demo · v137

Keystore roundtrip

The full export / persist / import / verify loop, end-to-end. Generate an Ed25519 keypair, export as JWK and raw, wrap the private key under an AES-KW key, persist the wrapped blob in IndexedDB, reload from storage, unwrap, and verify a signature against a stored public key.

probing…

1. Generate

2. Wrap + persist

3. Stored keys

no keys saved yet

4. Reload + sign + verify

verdict: —

the code

const kp = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
const jwk = await crypto.subtle.exportKey("jwk", kp.privateKey);
const wrapKey = await crypto.subtle.generateKey({ name: "AES-KW", length: 256 }, true, ["wrapKey", "unwrapKey"]);

const wrapped = await crypto.subtle.wrapKey("jwk", kp.privateKey, wrapKey, "AES-KW");

// store wrapped + jwk for the public key + raw wrap key in IndexedDB
// later: read it back, unwrap, sign, verify with the stored public key

see also