demo · v137
Keystore roundtrip
The full export / persist / import / verify loop, end-to-end. Generate an Ed25519 keypair, export as JWK and raw, wrap the private key under an AES-KW key, persist the wrapped blob in IndexedDB, reload from storage, unwrap, and verify a signature against a stored public key.
probing…
1. Generate
2. Wrap + persist
3. Stored keys
no keys saved yet
4. Reload + sign + verify
verdict: —
the code
const kp = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
const jwk = await crypto.subtle.exportKey("jwk", kp.privateKey);
const wrapKey = await crypto.subtle.generateKey({ name: "AES-KW", length: 256 }, true, ["wrapKey", "unwrapKey"]);
const wrapped = await crypto.subtle.wrapKey("jwk", kp.privateKey, wrapKey, "AES-KW");
// store wrapped + jwk for the public key + raw wrap key in IndexedDB
// later: read it back, unwrap, sign, verify with the stored public key