Consider deriving more signature keys and local storage key

[petrdvorak]

Currently, master secret KEY_MASTER_SECRET is used to derive one signing key KEY_SIGNATURE and one transport key KEY_TRANSPORT. It would be nice to have:

• multiple signing keys (namely 3 - each for a single authentication factor)
  • KEY_SIGNING_F1
  • KEY_SIGNING_F2
  • KEY_SIGNING_F3
• one "local storage key" to encrypt the original private key so that it can be used for further key derivation or asymmetric ECDSA signature
  • KEY_ENCRYPTED_STORAGE

[petrdvorak]

This will also require description of expected key storage...

[petrdvorak]

Just to add a note: the KEY_ENCRYPTED_STORAGE cannot of course be stored on the PowerAuth client. It must be used for initial encryption only, later purged and then retrieved from PowerAuth server upon successful authentication. For retrieving the key from the server, a unique transport key should be used, for example derived from CRT and KEY_TRANSPORT.

[petrdvorak]

Implementation fixed in 4b8610f.

Needed improvements:

• better description of the key storage
• description of fetching the vault unlock key from server

[petrdvorak]

Fixed in ea19194