b-lock

1. Please say that before people use it. Nothing at https://github.com/BlockProject/b-lock or https://blockproject.io/ says "proof of concept" or "you shouldn't use this yet." 2. You haven't proved the concept if you're not handling your key material right - among other things, if I'm still reading right, it looks like you're using the (asymmetric) wallet private key as the (symmetric) encryption key for passwords? Is this in any way safe? (Traditionally, the overwhelming consensus of the cryptography community is no.) If you need to generate new keys and unique nonces and verify IVs, you need to figure out how and where you're storing a key before you've successfully proved the concept.

So they're using AES in CTR mode for encryption. They encrypt both key (website + login) and value (password) using the same key (wallet private key) and counter (1). [1] Which means you can just bruteforce popular domain names, xor encryptedPass ^ encryptedKey ^ domainName, and get first bytes of the password (depending on domain name length), just by going through some recent TXs at [2]. [1] https://github.com/BlockProject/b-lock/blob/8a19e0b404a8afee... [2] https://explorer.nebulas.io/#/address/n1qmQeLTUU6fPJMs1uwTad...