Skip to content

Add ECIES encryption support to subxt-signer#2198

Draft
hitchhooker wants to merge 3 commits intoparitytech:masterfrom
hitchhooker:ecies
Draft

Add ECIES encryption support to subxt-signer#2198
hitchhooker wants to merge 3 commits intoparitytech:masterfrom
hitchhooker:ecies

Conversation

@hitchhooker
Copy link

Summary

  • Adds encrypt / decrypt methods to sr25519::Keypair using schnorrkel's ECIES module
  • New ecies feature flag in subxt-signer
  • Includes example: cargo run -p subxt-signer --features ecies --example ecies

Depends on: paritytech/schnorrkel#116 (schnorrkel needs to publish with the ecies feature before this can use a crates.io version)

Test plan

  • Example runs successfully with dev accounts (Alice/Bob)
  • Wrong key and wrong context correctly fail decryption
  • CI validation
  • Review by maintainers

@hitchhooker hitchhooker requested a review from a team as a code owner March 13, 2026 15:18
Adds encrypt/decrypt methods to sr25519::Keypair using schnorrkel's
new ECIES module. Gated behind the `ecies` feature flag.

Depends on: paritytech/schnorrkel#116
# ecdsa compiling to WASM on my mac; following this comment helped:
# https://github.com/rust-bitcoin/rust-bitcoin/issues/930#issuecomment-1215538699
sr25519 = ["schnorrkel"]
ecies = ["sr25519", "schnorrkel/ecies"]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder whether this feature would be better called "sr25519-ecies" since it seems specific to that (and then it would be a stronger hint that this enables some feature in the sr25519 module)

hmac = { version = "0.12.1", default-features = false }
pbkdf2 = { version = "0.12.2", default-features = false }
schnorrkel = { version = "0.11.4", default-features = false }
schnorrkel = { version = "0.11.5", default-features = false, git = "https://github.com/hitchhooker/schnorrkel", branch = "ecies" }
Copy link
Collaborator

@jsdw jsdw Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Until the original non-fork version of this has the relevant feature and is available on crates.io, we won't be able to merge this: git URLs prevent publishing, and I would not want to deviate from the Parity crate, in large part for security reasons :)

@jsdw
Copy link
Collaborator

jsdw commented Mar 13, 2026

Thankyou; offhand this looks good to me! Will need to wait for the schnorrkel crate to be published though.

My only general reservation is that the subxt-signer crate is really just some helpers to sign/check transactions which plays nicely with subxt. I would thus be hesitant to expand the features too much beyond this, and would generally encourage people to create alternate crates for more complex use cases. That said, this addition looks fairly small and simple enough so I think it would be ok to add (pending the feature making it to the Parity crate)!

@cla-bot-2021
Copy link

cla-bot-2021 bot commented Mar 13, 2026

User @claude, please sign the CLA here.

@hitchhooker hitchhooker marked this pull request as draft March 14, 2026 05:58
- add Keypair::viewing_key() to derive FullViewingKey
- encrypt now takes recipient ivk public + sender ovk
- decrypt unchanged (secret key path still works)
- example uses viewing key hierarchy (ivk/ovk)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants