Updates about CocoaPods and auto-linking + other questions

[paolospag]

Hi!
I should update my app from virgil-crypto-javascript to react-native-virgil-crypto soon and I want to know if there are updates about the auto-linking problem on iOS.

This PR is closed and doesn't seem to have been solved yet, but in the react-native@0.61.0-rc.2 release description I found this note:

Note: If you are using CocoaPods with use_frameworks!, you may be required to add s.static_framework = true to each podspec that depends on React Native. This is a temporary solution and we are working on a better way to integrate with the community packages before we ship a stable release.

Honestly, I don't know if I can proceed with auto-linking in this way on react-native@0.60.5

I have never used Carthage and I would like to avoid manual installation, since in my app all native dependencies have been auto-linked.

[vadimavdeev]

Hello,
Unfortunately, auto-linking this library does not seem to be possible on react-native@0.60

[paolospag]

@vadimavdeev this answer leaves me a bit perplexed ...

Do you think manual installation could be a problem, since the rest of the dependencies (including the core of React Native) is auto-linked?

Do you think that with the next version of RN this problem will be solved?

I also have another question: what other dependencies do I have to install along with this package? In the current version of my app, I have this situation:

"@virgilsecurity/key-storage-rn": "0.1.3",
"buffer": "5.2.1",
"react-native-keychain": "3.1.3",
"virgil-crypto": "3.2.6",
"virgil-sdk": "5.3.0"

but I'm not sure what's still needed and what's not ...

The documentation of this new package is not very clear about the installation, I find only a generic:

This library's API is compatible with the virgil-crypto for JavaScript and can be used in place of the latter in React Native projects.

[vadimavdeev]

this answer leaves me a bit perplexed ...

Sorry about that

Do you think manual installation could be a problem, since the rest of the dependencies (including the core of React Native) is auto-linked?

No, I don't think manual installation could be a problem. At least in the example projects in this repository everything was working fine with manual installation.

Do you think that with the next version of RN this problem will be solved?

Yes, once the version compatible with use_frameworks! in Podfile is out, we'll add a .podspec file to this package so that it can be auto-linked

What other dependencies do I have to install along with this package?

If you want it to work with virgil-sdk, you'll need:

1. Update the virgil-sdk to version 6.0.0, which is currently a pre-release. You can install it with npm install virgil-sdk@next.
2. Install one more package - npm install @virgilsecurity/sdk-crypto
3. Update the @virgilsecurity/key-storage-rn to the latest version, which is also in pre-release currently - npm install @virgilsecurity/key-storage-rn@next
4. Install the react-native-keychain package, a dependency of @virgilsecurity/key-storage-rn

And you can remove the javascript virgil-crypto.

Here's an example of initialization:

import { virgilCrypto } from 'react-native-virgil-crypto';
import createNativeKeyEntryStorage from '@virgilsecurity/key-storage-rn/native';
import { VirgilCardCrypto, VirgilPrivateKeyExporter } from '@virgilsecurity/sdk-crypto';
import { CachingJwtProvider, CardManager, VirgilCardVerifier, PrivateKeyStorage } from 'virgil-sdk';

const jwtProvider = new CachingJwtProvider(getTokenFunctionDefinedInYourCode);
const cardCrypto = new VirgilCardCrypto(virgilCrypto);
const cardVerifier = new VirgilCardVerifier(cardCrypto);
const cardManager = new CardManager({
  cardCrypto,
  cardVerifier,
  accessTokenProvider: jwtProvider,
  retryOnUnauthorized: true,
});

const privateKeyStroage = new PrivateKeyStorage(
  new VirgilPrivateKeyExporter(virgilCrypto),
  createNativeKeyEntryStorage({ username: nameOfTheStorageChosenByYou });
);

// use `cardManager` to work with cards
// use `privateKeyStorage` to save and retrieve private keys to\from local storage

Note that this package can be used standalone if all you need is a cryptographic library.

[vadimavdeev]

I'm closing this issue. Feel free to re-open or create a new one if you have any problems or questions.

[paolospag]

@vadimavdeev I noticed that a new version of react-native-keychain has been released (4.0.0), do you think it is compatible with the alpha version of @virgilsecurity/key-storage? Do I have to do something to ensure compatibility?

Another question: should I use virgil-crypto-javascript version 4 on Node.js? In my app, I generate the key pair from a cloud function, but the guide to the new version is not clear. Do you suggest to stay at 3.2.6?

[vadimavdeev]

Judging by release notes of version 4.0.0 of react-native-keychain it should be compatible with @virgilsecurity/key-storage. I don't think you should do anything specific to ensure compatibility except testing that it can load the keys stored by previous version.

should I use virgil-crypto-javascript version 4 on Node.js?

It depends on which version of Node.js you have. Both v3 and v4 are compatible with each other, the difference is that version 4 uses C crypto library compiled to WebAssembly, whereas version 3 uses C++ crypto library compiled to Node.js Native Addon.

Node.js supports WebAssembly starting from version 8, so if you have that version, you can update. However, It will still work fine if you stay on v3.2.6.

[paolospag]

@vadimavdeev thanks for the clarification.

I still have another question, sorry for my insistence...

I noticed that, unlike virgil-crypto-js, react-native-virgil-crypto does not have the password parameter in the importPrivateKey method.

In my app I have this situation in some cases (e.g. in my custom implementation of EThree restorePrivateKey):

const localPrivateKey = this.virgilCrypto.importPrivateKey(loggedUserPrivateKey, loggedUserPsw);
await this.keyLoader.savePrivateKeyLocal(localPrivateKey);

This is because I generate the key pair with a Cloud Function and after generation I re-export the private key with password :

// On Cloud Function/Node.js
const virgil = await require('virgil-crypto');
const virgilCrypto = new virgil.VirgilCrypto();
const keyPair = virgilCrypto.generateKeys();
const publicKeyData = virgilCrypto.exportPublicKey(keyPair.publicKey);
const privateKeyData = virgilCrypto.exportPrivateKey(keyPair.privateKey, userPassword);
// At this point I store keypair securely in base64 string:
// publicKeyData.toString('base64')
// privateKeyData.toString('base64')

For this reason, when I invoke my implementation version of restorePrivateKey I get a password-protected base64 string of private key and not a ready-to-use private key to pass to importPrivateKey.

How can I solve this problem?

[vadimavdeev]

Unfortunately, the underlying crypto library does not allow exporting private keys with passwords currently. We'll implement this feature asap. In the meantime you can solve this problem by doing the following:

Install virgil-crypto-javascript@3.2.6 on you client side alongside the react-native-virgil-crypto and use it to import the private key with password then export it without password and finally import into react-native-virgil-crypto:

import { virgilCrypto } from 'react-native-virgil-crypto';
import { VirgilCrypto as VirgilCryptoV3 } from  'virgil-crypto';

const virgilCryptoV3 = new VirgilCryptoV3();
const privateKeyV3 = virgilCryptoV3.importPrivateKey(encryptedPrivateKey, userPassword);
const privateKeyValue = virgilCryptoV3.exportPrivateKey(privateKeyV3);

const thePrivateKey = virgilCrypto.importPrivateKey(privateKeyValue)

[paolospag]

@vadimavdeev

Since I don't think it's a good idea to go back and use virgil-crypto-javascript on the React Native side due to performance issue, I believe I will do what you suggest on the Cloud Function side but maintaining virgil-crypto-javascript on 3.2.6 version... since I understand that version 4, unlike version 3, does not support export and import with password yet, correct?

[vadimavdeev]

Correct. Version 4 does not support import and export with password yet.

[vadimavdeev]

@paolospag By the way, I didn't suggest you go back to using only JS crypto library on the React Native side, but use both the JS and RN versions with the JS library being used only to import encrypted private key and export it without encrypting (i.e. without password). This should not have a big performance impact and you'll be able to remove it as soon as we implement the password-protected import \ export in version 4.

[paolospag]

@vadimavdeev
I have two other questions (I hope the latest)...

1. is react-native-virgil-crypto fully compatible with Hermes, considering that I will have to use in conjunction with virgil-sdk and @virgilsecurity/key-storage-rn? I haven't personally tested it yet, but before moving on I want to make sure it works.

2. is a good idea to do generateKeys and import/export operations in a Cloud Function (so server-side/Node.js) or is preferred to do that on client-side in terms of both performance and safety?

[vadimavdeev]

@paolospag

1. react-native-virgil-crypto should be fully compatible with Hermes, because Hermes is a JavaScript engine and there's nothing fancy in react-native-virgil-crypto in terms of JavaScript. I tried enabling Hermes in one of our sample projects and it worker well, but I suggest you do your own testing to be sure.

2. It's not a good idea to generate keys on the server side. The private key should never leave the end-user's device unprotected. In terms of safety it is preferred to generate private keys client-side. In terms of performance - it depends. However, safety should be the deciding factor here.