Add a v:3 unlock mode alongside the existing v:1 (WIF) and v:2 (seed-phrase +
BIP-32) paths in the faucet sign-in flow. The new mode keys directly off the
Deviant chipnet-keystore master password, so the SAME password that unlocks
Keys/chipnet-keystore.json also reveals the faucet's saved-address watchlist
after deploy.
build-seed-enc.mjs
- New --master-pw flag (or CHIPNET_KEYSTORE_PASSWORD env). Refuses a password
shorter than 8 chars; prompts interactively when no env is set.
- v:3 uses PBKDF2-SHA256/200000 with a FRESH 16-byte random salt per build,
stored inline in the blob. Deliberately different from v:1's fixed
"deviant-faucet-seed-v1" salt: the password entropy is much lower than a
raw private key, so a per-build salt kills pre-computed rainbow tables and
keeps rebuilds independent of stolen older blobs. 200k iters matches the
Deviant keystore's PBKDF2 parameters — a stolen blob costs ~0.5s per guess.
- The v:2/v:1 paths are unchanged; the blob shape stays the same shape
({v, iv, ct}) with kdf+salt fields on v:1/v:3 and a `path` field on v:2.
index.html
- New "Master password" input mode alongside the existing seed-phrase and WIF
modes. New masterPwToRawKey() reads the salt + iters from the loaded blob
and derives the AES-256 key via SubtleCrypto — verifies the blob is v:3
before continuing.
- tryAutoUnlock() now picks the default mode from the deployed blob version:
v:3 → 'master', else the existing v:2/v:1 probe.
- Sign-in modal grew a third input field; the panel-open focus target
branches on the current mode.
Verified end-to-end in browser preview:
- v:3 blob loads (2083 ct bytes · fresh 16-byte salt · 200k iters).
- Correct master password → 15 chipnet BCH addresses rendered (7 original +
8 imported from the extended keystore: h, i, gmx, anthemus-platform,
potidaea, sirius-x, bns-beacon, bns-tld-beacon).
- Wrong password → opaque "Wrong key — could not decrypt." error, no leak.
- No plaintext faucet-seed.js in the deploy path (already gitignored).
Third consumer of the same master-password crypto envelope this week, after
the shipped Deviant chipnet-keystore encryption
(scripts/chipnet-keystore-{encrypt,decrypt}.mjs) and before the Explorer
which reuses the same primitives at v:1 spec level.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
cbbc4e689b