Add secure key derivation APIs and restore backward compatibility - #197

Overview

This PR addresses a security vulnerability in key derivation functions while maintaining full backward compatibility. We introduce new secure APIs and restore the original behavior of existing APIs with deprecation warnings.

Changes

🔄 API Changes

• Restored original behavior for existing APIs (toKeypair, toViemAccount, to_keypair, to_account)
  • Now use first 32 bytes of key material directly (same as before)
  • Added deprecation warnings to console/logs
• Added new secure APIs (toKeypairSecure, toViemAccountSecure, to_keypair_secure, to_account_secure)
  • Use SHA256 hash of complete key material for enhanced security
  • Follow cryptographic best practices

📦 Version Updates

• JavaScript: @phala/[email protected]
• Python: [email protected]

🔒 Security Improvements

• Original APIs: Use first 32 bytes directly (restored for compatibility)
• Secure APIs: Apply SHA256 hashing to complete key material
• Zero breaking changes: Existing code continues to work exactly as before

Backward Compatibility

✅ Fully backward compatible - no breaking changes
✅ Same key generation - deprecated APIs produce identical keys as previous versions
✅ Gradual migration - users can migrate at their own pace

Example Migration

JavaScript

// Current (works, shows warning)
import { toKeypair } from '@phala/dstack-sdk/solana'
const keypair = toKeypair(keyResponse) // ⚠️ Shows warning

// Recommended (secure, no warning)
import { toKeypairSecure } from '@phala/dstack-sdk/solana'
const keypair = toKeypairSecure(keyResponse) // ✅ Secure

Python

# Current (works, shows warning)
from dstack_sdk.solana import to_keypair
keypair = to_keypair(key_response)  # ⚠️ Shows warning

# Recommended (secure, no warning)  
from dstack_sdk.solana import to_keypair_secure
keypair = to_keypair_secure(key_response)  # ✅ Secure