Tezos Stack Exchange is a question and answer site for users, experts, and developers of the Tezos blockchain project. It only takes a minute to sign up.
Sign up to join this community
P-256 signing curve can be used for tz3 accounts.
One of the secure enclave able to store a 256-bit elliptic curve such as P-256 is the one present in iPhones an Macs with Touch ID or Face ID.
Is there any Tezos wallet or project able to take advantage of this enclave? What are the main challenges of such a project?
There isn't currently a wallet for iOS using the secure enclave. But the tz3 accounts use p-256 encryption and were put in primarily to support iOS, Android, and other devices which are only compatible with p-256. There has been some work toward multisig contracts intended for use with secure enclave based wallets, I would expect we will see something soon.
The main challenge is that unlike a hardware wallet device such as Ledger, the secure enclave does not allow the importing/restoring of a key. The keys are created internally and never leave the enclave so there is no export. This makes backup/restore challenging in the case of a lost device. The most common solution will be a multisig where the enclave based key is only 1 of x.
This is how Apple describes the secure enclave:
The benefits of the Secure Enclave are balanced against a few restrictions. In particular, the Secure Enclave:
Is a hardware feature of the Apple A7 or later A-series processor. Only iOS devices with one of these processors or a MacBook Pro with the Touch Bar and Touch ID support this feature.
Stores only 256-bit elliptic curve private keys. These keys can only be used for creating and verifying cryptographic signatures, or for elliptic curve Diffie-Hellman key exchange (and by extension, symmetric encryption).
Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.
(source)
Taylor Keefer demonstrated a prototype iOS app on May 6, 2019 in a Medium article "Signing Tezos Transactions with iOS’s Secure Enclave and Face ID". As in the solution described by @cousinit, this prototype uses a "1 of 2 multi signature smart contract" with a second key used in case the access to the key in the secure enclave is not available anymore.
