ErrorKind::Other,
-                    "trying to store a non-existing key",
-                ))
-            }
-            Some(gate_key) => {
-                nym_pemstore::store_key(gate_key.as_ref(), client_pathfinder.gateway_shared_key())?
-            }
-        }
-
-        Ok(())
-    }
-
-    /// Overwrite the existing identity keypair
-    pub fn set_identity_keypair(&mut self, id_keypair: identity::KeyPair) {
-        self.identity_keypair = Arc::new(id_keypair);
-    }
-
-    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
-    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
-        Arc::clone(&self.identity_keypair)
-    }
-
-    /// Overwrite the existing encryption keypair
-    pub fn set_encryption_keypair(&mut self, enc_keypair: encryption::KeyPair) {
-        self.encryption_keypair = Arc::new(enc_keypair);
-    }
-
-    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
-    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
-        Arc::clone(&self.encryption_keypair)
-    }
-
-    /// Overwrite the existing ack key
-    pub fn set_ack_key(&mut self, ack_key: AckKey) {
-        self.ack_key = Arc::new(ack_key);
-    }
-
-    /// Gets an atomically reference counted pointer to [`AckKey`].
-    pub fn ack_key(&self) -> Arc<AckKey> {
-        Arc::clone(&self.ack_key)
-    }
-
-    /// After shared key with the gateway is derived, puts its ownership to this instance of a [`KeyManager`].
-    pub fn insert_gateway_shared_key(&mut self, gateway_shared_key: Arc<SharedKeys>) {
-        self.gateway_shared_key = Some(gateway_shared_key)
-    }
-
-    /// Gets an atomically reference counted pointer to [`SharedKey`].
-    // since this function is not fully public, it is not expected to be used externally and
-    // hence it's up to us to ensure it's called in correct context
-    pub fn gateway_shared_key(&self) -> Arc<SharedKeys> {
-        Arc::clone(
-            self.gateway_shared_key
-                .as_ref()
-                .expect("tried to unwrap empty gateway key!"),
-        )
-    }
-
-    pub fn is_gateway_key_set(&self) -> bool {
-        self.gateway_shared_key.is_some()
-    }
-}

common/client-core/src/client/key_manager/mod.rs

@@ -0,0 +1,265 @@
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::key_manager::persistence::KeyStore;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_sphinx::acknowledgements::AckKey;
+use rand::{CryptoRng, RngCore};
+use std::sync::Arc;
+use zeroize::ZeroizeOnDrop;
+
+pub mod persistence;
+
+pub enum ManagedKeys {
+    Initial(KeyManagerBuilder),
+    FullyDerived(KeyManager),
+
+    // I really hate the existence of this variant, but I couldn't come up with a better way to handle
+    // `Self::deal_with_gateway_key` otherwise.
+    Invalidated,
+}
+
+impl From<KeyManagerBuilder> for ManagedKeys {
+    fn from(value: KeyManagerBuilder) -> Self {
+        ManagedKeys::Initial(value)
+    }
+}
+
+impl From<KeyManager> for ManagedKeys {
+    fn from(value: KeyManager) -> Self {
+        ManagedKeys::FullyDerived(value)
+    }
+}
+
+impl ManagedKeys {
+    pub fn is_valid(&self) -> bool {
+        !matches!(self, ManagedKeys::Invalidated)
+    }
+
+    pub async fn must_load<S: KeyStore>(key_store: &S) -> Result<Self, S::StorageError> {
+        Ok(ManagedKeys::FullyDerived(
+            KeyManager::load_keys(key_store).await?,
+        ))
+    }
+
+    pub async fn load_or_generate<R, S>(rng: &mut R, key_store: &S) -> Self
+    where
+        R: RngCore + CryptoRng,
+        S: KeyStore,
+    {
+        if let Ok(loaded) = KeyManager::load_keys(key_store).await {
+            ManagedKeys::FullyDerived(loaded)
+        } else {
+            ManagedKeys::Initial(KeyManagerBuilder::new(rng))
+        }
+    }
+
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.identity_keypair(),
+            ManagedKeys::FullyDerived(keys) => keys.identity_keypair(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.encryption_keypair(),
+            ManagedKeys::FullyDerived(keys) => keys.encryption_keypair(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        match self {
+            ManagedKeys::Initial(keys) => keys.ack_key(),
+            ManagedKeys::FullyDerived(keys) => keys.ack_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn gateway_shared_key(&self) -> Option<Arc<SharedKeys>> {
+        match self {
+            ManagedKeys::Initial(_) => None,
+            ManagedKeys::FullyDerived(keys) => Some(keys.gateway_shared_key()),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn identity_public_key(&self) -> &identity::PublicKey {
+        match self {
+            ManagedKeys::Initial(keys) => keys.identity_keypair.public_key(),
+            ManagedKeys::FullyDerived(keys) => keys.identity_keypair.public_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub fn encryption_public_key(&self) -> &encryption::PublicKey {
+        match self {
+            ManagedKeys::Initial(keys) => keys.encryption_keypair.public_key(),
+            ManagedKeys::FullyDerived(keys) => keys.encryption_keypair.public_key(),
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        }
+    }
+
+    pub async fn deal_with_gateway_key<S: KeyStore>(
+        &mut self,
+        gateway_shared_key: Arc<SharedKeys>,
+        key_store: &S,
+    ) -> Result<(), S::StorageError> {
+        let key_manager = match std::mem::replace(self, ManagedKeys::Invalidated) {
+            ManagedKeys::Initial(keys) => {
+                let key_manager = keys.insert_gateway_shared_key(gateway_shared_key);
+                key_manager.persist_keys(key_store).await?;
+                key_manager
+            }
+            ManagedKeys::FullyDerived(key_manager) => {
+                if !Arc::ptr_eq(&key_manager.gateway_shared_key, &gateway_shared_key)
+                    || key_manager.gateway_shared_key != gateway_shared_key
+                {
+                    // this should NEVER happen thus panic here
+                    panic!("derived fresh gateway shared key whilst already holding one!")
+                }
+                key_manager
+            }
+            ManagedKeys::Invalidated => unreachable!("the managed keys got invalidated"),
+        };
+
+        *self = ManagedKeys::FullyDerived(key_manager);
+        Ok(())
+    }
+}
+
+// all of the keys really shouldn't be wrapped in `Arc`, but due to how the gateway client is currently
+// constructed, changing that would require more work than what it's worth
+pub struct KeyManagerBuilder {
+    /// identity key associated with the client instance.
+    identity_keypair: Arc<identity::KeyPair>,
+
+    /// encryption key associated with the client instance.
+    encryption_keypair: Arc<encryption::KeyPair>,
+
+    /// key used for producing and processing acknowledgement packets.
+    ack_key: Arc<AckKey>,
+}
+
+impl KeyManagerBuilder {
+    /// Creates new instance of a [`KeyManager`]
+    pub fn new<R>(rng: &mut R) -> Self
+    where
+        R: RngCore + CryptoRng,
+    {
+        KeyManagerBuilder {
+            identity_keypair: Arc::new(identity::KeyPair::new(rng)),
+            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
+            ack_key: Arc::new(AckKey::new(rng)),
+        }
+    }
+
+    pub fn insert_gateway_shared_key(self, gateway_shared_key: Arc<SharedKeys>) -> KeyManager {
+        KeyManager {
+            identity_keypair: self.identity_keypair,
+            encryption_keypair: self.encryption_keypair,
+            gateway_shared_key,
+            ack_key: self.ack_key,
+        }
+    }
+
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        Arc::clone(&self.identity_keypair)
+    }
+
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        Arc::clone(&self.encryption_keypair)
+    }
+
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        Arc::clone(&self.ack_key)
+    }
+}
+
+// Note: to support key rotation in the future, all keys will require adding an extra smart pointer,
+// most likely an AtomicCell, or if it doesn't work as I think it does, a Mutex. Although I think
+// AtomicCell includes a Mutex implicitly if the underlying type does not work atomically.
+// And I guess there will need to be some mechanism for a grace period when you can still
+// use the old key after new one was issued.
+
+// Remember that Arc<T> has Deref implementation for T
+#[derive(Clone)]
+pub struct KeyManager {
+    /// identity key associated with the client instance.
+    identity_keypair: Arc<identity::KeyPair>,
+
+    /// encryption key associated with the client instance.
+    encryption_keypair: Arc<encryption::KeyPair>,
+
+    /// shared key derived with the gateway during "registration handshake"
+    gateway_shared_key: Arc<SharedKeys>,
+
+    /// key used for producing and processing acknowledgement packets.
+    ack_key: Arc<AckKey>,
+}
+
+impl KeyManager {
+    pub fn from_keys(
+        id_keypair: identity::KeyPair,
+        enc_keypair: encryption::KeyPair,
+        gateway_shared_key: SharedKeys,
+        ack_key: AckKey,
+    ) -> Self {
+        Self {
+            identity_keypair: Arc::new(id_keypair),
+            encryption_keypair: Arc::new(enc_keypair),
+            gateway_shared_key: Arc::new(gateway_shared_key),
+            ack_key: Arc::new(ack_key),
+        }
+    }
+
+    pub async fn load_keys<S: KeyStore>(store: &S) -> Result<Self, S::StorageError> {
+        store.load_keys().await
+    }
+
+    pub async fn persist_keys<S: KeyStore>(&self, store: &S) -> Result<(), S::StorageError> {
+        store.store_keys(self).await
+    }
+
+    /// Gets an atomically reference counted pointer to [`identity::KeyPair`].
+    pub fn identity_keypair(&self) -> Arc<identity::KeyPair> {
+        Arc::clone(&self.identity_keypair)
+    }
+
+    /// Gets an atomically reference counted pointer to [`encryption::KeyPair`].
+    pub fn encryption_keypair(&self) -> Arc<encryption::KeyPair> {
+        Arc::clone(&self.encryption_keypair)
+    }
+    /// Gets an atomically reference counted pointer to [`AckKey`].
+    pub fn ack_key(&self) -> Arc<AckKey> {
+        Arc::clone(&self.ack_key)
+    }
+
+    /// Gets an atomically reference counted pointer to [`SharedKey`].
+    pub fn gateway_shared_key(&self) -> Arc<SharedKeys> {
+        Arc::clone(&self.gateway_shared_key)
+    }
+
+    pub fn remove_gateway_key(self) -> KeyManagerBuilder {
+        if Arc::strong_count(&self.gateway_shared_key) > 1 {
+            panic!("attempted to remove gateway key whilst still holding multiple references!")
+        }
+        KeyManagerBuilder {
+            identity_keypair: self.identity_keypair,
+            encryption_keypair: self.encryption_keypair,
+            ack_key: self.ack_key,
+        }
+    }
+}
+
+fn _assert_keys_zeroize_on_drop() {
+    fn _assert_zeroize_on_drop<T: ZeroizeOnDrop>() {}
+
+    _assert_zeroize_on_drop::<identity::KeyPair>();
+    _assert_zeroize_on_drop::<encryption::KeyPair>();
+    _assert_zeroize_on_drop::<AckKey>();
+    _assert_zeroize_on_drop::<SharedKeys>();
+}

common/client-core/src/client/key_manager/persistence.rs

@@ -0,0 +1,214 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::key_manager::KeyManager;
+use async_trait::async_trait;
+use std::error::Error;
+
+#[cfg(not(target_arch = "wasm32"))]
+use crate::config::persistence::key_pathfinder::ClientKeyPathfinder;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_crypto::asymmetric::{encryption, identity};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_gateway_requests::registration::handshake::SharedKeys;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_pemstore::KeyPairPath;
+#[cfg(not(target_arch = "wasm32"))]
+use nym_sphinx::acknowledgements::AckKey;
+
+// we have to define it as an async trait since wasm storage is async
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait KeyStore {
+    type StorageError: Error;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError>;
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError>;
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Debug, thiserror::Error)]
+pub enum OnDiskKeysError {
+    #[error("failed to load {keys} keys from {:?} (private key) and {:?} (public key): {err}", .paths.private_key_path, .paths.public_key_path)]
+    KeyPairLoadFailure {
+        keys: String,
+        paths: nym_pemstore::KeyPairPath,
+        err: std::io::Error,
+    },
+
+    #[error("failed to store {keys} keys to {:?} (private key) and {:?} (public key): {err}", .paths.private_key_path, .paths.public_key_path)]
+    KeyPairStoreFailure {
+        keys: String,
+        paths: nym_pemstore::KeyPairPath,
+        err: std::io::Error,
+    },
+
+    #[error("failed to load {key} key from {path}: {err}")]
+    KeyLoadFailure {
+        key: String,
+        path: String,
+        err: std::io::Error,
+    },
+
+    #[error("failed to store {key} key to {path}: {err}")]
+    KeyStoreFailure {
+        key: String,
+        path: String,
+        err: std::io::Error,
+    },
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+pub struct OnDiskKeys {
+    pathfinder: ClientKeyPathfinder,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl From<ClientKeyPathfinder> for OnDiskKeys {
+    fn from(pathfinder: ClientKeyPathfinder) -> Self {
+        OnDiskKeys { pathfinder }
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl OnDiskKeys {
+    pub fn new(pathfinder: ClientKeyPathfinder) -> Self {
+        OnDiskKeys { pathfinder }
+    }
+
+    fn load_key<T: PemStorableKey>(
+        &self,
+        path: &std::path::Path,
+        name: impl Into<String>,
+    ) -> Result<T, OnDiskKeysError> {
+        nym_pemstore::load_key(path).map_err(|err| OnDiskKeysError::KeyLoadFailure {
+            key: name.into(),
+            path: path.to_str().map(|s| s.to_owned()).unwrap_or_default(),
+            err,
+        })
+    }
+
+    fn load_keypair<T: PemStorableKeyPair>(
+        &self,
+        paths: KeyPairPath,
+        name: impl Into<String>,
+    ) -> Result<T, OnDiskKeysError> {
+        nym_pemstore::load_keypair(&paths).map_err(|err| OnDiskKeysError::KeyPairLoadFailure {
+            keys: name.into(),
+            paths,
+            err,
+        })
+    }
+
+    fn store_key<T: PemStorableKey>(
+        &self,
+        key: &T,
+        path: &std::path::Path,
+        name: impl Into<String>,
+    ) -> Result<(), OnDiskKeysError> {
+        nym_pemstore::store_key(key, path).map_err(|err| OnDiskKeysError::KeyStoreFailure {
+            key: name.into(),
+            path: path.to_str().map(|s| s.to_owned()).unwrap_or_default(),
+            err,
+        })
+    }
+
+    fn store_keypair<T: PemStorableKeyPair>(
+        &self,
+        keys: &T,
+        paths: KeyPairPath,
+        name: impl Into<String>,
+    ) -> Result<(), OnDiskKeysError> {
+        nym_pemstore::store_keypair(keys, &paths).map_err(|err| {
+            OnDiskKeysError::KeyPairStoreFailure {
+                keys: name.into(),
+                paths,
+                err,
+            }
+        })
+    }
+
+    fn load_keys(&self) -> Result<KeyManager, OnDiskKeysError> {
+        let identity_paths = self.pathfinder.identity_key_pair_path();
+        let encryption_paths = self.pathfinder.encryption_key_pair_path();
+
+        let identity_keypair: identity::KeyPair =
+            self.load_keypair(identity_paths, "identity keys")?;
+        let encryption_keypair: encryption::KeyPair =
+            self.load_keypair(encryption_paths, "encryption keys")?;
+
+        let ack_key: AckKey = self.load_key(self.pathfinder.ack_key(), "ack key")?;
+        let gateway_shared_key: SharedKeys =
+            self.load_key(self.pathfinder.gateway_shared_key(), "gateway shared keys")?;
+
+        Ok(KeyManager::from_keys(
+            identity_keypair,
+            encryption_keypair,
+            gateway_shared_key,
+            ack_key,
+        ))
+    }
+
+    fn store_keys(&self, keys: &KeyManager) -> Result<(), OnDiskKeysError> {
+        let identity_paths = self.pathfinder.identity_key_pair_path();
+        let encryption_paths = self.pathfinder.encryption_key_pair_path();
+
+        self.store_keypair(
+            keys.identity_keypair.as_ref(),
+            identity_paths,
+            "identity keys",
+        )?;
+        self.store_keypair(
+            keys.encryption_keypair.as_ref(),
+            encryption_paths,
+            "encryption keys",
+        )?;
+
+        self.store_key(keys.ack_key.as_ref(), self.pathfinder.ack_key(), "ack key")?;
+        self.store_key(
+            keys.gateway_shared_key.as_ref(),
+            self.pathfinder.gateway_shared_key(),
+            "gateway shared keys",
+        )?;
+
+        Ok(())
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl KeyStore for OnDiskKeys {
+    type StorageError = OnDiskKeysError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        self.load_keys()
+    }
+
+    async fn store_keys(&self, keys: &KeyManager) -> Result<(), Self::StorageError> {
+        self.store_keys(keys)
+    }
+}
+
+#[derive(Default)]
+pub struct InMemEphemeralKeys;
+
+#[derive(Debug, thiserror::Error)]
+#[error("ephemeral keys can't be loaded from storage")]
+pub struct EphemeralKeysError;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl KeyStore for InMemEphemeralKeys {
+    type StorageError = EphemeralKeysError;
+
+    async fn load_keys(&self) -> Result<KeyManager, Self::StorageError> {
+        Err(EphemeralKeysError)
+    }
+
+    async fn store_keys(&self, _keys: &KeyManager) -> Result<(), Self::StorageError> {
+        Ok(())
+    }
+}

common/client-core/src/client/mix_traffic.rs

@@ -35,6 +35,7 @@ impl<C, St> MixTrafficController<C, St>
 where
     C: DkgQueryClient + Sync + Send + 'static,
     St: Storage + 'static,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
     pub fn new(
         gateway_client: GatewayClient<C, St>,

common/client-core/src/client/replies/reply_storage/backend/browser_backend.rs

@@ -5,8 +5,6 @@ use crate::client::replies::reply_storage::backend::Empty;
 use crate::client::replies::reply_storage::{CombinedReplyStorage, ReplyStorageBackend};
 use async_trait::async_trait;
 
-use std::path::PathBuf;
-
 // well, right now we don't have the browser storage : (
 // so we keep everything in memory
 #[derive(Debug)]
@@ -29,22 +27,6 @@ impl Backend {
 impl ReplyStorageBackend for Backend {
     type StorageError = <Empty as ReplyStorageBackend>::StorageError;
 
-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        _db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        Ok(Backend {
-            empty: Empty {
-                min_surb_threshold: debug_config
-                    .reply_surbs
-                    .minimum_reply_surb_storage_threshold,
-                max_surb_threshold: debug_config
-                    .reply_surbs
-                    .maximum_reply_surb_storage_threshold,
-            },
-        })
-    }
-
     async fn flush_surb_storage(
         &mut self,
         storage: &CombinedReplyStorage,
@@ -59,8 +41,4 @@ impl ReplyStorageBackend for Backend {
     async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
         self.empty.load_surb_storage().await
     }
-
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        self.empty.get_inactive_storage()
-    }
 }

common/client-core/src/client/replies/reply_storage/backend/fs_backend/mod.rs

@@ -1,7 +1,6 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::client::base_client::non_wasm_helpers;
 use crate::client::replies::reply_storage::backend::fs_backend::manager::StorageManager;
 use crate::client::replies::reply_storage::backend::fs_backend::models::{
     ReplySurbStorageMetadata, StoredReplyKey, StoredReplySurb, StoredSenderTag, StoredSurbSender,
@@ -23,49 +22,11 @@ mod error;
 mod manager;
 mod models;
 
-#[derive(Debug)]
-enum StorageManagerState {
-    Storage(StorageManager),
-    Inactive(InactiveMetadata),
-}
-
-// When the storage backaed is initialized as inactive, it will still contain metadata parameters
-// that will be needed when the in-mem storage is fetched for use.
-#[derive(Debug)]
-struct InactiveMetadata {
-    pub minimum_reply_surb_storage_threshold: usize,
-    pub maximum_reply_surb_storage_threshold: usize,
-}
-
-impl StorageManagerState {
-    fn get(&self) -> &StorageManager {
-        match self {
-            StorageManagerState::Storage(manager) => manager,
-            StorageManagerState::Inactive(_) => {
-                panic!("tried to get storage of an inactive backend")
-            }
-        }
-    }
-
-    fn get_mut(&mut self) -> &mut StorageManager {
-        match self {
-            StorageManagerState::Storage(manager) => manager,
-            StorageManagerState::Inactive(_) => {
-                panic!("tried to get storage of an inactive backend")
-            }
-        }
-    }
-
-    fn is_active(&self) -> bool {
-        matches!(self, StorageManagerState::Storage(_))
-    }
-}
-
 #[derive(Debug)]
 pub struct Backend {
     temporary_old_path: Option<PathBuf>,
     database_path: PathBuf,
-    manager: StorageManagerState,
+    manager: StorageManager,
 }
 
 impl Backend {
@@ -85,26 +46,12 @@ impl Backend {
         let backend = Backend {
             temporary_old_path: None,
             database_path: owned_path,
-            manager: StorageManagerState::Storage(manager),
+            manager,
         };
 
         Ok(backend)
     }
 
-    pub fn new_inactive(
-        minimum_reply_surb_storage_threshold: usize,
-        maximum_reply_surb_storage_threshold: usize,
-    ) -> Self {
-        Backend {
-            temporary_old_path: None,
-            database_path: PathBuf::new(),
-            manager: StorageManagerState::Inactive(InactiveMetadata {
-                minimum_reply_surb_storage_threshold,
-                maximum_reply_surb_storage_threshold,
-            }),
-        }
-    }
-
     pub async fn try_load<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
         let owned_path: PathBuf = database_path.as_ref().into();
         if owned_path.file_name().is_none() {
@@ -176,12 +123,13 @@ impl Backend {
         Ok(Backend {
             temporary_old_path: None,
             database_path: owned_path,
-            manager: StorageManagerState::Storage(manager),
+            // manager: StorageManagerState::Storage(manager),
+            manager,
         })
     }
 
     async fn close_pool(&mut self) {
-        self.manager.get_mut().connection_pool.close().await;
+        self.manager.connection_pool.close().await;
     }
 
     async fn rotate(&mut self) -> Result<(), StorageError> {
@@ -200,9 +148,8 @@ impl Backend {
 
         fs::rename(&self.database_path, &temp_old)
             .map_err(|err| StorageError::DatabaseRenameError { source: err })?;
-        self.manager =
-            StorageManagerState::Storage(StorageManager::init(&self.database_path, true).await?);
-        self.manager.get_mut().create_status_table().await?;
+        self.manager = StorageManager::init(&self.database_path, true).await?;
+        self.manager.create_status_table().await?;
 
         self.temporary_old_path = Some(temp_old);
         Ok(())
@@ -219,27 +166,26 @@ impl Backend {
     }
 
     async fn start_storage_flush(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_flush_status(true).await?)
+        Ok(self.manager.set_flush_status(true).await?)
     }
 
     async fn end_storage_flush(&self) -> Result<(), StorageError> {
         self.manager
-            .get()
             .set_previous_flush_timestamp(OffsetDateTime::now_utc().unix_timestamp())
             .await?;
-        Ok(self.manager.get().set_flush_status(false).await?)
+        Ok(self.manager.set_flush_status(false).await?)
     }
 
     async fn start_client_use(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_client_in_use_status(true).await?)
+        Ok(self.manager.set_client_in_use_status(true).await?)
     }
 
     async fn stop_client_use(&self) -> Result<(), StorageError> {
-        Ok(self.manager.get().set_client_in_use_status(false).await?)
+        Ok(self.manager.set_client_in_use_status(false).await?)
     }
 
     async fn get_stored_tags(&self) -> Result<UsedSenderTags, StorageError> {
-        let stored = self.manager.get().get_tags().await?;
+        let stored = self.manager.get_tags().await?;
 
         // stop at the first instance of corruption. if even a single entry is malformed,
         // something weird has happened and we can't trust the rest of the data
@@ -255,7 +201,6 @@ impl Backend {
         for map_ref in tags.as_raw_iter() {
             let (recipient, tag) = map_ref.pair();
             self.manager
-                .get()
                 .insert_tag(StoredSenderTag::new(*recipient, *tag))
                 .await?;
         }
@@ -263,7 +208,7 @@ impl Backend {
     }
 
     async fn get_stored_reply_keys(&self) -> Result<SentReplyKeys, StorageError> {
-        let stored = self.manager.get().get_reply_keys().await?;
+        let stored = self.manager.get_reply_keys().await?;
 
         // stop at the first instance of corruption. if even a single entry is malformed,
         // something weird has happened and we can't trust the rest of the data
@@ -279,7 +224,6 @@ impl Backend {
         for map_ref in reply_keys.as_raw_iter() {
             let (digest, key) = map_ref.pair();
             self.manager
-                .get()
                 .insert_reply_key(StoredReplyKey::new(*digest, *key))
                 .await?;
         }
@@ -287,7 +231,7 @@ impl Backend {
     }
 
     async fn get_stored_reply_surbs(&self) -> Result<ReceivedReplySurbsMap, StorageError> {
-        let surb_senders = self.manager.get().get_surb_senders().await?;
+        let surb_senders = self.manager.get_surb_senders().await?;
 
         let metadata = self.get_reply_surb_storage_metadata().await?;
         let mut received_surbs = Vec::with_capacity(surb_senders.len());
@@ -297,7 +241,6 @@ impl Backend {
                 sender.try_into()?;
             let stored_surbs = self
                 .manager
-                .get()
                 .get_reply_surbs(sender_id)
                 .await?
                 .into_iter()
@@ -325,7 +268,6 @@ impl Backend {
             let (tag, received_surbs) = map_ref.pair();
             let sender_id = self
                 .manager
-                .get()
                 .insert_surb_sender(StoredSurbSender::new(
                     *tag,
                     received_surbs.surbs_last_received_at(),
@@ -334,7 +276,6 @@ impl Backend {
 
             for reply_surb in received_surbs.surbs_ref() {
                 self.manager
-                    .get()
                     .insert_reply_surb(StoredReplySurb::new(sender_id, reply_surb))
                     .await?
             }
@@ -346,7 +287,6 @@ impl Backend {
         &self,
     ) -> Result<ReplySurbStorageMetadata, StorageError> {
         self.manager
-            .get()
             .get_reply_surb_storage_metadata()
             .await
             .map_err(Into::into)
@@ -357,7 +297,6 @@ impl Backend {
         reply_surbs: &ReceivedReplySurbsMap,
     ) -> Result<(), StorageError> {
         self.manager
-            .get()
             .insert_reply_surb_storage_metadata(ReplySurbStorageMetadata::new(
                 reply_surbs.min_surb_threshold(),
                 reply_surbs.max_surb_threshold(),
@@ -371,24 +310,6 @@ impl Backend {
 impl ReplyStorageBackend for Backend {
     type StorageError = error::StorageError;
 
-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        non_wasm_helpers::setup_fs_reply_surb_backend(db_path, debug_config)
-            .await
-            .map_err(|err| {
-                log::error!("Failed to create storage: {err}");
-                Self::StorageError::FailedToCreateStorage {
-                    source: Box::new(err),
-                }
-            })
-    }
-
-    fn is_active(&self) -> bool {
-        self.manager.is_active()
-    }
-
     async fn start_storage_session(&self) -> Result<(), Self::StorageError> {
         self.start_client_use().await
     }
@@ -426,18 +347,6 @@ impl ReplyStorageBackend for Backend {
         Ok(CombinedReplyStorage::load(reply_keys, reply_surbs, tags))
     }
 
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        match self.manager {
-            StorageManagerState::Storage(_) => {
-                panic!("tried to get inactive storage from an active storage backend")
-            }
-            StorageManagerState::Inactive(ref state) => Ok(CombinedReplyStorage::new(
-                state.minimum_reply_surb_storage_threshold,
-                state.maximum_reply_surb_storage_threshold,
-            )),
-        }
-    }
-
     async fn stop_storage_session(self) -> Result<(), Self::StorageError> {
         self.stop_client_use().await
     }

common/client-core/src/client/replies/reply_storage/backend/mod.rs

@@ -3,7 +3,7 @@
 
 use crate::client::replies::reply_storage::CombinedReplyStorage;
 use async_trait::async_trait;
-use std::{error::Error, path::PathBuf};
+use std::error::Error;
 use thiserror::Error;
 
 #[cfg(target_arch = "wasm32")]
@@ -26,24 +26,19 @@ pub struct Empty {
     pub max_surb_threshold: usize,
 }
 
+impl Default for Empty {
+    fn default() -> Self {
+        Empty {
+            min_surb_threshold: 20,
+            max_surb_threshold: 200,
+        }
+    }
+}
+
 #[async_trait]
 impl ReplyStorageBackend for Empty {
     type StorageError = UndefinedError;
 
-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        _db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError> {
-        Ok(Self {
-            min_surb_threshold: debug_config
-                .reply_surbs
-                .minimum_reply_surb_storage_threshold,
-            max_surb_threshold: debug_config
-                .reply_surbs
-                .maximum_reply_surb_storage_threshold,
-        })
-    }
-
     async fn flush_surb_storage(
         &mut self,
         _storage: &CombinedReplyStorage,
@@ -64,28 +59,12 @@ impl ReplyStorageBackend for Empty {
             self.max_surb_threshold,
         ))
     }
-
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError> {
-        Ok(CombinedReplyStorage::new(
-            self.min_surb_threshold,
-            self.max_surb_threshold,
-        ))
-    }
 }
 
 #[async_trait]
 pub trait ReplyStorageBackend: Sized {
     type StorageError: Error + 'static;
 
-    async fn new(
-        debug_config: &crate::config::DebugConfig,
-        db_path: Option<PathBuf>,
-    ) -> Result<Self, Self::StorageError>;
-
-    fn is_active(&self) -> bool {
-        true
-    }
-
     async fn start_storage_session(&self) -> Result<(), Self::StorageError> {
         Ok(())
     }
@@ -103,11 +82,6 @@ pub trait ReplyStorageBackend: Sized {
 
     async fn load_surb_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError>;
 
-    /// In the case the storage backend is initialized in an inactive state (persisting data is
-    /// disabled), we might still need to fetch the (in-mem) storage and the parameters it was
-    /// created with.
-    fn get_inactive_storage(&self) -> Result<CombinedReplyStorage, Self::StorageError>;
-
     async fn stop_storage_session(self) -> Result<(), Self::StorageError> {
         Ok(())
     }

common/client-core/src/config/persistence/key_pathfinder.rs

@@ -40,6 +40,14 @@ impl ClientKeyPathfinder {
         }
     }
 
+    pub fn identity_key_pair_path(&self) -> nym_pemstore::KeyPairPath {
+        nym_pemstore::KeyPairPath::new(self.private_identity_key(), self.public_identity_key())
+    }
+
+    pub fn encryption_key_pair_path(&self) -> nym_pemstore::KeyPairPath {
+        nym_pemstore::KeyPairPath::new(self.private_encryption_key(), self.public_encryption_key())
+    }
+
     pub fn any_file_exists(&self) -> bool {
         matches!(self.identity_public_key.try_exists(), Ok(true))
             || matches!(self.identity_private_key.try_exists(), Ok(true))

common/client-core/src/error.rs

@@ -6,6 +6,7 @@ use nym_gateway_client::error::GatewayClientError;
 use nym_topology::gateway::GatewayConversionError;
 use nym_topology::NymTopologyError;
 use nym_validator_client::ValidatorClientError;
+use std::error::Error;
 
 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
@@ -41,13 +42,18 @@ pub enum ClientCoreError {
 
     #[error("experienced a failure with our reply surb persistent storage: {source}")]
     SurbStorageError {
-        source: Box<dyn std::error::Error + Send + Sync>,
+        source: Box<dyn Error + Send + Sync>,
+    },
+
+    #[error("experienced a failure with our cryptographic keys persistent storage: {source}")]
+    KeyStoreError {
+        source: Box<dyn Error + Send + Sync>,
     },
 
     #[error("The gateway id is invalid - {0}")]
     UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),
 
-    #[error("The identity of the gateway is unknwown - did you run init?")]
+    #[error("The identity of the gateway is unknown - did you run init?")]
     GatewayIdUnknown,
 
     #[error("The owner of the gateway is unknown - did you run init?")]

common/client-core/src/init/helpers.rs

@@ -1,14 +1,10 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use crate::{
-    client::key_manager::KeyManager,
-    config::{persistence::key_pathfinder::ClientKeyPathfinder, Config},
-    error::ClientCoreError,
-};
+use crate::error::ClientCoreError;
 use futures::{SinkExt, StreamExt};
 use log::{debug, info, trace, warn};
-use nym_config::NymConfig;
+use nym_credential_storage::storage::Storage;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
 use nym_gateway_requests::registration::handshake::SharedKeys;
@@ -29,10 +25,14 @@ use tokio::time::Instant;
 use tokio_tungstenite::connect_async;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
-
 #[cfg(not(target_arch = "wasm32"))]
 type WsConn = WebSocketStream<MaybeTlsStream<TcpStream>>;
-use nym_credential_storage::storage::Storage;
+#[cfg(not(target_arch = "wasm32"))]
+use crate::client::key_manager::persistence::OnDiskKeys;
+#[cfg(not(target_arch = "wasm32"))]
+use crate::config::{persistence::key_pathfinder::ClientKeyPathfinder, Config};
+#[cfg(not(target_arch = "wasm32"))]
+use nym_config::NymConfig;
 
 #[cfg(target_arch = "wasm32")]
 use nym_bandwidth_controller::wasm_mockups::DirectSigningNyxdClient;
@@ -224,10 +224,14 @@ pub(super) async fn query_gateway_details(
     }
 }
 
-pub(super) async fn register_with_gateway<St: Storage>(
+pub(super) async fn register_with_gateway<St>(
     gateway: &gateway::Node,
     our_identity: Arc<identity::KeyPair>,
-) -> Result<Arc<SharedKeys>, ClientCoreError> {
+) -> Result<Arc<SharedKeys>, ClientCoreError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
     let timeout = Duration::from_millis(1500);
     let mut gateway_client: GatewayClient<DirectSigningNyxdClient, St> = GatewayClient::new_init(
         gateway.clients_address(),
@@ -246,15 +250,12 @@ pub(super) async fn register_with_gateway<St: Storage>(
     Ok(shared_keys)
 }
 
-pub(super) fn store_keys<T>(
-    key_manager: &KeyManager,
-    config: &Config<T>,
-) -> Result<(), ClientCoreError>
+// TODO: make it generic
+#[cfg(not(target_arch = "wasm32"))]
+pub(super) fn on_disk_key_store<T>(config: &Config<T>) -> OnDiskKeys
 where
     T: NymConfig,
 {
     let pathfinder = ClientKeyPathfinder::new_from_config(config);
-    Ok(key_manager
-        .store_keys(&pathfinder)
-        .tap_err(|err| log::error!("Failed to generate keys: {err}"))?)
+    OnDiskKeys::new(pathfinder)
 }

common/client-core/src/init/mod.rs

@@ -1,20 +1,8 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 //! Collection of initialization steps used by client implementations
 
-use std::fmt::Display;
-
-use nym_sphinx::addressing::{clients::Recipient, nodes::NodeIdentity};
-use rand::rngs::OsRng;
-use serde::Serialize;
-use tap::TapFallible;
-
-use nym_config::NymConfig;
-use nym_credential_storage::storage::Storage;
-use nym_crypto::asymmetric::{encryption, identity};
-use url::Url;
-
 use crate::client::key_manager::KeyManager;
 use crate::{
     config::{
@@ -23,6 +11,16 @@ use crate::{
     },
     error::ClientCoreError,
 };
+use nym_config::NymConfig;
+use nym_credential_storage::storage::Storage;
+use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_requests::registration::handshake::SharedKeys;
+use nym_sphinx::addressing::{clients::Recipient, nodes::NodeIdentity};
+use serde::Serialize;
+use std::fmt::Display;
+use std::sync::Arc;
+use tap::TapFallible;
+use url::Url;
 
 mod helpers;
 
@@ -64,34 +62,29 @@ impl Display for InitResults {
     }
 }
 
-/// Create a new set of client keys.
-pub fn new_client_keys() -> KeyManager {
-    let mut rng = OsRng;
-    KeyManager::new(&mut rng)
-}
-
 /// Authenticate and register with a gateway.
 /// Either pick one at random by querying the available gateways from the nym-api, or use the
 /// chosen one if it's among the available ones.
 /// The shared key is added to the supplied `KeyManager` and the endpoint details are returned.
-pub async fn register_with_gateway<St: Storage>(
-    key_manager: &mut KeyManager,
+pub async fn register_with_gateway<St>(
+    identity_keys: Arc<identity::KeyPair>,
     nym_api_endpoints: Vec<Url>,
     chosen_gateway_id: Option<identity::PublicKey>,
     by_latency: bool,
-) -> Result<GatewayEndpointConfig, ClientCoreError> {
+) -> Result<(GatewayEndpointConfig, Arc<SharedKeys>), ClientCoreError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
     // Get the gateway details of the gateway we will use
     let gateway =
         helpers::query_gateway_details(nym_api_endpoints, chosen_gateway_id, by_latency).await?;
-    log::debug!("Querying gateway gives: {}", gateway);
-
-    let our_identity = key_manager.identity_keypair();
+    log::debug!("Querying gateway gives: {gateway}");
 
     // Establish connection, authenticate and generate keys for talking with the gateway
-    let shared_keys = helpers::register_with_gateway::<St>(&gateway, our_identity).await?;
-    key_manager.insert_gateway_shared_key(shared_keys);
+    let shared_keys = helpers::register_with_gateway::<St>(&gateway, identity_keys).await?;
 
-    Ok(gateway.into())
+    Ok((gateway.into(), shared_keys))
 }
 
 /// Convenience function for setting up the gateway for a client given a `Config`. Depending on the
@@ -101,6 +94,7 @@ pub async fn register_with_gateway<St: Storage>(
 /// b. Create a new gateway configuration but keep existing keys. This assumes that the caller
 ///    knows what they are doing and that the keys match the requested gateway.
 /// c. Create a new gateway configuration with a newly registered gateway and keys.
+#[cfg(not(target_arch = "wasm32"))]
 pub async fn setup_gateway_from_config<C, T, St>(
     register_gateway: bool,
     user_chosen_gateway_id: Option<identity::PublicKey>,
@@ -111,6 +105,7 @@ where
     C: NymConfig + ClientCoreConfigTrait,
     T: NymConfig,
     St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
     let id = config.get_id();
 
@@ -137,18 +132,24 @@ where
         return Ok(gateway.into());
     }
 
+    let key_store = helpers::on_disk_key_store(config);
+    let mut rng = rand::thread_rng();
+    let mut managed_keys =
+        crate::client::key_manager::ManagedKeys::load_or_generate(&mut rng, &key_store).await;
+
     // Create new keys and derive our identity
-    let mut key_manager = new_client_keys();
-    let our_identity = key_manager.identity_keypair();
+    let our_identity = managed_keys.identity_keypair();
 
     // Establish connection, authenticate and generate keys for talking with the gateway
     eprintln!("Registering with new gateway");
     let shared_keys = helpers::register_with_gateway::<St>(&gateway, our_identity).await?;
-    key_manager.insert_gateway_shared_key(shared_keys);
+    managed_keys
+        .deal_with_gateway_key(shared_keys, &key_store)
+        .await
+        .map_err(|source| ClientCoreError::KeyStoreError {
+            source: Box::new(source),
+        })?;
 
-    // Write all keys to storage and just return the gateway endpoint config. It is assumed that we
-    // will load keys from storage when actually connecting.
-    helpers::store_keys(&key_manager, config)?;
     Ok(gateway.into())
 }
 
@@ -185,6 +186,15 @@ pub fn get_client_address(
     )
 }
 
+pub fn load_identity_keys(
+    pathfinder: &ClientKeyPathfinder,
+) -> Result<identity::KeyPair, ClientCoreError> {
+    let identity_keypair: identity::KeyPair =
+        nym_pemstore::load_keypair(&pathfinder.identity_key_pair_path())
+            .tap_err(|_| log::error!("Failed to read stored identity key files"))?;
+    Ok(identity_keypair)
+}
+
 /// Get the client address by loading the keys from stored files.
 pub fn get_client_address_from_stored_keys<T>(
     config: &Config<T>,
@@ -192,18 +202,6 @@ pub fn get_client_address_from_stored_keys<T>(
 where
     T: nym_config::NymConfig,
 {
-    fn load_identity_keys(
-        pathfinder: &ClientKeyPathfinder,
-    ) -> Result<identity::KeyPair, ClientCoreError> {
-        let identity_keypair: identity::KeyPair =
-            nym_pemstore::load_keypair(&nym_pemstore::KeyPairPath::new(
-                pathfinder.private_identity_key().to_owned(),
-                pathfinder.public_identity_key().to_owned(),
-            ))
-            .tap_err(|_| log::error!("Failed to read stored identity key files"))?;
-        Ok(identity_keypair)
-    }
-
     fn load_sphinx_keys(
         pathfinder: &ClientKeyPathfinder,
     ) -> Result<encryption::KeyPair, ClientCoreError> {

common/client-libs/gateway-client/src/client.rs

@@ -72,6 +72,7 @@ impl<C, St> GatewayClient<C, St>
 where
     C: Sync + Send,
     St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
 {
     // TODO: put it all in a Config struct
     #[allow(clippy::too_many_arguments)]
@@ -79,6 +80,7 @@ where
         gateway_address: String,
         local_identity: Arc<identity::KeyPair>,
         gateway_identity: identity::PublicKey,
+        // TODO: make it mandatory. if you don't want to pass it, use `new_init`
         shared_key: Option<Arc<SharedKeys>>,
         mixnet_message_sender: MixnetMessageSender,
         ack_sender: AcknowledgementSender,

common/client-libs/gateway-client/src/lib.rs

@@ -1,16 +1,17 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::error::GatewayClientError;
 pub use client::GatewayClient;
 use log::warn;
-use nym_gateway_requests::registration::handshake::SharedKeys;
 use nym_gateway_requests::BinaryResponse;
 pub use packet_router::{
     AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
 };
 use tungstenite::{protocol::Message, Error as WsError};
 
+pub use nym_gateway_requests::registration::handshake::SharedKeys;
+
 pub mod client;
 pub mod error;
 pub mod packet_router;

common/client-libs/validator-client/src/nym_api/mod.rs

@@ -15,7 +15,8 @@ use nym_api_requests::models::{
 };
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
 use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, MixId};
-use nym_service_provider_directory_common::ServiceInfo;
+use nym_name_service_common::response::NamesListResponse;
+use nym_service_provider_directory_common::response::ServicesListResponse;
 use reqwest::{Response, StatusCode};
 use serde::{Deserialize, Serialize};
 use url::Url;
@@ -169,7 +170,7 @@ impl Client {
 
     pub async fn get_active_mixnodes(&self) -> Result<Vec<MixNodeDetails>, NymAPIError> {
         self.query_nym_api(
-            &[routes::API_VERSION, routes::MIXNODES],
+            &[routes::API_VERSION, routes::MIXNODES, routes::ACTIVE],
             NO_PARAMS,
         )
         .await
@@ -484,10 +485,18 @@ impl Client {
         .await
     }
 
-    pub async fn get_service_providers(&self) -> Result<Vec<ServiceInfo>, NymAPIError> {
+    pub async fn get_service_providers(&self) -> Result<ServicesListResponse, NymAPIError> {
+        log::trace!("Getting service providers");
         self.query_nym_api(&[routes::API_VERSION, routes::SERVICE_PROVIDERS], NO_PARAMS)
             .await
     }
+
+    //pub async fn get_registered_names(&self) -> Result<Vec<NameEntry>, NymAPIError> {
+    pub async fn get_registered_names(&self) -> Result<NamesListResponse, NymAPIError> {
+        log::trace!("Getting registered names");
+        self.query_nym_api(&[routes::API_VERSION, routes::REGISTERED_NAMES], NO_PARAMS)
+            .await
+    }
 }
 
 // utility function that should solve the double slash problem in validator API forever.

common/client-libs/validator-client/src/nym_api/routes.rs

@@ -33,4 +33,5 @@ pub const AVG_UPTIME: &str = "avg_uptime";
 pub const STAKE_SATURATION: &str = "stake-saturation";
 pub const INCLUSION_CHANCE: &str = "inclusion-probability";
 
-pub const SERVICE_PROVIDERS: &str = "service-providers";
+pub const SERVICE_PROVIDERS: &str = "services";
+pub const REGISTERED_NAMES: &str = "names";

common/client-libs/validator-client/src/nyxd/mod.rs

@@ -16,7 +16,7 @@ use cosmrs::rpc::query::Query;
 use cosmrs::rpc::Error as TendermintRpcError;
 use cosmrs::rpc::HttpClientUrl;
 use cosmrs::tx::Msg;
-use log::debug;
+use log::{debug, trace};
 use nym_network_defaults::{ChainDetails, NymNetworkDetails};
 use serde::{Deserialize, Serialize};
 use std::convert::TryInto;
@@ -79,8 +79,8 @@ impl Config {
         expected_prefix: &str,
     ) -> Result<Option<AccountId>, NyxdError> {
         if let Some(address) = raw {
-            debug!("Raw address:{:?}", raw);
-            debug!("Expected prefix:{:?}", expected_prefix);
+            trace!("Raw address:{:?}", raw);
+            trace!("Expected prefix:{:?}", expected_prefix);
             let parsed: AccountId = address
                 .parse()
                 .map_err(|_| NyxdError::MalformedAccountAddress(address.clone()))?;

common/client-libs/validator-client/src/nyxd/traits/sp_directory_query_client.rs

@@ -1,12 +1,12 @@
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use nym_contracts_common::ContractBuildInformation;
+use nym_contracts_common::{signing::Nonce, ContractBuildInformation};
 use nym_service_provider_directory_common::{
     msg::QueryMsg as SpQueryMsg,
     response::{
         ConfigResponse, PagedServicesListResponse, ServiceInfoResponse, ServicesListResponse,
     },
-    NymAddress, ServiceId, ServiceInfo,
+    NymAddress, Service, ServiceId,
 };
 use serde::Deserialize;
 
@@ -63,17 +63,14 @@ pub trait SpDirectoryQueryClient {
             .await
     }
 
-    async fn get_all_services(&self) -> Result<Vec<ServiceInfo>, NyxdError> {
+    async fn get_all_services(&self) -> Result<Vec<Service>, NyxdError> {
         let mut services = Vec::new();
         let mut start_after = None;
-
         loop {
             let mut paged_response = self.get_services_paged(start_after.take(), None).await?;
-
-            let last_id = paged_response.services.last().map(|serv| serv.service_id);
             services.append(&mut paged_response.services);
 
-            if let Some(start_after_res) = last_id {
+            if let Some(start_after_res) = paged_response.start_next_after {
                 start_after = Some(start_after_res)
             } else {
                 break;
@@ -82,6 +79,13 @@ pub trait SpDirectoryQueryClient {
 
         Ok(services)
     }
+
+    async fn get_service_signing_nonce(&self, address: &AccountId) -> Result<Nonce, NyxdError> {
+        self.query_service_provider_contract(SpQueryMsg::SigningNonce {
+            address: address.to_string(),
+        })
+        .await
+    }
 }
 
 #[async_trait]

common/client-libs/validator-client/src/nyxd/traits/sp_directory_signing_client.rs

@@ -2,8 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use async_trait::async_trait;
+use nym_contracts_common::signing::MessageSignature;
 use nym_service_provider_directory_common::{
-    msg::ExecuteMsg as SpExecuteMsg, NymAddress, ServiceId, ServiceType,
+    msg::ExecuteMsg as SpExecuteMsg, NymAddress, ServiceDetails, ServiceId,
 };
 
 use crate::nyxd::{
@@ -22,16 +23,16 @@ pub trait SpDirectorySigningClient {
 
     async fn announce_service_provider(
         &self,
-        nym_address: NymAddress,
-        service_type: ServiceType,
+        service: ServiceDetails,
+        owner_signature: MessageSignature,
         deposit: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_service_provider_directory_contract(
             fee,
             SpExecuteMsg::Announce {
-                nym_address,
-                service_type,
+                service,
+                owner_signature,
             },
             vec![deposit],
         )

common/commands/Cargo.toml

@@ -39,3 +39,5 @@ nym-coconut-bandwidth-contract-common = { path = "../cosmwasm-smart-contracts/co
 nym-coconut-dkg-common = { path = "../cosmwasm-smart-contracts/coconut-dkg" }
 nym-multisig-contract-common = { path = "../cosmwasm-smart-contracts/multisig-contract" }
 nym-service-provider-directory-common = { path = "../cosmwasm-smart-contracts/service-provider-directory" }
+nym-name-service-common = { path = "../cosmwasm-smart-contracts/name-service" }
+nym-sphinx = { path = "../../common/nymsphinx" }

common/commands/src/validator/mixnet/mod.rs

@@ -14,6 +14,7 @@ pub struct Mixnet {
     pub command: MixnetCommands,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
 pub enum MixnetCommands {
     /// Query the mixnet directory

common/commands/src/validator/mixnet/operators/mod.rs

@@ -5,6 +5,7 @@ use clap::{Args, Subcommand};
 
 pub mod gateway;
 pub mod mixnode;
+pub mod name;
 pub mod service;
 
 #[derive(Debug, Args)]
@@ -14,6 +15,7 @@ pub struct MixnetOperators {
     pub command: MixnetOperatorsCommands,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
 pub enum MixnetOperatorsCommands {
     /// Manage your mixnode
@@ -22,4 +24,6 @@ pub enum MixnetOperatorsCommands {
     Gateway(gateway::MixnetOperatorsGateway),
     /// Manage your service
     ServiceProvider(service::MixnetOperatorsService),
+    /// Manage your registered name
+    Name(name::MixnetOperatorsName),
 }

common/commands/src/validator/mixnet/operators/name/delete.rs

@@ -0,0 +1,25 @@
+use clap::Parser;
+use log::{error, info};
+use nym_name_service_common::NameId;
+use nym_validator_client::nyxd::{error::NyxdError, traits::NameServiceSigningClient};
+use tap::TapFallible;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub id: NameId,
+}
+
+pub async fn delete(args: Args, client: SigningClient) -> Result<(), NyxdError> {
+    info!("Deleting registered name alias with id {}", args.id);
+
+    let res = client
+        .delete_name_by_id(args.id, None)
+        .await
+        .tap_err(|err| error!("Failed to delete name: {err:#?}"))?;
+
+    info!("Deleted: {res:?}");
+    Ok(())
+}

common/commands/src/validator/mixnet/operators/name/mod.rs

@@ -0,0 +1,19 @@
+use clap::{Args, Subcommand};
+
+pub mod delete;
+pub mod register;
+
+#[derive(Debug, Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct MixnetOperatorsName {
+    #[clap(subcommand)]
+    pub command: MixnetOperatorsNameCommands,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum MixnetOperatorsNameCommands {
+    /// Register a name alias for a nym address
+    Register(register::Args),
+    /// Delete name alias for a nym address
+    Delete(delete::Args),
+}

common/commands/src/validator/mixnet/operators/name/register.rs

@@ -0,0 +1,43 @@
+use clap::Parser;
+use log::{error, info};
+use nym_name_service_common::{Address, Coin, NymName};
+use nym_validator_client::nyxd::{error::NyxdError, traits::NameServiceSigningClient};
+use tap::TapFallible;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// Name alias
+    #[clap(long)]
+    pub name: String,
+
+    /// Nym address that the alias is pointing to
+    #[clap(long)]
+    pub nym_address: String,
+
+    /// Deposit to be made to the service provider directory, in curent DENOMINATION (e.g. 'unym')
+    #[clap(long)]
+    pub deposit: u128,
+}
+
+pub async fn register(args: Args, client: SigningClient) -> Result<(), NyxdError> {
+    info!(
+        "Registering name alias '{}' for nym address '{}'",
+        args.name, args.nym_address
+    );
+
+    let name = NymName::new(&args.name).expect("invalid name");
+    let address = Address::new(&args.nym_address);
+
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+    let deposit = Coin::new(args.deposit, denom);
+
+    let res = client
+        .register_name(name, address, deposit.into(), None)
+        .await
+        .tap_err(|err| error!("Failed to register name: {err:#?}"))?;
+
+    info!("Registered name: {res:?}");
+    Ok(())
+}

common/commands/src/validator/mixnet/operators/service/announce.rs

@@ -1,6 +1,7 @@
 use clap::Parser;
 use log::info;
-use nym_service_provider_directory_common::{Coin, NymAddress, ServiceType};
+use nym_contracts_common::signing::MessageSignature;
+use nym_service_provider_directory_common::{Coin, NymAddress, ServiceDetails, ServiceType};
 use nym_validator_client::nyxd::traits::SpDirectorySigningClient;
 
 use crate::context::SigningClient;
@@ -10,9 +11,15 @@ pub struct Args {
     #[clap(long)]
     pub nym_address: String,
 
+    #[clap(long)]
+    pub signature: MessageSignature,
+
     /// Deposit to be made to the service provider directory, in curent DENOMINATION (e.g. 'unym')
     #[clap(long)]
     pub deposit: u128,
+
+    #[clap(long)]
+    pub identity_key: String,
 }
 
 pub async fn announce(args: Args, client: SigningClient) {
@@ -20,12 +27,17 @@ pub async fn announce(args: Args, client: SigningClient) {
 
     let nym_address = NymAddress::Address(args.nym_address);
     let service_type = ServiceType::NetworkRequester;
+    let service = ServiceDetails {
+        nym_address,
+        service_type,
+        identity_key: args.identity_key,
+    };
 
     let denom = client.current_chain_details().mix_denom.base.as_str();
     let deposit = Coin::new(args.deposit, denom);
 
     let res = client
-        .announce_service_provider(nym_address, service_type, deposit.into(), None)
+        .announce_service_provider(service, args.signature, deposit.into(), None)
         .await
         .expect("Failed to announce service provider");
 

common/commands/src/validator/mixnet/operators/service/announce_sign_payload.rs

@@ -0,0 +1,61 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    context::SigningClient,
+    utils::{account_id_to_cw_addr, DataWrapper},
+};
+
+use clap::Parser;
+use cosmwasm_std::Coin;
+
+use nym_bin_common::output_format::OutputFormat;
+use nym_service_provider_directory_common::{
+    signing_types::construct_service_provider_announce_sign_payload, NymAddress,
+    ServiceType::NetworkRequester,
+};
+use nym_sphinx::addressing::clients::Recipient;
+use nym_validator_client::nyxd::traits::SpDirectoryQueryClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub nym_address: Recipient,
+
+    #[clap(long)]
+    pub amount: u128,
+
+    #[clap(long)]
+    pub identity_key: String,
+
+    #[clap(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+pub async fn create_payload(args: Args, client: SigningClient) {
+    let service = nym_service_provider_directory_common::ServiceDetails {
+        nym_address: NymAddress::new(&args.nym_address.to_string()),
+        service_type: NetworkRequester,
+        identity_key: args.identity_key,
+    };
+
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+    let deposit = Coin::new(args.amount, denom);
+
+    let nonce = match client.get_service_signing_nonce(client.address()).await {
+        Ok(nonce) => nonce,
+        Err(err) => {
+            eprint!(
+                "failed to query for the signing nonce of {}: {err}",
+                client.address()
+            );
+            return;
+        }
+    };
+
+    let address = account_id_to_cw_addr(client.address());
+    let payload =
+        construct_service_provider_announce_sign_payload(nonce, address, deposit, service);
+    let wrapper = DataWrapper::new(payload.to_base58_string().unwrap());
+    println!("{}", args.output.format(&wrapper))
+}

common/commands/src/validator/mixnet/operators/service/mod.rs

@@ -1,6 +1,7 @@
 use clap::{Args, Subcommand};
 
 pub mod announce;
+pub mod announce_sign_payload;
 pub mod delete;
 
 #[derive(Debug, Args)]
@@ -10,10 +11,13 @@ pub struct MixnetOperatorsService {
     pub command: MixnetOperatorsServiceCommands,
 }
 
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug, Subcommand)]
 pub enum MixnetOperatorsServiceCommands {
     /// Announce service provider to the world
     Announce(announce::Args),
     /// Delete entry for service provider from the directory
     Delete(delete::Args),
+    /// Create base58-encoded payload required for producing valid announce signature.
+    CreateServiceAnnounceSignPayload(announce_sign_payload::Args),
 }

common/commands/src/validator/mixnet/query/mod.rs

@@ -5,6 +5,7 @@ use clap::{Args, Subcommand};
 
 pub mod query_all_gateways;
 pub mod query_all_mixnodes;
+pub mod query_all_names;
 pub mod query_all_service_providers;
 
 #[derive(Debug, Args)]
@@ -22,4 +23,6 @@ pub enum MixnetQueryCommands {
     Gateways(query_all_gateways::Args),
     /// Query announced service-providers
     ServiceProviders(query_all_service_providers::Args),
+    /// Query registed names
+    Names(query_all_names::Args),
 }

common/commands/src/validator/mixnet/query/query_all_names.rs

@@ -0,0 +1,53 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::Parser;
+use comfy_table::Table;
+use nym_validator_client::nym_api::error::NymAPIError;
+
+use crate::context::QueryClientWithNyxd;
+use crate::utils::show_error;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(value_parser)]
+    #[clap(help = "Optionally, the registered name to display")]
+    pub name: Option<String>,
+}
+
+pub async fn query(args: Args, client: &QueryClientWithNyxd) {
+    log::trace!("Querying all registered names");
+
+    match client.nym_api.get_registered_names().await {
+        Ok(res) => {
+            if let Some(name) = args.name {
+                let name = res.names.iter().find(|name_entry| {
+                    name_entry.name.name.to_string().eq_ignore_ascii_case(&name)
+                });
+                println!(
+                    "{}",
+                    ::serde_json::to_string_pretty(&name).expect("json formatting error")
+                );
+            } else {
+                let mut table = Table::new();
+
+                table.set_header(vec!["Name Id", "Owner", "Nym Address", "Name"]);
+                for name_entry in res.names {
+                    table.add_row(vec![
+                        name_entry.name_id.to_string(),
+                        name_entry.name.owner.to_string(),
+                        name_entry.name.address.to_string(),
+                        name_entry.name.name.to_string(),
+                    ]);
+                }
+
+                println!("The registered names in the directory are:");
+                println!("{table}");
+            }
+        }
+        Err(NymAPIError::NotFound) => {
+            println!("nym-api reports no name endpoint available");
+        }
+        Err(e) => show_error(e),
+    }
+}

common/commands/src/validator/mixnet/query/query_all_service_providers.rs

@@ -19,7 +19,7 @@ pub async fn query(args: Args, client: &QueryClientWithNyxd) {
     match client.nym_api.get_service_providers().await {
         Ok(res) => {
             if let Some(nym_address) = args.nym_address {
-                let service = res.iter().find(|service| {
+                let service = res.services.iter().find(|service| {
                     service
                         .service
                         .nym_address
@@ -33,11 +33,11 @@ pub async fn query(args: Args, client: &QueryClientWithNyxd) {
             } else {
                 let mut table = Table::new();
 
-                table.set_header(vec!["Service Id", "Announcer", "Nym Address"]);
-                for service in res {
+                table.set_header(vec!["Service Id", "Announcer", "Type", "Nym Address"]);
+                for service in res.services {
                     table.add_row(vec![
                         service.service_id.to_string(),
-                        service.service.announcer.to_string(),
+                        service.announcer.to_string(),
                         service.service.service_type.to_string(),
                         service.service.nym_address.to_string(),
                     ]);

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-contracts-common"
-version = "0.4.0"
+version = "0.5.0"
 description = "Common library for Nym cosmwasm contracts"
 edition = { workspace = true }
 authors = { workspace = true }

common/cosmwasm-smart-contracts/contracts-common/src/types.rs

@@ -11,6 +11,9 @@ use std::ops::Mul;
 use std::str::FromStr;
 use thiserror::Error;
 
+pub type IdentityKey = String;
+pub type IdentityKeyRef<'a> = &'a str;
+
 pub fn truncate_decimal(amount: Decimal) -> Uint128 {
     amount * Uint128::new(1)
 }

common/cosmwasm-smart-contracts/mixnet-contract/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-mixnet-contract-common"
-version = "0.5.0"
+version = "0.6.0"
 description = "Common library for the Nym mixnet contract"
 rust-version = "1.62"
 edition = { workspace = true }
@@ -15,7 +15,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_repr = "0.1"
 schemars = "0.8"
 thiserror = "1.0"
-contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.4.0" }
+contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.5.0" }
 # use 0.4.1 as that's the version used by cosmwasm-std 1.0.0
 # (and ideally we don't want to pull the same dependency twice)
 serde-json-wasm = "=0.4.1"

common/cosmwasm-smart-contracts/mixnet-contract/src/types.rs

@@ -4,6 +4,7 @@
 use crate::error::MixnetContractError;
 use crate::families::{Family, FamilyHead};
 use crate::{Layer, RewardedSetNodeStatus};
+use contracts_common::IdentityKey;
 use cosmwasm_std::Addr;
 use cosmwasm_std::Coin;
 use schemars::JsonSchema;
@@ -11,8 +12,6 @@ use serde::{Deserialize, Serialize};
 use std::ops::Index;
 
 // type aliases for better reasoning about available data
-pub type IdentityKey = String;
-pub type IdentityKeyRef<'a> = &'a str;
 pub type SphinxKey = String;
 pub type SphinxKeyRef<'a> = &'a str;
 pub type EpochId = u32;

common/cosmwasm-smart-contracts/name-service/src/lib.rs

@@ -5,3 +5,5 @@ pub mod types;
 
 // Re-export all types at the top-level
 pub use types::*;
+
+pub use cosmwasm_std::{Addr, Coin, Decimal, Fraction};

common/cosmwasm-smart-contracts/service-provider-directory/Cargo.toml

@@ -7,5 +7,9 @@ edition = "2021"
 
 [dependencies]
 cosmwasm-std = { workspace = true }
+nym-contracts-common = { path = "../contracts-common", version = "0.5.0" }
 schemars = "0.8"
 serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
+cw-utils = { workspace = true }
+cw-controllers = { workspace = true }

common/cosmwasm-smart-contracts/service-provider-directory/src/error.rs

@@ -1,10 +1,12 @@
 use cosmwasm_std::{Addr, StdError};
 use cw_controllers::AdminError;
-use nym_service_provider_directory_common::{NymAddress, ServiceId};
+use nym_contracts_common::signing::verifier::ApiVerifierError;
 use thiserror::Error;
 
+use crate::{NymAddress, ServiceId};
+
 #[derive(Error, Debug, PartialEq)]
-pub enum ContractError {
+pub enum SpContractError {
     #[error("{0}")]
     Std(#[from] StdError),
 
@@ -46,6 +48,21 @@ pub enum ContractError {
         value: String,
         error_message: String,
     },
+
+    #[error("Failed to recover ed25519 public key from its base58 representation - {0}")]
+    MalformedEd25519IdentityKey(String),
+
+    #[error("Failed to recover ed25519 signature from its base58 representation - {0}")]
+    MalformedEd25519Signature(String),
+
+    #[error("Provided ed25519 signature did not verify correctly")]
+    InvalidEd25519Signature,
+
+    #[error("failed to verify message signature: {source}")]
+    SignatureVerificationFailure {
+        #[from]
+        source: ApiVerifierError,
+    },
 }
 
-pub(crate) type Result<T, E = ContractError> = std::result::Result<T, E>;
+pub type Result<T, E = SpContractError> = std::result::Result<T, E>;

common/cosmwasm-smart-contracts/service-provider-directory/src/events.rs

@@ -39,16 +39,16 @@ pub fn new_announce_event(service_id: ServiceId, service: Service) -> Event {
     Event::new(ServiceProviderEventType::Announce)
         .add_attribute(ACTION, ServiceProviderEventType::Announce)
         .add_attribute(SERVICE_ID, service_id.to_string())
-        .add_attribute(SERVICE_TYPE, service.service_type.to_string())
-        .add_attribute(NYM_ADDRESS, service.nym_address.to_string())
+        .add_attribute(SERVICE_TYPE, service.service.service_type.to_string())
+        .add_attribute(NYM_ADDRESS, service.service.nym_address.to_string())
         .add_attribute(OWNER, service.announcer.to_string())
 }
 
-pub fn new_delete_id_event(service_id: ServiceId, service: Service) -> Event {
+pub fn new_delete_id_event(service: Service) -> Event {
     Event::new(ServiceProviderEventType::DeleteId)
         .add_attribute(ACTION, ServiceProviderEventType::DeleteId)
-        .add_attribute(SERVICE_ID, service_id.to_string())
-        .add_attribute(NYM_ADDRESS, service.nym_address.to_string())
+        .add_attribute(SERVICE_ID, service.service_id.to_string())
+        .add_attribute(NYM_ADDRESS, service.service.nym_address.to_string())
 }
 
 pub fn new_update_deposit_required_event(deposit_required: Coin) -> Event {

common/cosmwasm-smart-contracts/service-provider-directory/src/lib.rs

@@ -1,6 +1,8 @@
+pub mod error;
 pub mod events;
 pub mod msg;
 pub mod response;
+pub mod signing_types;
 pub mod types;
 
 // Re-export all types at the top-level

common/cosmwasm-smart-contracts/service-provider-directory/src/msg.rs

@@ -1,5 +1,6 @@
-use crate::{NymAddress, ServiceId, ServiceType};
+use crate::{NymAddress, ServiceDetails, ServiceId};
 use cosmwasm_std::Coin;
+use nym_contracts_common::signing::MessageSignature;
 use serde::{Deserialize, Serialize};
 
 #[derive(Serialize, Deserialize, PartialEq, Debug, Clone)]
@@ -22,8 +23,8 @@ pub struct MigrateMsg {}
 #[serde(rename_all = "snake_case")]
 pub enum ExecuteMsg {
     Announce {
-        nym_address: NymAddress,
-        service_type: ServiceType,
+        service: ServiceDetails,
+        owner_signature: MessageSignature,
     },
     DeleteId {
         service_id: ServiceId,
@@ -44,9 +45,12 @@ impl ExecuteMsg {
     pub fn default_memo(&self) -> String {
         match self {
             ExecuteMsg::Announce {
-                nym_address,
-                service_type,
-            } => format!("announcing {nym_address} as type {service_type}"),
+                service,
+                owner_signature: _,
+            } => format!(
+                "announcing {} as type {}",
+                service.nym_address, service.service_type
+            ),
             ExecuteMsg::DeleteId { service_id } => {
                 format!("deleting service with service id {service_id}")
             }
@@ -76,6 +80,9 @@ pub enum QueryMsg {
         limit: Option<u32>,
         start_after: Option<ServiceId>,
     },
+    SigningNonce {
+        address: String,
+    },
     Config {},
     GetContractVersion {},
     #[serde(rename = "get_cw2_contract_version")]

common/cosmwasm-smart-contracts/service-provider-directory/src/response.rs

@@ -1,4 +1,4 @@
-use crate::{msg::ExecuteMsg, Service, ServiceId, ServiceInfo};
+use crate::{Service, ServiceId};
 use cosmwasm_std::Coin;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -13,22 +13,17 @@ pub struct ServiceInfoResponse {
 #[derive(Serialize, Deserialize, PartialEq, Debug, Clone, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub struct ServicesListResponse {
-    pub services: Vec<ServiceInfo>,
+    pub services: Vec<Service>,
 }
 
 impl ServicesListResponse {
-    pub fn new(services: Vec<(ServiceId, Service)>) -> ServicesListResponse {
-        ServicesListResponse {
-            services: services
-                .into_iter()
-                .map(|(service_id, service)| ServiceInfo::new(service_id, service))
-                .collect(),
-        }
+    pub fn new(services: Vec<Service>) -> ServicesListResponse {
+        ServicesListResponse { services }
     }
 }
 
-impl From<&[ServiceInfo]> for ServicesListResponse {
-    fn from(services: &[ServiceInfo]) -> Self {
+impl From<&[Service]> for ServicesListResponse {
+    fn from(services: &[Service]) -> Self {
         Self {
             services: services.to_vec(),
         }
@@ -38,21 +33,17 @@ impl From<&[ServiceInfo]> for ServicesListResponse {
 #[derive(Serialize, Deserialize, PartialEq, Debug, Clone)]
 #[serde(rename_all = "snake_case")]
 pub struct PagedServicesListResponse {
-    pub services: Vec<ServiceInfo>,
+    pub services: Vec<Service>,
     pub per_page: usize,
     pub start_next_after: Option<ServiceId>,
 }
 
 impl PagedServicesListResponse {
     pub fn new(
-        services: Vec<(ServiceId, Service)>,
+        services: Vec<Service>,
         per_page: usize,
         start_next_after: Option<ServiceId>,
     ) -> PagedServicesListResponse {
-        let services = services
-            .into_iter()
-            .map(|(service_id, service)| ServiceInfo::new(service_id, service))
-            .collect();
         PagedServicesListResponse {
             services,
             per_page,
@@ -66,12 +57,3 @@ impl PagedServicesListResponse {
 pub struct ConfigResponse {
     pub deposit_required: Coin,
 }
-
-impl From<Service> for ExecuteMsg {
-    fn from(service: Service) -> Self {
-        ExecuteMsg::Announce {
-            nym_address: service.nym_address,
-            service_type: service.service_type,
-        }
-    }
-}

common/cosmwasm-smart-contracts/service-provider-directory/src/signing_types.rs

@@ -0,0 +1,33 @@
+use cosmwasm_std::{Addr, Coin};
+use nym_contracts_common::signing::{
+    ContractMessageContent, MessageType, Nonce, SignableMessage, SigningPurpose,
+};
+use serde::Serialize;
+
+use crate::ServiceDetails;
+
+pub type SignableServiceProviderAnnounceMsg =
+    SignableMessage<ContractMessageContent<ServiceProviderAnnounce>>;
+
+#[derive(Serialize)]
+pub struct ServiceProviderAnnounce {
+    service: ServiceDetails,
+}
+
+impl SigningPurpose for ServiceProviderAnnounce {
+    fn message_type() -> MessageType {
+        MessageType::new("service-provider-announce")
+    }
+}
+
+pub fn construct_service_provider_announce_sign_payload(
+    nonce: Nonce,
+    sender: Addr,
+    deposit: Coin,
+    service: ServiceDetails,
+) -> SignableServiceProviderAnnounceMsg {
+    let payload = ServiceProviderAnnounce { service };
+    let proxy = None;
+    let content = ContractMessageContent::new(sender, proxy, vec![deposit], payload);
+    SignableMessage::new(nonce, content)
+}

common/cosmwasm-smart-contracts/service-provider-directory/src/types.rs

@@ -1,6 +1,7 @@
 use std::fmt::{Display, Formatter};
 
 use cosmwasm_std::{Addr, Coin};
+use nym_contracts_common::IdentityKey;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
@@ -9,11 +10,11 @@ pub type ServiceId = u32;
 
 #[derive(Serialize, Deserialize, Clone, PartialEq, Debug, JsonSchema)]
 pub struct Service {
-    /// The address of the service.
-    pub nym_address: NymAddress,
-    /// The service type.
-    pub service_type: ServiceType,
-    /// Service owner.
+    /// Unique id assigned to the anounced service.
+    pub service_id: ServiceId,
+    /// The announced service.
+    pub service: ServiceDetails,
+    /// Address of the service owner.
     pub announcer: Addr,
     /// Block height at which the service was added.
     pub block_height: u64,
@@ -21,6 +22,16 @@ pub struct Service {
     pub deposit: Coin,
 }
 
+#[derive(Serialize, Deserialize, Clone, PartialEq, Debug, JsonSchema)]
+pub struct ServiceDetails {
+    /// The address of the service.
+    pub nym_address: NymAddress,
+    /// The service type.
+    pub service_type: ServiceType,
+    /// The identity key of the service.
+    pub identity_key: IdentityKey,
+}
+
 /// The types of addresses supported.
 #[derive(Serialize, Deserialize, Clone, PartialEq, Eq, Debug, JsonSchema)]
 #[serde(rename_all = "snake_case")]
@@ -28,7 +39,7 @@ pub enum NymAddress {
     /// String representation of a nym address, which is of the form
     /// client_id.client_enc@gateway_id.
     Address(String),
-    // For the future when we have a nym-dns contract
+    // String name that can looked up in the nym-name-service contract (once it exists)
     //Name(String),
 }
 
@@ -41,6 +52,7 @@ impl NymAddress {
     pub fn as_str(&self) -> &str {
         match self {
             NymAddress::Address(address) => address,
+            //NymAddress::Name(name) => name,
         }
     }
 }
@@ -66,19 +78,3 @@ impl std::fmt::Display for ServiceType {
         write!(f, "{service_type}")
     }
 }
-
-#[derive(Serialize, Deserialize, PartialEq, Debug, Clone, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub struct ServiceInfo {
-    pub service_id: ServiceId,
-    pub service: Service,
-}
-
-impl ServiceInfo {
-    pub fn new(service_id: ServiceId, service: Service) -> Self {
-        Self {
-            service_id,
-            service,
-        }
-    }
-}

common/cosmwasm-smart-contracts/vesting-contract/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-vesting-contract-common"
-version = "0.6.0"
+version = "0.7.0"
 description = "Common library for the Nym vesting contract"
 edition = { workspace = true }
 authors = { workspace = true }
@@ -9,8 +9,8 @@ repository = { workspace = true }
 
 [dependencies]
 cosmwasm-std = { workspace = true }
-mixnet-contract-common = { path = "../mixnet-contract", package = "nym-mixnet-contract-common", version = "0.5.0" }
-contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.4.0" }
+mixnet-contract-common = { path = "../mixnet-contract", package = "nym-mixnet-contract-common", version = "0.6.0" }
+contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.5.0" }
 serde = { version = "1.0", features = ["derive"] }
 schemars = "0.8"
 ts-rs = {version = "6.1.2", optional = true}

common/credential-storage/src/ephemeral_storage.rs

@@ -24,6 +24,8 @@ impl Default for EphemeralStorage {
 
 #[async_trait]
 impl Storage for EphemeralStorage {
+    type StorageError = StorageError;
+
     async fn insert_coconut_credential(
         &self,
         voucher_value: String,

common/credential-storage/src/lib.rs

@@ -10,7 +10,7 @@ use crate::persistent_storage::PersistentStorage;
 mod backends;
 pub mod ephemeral_storage;
 pub mod error;
-mod models;
+pub mod models;
 #[cfg(not(target_arch = "wasm32"))]
 pub mod persistent_storage;
 pub mod storage;

common/credential-storage/src/persistent_storage.rs

@@ -56,6 +56,8 @@ impl PersistentStorage {
 
 #[async_trait]
 impl Storage for PersistentStorage {
+    type StorageError = StorageError;
+
     async fn insert_coconut_credential(
         &self,
         voucher_value: String,

common/credential-storage/src/storage.rs

@@ -1,13 +1,14 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use async_trait::async_trait;
-
-use crate::error::StorageError;
 use crate::models::CoconutCredential;
+use async_trait::async_trait;
+use std::error::Error;
 
 #[async_trait]
 pub trait Storage: Send + Sync {
+    type StorageError: Error;
+
     /// Inserts provided signature into the database.
     ///
     /// # Arguments
@@ -26,15 +27,15 @@ pub trait Storage: Send + Sync {
         binding_number: String,
         signature: String,
         epoch_id: String,
-    ) -> Result<(), StorageError>;
+    ) -> Result<(), Self::StorageError>;
 
     /// Tries to retrieve one of the stored, unused credentials.
-    async fn get_next_coconut_credential(&self) -> Result<CoconutCredential, StorageError>;
+    async fn get_next_coconut_credential(&self) -> Result<CoconutCredential, Self::StorageError>;
 
     /// Marks as consumed in the database the specified credential.
     ///
     /// # Arguments
     ///
     /// * `id`: Id of the credential to be consumed.
-    async fn consume_coconut_credential(&self, id: i64) -> Result<(), StorageError>;
+    async fn consume_coconut_credential(&self, id: i64) -> Result<(), Self::StorageError>;
 }

common/crypto/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-crypto"
-version = "0.3.0"
+version = "0.4.0"
 description = "Crypto library for the nym mixnet"
 edition = { workspace = true }
 authors = { workspace = true }
@@ -13,7 +13,7 @@ bs58 = "0.4.0"
 blake3 = { version = "1.3.1", features = ["traits-preview"], optional = true }
 ctr = { version = "0.9.1", optional = true }
 digest = { version = "0.10.3", optional = true }
-generic-array = { version = "0.14", optional = true }
+generic-array = { workspace = true, optional = true }
 hkdf = { version = "0.12.3", optional = true }
 hmac = { version = "0.12.1", optional = true }
 cipher = { version = "0.4.3", optional = true }
@@ -21,20 +21,20 @@ x25519-dalek = { version = "1.1", optional = true }
 ed25519-dalek = { version = "1.0", optional = true }
 rand = { version = "0.7.3", features = ["wasm-bindgen"], optional = true }
 serde_bytes = { version = "0.11.6", optional = true }
-serde_crate = { version = "1.0", optional = true, default_features = false, package = "serde" }
+serde_crate = { version = "1.0", optional = true, default_features = false, features = ["derive"], package = "serde" }
 subtle-encoding = { version = "0.5", features =  ["bech32-preview"]}
 thiserror = "1.0.37"
-zeroize = { version = "1.5.7", optional = true, features = ["zeroize_derive"] }
+zeroize = { workspace = true, optional = true, features = ["zeroize_derive"] }
 
 # internal
 nym-sphinx-types = { path = "../nymsphinx/types", version = "0.2.0" }
-nym-pemstore = { path = "../../common/pemstore", version = "0.2.0" }
+nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }
 
 [dev-dependencies]
 rand_chacha = "0.2"
 
 [features]
 serde = ["serde_crate", "serde_bytes", "ed25519-dalek/serde", "x25519-dalek/serde"]
-asymmetric = ["x25519-dalek", "ed25519-dalek"]
+asymmetric = ["x25519-dalek", "ed25519-dalek", "zeroize"]
 hashing = ["blake3", "digest", "hkdf", "hmac", "generic-array"]
 symmetric = ["aes", "ctr", "cipher", "generic-array"]

common/crypto/src/asymmetric/encryption/mod.rs

@@ -1,10 +1,11 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
 use std::fmt::{self, Display, Formatter};
 use std::str::FromStr;
 use thiserror::Error;
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 #[cfg(feature = "rand")]
 use rand::{CryptoRng, RngCore};
@@ -41,8 +42,14 @@ pub enum KeyRecoveryError {
     },
 }
 
+#[derive(Zeroize, ZeroizeOnDrop)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "serde", serde(crate = "serde_crate"))]
 pub struct KeyPair {
     pub(crate) private_key: PrivateKey,
+
+    // nothing secret about public key
+    #[zeroize(skip)]
     pub(crate) public_key: PublicKey,
 }
 
@@ -178,6 +185,7 @@ impl PemStorableKey for PublicKey {
     }
 }
 
+#[derive(Zeroize, ZeroizeOnDrop)]
 pub struct PrivateKey(x25519_dalek::StaticSecret);
 
 impl Display for PrivateKey {
@@ -306,17 +314,24 @@ impl From<nym_sphinx_types::PrivateKey> for PrivateKey {
 #[cfg(test)]
 mod sphinx_key_conversion {
     use super::*;
+    use rand_chacha::rand_core::SeedableRng;
+    use rand_chacha::ChaCha20Rng;
+
+    pub(super) fn test_rng() -> ChaCha20Rng {
+        let dummy_seed = [42u8; 32];
+        ChaCha20Rng::from_seed(dummy_seed)
+    }
 
     const NUM_ITERATIONS: usize = 100;
 
     #[test]
     fn works_for_forward_conversion() {
-        let mut rng = rand::rngs::OsRng;
+        let mut rng = test_rng();
 
         for _ in 0..NUM_ITERATIONS {
             let keys = KeyPair::new(&mut rng);
-            let private = keys.private_key;
-            let public = keys.public_key;
+            let private = &keys.private_key;
+            let public = &keys.public_key;
 
             let private_bytes = private.to_bytes();
             let public_bytes = public.to_bytes();

common/crypto/src/asymmetric/identity/mod.rs

@@ -1,4 +1,4 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 pub use ed25519_dalek::ed25519::signature::Signature as SignatureTrait;
@@ -9,6 +9,7 @@ use nym_sphinx_types::{DestinationAddressBytes, DESTINATION_ADDRESS_LENGTH};
 use std::fmt::{self, Display, Formatter};
 use std::str::FromStr;
 use thiserror::Error;
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 #[cfg(feature = "rand")]
 use rand::{CryptoRng, RngCore};
@@ -44,9 +45,14 @@ pub enum Ed25519RecoveryError {
 }
 
 /// Keypair for usage in ed25519 EdDSA.
-#[derive(Debug)]
+#[derive(Debug, Zeroize, ZeroizeOnDrop)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "serde", serde(crate = "serde_crate"))]
 pub struct KeyPair {
     private_key: PrivateKey,
+
+    // nothing secret about public key
+    #[zeroize(skip)]
     public_key: PublicKey,
 }
 
@@ -189,7 +195,7 @@ impl PemStorableKey for PublicKey {
 }
 
 /// ed25519 EdDSA Private Key
-#[derive(Debug)]
+#[derive(Debug, Zeroize, ZeroizeOnDrop)]
 pub struct PrivateKey(ed25519_dalek::SecretKey);
 
 impl Display for PrivateKey {

common/mixnode-common/src/packet_processor/key_storage.rs

@@ -1,38 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use std::sync::{Arc, Mutex};
-use std::collections::HashMap;
-use nym_sphinx_types::{
-    SharedSecret, RoutingKeys
-};
-
-
-#[derive(Clone, Debug)]
-pub struct KeyStorage(Arc<Mutex<HashMap<SharedSecret, (RoutingKeys, Option<SharedSecret>)>>>);
-
-impl KeyStorage {
-    pub fn new() -> Self {
-        KeyStorage(Arc::new(Mutex::new(
-            HashMap::new()
-        )))
-    }
-
-
-    pub fn lookup(&self, key : SharedSecret) -> Option<(RoutingKeys, Option<SharedSecret>)> {
-        match self.0.lock() {
-            Ok(map) => map.get(&key).cloned(),
-            Err(_) => None,
-        }
-    }
-
-    pub fn store(&self, key : SharedSecret, routing_key : RoutingKeys, blinded_shared_secret : Option<SharedSecret>) {
-        match self.0.lock() {
-            Ok(mut map) => map.insert(key, (routing_key, blinded_shared_secret)),
-            Err(_) => return,
-        };
-    }
-
-}
-
-

common/mixnode-common/src/packet_processor/mod.rs

@@ -3,4 +3,3 @@
 
 pub mod error;
 pub mod processor;
-mod key_storage;

common/mixnode-common/src/packet_processor/processor.rs

@@ -3,7 +3,6 @@
 
 use crate::measure;
 use crate::packet_processor::error::MixProcessingError;
-use crate::packet_processor::key_storage::KeyStorage;
 use log::*;
 use nym_sphinx_acknowledgements::surb_ack::SurbAck;
 use nym_sphinx_addressing::nodes::NymNodeRoutingAddress;
@@ -12,7 +11,7 @@ use nym_sphinx_framing::packet::FramedSphinxPacket;
 use nym_sphinx_params::{PacketMode, PacketSize};
 use nym_sphinx_types::{
     Delay as SphinxDelay, DestinationAddressBytes, NodeAddressBytes, Payload, PrivateKey,
-    ProcessedPacket, RoutingKeys, SharedSecret, SphinxPacket,
+    ProcessedPacket, SphinxPacket,
 };
 use std::convert::TryFrom;
 use std::sync::Arc;
@@ -39,7 +38,6 @@ pub enum MixProcessingResult {
 pub struct SphinxPacketProcessor {
     /// Private sphinx key of this node required to unwrap received sphinx packet.
     sphinx_key: Arc<PrivateKey>,
-    key_storage: KeyStorage,
 }
 
 impl SphinxPacketProcessor {
@@ -47,7 +45,6 @@ impl SphinxPacketProcessor {
     pub fn new(sphinx_key: PrivateKey) -> Self {
         SphinxPacketProcessor {
             sphinx_key: Arc::new(sphinx_key),
-            key_storage: KeyStorage::new(),
         }
     }
 
@@ -68,27 +65,6 @@ impl SphinxPacketProcessor {
         })
     }
 
-    /// Performs a sphinx unwrapping using given keys.
-    #[cfg_attr(
-        feature = "cpucycles",
-        instrument(skip(self, packet), fields(cpucycles))
-    )]
-    fn perform_initial_sphinx_packet_processing_with_keys(
-        &self,
-        packet: SphinxPacket,
-        new_blinded_secret: &Option<SharedSecret>,
-        routing_keys: RoutingKeys,
-    ) -> Result<ProcessedPacket, MixProcessingError> {
-        measure!({
-            packet
-                .process_with_derived_keys(new_blinded_secret, routing_keys)
-                .map_err(|err| {
-                    debug!("Failed to unwrap Sphinx packet: {err}");
-                    MixProcessingError::SphinxProcessingError(err)
-                })
-        })
-    }
-
     /// Takes the received framed packet and tries to unwrap it from the sphinx encryption.
     #[cfg_attr(
         feature = "cpucycles",
@@ -105,28 +81,8 @@ impl SphinxPacketProcessor {
             if packet_mode.is_old_vpn() {
                 return Err(MixProcessingError::ReceivedOldTypeVpnPacket);
             }
-            //here be shared secret retrieval and hashmap lookup
-            if let Some((routing_keys, blinded_shared_secret)) =
-                self.key_storage.lookup(sphinx_packet.shared_secret())
-            {
-                trace!("Packet already seen, reusing keys");
-                self.perform_initial_sphinx_packet_processing_with_keys(
-                    sphinx_packet,
-                    &blinded_shared_secret,
-                    routing_keys,
-                )
-            } else {
-                trace!("New packet, deriving keys and storing them");
-                let key_secret = sphinx_packet.shared_secret();
-                let processed_packet =
-                    self.perform_initial_sphinx_packet_processing(sphinx_packet)?;
-                self.key_storage.store(
-                    key_secret,
-                    processed_packet.routing_keys(),
-                    processed_packet.shared_secret(),
-                );
-                Ok(processed_packet)
-            }
+
+            self.perform_initial_sphinx_packet_processing(sphinx_packet)
         })
     }
 
@@ -219,12 +175,12 @@ impl SphinxPacketProcessor {
         packet_mode: PacketMode,
     ) -> Result<MixProcessingResult, MixProcessingError> {
         match packet {
-            ProcessedPacket::ForwardHop(packet, address, delay, _) => {
+            ProcessedPacket::ForwardHop(packet, address, delay) => {
                 self.process_forward_hop(*packet, address, delay, packet_mode)
             }
             // right now there's no use for the surb_id included in the header - probably it should get removed from the
             // sphinx all together?
-            ProcessedPacket::FinalHop(destination, _, payload, _) => {
+            ProcessedPacket::FinalHop(destination, _, payload) => {
                 self.process_final_hop(destination, payload, packet_size, packet_mode)
             }
         }

common/nymsphinx/Cargo.toml

@@ -25,7 +25,7 @@ nym-sphinx-types = { path = "types" }
 
 # those dependencies are due to intriducing preparer and receiver. Perpaphs that indicates they should be moved
 # to separate crate?
-nym-crypto = { path = "../crypto", version = "0.3.0" }
+nym-crypto = { path = "../crypto", version = "0.4.0" }
 nym-topology = { path = "../topology" }
 
 # outfox
@@ -33,7 +33,7 @@ nym-outfox = { path = "../../nym-outfox" }
 
 [dev-dependencies]
 nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
-nym-crypto = { path = "../crypto", version = "0.3.0", features = ["asymmetric"] }
+nym-crypto = { path = "../crypto", version = "0.4.0", features = ["asymmetric"] }
 
 # do not include this when compiling into wasm as it somehow when combined together with reqwest, it will require
 # net2 via tokio-util -> tokio -> mio -> net2

common/nymsphinx/acknowledgements/Cargo.toml

@@ -9,7 +9,10 @@ repository = { workspace = true }
 
 [dependencies]
 rand = { version = "0.7.3", features = ["wasm-bindgen"] }
-thiserror = "1.0.37"
+serde_crate = { version = "1.0", optional = true, default_features = false, features = ["derive"], package = "serde" }
+generic-array = { workspace = true, optional = true, features = ["serde"] }
+thiserror = { workspace = true }
+zeroize = { workspace = true }
 
 nym-crypto = { path = "../../crypto", features = ["symmetric", "rand"] }
 nym-sphinx-addressing = { path = "../addressing" }
@@ -18,4 +21,5 @@ nym-sphinx-types = { path = "../types" }
 nym-pemstore = { path = "../../pemstore" }
 nym-topology = { path = "../../topology" }
 
-
+[features]
+serde = ["serde_crate", "generic-array"]

common/nymsphinx/acknowledgements/src/key.rs

@@ -6,7 +6,14 @@ use nym_pemstore::traits::PemStorableKey;
 use nym_sphinx_params::AckEncryptionAlgorithm;
 use rand::{CryptoRng, RngCore};
 use std::fmt::{self, Display, Formatter};
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
+#[cfg(feature = "serde")]
+use serde_crate::{Deserialize, Serialize};
+
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+#[cfg_attr(feature = "serde", serde(crate = "serde_crate"))]
+#[derive(Zeroize, ZeroizeOnDrop)]
 pub struct AckKey(CipherKey<AckEncryptionAlgorithm>);
 
 #[derive(Debug)]

common/nymsphinx/acknowledgements/src/surb_ack.rs

@@ -60,7 +60,6 @@ impl SurbAck {
 
         let surb_ack_packet = SphinxPacketBuilder::new()
             .with_payload_size(PacketSize::AckPacket.payload_size())
-            .with_initial_secret(&[42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42].into())
             .build_packet(surb_ack_payload, &route, &destination, &delays)
             .unwrap();
 

common/nymsphinx/cover/src/lib.rs

@@ -113,7 +113,6 @@ where
     // once merged, that's an easy rng injection point for sphinx packets : )
     let packet = SphinxPacketBuilder::new()
         .with_payload_size(packet_size.payload_size())
-        .with_initial_secret(&[42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42].into())
         .build_packet(packet_payload, &route, &destination, &delays)
         .unwrap();
 

common/nymsphinx/src/preparer/mod.rs

@@ -208,7 +208,6 @@ pub trait FragmentPreparer {
         // there's absolutely no reason for this call to fail.
         let sphinx_packet = SphinxPacketBuilder::new()
             .with_payload_size(packet_size.payload_size())
-            .with_initial_secret(&[42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42].into())
             .build_packet(packet_payload, &route, &destination, &delays)
             .unwrap();
 

common/nymsphinx/types/Cargo.toml

@@ -8,8 +8,7 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-#sphinx-packet = { version = "0.1.0" }
-sphinx-packet = { git = "https://github.com/nymtech/sphinx.git", branch = "simon/key-reuse"}
+sphinx-packet = { version = "0.1.0" }
 
 #[patch.crates-io]
 #sphinx-packet = { path = "../../../../sphinx" }

common/nymsphinx/types/src/lib.rs

@@ -8,7 +8,7 @@ pub use sphinx_packet::{
         PAYLOAD_KEY_SIZE,
     },
     crypto::{self, EphemeralSecret, PrivateKey, PublicKey, SharedSecret},
-    header::{self, delays, delays::Delay, ProcessedHeader, SphinxHeader, HEADER_SIZE, keys::RoutingKeys},
+    header::{self, delays, delays::Delay, ProcessedHeader, SphinxHeader, HEADER_SIZE},
     packet::builder::{self, DEFAULT_PAYLOAD_SIZE},
     payload::{Payload, PAYLOAD_OVERHEAD_SIZE},
     route::{Destination, DestinationAddressBytes, Node, NodeAddressBytes, SURBIdentifier},

common/pemstore/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "nym-pemstore"
 description = "Store private-public keypairs in PEM format"
-version = "0.2.0"
+version = "0.3.0"
 edition = { workspace = true }
 authors = { workspace = true }
 license = { workspace = true }

common/pemstore/src/lib.rs

@@ -1,4 +1,4 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::traits::{PemStorableKey, PemStorableKeyPair};
@@ -9,16 +9,17 @@ use std::path::{Path, PathBuf};
 
 pub mod traits;
 
+#[derive(Debug)]
 pub struct KeyPairPath {
-    private_key_path: PathBuf,
-    public_key_path: PathBuf,
+    pub private_key_path: PathBuf,
+    pub public_key_path: PathBuf,
 }
 
 impl KeyPairPath {
-    pub fn new(private_key_path: PathBuf, public_key_path: PathBuf) -> Self {
+    pub fn new<P: AsRef<Path>>(private_key_path: P, public_key_path: P) -> Self {
         KeyPairPath {
-            private_key_path,
-            public_key_path,
+            private_key_path: private_key_path.as_ref().to_owned(),
+            public_key_path: public_key_path.as_ref().to_owned(),
         }
     }
 }
@@ -27,8 +28,8 @@ pub fn load_keypair<T>(paths: &KeyPairPath) -> io::Result<T>
 where
     T: PemStorableKeyPair,
 {
-    let private = load_key::<T::PrivatePemKey>(&paths.private_key_path)?;
-    let public = load_key::<T::PublicPemKey>(&paths.public_key_path)?;
+    let private: T::PrivatePemKey = load_key(&paths.private_key_path)?;
+    let public: T::PublicPemKey = load_key(&paths.public_key_path)?;
     Ok(T::from_keys(private, public))
 }
 
@@ -40,9 +41,10 @@ where
     store_key(keypair.private_key(), &paths.private_key_path)
 }
 
-pub fn load_key<T>(path: &Path) -> io::Result<T>
+pub fn load_key<T, P>(path: P) -> io::Result<T>
 where
     T: PemStorableKey,
+    P: AsRef<Path>,
 {
     let key_pem = read_pem_file(path)?;
 
@@ -61,23 +63,24 @@ where
     Ok(key)
 }
 
-pub fn store_key<T>(key: &T, path: &Path) -> io::Result<()>
+pub fn store_key<T, P>(key: &T, path: P) -> io::Result<()>
 where
     T: PemStorableKey,
+    P: AsRef<Path>,
 {
     write_pem_file(path, key.to_bytes(), T::pem_type())
 }
 
-fn read_pem_file(filepath: &Path) -> io::Result<Pem> {
+fn read_pem_file<P: AsRef<Path>>(filepath: P) -> io::Result<Pem> {
     let mut pem_bytes = File::open(filepath)?;
     let mut buf = Vec::new();
     pem_bytes.read_to_end(&mut buf)?;
     pem::parse(&buf).map_err(|e| io::Error::new(io::ErrorKind::Other, e))
 }
 
-fn write_pem_file(filepath: &Path, data: Vec<u8>, tag: &str) -> io::Result<()> {
+fn write_pem_file<P: AsRef<Path>>(filepath: P, data: Vec<u8>, tag: &str) -> io::Result<()> {
     // ensure the whole directory structure exists
-    if let Some(parent_dir) = filepath.parent() {
+    if let Some(parent_dir) = filepath.as_ref().parent() {
         std::fs::create_dir_all(parent_dir)?;
     }
     let pem = Pem {
@@ -86,7 +89,7 @@ fn write_pem_file(filepath: &Path, data: Vec<u8>, tag: &str) -> io::Result<()> {
     };
     let key = pem::encode(&pem);
 
-    let mut file = File::create(filepath)?;
+    let mut file = File::create(filepath.as_ref())?;
     file.write_all(key.as_bytes())?;
 
     // note: this is only supported on unix (on different systems, like Windows, it will just

common/socks5-client-core/Cargo.toml

@@ -14,9 +14,9 @@ serde = { workspace = true, features = ["derive"] } # for config serialization/d
 thiserror = "1.0.34"
 tap = "1.0.1"
 tokio = { version = "1.24.1", features = ["rt-multi-thread", "net", "signal"] }
+futures = "0.3"
 
 nym-client-core = { path = "../client-core", features = ["fs-surb-storage"] }
-futures = "0.3"
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-config = { path = "../config" }
 nym-credential-storage = { path = "../credential-storage" }

common/socks5-client-core/src/lib.rs

@@ -14,9 +14,8 @@ use nym_bandwidth_controller::BandwidthController;
 use nym_client_core::client::base_client::{
     BaseClientBuilder, ClientInput, ClientOutput, ClientState,
 };
-use nym_client_core::client::key_manager::KeyManager;
 use nym_client_core::config::persistence::key_pathfinder::ClientKeyPathfinder;
-use nym_credential_storage::storage::Storage;
+use nym_client_core::config::DebugConfig;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_task::{TaskClient, TaskManager};
 use nym_validator_client::nyxd::QueryNyxdClient;
@@ -24,10 +23,20 @@ use nym_validator_client::Client;
 use std::error::Error;
 
 #[cfg(target_os = "android")]
-use nym_client_core::client::base_client::helpers::setup_empty_reply_surb_backend;
+use nym_client_core::client::{
+    base_client::helpers::setup_empty_reply_surb_backend, base_client::storage,
+    key_manager::persistence::InMemEphemeralKeys, replies::reply_storage,
+};
+#[cfg(target_os = "android")]
+use nym_credential_storage::ephemeral_storage::EphemeralStorage;
+
 #[cfg(not(target_os = "android"))]
-use nym_client_core::client::base_client::non_wasm_helpers;
-use nym_client_core::config::DebugConfig;
+use nym_client_core::client::{
+    base_client::non_wasm_helpers, base_client::storage::OnDiskPersistent,
+    key_manager::persistence::OnDiskKeys, replies::reply_storage::fs_backend,
+};
+#[cfg(not(target_os = "android"))]
+use nym_credential_storage::persistent_storage::PersistentStorage;
 
 pub mod config;
 pub mod error;
@@ -37,6 +46,13 @@ pub mod socks;
 pub type Socks5ControlMessageSender = mpsc::UnboundedSender<Socks5ControlMessage>;
 pub type Socks5ControlMessageReceiver = mpsc::UnboundedReceiver<Socks5ControlMessage>;
 
+#[cfg(target_os = "android")]
+type AndroidSocks5ClientBuilder<'a> =
+    BaseClientBuilder<'a, Client<QueryNyxdClient>, storage::Ephemeral>;
+
+#[cfg(not(target_os = "android"))]
+type Socks5ClientBuilder<'a> = BaseClientBuilder<'a, Client<QueryNyxdClient>, OnDiskPersistent>;
+
 #[derive(Debug)]
 pub enum Socks5ControlMessage {
     /// Tell the main task to stop
@@ -47,58 +63,11 @@ pub struct NymClient {
     /// Client configuration options, including, among other things, packet sending rates,
     /// key filepaths, etc.
     config: Config,
-
-    /// KeyManager object containing smart pointers to all relevant keys used by the client.
-    key_manager: KeyManager,
 }
 
 impl NymClient {
     pub fn new(config: Config) -> Self {
-        let pathfinder = ClientKeyPathfinder::new_from_config(config.get_base());
-        let key_manager = KeyManager::load_keys(&pathfinder).expect("failed to load stored keys");
-
-        NymClient {
-            config,
-            key_manager,
-        }
-    }
-
-    pub fn new_with_keys(config: Config, key_manager: Option<KeyManager>) -> Self {
-        let key_manager = key_manager.unwrap_or_else(|| {
-            let pathfinder = ClientKeyPathfinder::new_from_config(config.get_base());
-            KeyManager::load_keys(&pathfinder).expect("failed to load stored keys")
-        });
-
-        NymClient {
-            config,
-            key_manager,
-        }
-    }
-
-    async fn create_bandwidth_controller<St: Storage>(
-        config: &Config,
-        storage: St,
-    ) -> BandwidthController<Client<QueryNyxdClient>, St> {
-        let details = nym_network_defaults::NymNetworkDetails::new_from_env();
-        let mut client_config =
-            nym_validator_client::Config::try_from_nym_network_details(&details)
-                .expect("failed to construct validator client config");
-        let nyxd_url = config
-            .get_base()
-            .get_validator_endpoints()
-            .pop()
-            .expect("No nyxd validator endpoint provided");
-        let api_url = config
-            .get_base()
-            .get_nym_api_endpoints()
-            .pop()
-            .expect("No validator api endpoint provided");
-        // overwrite env configuration with config URLs
-        client_config = client_config.with_urls(nyxd_url, api_url);
-        let client = nym_validator_client::Client::new_query(client_config)
-            .expect("Could not construct query client");
-
-        BandwidthController::new(storage, client)
+        NymClient { config }
     }
 
     pub fn start_socks5_listener(
@@ -221,42 +190,13 @@ impl NymClient {
 
     pub async fn start(self) -> Result<TaskManager, Socks5ClientCoreError> {
         #[cfg(not(target_os = "android"))]
-        let base_builder = BaseClientBuilder::new_from_base_config(
-            self.config.get_base(),
-            self.key_manager,
-            Some(
-                Self::create_bandwidth_controller(
-                    &self.config,
-                    nym_credential_storage::initialise_persistent_storage(
-                        self.config.get_base().get_database_path(),
-                    )
-                    .await,
-                )
-                .await,
-            ),
-            non_wasm_helpers::setup_fs_reply_surb_backend(
-                Some(self.config.get_base().get_reply_surb_database_path()),
-                self.config.get_debug_settings(),
-            )
-            .await?,
-        );
+        let base_builder = self.create_base_client_builder().await?;
 
         #[cfg(target_os = "android")]
-        let base_builder = BaseClientBuilder::<_, Client<QueryNyxdClient>, _>::new_from_base_config(
-            self.config.get_base(),
-            self.key_manager,
-            Some(
-                Self::create_bandwidth_controller(
-                    &self.config,
-                    nym_credential_storage::initialise_ephemeral_storage(),
-                )
-                .await,
-            ),
-            setup_empty_reply_surb_backend(self.config.get_debug_settings()),
-        );
+        let base_builder = self.create_base_client_builder().await;
 
-        let self_address = base_builder.as_mix_recipient();
         let mut started_client = base_builder.start_base().await?;
+        let self_address = started_client.address;
         let client_input = started_client.client_input.register_producer();
         let client_output = started_client.client_output.register_consumer();
         let client_state = started_client.client_state;
@@ -277,3 +217,92 @@ impl NymClient {
         Ok(started_client.task_manager)
     }
 }
+
+#[cfg(not(target_os = "android"))]
+impl NymClient {
+    fn key_store(&self) -> OnDiskKeys {
+        let pathfinder = ClientKeyPathfinder::new_from_config(self.config.get_base());
+        OnDiskKeys::new(pathfinder)
+    }
+
+    async fn create_bandwidth_controller(
+        &self,
+    ) -> BandwidthController<Client<QueryNyxdClient>, PersistentStorage> {
+        let storage = nym_credential_storage::initialise_persistent_storage(
+            self.config.get_base().get_database_path(),
+        )
+        .await;
+
+        non_wasm_helpers::create_bandwidth_controller(self.config.get_base(), storage)
+    }
+
+    async fn create_reply_storage_backend(
+        &self,
+    ) -> Result<fs_backend::Backend, Socks5ClientCoreError> {
+        non_wasm_helpers::setup_fs_reply_surb_backend(
+            self.config.get_base().get_reply_surb_database_path(),
+            &self.config.get_debug_settings().reply_surbs,
+        )
+        .await
+        .map_err(Into::into)
+    }
+
+    async fn create_base_client_builder(
+        &self,
+    ) -> Result<Socks5ClientBuilder, Socks5ClientCoreError> {
+        // don't create bandwidth controller if credentials are disabled
+        let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
+            None
+        } else {
+            Some(self.create_bandwidth_controller().await)
+        };
+
+        let key_store = self.key_store();
+        let reply_storage_backend = self.create_reply_storage_backend().await?;
+
+        Ok(BaseClientBuilder::new_from_base_config(
+            self.config.get_base(),
+            key_store,
+            bandwidth_controller,
+            reply_storage_backend,
+        ))
+    }
+}
+
+#[cfg(target_os = "android")]
+impl NymClient {
+    fn key_store(&self) -> InMemEphemeralKeys {
+        InMemEphemeralKeys::new()
+    }
+
+    fn create_bandwidth_controller(
+        config: &Config,
+    ) -> BandwidthController<Client<QueryNyxdClient>, EphemeralStorage> {
+        let storage = nym_credential_storage::initialise_ephemeral_storage();
+
+        create_bandwidth_controller(config.get_base(), storage)
+    }
+
+    fn create_reply_storage_backend(&self) -> reply_storage::Empty {
+        setup_empty_reply_surb_backend(self.config.get_debug_settings())
+    }
+
+    #[cfg(target_os = "android")]
+    fn create_base_client_builder(&self) -> Socks5ClientBuilder {
+        let bandwidth_controller = if self.config.get_base().get_disabled_credentials_mode() {
+            None
+        } else {
+            Some(self.create_bandwidth_controller().await)
+        };
+
+        let key_store = self.key_store();
+        let reply_storage_backend = self.create_reply_storage_backend();
+
+        BaseClientBuilder::new_from_base_config(
+            self.config.get_base(),
+            key_store,
+            bandwidth_controller,
+            reply_storage_backend,
+        )
+    }
+}

common/socks5/proxy-helpers/src/proxy_runner/mod.rs

@@ -13,7 +13,7 @@ mod inbound;
 mod outbound;
 
 // TODO: make this configurable
-const SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(30);
+const SHUTDOWN_TIMEOUT: Duration = Duration::from_secs(3);
 
 // Send empty keepalive messages regurarly to keep the connection alive. This should be smaller
 // than [`MIX_TTL`].

common/store-cipher/Cargo.toml

@@ -8,6 +8,7 @@ edition = "2021"
 [dependencies]
 aes-gcm = { version = "0.10.1" }
 argon2 = { version = "0.5.0" }
+generic-array = { workspace = true, features = ["zeroize"] }
 rand = "0.8.5"
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, optional = true }

common/store-cipher/src/lib.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use aes_gcm::aead::{Aead, Nonce};
-use aes_gcm::{AeadCore, AeadInPlace, Key, KeyInit, KeySizeUser};
+use aes_gcm::{AeadCore, AeadInPlace, KeyInit};
 use rand::{thread_rng, CryptoRng, Fill, RngCore};
 use serde::{Deserialize, Serialize};
 use serde_helpers::{argon2_algorithm_helper, argon2_params_helper, argon2_version_helper};
@@ -10,7 +10,9 @@ use thiserror::Error;
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
 pub use aes_gcm::Aes256Gcm;
+pub use aes_gcm::{Key, KeySizeUser};
 pub use argon2::{Algorithm, Argon2, Params, Version};
+pub use generic_array::typenum::Unsigned;
 
 mod serde_helpers;
 
@@ -18,8 +20,13 @@ pub const CURRENT_VERSION: u8 = 1;
 pub const ARGON2_SALT_SIZE: usize = 16;
 pub const AES256GCM_NONCE_SIZE: usize = 12;
 
+const VERIFICATION_PHRASE: &[u8] = &[0u8; 32];
+
 #[derive(Debug, Error)]
 pub enum Error {
+    #[error("Unsupported cipher")]
+    UnsupportedCipher,
+
     #[error("failed to encrypt/decrypt provided data: {cause}")]
     AesFailure { cause: aes_gcm::Error },
 
@@ -41,6 +48,12 @@ pub enum Error {
 
     #[error("the received ciphertext was encrypted with different store version ({received}). The current version is {CURRENT_VERSION}")]
     VersionMismatch { received: u8 },
+
+    #[error("the decoded verification phrase did not match the expected value")]
+    VerificationPhraseMismatch,
+
+    #[error("could not import the store - the provided passphrase was invalid")]
+    InvalidImportPassphrase,
 }
 
 // it's weird that this couldn't be auto-derived with a `#[from]`...
@@ -56,7 +69,7 @@ impl From<argon2::Error> for Error {
     }
 }
 
-#[derive(Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub enum KdfInfo {
     Argon2 {
         /// The Argon2 parameters that were used when deriving the store key.
@@ -122,12 +135,93 @@ impl KdfInfo {
     }
 }
 
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub enum CiphertextInfo {
+    Aes256Gcm {
+        /// The nonce that was used to encrypt the ciphertext.
+        nonce: [u8; AES256GCM_NONCE_SIZE],
+        ciphertext: Vec<u8>,
+    },
+}
+
+impl CiphertextInfo {
+    pub fn nonce<C>(&self) -> &Nonce<C>
+    where
+        C: AeadCore,
+    {
+        match self {
+            CiphertextInfo::Aes256Gcm { nonce, .. } => Nonce::<C>::from_slice(nonce),
+        }
+    }
+
+    pub fn ciphertext(&self) -> &[u8] {
+        match self {
+            CiphertextInfo::Aes256Gcm { ciphertext, .. } => ciphertext,
+        }
+    }
+}
+
 #[derive(Zeroize, ZeroizeOnDrop)]
 pub struct StoreCipher<C = Aes256Gcm>
 where
     C: KeySizeUser,
 {
     key: Key<C>,
+
+    #[zeroize(skip)]
+    kdf_info: KdfInfo,
+}
+
+impl StoreCipher<Aes256Gcm> {
+    pub fn import_aes256gcm(
+        passphrase: &[u8],
+        exported: ExportedStoreCipher,
+    ) -> Result<Self, Error> {
+        // that's a terrible interface, but we can refactor it later
+        if !matches!(exported.ciphertext_info, CiphertextInfo::Aes256Gcm { .. }) {
+            return Err(Error::UnsupportedCipher);
+        }
+
+        let mut key = exported.kdf_info.expand_key::<Aes256Gcm>(passphrase)?;
+
+        // check if correct key was derived
+        let Ok(plaintext) = Aes256Gcm::new(&key).decrypt(
+            exported.ciphertext_info.nonce::<Aes256Gcm>(),
+            exported.ciphertext_info.ciphertext(),
+        ) else {
+            key.zeroize();
+            return Err(Error::InvalidImportPassphrase)
+        };
+
+        // if we successfully decrypted aes256gcm ciphertext, it's almost certainly correct
+        // otherwise the tag wouldn't match, but let's do the sanity sake
+        if plaintext != VERIFICATION_PHRASE {
+            key.zeroize();
+            return Err(Error::VerificationPhraseMismatch);
+        }
+
+        Ok(StoreCipher {
+            key,
+            kdf_info: exported.kdf_info,
+        })
+    }
+
+    pub fn export_aes256gcm(&self) -> Result<ExportedStoreCipher, Error> {
+        let verification_ciphertext = self.encrypt_data_ref(VERIFICATION_PHRASE)?;
+
+        Ok(ExportedStoreCipher {
+            kdf_info: self.kdf_info.clone(),
+            ciphertext_info: CiphertextInfo::Aes256Gcm {
+                // the unwrap is fine, otherwise it implies we've been using incorrect nonces all along!
+                nonce: verification_ciphertext.nonce.try_into().unwrap(),
+                ciphertext: verification_ciphertext.ciphertext,
+            },
+        })
+    }
+
+    pub fn new_aes256gcm(passphrase: &[u8], kdf_info: KdfInfo) -> Result<Self, Error> {
+        Self::new(passphrase, kdf_info)
+    }
 }
 
 impl<C: KeySizeUser + KeyInit> StoreCipher<C>
@@ -136,7 +230,7 @@ where
 {
     pub fn new(passphrase: &[u8], kdf_info: KdfInfo) -> Result<Self, Error> {
         let key = kdf_info.expand_key::<C>(passphrase)?;
-        Ok(StoreCipher { key })
+        Ok(StoreCipher { key, kdf_info })
     }
 
     pub fn new_with_default_kdf(passphrase: &[u8]) -> Result<Self, Error> {
@@ -195,14 +289,9 @@ where
     where
         C: AeadInPlace,
     {
-        let mut plaintext = self.decrypt_data(data)?;
-
-        // DO NOT USE `?` here!!
-        // We need to make sure to zeroize the plaintext even if deserialization fails!!
-        let value = serde_json::from_slice(&plaintext);
-
-        plaintext.zeroize();
-        Ok(value?)
+        let plaintext = zeroize::Zeroizing::new(self.decrypt_data(data)?);
+        let value = serde_json::from_slice(&plaintext)?;
+        Ok(value)
     }
 
     pub fn decrypt_data_unchecked(&self, data: EncryptedData) -> Result<Vec<u8>, Error>
@@ -248,6 +337,17 @@ where
     }
 }
 
+#[derive(Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ExportedStoreCipher {
+    /// Info about the key derivation method that was used to expand the
+    /// passphrase into an encryption key.
+    pub kdf_info: KdfInfo,
+
+    /// The ciphertext of known plaintext and additional data that is needed to
+    /// verify correct key derivation and cipher choice.
+    pub ciphertext_info: CiphertextInfo,
+}
+
 #[derive(Debug, Serialize, Deserialize, PartialEq, Eq, Clone)]
 pub struct EncryptedData {
     pub version: u8,

common/wasm-utils/Cargo.toml

@@ -11,6 +11,13 @@ futures = "0.3"
 js-sys = "^0.3.51"
 wasm-bindgen = "=0.2.83"
 wasm-bindgen-futures = "0.4"
+serde = { workspace = true, features = ["derive"], optional = true }
+serde-wasm-bindgen = { version = "0.5.0", optional = true }
+getrandom = { version="0.2", features=["js"], optional = true }
+indexed_db_futures = { version = " 0.3.0", optional = true }
+thiserror = { workspace = true, optional = true }
+
+nym-store-cipher = { path = "../store-cipher", features = ["json"], optional = true }
 
 # we don't want entire tokio-tungstenite, tungstenite itself is just fine - we just want message and error enums
 [dependencies.tungstenite]
@@ -20,20 +27,37 @@ optional = true
 
 [dependencies.web-sys]
 version = "0.3"
-features = [
-    "BinaryType",
-    "Blob",
-    "CloseEvent",
-    "ErrorEvent",
-    "FileReader",
-    "MessageEvent",
-    "ProgressEvent",
-    "WebSocket",
-    "Window",
-]
 optional = true
 
 [features]
 default = ["sleep"]
-websocket = ["tungstenite", "web-sys"]
-sleep = ["web-sys"]
+sleep = ["web-sys", "web-sys/Window"]
+websocket = [
+    "getrandom",
+    "tungstenite",
+    "web-sys",
+    "web-sys/BinaryType",
+    "web-sys/Blob",
+    "web-sys/CloseEvent",
+    "web-sys/ErrorEvent",
+    "web-sys/FileReader",
+    "web-sys/MessageEvent",
+    "web-sys/ProgressEvent",
+    "web-sys/WebSocket",
+]
+crypto = [
+    "web-sys",
+    "web-sys/Crypto",
+    "web-sys/CryptoKey",
+    "web-sys/CryptoKeyPair",
+    "web-sys/SubtleCrypto",
+    "web-sys/Window",
+    "web-sys/WorkerGlobalScope",
+]
+storage = [
+    "indexed_db_futures",
+    "nym-store-cipher",
+    "serde",
+    "serde-wasm-bindgen",
+    "thiserror"
+]

common/wasm-utils/src/crypto/asymmetric.rs

@@ -0,0 +1,16 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::crypto::{generate_key, KeyUsage};
+use wasm_bindgen::{JsCast, JsValue};
+
+pub use web_sys::CryptoKeyPair;
+
+pub async fn generate_asymmetric_keypair(
+    algorithm: &str,
+    extractable: bool,
+    key_usages: &[KeyUsage],
+) -> Result<CryptoKeyPair, JsValue> {
+    let key = generate_key(algorithm, extractable, key_usages).await?;
+    key.dyn_into::<CryptoKeyPair>()
+}

common/wasm-utils/src/crypto/mod.rs

@@ -0,0 +1,113 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use js_sys::Array;
+use std::fmt::{Display, Formatter};
+use std::str::FromStr;
+use wasm_bindgen::JsCast;
+use wasm_bindgen::JsValue;
+use wasm_bindgen_futures::JsFuture;
+use web_sys::{Crypto, Window, WorkerGlobalScope};
+
+pub mod asymmetric;
+pub mod symmetric;
+
+#[derive(Copy, Clone, Eq, PartialEq, Debug)]
+pub enum KeyUsage {
+    Encrypt,
+    Decrypt,
+    Sign,
+    Verify,
+    DeriveKey,
+    DeriveBits,
+    WrapKey,
+    UnwrapKey,
+}
+
+pub struct InvalidKeyUsage;
+
+impl FromStr for KeyUsage {
+    type Err = InvalidKeyUsage;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "encrypt" => Ok(KeyUsage::Encrypt),
+            "decrypt" => Ok(KeyUsage::Decrypt),
+            "sign" => Ok(KeyUsage::Sign),
+            "verify" => Ok(KeyUsage::Verify),
+            "deriveKey" => Ok(KeyUsage::DeriveKey),
+            "deriveBits" => Ok(KeyUsage::DeriveBits),
+            "wrapKey" => Ok(KeyUsage::WrapKey),
+            "unwrapKey" => Ok(KeyUsage::UnwrapKey),
+            _ => Err(InvalidKeyUsage),
+        }
+    }
+}
+
+impl From<KeyUsage> for JsValue {
+    fn from(value: KeyUsage) -> Self {
+        JsValue::from_str(&value.to_string())
+    }
+}
+
+impl Display for KeyUsage {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            KeyUsage::Encrypt => write!(f, "encrypt"),
+            KeyUsage::Decrypt => write!(f, "decrypt"),
+            KeyUsage::Sign => write!(f, "sign"),
+            KeyUsage::Verify => write!(f, "verify"),
+            KeyUsage::DeriveKey => write!(f, "deriveKey"),
+            KeyUsage::DeriveBits => write!(f, "deriveBits"),
+            KeyUsage::WrapKey => write!(f, "wrapKey"),
+            KeyUsage::UnwrapKey => write!(f, "unwrapKey"),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum GlobalScope {
+    Window(Window),
+    Worker(WorkerGlobalScope),
+}
+
+impl GlobalScope {
+    pub fn crypto(&self) -> Result<Crypto, JsValue> {
+        match self {
+            GlobalScope::Window(window) => window.crypto(),
+            GlobalScope::Worker(worker) => worker.crypto(),
+        }
+    }
+}
+
+pub fn get_global_scope() -> Option<GlobalScope> {
+    let global = js_sys::global();
+
+    match global.dyn_into::<Window>() {
+        Ok(window) => Some(GlobalScope::Window(window)),
+        Err(maybe_worker) => maybe_worker
+            .dyn_into::<WorkerGlobalScope>()
+            .ok()
+            .map(GlobalScope::Worker),
+    }
+}
+
+pub async fn generate_key(
+    algorithm: &str,
+    extractable: bool,
+    key_usages: &[KeyUsage],
+) -> Result<JsValue, JsValue> {
+    let key_usages = key_usages
+        .iter()
+        .map(|&usage| JsValue::from(usage))
+        .collect::<Array>();
+
+    JsFuture::from(
+        get_global_scope()
+            .expect("no global scope available!")
+            .crypto()?
+            .subtle()
+            .generate_key_with_str(algorithm, extractable, &key_usages)?,
+    )
+    .await
+}

common/wasm-utils/src/crypto/symmetric.rs

@@ -0,0 +1,16 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::crypto::{generate_key, KeyUsage};
+use wasm_bindgen::{JsCast, JsValue};
+
+pub use web_sys::CryptoKey;
+
+pub async fn generate_symmetric_key(
+    algorithm: &str,
+    extractable: bool,
+    key_usages: &[KeyUsage],
+) -> Result<CryptoKey, JsValue> {
+    let key = generate_key(algorithm, extractable, key_usages).await?;
+    key.dyn_into::<CryptoKey>()
+}

common/wasm-utils/src/lib.rs

@@ -1,14 +1,18 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
-use js_sys::Promise;
 use wasm_bindgen::prelude::*;
 use wasm_bindgen::JsValue;
-use wasm_bindgen_futures::JsFuture;
 
 #[cfg(feature = "websocket")]
 pub mod websocket;
 
+#[cfg(feature = "crypto")]
+pub mod crypto;
+
+#[cfg(feature = "storage")]
+pub mod storage;
+
 // will cause messages to be written as if console.log("...") was called
 #[macro_export]
 macro_rules! console_log {
@@ -41,12 +45,12 @@ extern "C" {
 
 #[cfg(feature = "sleep")]
 pub async fn sleep(ms: i32) -> Result<(), JsValue> {
-    let promise = Promise::new(&mut |yes, _| {
+    let promise = js_sys::Promise::new(&mut |yes, _| {
         let win = web_sys::window().expect("no window available!");
         win.set_timeout_with_callback_and_timeout_and_arguments_0(&yes, ms)
             .unwrap();
     });
-    let js_fut = JsFuture::from(promise);
+    let js_fut = wasm_bindgen_futures::JsFuture::from(promise);
     js_fut.await?;
     Ok(())
 }