@aztec-labs/key-store 6.0.0-nightly.20260829

package/README.md

@@ -0,0 +1,3 @@
+# Key Store
+
+A key store is an input component for the [PXE](../pxe/) to manage keys securely. It provides a secure environment and interfaces for users to manage their keys. When the PXE requests keys and signatures from the key store, a well-designed key store should prompt users to authorize the requested action before sending any sensitive information to the PXE. This helps to ensure that sensitive data, such as private keys, is not accessible to unauthorized parties. Additionally, the key store should provide robust protection mechanisms such as encryption, multi-factor authentication, and backup/restore functionalities to prevent data loss or theft.

package/dest/account_privacy_keys.d.ts

@@ -0,0 +1,23 @@
+import type { GrumpkinScalar } from '@aztec-labs/foundation/curves/grumpkin';
+import type { PublicKey } from '@aztec-labs/stdlib/keys';
+/**
+ * The four master privacy secret keys the key store holds for an account: the nullifier-hiding, incoming-viewing,
+ * outgoing-viewing, and tagging keys.
+ */
+export type AccountPrivacySecretKeys = {
+    masterNullifierHidingSecretKey: GrumpkinScalar;
+    masterIncomingViewingSecretKey: GrumpkinScalar;
+    masterOutgoingViewingSecretKey: GrumpkinScalar;
+    masterTaggingSecretKey: GrumpkinScalar;
+};
+/**
+ * The keys needed to register an account: the four privacy secret keys the key store holds, plus the *public*
+ * message-signing and fallback keys. The message-signing and fallback secret keys are withheld from the key store (and
+ * hence from PXE, which embeds it), since it is not trusted to hold them: only their public keys are needed (to
+ * reconstruct the account's address).
+ */
+export type AccountPrivacyKeys = AccountPrivacySecretKeys & {
+    masterMessageSigningPublicKey: PublicKey;
+    masterFallbackPublicKey: PublicKey;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjb3VudF9wcml2YWN5X2tleXMuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9hY2NvdW50X3ByaXZhY3lfa2V5cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxjQUFjLEVBQUUsTUFBTSx3Q0FBd0MsQ0FBQztBQUM3RSxPQUFPLEtBQUssRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUV6RDs7O0dBR0c7QUFDSCxNQUFNLE1BQU0sd0JBQXdCLEdBQUc7SUFDckMsOEJBQThCLEVBQUUsY0FBYyxDQUFDO0lBQy9DLDhCQUE4QixFQUFFLGNBQWMsQ0FBQztJQUMvQyw4QkFBOEIsRUFBRSxjQUFjLENBQUM7SUFDL0Msc0JBQXNCLEVBQUUsY0FBYyxDQUFDO0NBQ3hDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sTUFBTSxrQkFBa0IsR0FBRyx3QkFBd0IsR0FBRztJQUMxRCw2QkFBNkIsRUFBRSxTQUFTLENBQUM7SUFDekMsdUJBQXVCLEVBQUUsU0FBUyxDQUFDO0NBQ3BDLENBQUMifQ==

package/dest/account_privacy_keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account_privacy_keys.d.ts","sourceRoot":"","sources":["../src/account_privacy_keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,8BAA8B,EAAE,cAAc,CAAC;IAC/C,8BAA8B,EAAE,cAAc,CAAC;IAC/C,8BAA8B,EAAE,cAAc,CAAC;IAC/C,sBAAsB,EAAE,cAAc,CAAC;CACxC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,wBAAwB,GAAG;IAC1D,6BAA6B,EAAE,SAAS,CAAC;IACzC,uBAAuB,EAAE,SAAS,CAAC;CACpC,CAAC"}

package/dest/account_privacy_keys.js

@@ -0,0 +1,6 @@
+/**
+ * The keys needed to register an account: the four privacy secret keys the key store holds, plus the *public*
+ * message-signing and fallback keys. The message-signing and fallback secret keys are withheld from the key store (and
+ * hence from PXE, which embeds it), since it is not trusted to hold them: only their public keys are needed (to
+ * reconstruct the account's address).
+ */ export { };

package/dest/index.d.ts

@@ -0,0 +1,3 @@
+export * from './account_privacy_keys.js';
+export * from './key_store.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDJCQUEyQixDQUFDO0FBQzFDLGNBQWMsZ0JBQWdCLENBQUMifQ==

package/dest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC"}

package/dest/index.js

@@ -0,0 +1,2 @@
+export * from './account_privacy_keys.js';
+export * from './key_store.js';

package/dest/key_store.d.ts

@@ -0,0 +1,110 @@
+import { Fr } from '@aztec-labs/foundation/curves/bn254';
+import { GrumpkinScalar } from '@aztec-labs/foundation/curves/grumpkin';
+import { type Bufferable } from '@aztec-labs/foundation/serialize';
+import type { AztecAsyncKVStore } from '@aztec-labs/kv-store';
+import { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { CompleteAddress, type PartialAddress } from '@aztec-labs/stdlib/contract';
+import { KeyValidationRequest } from '@aztec-labs/stdlib/kernel';
+import { type KeyPrefix, type PublicKey } from '@aztec-labs/stdlib/keys';
+import type { AccountPrivacyKeys, AccountPrivacySecretKeys } from './account_privacy_keys.js';
+/**
+ * Used for managing keys. Can hold keys of multiple accounts.
+ */
+export declare class KeyStore {
+    #private;
+    static readonly SCHEMA_VERSION = 1;
+    constructor(database: AztecAsyncKVStore);
+    /**
+     * Adds an account to the key store.
+     *
+     * The key store holds the four privacy secret keys (nullifier-hiding, incoming-viewing, outgoing-viewing, tagging),
+     * but only the *public* message-signing and fallback keys: their secret keys are withheld, since the key store (and
+     * PXE, which embeds it) is not trusted to hold them. The public keys are still needed to reconstruct the account's
+     * address, which commits to all six master public keys.
+     *
+     * @param keys - The account's privacy keys: four secret keys plus the message-signing and fallback public keys.
+     * @param partialAddress - The partial address of the account.
+     * @returns The account's complete address.
+     * @throws If any of the account's six master public keys would be the point at infinity.
+     */
+    addAccount(keys: AccountPrivacyKeys, partialAddress: PartialAddress): Promise<CompleteAddress>;
+    /**
+     * Retrieves addresses of accounts stored in the key store.
+     * @returns A Promise that resolves to an array of account addresses.
+     */
+    getAccounts(): Promise<AztecAddress[]>;
+    /** Checks whether an account is registered in the key store. */
+    hasAccount(account: AztecAddress): Promise<boolean>;
+    /**
+     * Gets the key validation request for a given master public key hash and contract address.
+     * @throws If the account corresponding to the master public key hash does not exist in the key store.
+     * @param pkMHash - The master public key hash.
+     * @param contractAddress - The contract address to silo the secret key in the key validation request with.
+     * @returns The key validation request.
+     */
+    getKeyValidationRequest(pkMHash: Fr, contractAddress: AztecAddress): Promise<KeyValidationRequest>;
+    /**
+     * Gets the master nullifier public key for a given account.
+     * @throws If the account does not exist in the key store.
+     */
+    getMasterNullifierHidingPublicKey(account: AztecAddress): Promise<PublicKey>;
+    /**
+     * Gets the master incoming viewing public key for a given account.
+     * @throws If the account does not exist in the key store.
+     */
+    getMasterIncomingViewingPublicKey(account: AztecAddress): Promise<PublicKey>;
+    /**
+     * Retrieves the master outgoing viewing public key.
+     * @throws If the account does not exist in the key store.
+     */
+    getMasterOutgoingViewingPublicKey(account: AztecAddress): Promise<PublicKey>;
+    /**
+     * Retrieves the master tagging public key.
+     * @throws If the account does not exist in the key store.
+     */
+    getMasterTaggingPublicKey(account: AztecAddress): Promise<PublicKey>;
+    /**
+     * Retrieves master incoming viewing secret key.
+     * @throws If the account does not exist in the key store.
+     */
+    getMasterIncomingViewingSecretKey(account: AztecAddress): Promise<GrumpkinScalar>;
+    /**
+     * Retrieves the four privacy secret keys the key store holds for an account. Paired with {@link addAccount}, this
+     * allows exporting an account's privacy secret keys, e.g. to re-register it on another PXE. The message-signing and
+     * fallback secret keys are not held by the key store and so are not returned.
+     *
+     * @throws If the account does not exist in the key store.
+     */
+    getAccountSecretKeys(account: AztecAddress): Promise<AccountPrivacySecretKeys>;
+    /**
+     * Retrieves application outgoing viewing secret key.
+     * @throws If the account does not exist in the key store.
+     * @param account - The account to retrieve the application outgoing viewing secret key for.
+     * @param app - The application address to retrieve the outgoing viewing secret key for.
+     * @returns A Promise that resolves to the application outgoing viewing secret key.
+     */
+    getAppOutgoingViewingSecretKey(account: AztecAddress, app: AztecAddress): Promise<Fr>;
+    /**
+     * Retrieves the sk_m corresponding to the given pk_m hash.
+     * @throws If the provided hash is not associated with any of the registered accounts.
+     * @param pkMHash - The master public key hash to get secret key for.
+     * @returns A Promise that resolves to sk_m.
+     * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
+     */
+    getMasterSecretKey(pkMHash: Fr): Promise<GrumpkinScalar>;
+    /**
+     * Checks whether a given account has a key matching the provided master public key hash.
+     * @param account - The account address to check.
+     * @param pkMHash - The master public key hash to look for.
+     * @returns True if the account has a key with the given hash.
+     */
+    accountHasKey(account: AztecAddress, pkMHash: Fr): Promise<boolean>;
+    /**
+     * Gets the key prefix and account address for a given value.
+     * @returns A tuple containing the key prefix and account address.
+     * @dev Note that this is quite inefficient but it should not matter because there should never be too many keys
+     * in the key store.
+     */
+    getKeyPrefixAndAccount(value: Bufferable): Promise<[KeyPrefix, AztecAddress]>;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5X3N0b3JlLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMva2V5X3N0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxFQUFFLEVBQUUsTUFBTSxxQ0FBcUMsQ0FBQztBQUN6RCxPQUFPLEVBQUUsY0FBYyxFQUFTLE1BQU0sd0NBQXdDLENBQUM7QUFFL0UsT0FBTyxFQUFFLEtBQUssVUFBVSxFQUFxQixNQUFNLGtDQUFrQyxDQUFDO0FBQ3RGLE9BQU8sS0FBSyxFQUFFLGlCQUFpQixFQUFpQixNQUFNLHNCQUFzQixDQUFDO0FBQzdFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQUNoRSxPQUFPLEVBQUUsZUFBZSxFQUFFLEtBQUssY0FBYyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDbkYsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDakUsT0FBTyxFQUVMLEtBQUssU0FBUyxFQUNkLEtBQUssU0FBUyxFQUtmLE1BQU0seUJBQXlCLENBQUM7QUFFakMsT0FBTyxLQUFLLEVBQUUsa0JBQWtCLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQStEOUY7O0dBRUc7QUFDSCxxQkFBYSxRQUFROztJQUNuQixnQkFBdUIsY0FBYyxLQUFLO0lBSTFDLFlBQVksUUFBUSxFQUFFLGlCQUFpQixFQUd0QztJQUVEOzs7Ozs7Ozs7Ozs7T0FZRztJQUNVLFVBQVUsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLGNBQWMsR0FBRyxPQUFPLENBQUMsZUFBZSxDQUFDLENBRzFHO0lBRUQ7OztPQUdHO0lBQ1UsV0FBVyxJQUFJLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQyxDQUtsRDtJQUVELGdFQUFnRTtJQUNuRCxVQUFVLENBQUMsT0FBTyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLENBRS9EO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksdUJBQXVCLENBQUMsT0FBTyxFQUFFLEVBQUUsRUFBRSxlQUFlLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxDQTBDeEc7SUFFRDs7O09BR0c7SUFDVSxpQ0FBaUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FFeEY7SUFFRDs7O09BR0c7SUFDVSxpQ0FBaUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FFeEY7SUFFRDs7O09BR0c7SUFDVSxpQ0FBaUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FFeEY7SUFFRDs7O09BR0c7SUFDVSx5QkFBeUIsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FFaEY7SUFFRDs7O09BR0c7SUFDVSxpQ0FBaUMsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FFN0Y7SUFFRDs7Ozs7O09BTUc7SUFDVSxvQkFBb0IsQ0FBQyxPQUFPLEVBQUUsWUFBWSxHQUFHLE9BQU8sQ0FBQyx3QkFBd0IsQ0FBQyxDQVExRjtJQUVEOzs7Ozs7T0FNRztJQUNVLDhCQUE4QixDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsR0FBRyxFQUFFLFlBQVksR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLENBT2pHO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksa0JBQWtCLENBQUMsT0FBTyxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsY0FBYyxDQUFDLENBNkI5RDtJQUVEOzs7OztPQUtHO0lBQ0ksYUFBYSxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLENBV3pFO0lBRUQ7Ozs7O09BS0c7SUFDVSxzQkFBc0IsQ0FBQyxLQUFLLEVBQUUsVUFBVSxHQUFHLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQWN6RjtDQWdGRiJ9

package/dest/key_store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key_store.d.ts","sourceRoot":"","sources":["../src/key_store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,MAAM,qCAAqC,CAAC;AACzD,OAAO,EAAE,cAAc,EAAS,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,KAAK,UAAU,EAAqB,MAAM,kCAAkC,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,SAAS,EAKf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AA+D9F;;GAEG;AACH,qBAAa,QAAQ;;IACnB,gBAAuB,cAAc,KAAK;IAI1C,YAAY,QAAQ,EAAE,iBAAiB,EAGtC;IAED;;;;;;;;;;;;OAYG;IACU,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAG1G;IAED;;;OAGG;IACU,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAKlD;IAED,gEAAgE;IACnD,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/D;IAED;;;;;;OAMG;IACI,uBAAuB,CAAC,OAAO,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0CxG;IAED;;;OAGG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAExF;IAED;;;OAGG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAExF;IAED;;;OAGG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAExF;IAED;;;OAGG;IACU,yBAAyB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAEhF;IAED;;;OAGG;IACU,iCAAiC,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAE7F;IAED;;;;;;OAMG;IACU,oBAAoB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAQ1F;IAED;;;;;;OAMG;IACU,8BAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,CAOjG;IAED;;;;;;OAMG;IACI,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CA6B9D;IAED;;;;;OAKG;IACI,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAWzE;IAED;;;;;OAKG;IACU,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAczF;CAgFF"}

package/dest/key_store.js

@@ -0,0 +1,308 @@
+import { DomainSeparator } from '@aztec-labs/constants';
+import { poseidon2HashWithSeparator } from '@aztec-labs/foundation/crypto/poseidon';
+import { GrumpkinScalar, Point } from '@aztec-labs/foundation/curves/grumpkin';
+import { toArray } from '@aztec-labs/foundation/iterable';
+import { serializeToBuffer } from '@aztec-labs/foundation/serialize';
+import { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { CompleteAddress } from '@aztec-labs/stdlib/contract';
+import { KeyValidationRequest } from '@aztec-labs/stdlib/kernel';
+import { KEY_PREFIXES, PublicKeys, computeAppSecretKey, derivePublicKeyFromSecretKey, hashPublicKey } from '@aztec-labs/stdlib/keys';
+/** Maps a key prefix to the storage suffix for the corresponding master secret key. */ function secretKeyStorageSuffix(prefix) {
+    return prefix === 'n' ? 'nhk_m' : `${prefix}sk_m`;
+}
+/**
+ * Computes the public counterparts of an account's four privacy secret keys and assembles its {@link PublicKeys} struct
+ * (used to derive the address), from the {@link AccountPrivacyKeys} passed to {@link KeyStore.addAccount}.
+ *
+ * The message-signing and fallback keys are already supplied as public keys, since the key store never holds their
+ * secrets.
+ */ async function completeAccountKeys(keys) {
+    const { masterNullifierHidingSecretKey, masterIncomingViewingSecretKey, masterOutgoingViewingSecretKey, masterTaggingSecretKey, masterMessageSigningPublicKey, masterFallbackPublicKey } = keys;
+    const masterNullifierHidingPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingSecretKey);
+    const masterIncomingViewingPublicKey = await derivePublicKeyFromSecretKey(masterIncomingViewingSecretKey);
+    const masterOutgoingViewingPublicKey = await derivePublicKeyFromSecretKey(masterOutgoingViewingSecretKey);
+    const masterTaggingPublicKey = await derivePublicKeyFromSecretKey(masterTaggingSecretKey);
+    for (const [name, publicKey] of Object.entries({
+        masterNullifierHidingPublicKey,
+        masterIncomingViewingPublicKey,
+        masterOutgoingViewingPublicKey,
+        masterTaggingPublicKey,
+        masterMessageSigningPublicKey,
+        masterFallbackPublicKey
+    })){
+        if (publicKey.isInfinite) {
+            throw new Error(`Cannot register an account with an infinity ${name}.`);
+        }
+    }
+    const publicKeys = new PublicKeys(await hashPublicKey(masterNullifierHidingPublicKey), masterIncomingViewingPublicKey, await hashPublicKey(masterOutgoingViewingPublicKey), await hashPublicKey(masterTaggingPublicKey), await hashPublicKey(masterMessageSigningPublicKey), await hashPublicKey(masterFallbackPublicKey));
+    return {
+        masterNullifierHidingSecretKey,
+        masterIncomingViewingSecretKey,
+        masterOutgoingViewingSecretKey,
+        masterTaggingSecretKey,
+        masterNullifierHidingPublicKey,
+        masterOutgoingViewingPublicKey,
+        masterTaggingPublicKey,
+        publicKeys
+    };
+}
+/**
+ * Used for managing keys. Can hold keys of multiple accounts.
+ */ export class KeyStore {
+    static SCHEMA_VERSION = 1;
+    #db;
+    #keys;
+    constructor(database){
+        this.#db = database;
+        this.#keys = database.openMap('key_store');
+    }
+    /**
+   * Adds an account to the key store.
+   *
+   * The key store holds the four privacy secret keys (nullifier-hiding, incoming-viewing, outgoing-viewing, tagging),
+   * but only the *public* message-signing and fallback keys: their secret keys are withheld, since the key store (and
+   * PXE, which embeds it) is not trusted to hold them. The public keys are still needed to reconstruct the account's
+   * address, which commits to all six master public keys.
+   *
+   * @param keys - The account's privacy keys: four secret keys plus the message-signing and fallback public keys.
+   * @param partialAddress - The partial address of the account.
+   * @returns The account's complete address.
+   * @throws If any of the account's six master public keys would be the point at infinity.
+   */ async addAccount(keys, partialAddress) {
+        const accountKeys = await completeAccountKeys(keys);
+        return this.#storeAccountKeys(accountKeys, partialAddress);
+    }
+    /**
+   * Retrieves addresses of accounts stored in the key store.
+   * @returns A Promise that resolves to an array of account addresses.
+   */ async getAccounts() {
+        const allMapKeys = await this.#db.transactionAsync(()=>toArray(this.#keys.keysAsync()));
+        // We return account addresses based on the map keys that end with '-ivsk_m'
+        const accounts = allMapKeys.filter((key)=>key.endsWith('-ivsk_m')).map((key)=>key.split('-')[0]);
+        return accounts.map((account)=>AztecAddress.fromStringUnsafe(account));
+    }
+    /** Checks whether an account is registered in the key store. */ async hasAccount(account) {
+        return !!await this.#db.transactionAsync(()=>this.#keys.getAsync(`${account.toString()}-ivsk_m`));
+    }
+    /**
+   * Gets the key validation request for a given master public key hash and contract address.
+   * @throws If the account corresponding to the master public key hash does not exist in the key store.
+   * @param pkMHash - The master public key hash.
+   * @param contractAddress - The contract address to silo the secret key in the key validation request with.
+   * @returns The key validation request.
+   */ getKeyValidationRequest(pkMHash, contractAddress) {
+        return this.#db.transactionAsync(async ()=>{
+            const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkMHash);
+            // Load the stored master public key point. The returned KVR carries only the hash, but we
+            // use the point here as a witness for two integrity checks below: (1) it matches the supplied
+            // hash, and (2) it matches the value derived from the stored secret key.
+            const pkMBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}pk_m`);
+            if (!pkMBuffer) {
+                throw new Error(`Could not find ${keyPrefix}pk_m for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
+            }
+            const pkM = Point.fromBuffer(pkMBuffer);
+            // Now we find the secret key for the public key
+            const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+            const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
+            if (!skMBuffer) {
+                throw new Error(`Could not find ${skStorageSuffix} for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
+            }
+            const skM = GrumpkinScalar.fromBuffer(skMBuffer);
+            // The remaining awaits are non-DB computations. They are safe because no further IDB operations follow them.
+            const computedPkMHash = await hashPublicKey(pkM);
+            if (!computedPkMHash.equals(pkMHash)) {
+                throw new Error(`Could not find ${keyPrefix}pkM for ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
+            }
+            const derivedPkM = await derivePublicKeyFromSecretKey(skM);
+            if (!derivedPkM.equals(pkM)) {
+                throw new Error(`Could not derive ${keyPrefix}pkM from ${keyPrefix}skM.`);
+            }
+            const skApp = await computeAppSecretKey(skM, contractAddress, keyPrefix);
+            return new KeyValidationRequest(pkMHash, skApp);
+        });
+    }
+    /**
+   * Gets the master nullifier public key for a given account.
+   * @throws If the account does not exist in the key store.
+   */ async getMasterNullifierHidingPublicKey(account) {
+        return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'npk_m'));
+    }
+    /**
+   * Gets the master incoming viewing public key for a given account.
+   * @throws If the account does not exist in the key store.
+   */ async getMasterIncomingViewingPublicKey(account) {
+        return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'ivpk_m'));
+    }
+    /**
+   * Retrieves the master outgoing viewing public key.
+   * @throws If the account does not exist in the key store.
+   */ async getMasterOutgoingViewingPublicKey(account) {
+        return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'ovpk_m'));
+    }
+    /**
+   * Retrieves the master tagging public key.
+   * @throws If the account does not exist in the key store.
+   */ async getMasterTaggingPublicKey(account) {
+        return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'tpk_m'));
+    }
+    /**
+   * Retrieves master incoming viewing secret key.
+   * @throws If the account does not exist in the key store.
+   */ async getMasterIncomingViewingSecretKey(account) {
+        return GrumpkinScalar.fromBuffer(await this.#getMasterKeyBuffer(account, 'ivsk_m'));
+    }
+    /**
+   * Retrieves the four privacy secret keys the key store holds for an account. Paired with {@link addAccount}, this
+   * allows exporting an account's privacy secret keys, e.g. to re-register it on another PXE. The message-signing and
+   * fallback secret keys are not held by the key store and so are not returned.
+   *
+   * @throws If the account does not exist in the key store.
+   */ async getAccountSecretKeys(account) {
+        const [nhkM, ivskM, ovskM, tskM] = await this.#getMasterKeyBuffers(account, [
+            'nhk_m',
+            'ivsk_m',
+            'ovsk_m',
+            'tsk_m'
+        ]);
+        return {
+            masterNullifierHidingSecretKey: GrumpkinScalar.fromBuffer(nhkM),
+            masterIncomingViewingSecretKey: GrumpkinScalar.fromBuffer(ivskM),
+            masterOutgoingViewingSecretKey: GrumpkinScalar.fromBuffer(ovskM),
+            masterTaggingSecretKey: GrumpkinScalar.fromBuffer(tskM)
+        };
+    }
+    /**
+   * Retrieves application outgoing viewing secret key.
+   * @throws If the account does not exist in the key store.
+   * @param account - The account to retrieve the application outgoing viewing secret key for.
+   * @param app - The application address to retrieve the outgoing viewing secret key for.
+   * @returns A Promise that resolves to the application outgoing viewing secret key.
+   */ async getAppOutgoingViewingSecretKey(account, app) {
+        const masterOutgoingViewingSecretKey = GrumpkinScalar.fromBuffer(await this.#getMasterKeyBuffer(account, 'ovsk_m'));
+        return poseidon2HashWithSeparator([
+            masterOutgoingViewingSecretKey.hi,
+            masterOutgoingViewingSecretKey.lo,
+            app
+        ], DomainSeparator.OVSK_M);
+    }
+    /**
+   * Retrieves the sk_m corresponding to the given pk_m hash.
+   * @throws If the provided hash is not associated with any of the registered accounts.
+   * @param pkMHash - The master public key hash to get secret key for.
+   * @returns A Promise that resolves to sk_m.
+   * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
+   */ getMasterSecretKey(pkMHash) {
+        return this.#db.transactionAsync(async ()=>{
+            const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkMHash);
+            const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+            const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
+            if (!secretKeyBuffer) {
+                throw new Error(`Could not find ${skStorageSuffix} for ${keyPrefix}pk_m_hash ${pkMHash.toString()}. This should not happen.`);
+            }
+            const skM = GrumpkinScalar.fromBuffer(secretKeyBuffer);
+            // Non-DB computation — safe because no further IDB operations follow.
+            // Integrity check: confirm the stored secret key still derives the requested hash. The check
+            // is hash-based rather than point-equal because the on-disk identifier is `pk_m_hash`;
+            // cryptographic collision resistance of `hashPublicKey` makes this equivalent to a
+            // direct point comparison in practice.
+            const derivedPkM = await derivePublicKeyFromSecretKey(skM);
+            const derivedPkMHash = await hashPublicKey(derivedPkM);
+            if (!derivedPkMHash.equals(pkMHash)) {
+                throw new Error(`Could not find ${skStorageSuffix} for ${keyPrefix}pk_m_hash ${pkMHash.toString()} in secret keys buffer.`);
+            }
+            return skM;
+        });
+    }
+    /**
+   * Checks whether a given account has a key matching the provided master public key hash.
+   * @param account - The account address to check.
+   * @param pkMHash - The master public key hash to look for.
+   * @returns True if the account has a key with the given hash.
+   */ accountHasKey(account, pkMHash) {
+        return this.#db.transactionAsync(async ()=>{
+            const pkMHashBuffer = serializeToBuffer(pkMHash);
+            for (const prefix of KEY_PREFIXES){
+                const stored = await this.#keys.getAsync(`${account.toString()}-${prefix}pk_m_hash`);
+                if (stored && Buffer.from(stored).equals(pkMHashBuffer)) {
+                    return true;
+                }
+            }
+            return false;
+        });
+    }
+    /**
+   * Gets the key prefix and account address for a given value.
+   * @returns A tuple containing the key prefix and account address.
+   * @dev Note that this is quite inefficient but it should not matter because there should never be too many keys
+   * in the key store.
+   */ async getKeyPrefixAndAccount(value) {
+        const valueBuffer = serializeToBuffer(value);
+        for await (const [key, val] of this.#keys.entriesAsync()){
+            // Browser returns Uint8Array, Node.js returns Buffer
+            if (Buffer.from(val).equals(valueBuffer)) {
+                for (const prefix of KEY_PREFIXES){
+                    if (key.includes(`-${prefix}`)) {
+                        const account = AztecAddress.fromStringUnsafe(key.split('-')[0]);
+                        return [
+                            prefix,
+                            account
+                        ];
+                    }
+                }
+            }
+        }
+        throw new Error(`Could not find key prefix.`);
+    }
+    /**
+   * Persists a completed set of account keys and returns the resulting complete address.
+   */ async #storeAccountKeys(accountKeys, partialAddress) {
+        const { masterNullifierHidingSecretKey, masterIncomingViewingSecretKey, masterOutgoingViewingSecretKey, masterTaggingSecretKey, masterNullifierHidingPublicKey, masterOutgoingViewingPublicKey, masterTaggingPublicKey, publicKeys } = accountKeys;
+        const completeAddress = await CompleteAddress.fromPublicKeysAndPartialAddress(publicKeys, partialAddress);
+        const { address: account } = completeAddress;
+        // completeAccountKeys has already guaranteed these master public keys are non-infinity, which the kernel cannot
+        // check but the address relies on.
+        // The npk/ovpk/tpk hashes are already in publicKeys; ivpk_m_hash is computed for indexing.
+        const masterIncomingViewingPublicKeyHash = await hashPublicKey(publicKeys.ivpkM);
+        await this.#db.transactionAsync(async ()=>{
+            // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m.
+            //
+            // The message-signing and fallback keys are not stored: their secret keys are withheld from the key store, and
+            // their public keys are only needed transiently to compute the address (they live in the AddressStore).
+            await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-nhk_m`, masterNullifierHidingSecretKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-npk_m`, masterNullifierHidingPublicKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.ivpkM.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovpk_m`, masterOutgoingViewingPublicKey.toBuffer());
+            await this.#keys.set(`${account.toString()}-tpk_m`, masterTaggingPublicKey.toBuffer());
+            // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
+            // using the #getKeyPrefixAndAccount function later on
+            await this.#keys.set(`${account.toString()}-npk_m_hash`, publicKeys.npkMHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-ovpk_m_hash`, publicKeys.ovpkMHash.toBuffer());
+            await this.#keys.set(`${account.toString()}-tpk_m_hash`, publicKeys.tpkMHash.toBuffer());
+        });
+        return completeAddress;
+    }
+    /**
+   * Fetches a stored master key buffer for an account by its storage suffix (e.g. `npk_m`, `ivsk_m`).
+   * @throws If the account does not exist in the key store.
+   */ async #getMasterKeyBuffer(account, suffix) {
+        const [buffer] = await this.#getMasterKeyBuffers(account, [
+            suffix
+        ]);
+        return buffer;
+    }
+    /**
+   * Fetches multiple stored master key buffers for an account in a single transaction, returning them in the order of
+   * the requested storage suffixes.
+   * @throws If any of the keys is missing (i.e. the account does not exist in the key store).
+   */ async #getMasterKeyBuffers(account, suffixes) {
+        const buffers = await this.#db.transactionAsync(()=>Promise.all(suffixes.map((suffix)=>this.#keys.getAsync(`${account.toString()}-${suffix}`))));
+        if (!buffers.every((buffer)=>buffer !== undefined)) {
+            throw new Error(`Account ${account.toString()} does not exist. Registered accounts: ${await this.getAccounts()}.`);
+        }
+        return buffers;
+    }
+}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@aztec-labs/key-store",
+  "version": "6.0.0-nightly.20260829",
+  "type": "module",
+  "exports": "./dest/index.js",
+  "typedocOptions": {
+    "entryPoints": [
+      "./src/index.ts"
+    ],
+    "name": "KeyStore",
+    "tsconfig": "./tsconfig.json"
+  },
+  "scripts": {
+    "build": "yarn clean && ../scripts/tsc.sh",
+    "build:dev": "../scripts/tsc.sh --watch",
+    "clean": "rm -rf ./dest .tsbuildinfo",
+    "test": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}"
+  },
+  "inherits": [
+    "../package.common.json"
+  ],
+  "jest": {
+    "moduleNameMapper": {
+      "^(\\.{1,2}/.*)\\.[cm]?js$": "$1"
+    },
+    "testRegex": "./src/.*\\.test\\.(js|mjs|ts)$",
+    "rootDir": "./src",
+    "transform": {
+      "^.+\\.tsx?$": [
+        "@swc/jest",
+        {
+          "jsc": {
+            "parser": {
+              "syntax": "typescript",
+              "decorators": true
+            },
+            "transform": {
+              "decoratorVersion": "2022-03"
+            }
+          }
+        }
+      ]
+    },
+    "extensionsToTreatAsEsm": [
+      ".ts"
+    ],
+    "reporters": [
+      "default"
+    ],
+    "testTimeout": 120000,
+    "setupFiles": [
+      "../../foundation/src/jest/setup.mjs"
+    ],
+    "testEnvironment": "../../foundation/src/jest/env.mjs",
+    "setupFilesAfterEnv": [
+      "../../foundation/src/jest/setupAfterEnv.mjs"
+    ]
+  },
+  "dependencies": {
+    "@aztec-labs/constants": "6.0.0-nightly.20260829",
+    "@aztec-labs/foundation": "6.0.0-nightly.20260829",
+    "@aztec-labs/kv-store": "6.0.0-nightly.20260829",
+    "@aztec-labs/stdlib": "6.0.0-nightly.20260829",
+    "tslib": "^2.4.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "^30.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^22.15.17",
+    "@typescript/native-preview": "7.0.0-dev.20260113.1",
+    "jest": "^30.0.0",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.3.3"
+  },
+  "files": [
+    "dest",
+    "src",
+    "!*.test.*"
+  ],
+  "types": "./dest/index.d.ts",
+  "engines": {
+    "node": ">=20.10"
+  }
+}

package/src/account_privacy_keys.ts

@@ -0,0 +1,24 @@
+import type { GrumpkinScalar } from '@aztec-labs/foundation/curves/grumpkin';
+import type { PublicKey } from '@aztec-labs/stdlib/keys';
+
+/**
+ * The four master privacy secret keys the key store holds for an account: the nullifier-hiding, incoming-viewing,
+ * outgoing-viewing, and tagging keys.
+ */
+export type AccountPrivacySecretKeys = {
+  masterNullifierHidingSecretKey: GrumpkinScalar;
+  masterIncomingViewingSecretKey: GrumpkinScalar;
+  masterOutgoingViewingSecretKey: GrumpkinScalar;
+  masterTaggingSecretKey: GrumpkinScalar;
+};
+
+/**
+ * The keys needed to register an account: the four privacy secret keys the key store holds, plus the *public*
+ * message-signing and fallback keys. The message-signing and fallback secret keys are withheld from the key store (and
+ * hence from PXE, which embeds it), since it is not trusted to hold them: only their public keys are needed (to
+ * reconstruct the account's address).
+ */
+export type AccountPrivacyKeys = AccountPrivacySecretKeys & {
+  masterMessageSigningPublicKey: PublicKey;
+  masterFallbackPublicKey: PublicKey;
+};

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from './account_privacy_keys.js';
+export * from './key_store.js';

package/src/key_store.ts

@@ -0,0 +1,412 @@
+import { DomainSeparator } from '@aztec-labs/constants';
+import { poseidon2HashWithSeparator } from '@aztec-labs/foundation/crypto/poseidon';
+import { Fr } from '@aztec-labs/foundation/curves/bn254';
+import { GrumpkinScalar, Point } from '@aztec-labs/foundation/curves/grumpkin';
+import { toArray } from '@aztec-labs/foundation/iterable';
+import { type Bufferable, serializeToBuffer } from '@aztec-labs/foundation/serialize';
+import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec-labs/kv-store';
+import { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { CompleteAddress, type PartialAddress } from '@aztec-labs/stdlib/contract';
+import { KeyValidationRequest } from '@aztec-labs/stdlib/kernel';
+import {
+  KEY_PREFIXES,
+  type KeyPrefix,
+  type PublicKey,
+  PublicKeys,
+  computeAppSecretKey,
+  derivePublicKeyFromSecretKey,
+  hashPublicKey,
+} from '@aztec-labs/stdlib/keys';
+
+import type { AccountPrivacyKeys, AccountPrivacySecretKeys } from './account_privacy_keys.js';
+
+/** Maps a key prefix to the storage suffix for the corresponding master secret key. */
+function secretKeyStorageSuffix(prefix: KeyPrefix): string {
+  return prefix === 'n' ? 'nhk_m' : `${prefix}sk_m`;
+}
+
+/**
+ * Computes the public counterparts of an account's four privacy secret keys and assembles its {@link PublicKeys} struct
+ * (used to derive the address), from the {@link AccountPrivacyKeys} passed to {@link KeyStore.addAccount}.
+ *
+ * The message-signing and fallback keys are already supplied as public keys, since the key store never holds their
+ * secrets.
+ */
+async function completeAccountKeys(keys: AccountPrivacyKeys) {
+  const {
+    masterNullifierHidingSecretKey,
+    masterIncomingViewingSecretKey,
+    masterOutgoingViewingSecretKey,
+    masterTaggingSecretKey,
+    masterMessageSigningPublicKey,
+    masterFallbackPublicKey,
+  } = keys;
+
+  const masterNullifierHidingPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingSecretKey);
+  const masterIncomingViewingPublicKey = await derivePublicKeyFromSecretKey(masterIncomingViewingSecretKey);
+  const masterOutgoingViewingPublicKey = await derivePublicKeyFromSecretKey(masterOutgoingViewingSecretKey);
+  const masterTaggingPublicKey = await derivePublicKeyFromSecretKey(masterTaggingSecretKey);
+
+  for (const [name, publicKey] of Object.entries({
+    masterNullifierHidingPublicKey,
+    masterIncomingViewingPublicKey,
+    masterOutgoingViewingPublicKey,
+    masterTaggingPublicKey,
+    masterMessageSigningPublicKey,
+    masterFallbackPublicKey,
+  })) {
+    if (publicKey.isInfinite) {
+      throw new Error(`Cannot register an account with an infinity ${name}.`);
+    }
+  }
+
+  const publicKeys = new PublicKeys(
+    await hashPublicKey(masterNullifierHidingPublicKey),
+    masterIncomingViewingPublicKey,
+    await hashPublicKey(masterOutgoingViewingPublicKey),
+    await hashPublicKey(masterTaggingPublicKey),
+    await hashPublicKey(masterMessageSigningPublicKey),
+    await hashPublicKey(masterFallbackPublicKey),
+  );
+
+  return {
+    masterNullifierHidingSecretKey,
+    masterIncomingViewingSecretKey,
+    masterOutgoingViewingSecretKey,
+    masterTaggingSecretKey,
+    masterNullifierHidingPublicKey,
+    masterOutgoingViewingPublicKey,
+    masterTaggingPublicKey,
+    publicKeys,
+  };
+}
+
+/**
+ * Used for managing keys. Can hold keys of multiple accounts.
+ */
+export class KeyStore {
+  public static readonly SCHEMA_VERSION = 1;
+  #db: AztecAsyncKVStore;
+  #keys: AztecAsyncMap<string, Buffer>;
+
+  constructor(database: AztecAsyncKVStore) {
+    this.#db = database;
+    this.#keys = database.openMap('key_store');
+  }
+
+  /**
+   * Adds an account to the key store.
+   *
+   * The key store holds the four privacy secret keys (nullifier-hiding, incoming-viewing, outgoing-viewing, tagging),
+   * but only the *public* message-signing and fallback keys: their secret keys are withheld, since the key store (and
+   * PXE, which embeds it) is not trusted to hold them. The public keys are still needed to reconstruct the account's
+   * address, which commits to all six master public keys.
+   *
+   * @param keys - The account's privacy keys: four secret keys plus the message-signing and fallback public keys.
+   * @param partialAddress - The partial address of the account.
+   * @returns The account's complete address.
+   * @throws If any of the account's six master public keys would be the point at infinity.
+   */
+  public async addAccount(keys: AccountPrivacyKeys, partialAddress: PartialAddress): Promise<CompleteAddress> {
+    const accountKeys = await completeAccountKeys(keys);
+    return this.#storeAccountKeys(accountKeys, partialAddress);
+  }
+
+  /**
+   * Retrieves addresses of accounts stored in the key store.
+   * @returns A Promise that resolves to an array of account addresses.
+   */
+  public async getAccounts(): Promise<AztecAddress[]> {
+    const allMapKeys = await this.#db.transactionAsync(() => toArray(this.#keys.keysAsync()));
+    // We return account addresses based on the map keys that end with '-ivsk_m'
+    const accounts = allMapKeys.filter(key => key.endsWith('-ivsk_m')).map(key => key.split('-')[0]);
+    return accounts.map(account => AztecAddress.fromStringUnsafe(account));
+  }
+
+  /** Checks whether an account is registered in the key store. */
+  public async hasAccount(account: AztecAddress): Promise<boolean> {
+    return !!(await this.#db.transactionAsync(() => this.#keys.getAsync(`${account.toString()}-ivsk_m`)));
+  }
+
+  /**
+   * Gets the key validation request for a given master public key hash and contract address.
+   * @throws If the account corresponding to the master public key hash does not exist in the key store.
+   * @param pkMHash - The master public key hash.
+   * @param contractAddress - The contract address to silo the secret key in the key validation request with.
+   * @returns The key validation request.
+   */
+  public getKeyValidationRequest(pkMHash: Fr, contractAddress: AztecAddress): Promise<KeyValidationRequest> {
+    return this.#db.transactionAsync(async () => {
+      const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkMHash);
+
+      // Load the stored master public key point. The returned KVR carries only the hash, but we
+      // use the point here as a witness for two integrity checks below: (1) it matches the supplied
+      // hash, and (2) it matches the value derived from the stored secret key.
+      const pkMBuffer = await this.#keys.getAsync(`${account.toString()}-${keyPrefix}pk_m`);
+      if (!pkMBuffer) {
+        throw new Error(
+          `Could not find ${keyPrefix}pk_m for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`,
+        );
+      }
+
+      const pkM = Point.fromBuffer(pkMBuffer);
+
+      // Now we find the secret key for the public key
+      const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+      const skMBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
+      if (!skMBuffer) {
+        throw new Error(
+          `Could not find ${skStorageSuffix} for account ${account.toString()} whose address was successfully obtained with ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`,
+        );
+      }
+
+      const skM = GrumpkinScalar.fromBuffer(skMBuffer);
+
+      // The remaining awaits are non-DB computations. They are safe because no further IDB operations follow them.
+      const computedPkMHash = await hashPublicKey(pkM);
+      if (!computedPkMHash.equals(pkMHash)) {
+        throw new Error(`Could not find ${keyPrefix}pkM for ${keyPrefix}pk_m_hash ${pkMHash.toString()}.`);
+      }
+
+      const derivedPkM = await derivePublicKeyFromSecretKey(skM);
+      if (!derivedPkM.equals(pkM)) {
+        throw new Error(`Could not derive ${keyPrefix}pkM from ${keyPrefix}skM.`);
+      }
+
+      const skApp = await computeAppSecretKey(skM, contractAddress, keyPrefix!);
+
+      return new KeyValidationRequest(pkMHash, skApp);
+    });
+  }
+
+  /**
+   * Gets the master nullifier public key for a given account.
+   * @throws If the account does not exist in the key store.
+   */
+  public async getMasterNullifierHidingPublicKey(account: AztecAddress): Promise<PublicKey> {
+    return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'npk_m'));
+  }
+
+  /**
+   * Gets the master incoming viewing public key for a given account.
+   * @throws If the account does not exist in the key store.
+   */
+  public async getMasterIncomingViewingPublicKey(account: AztecAddress): Promise<PublicKey> {
+    return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'ivpk_m'));
+  }
+
+  /**
+   * Retrieves the master outgoing viewing public key.
+   * @throws If the account does not exist in the key store.
+   */
+  public async getMasterOutgoingViewingPublicKey(account: AztecAddress): Promise<PublicKey> {
+    return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'ovpk_m'));
+  }
+
+  /**
+   * Retrieves the master tagging public key.
+   * @throws If the account does not exist in the key store.
+   */
+  public async getMasterTaggingPublicKey(account: AztecAddress): Promise<PublicKey> {
+    return Point.fromBuffer(await this.#getMasterKeyBuffer(account, 'tpk_m'));
+  }
+
+  /**
+   * Retrieves master incoming viewing secret key.
+   * @throws If the account does not exist in the key store.
+   */
+  public async getMasterIncomingViewingSecretKey(account: AztecAddress): Promise<GrumpkinScalar> {
+    return GrumpkinScalar.fromBuffer(await this.#getMasterKeyBuffer(account, 'ivsk_m'));
+  }
+
+  /**
+   * Retrieves the four privacy secret keys the key store holds for an account. Paired with {@link addAccount}, this
+   * allows exporting an account's privacy secret keys, e.g. to re-register it on another PXE. The message-signing and
+   * fallback secret keys are not held by the key store and so are not returned.
+   *
+   * @throws If the account does not exist in the key store.
+   */
+  public async getAccountSecretKeys(account: AztecAddress): Promise<AccountPrivacySecretKeys> {
+    const [nhkM, ivskM, ovskM, tskM] = await this.#getMasterKeyBuffers(account, ['nhk_m', 'ivsk_m', 'ovsk_m', 'tsk_m']);
+    return {
+      masterNullifierHidingSecretKey: GrumpkinScalar.fromBuffer(nhkM),
+      masterIncomingViewingSecretKey: GrumpkinScalar.fromBuffer(ivskM),
+      masterOutgoingViewingSecretKey: GrumpkinScalar.fromBuffer(ovskM),
+      masterTaggingSecretKey: GrumpkinScalar.fromBuffer(tskM),
+    };
+  }
+
+  /**
+   * Retrieves application outgoing viewing secret key.
+   * @throws If the account does not exist in the key store.
+   * @param account - The account to retrieve the application outgoing viewing secret key for.
+   * @param app - The application address to retrieve the outgoing viewing secret key for.
+   * @returns A Promise that resolves to the application outgoing viewing secret key.
+   */
+  public async getAppOutgoingViewingSecretKey(account: AztecAddress, app: AztecAddress): Promise<Fr> {
+    const masterOutgoingViewingSecretKey = GrumpkinScalar.fromBuffer(await this.#getMasterKeyBuffer(account, 'ovsk_m'));
+
+    return poseidon2HashWithSeparator(
+      [masterOutgoingViewingSecretKey.hi, masterOutgoingViewingSecretKey.lo, app],
+      DomainSeparator.OVSK_M,
+    );
+  }
+
+  /**
+   * Retrieves the sk_m corresponding to the given pk_m hash.
+   * @throws If the provided hash is not associated with any of the registered accounts.
+   * @param pkMHash - The master public key hash to get secret key for.
+   * @returns A Promise that resolves to sk_m.
+   * @dev Used when feeding the sk_m to the kernel circuit for keys verification.
+   */
+  public getMasterSecretKey(pkMHash: Fr): Promise<GrumpkinScalar> {
+    return this.#db.transactionAsync(async () => {
+      const [keyPrefix, account] = await this.getKeyPrefixAndAccount(pkMHash);
+
+      const skStorageSuffix = secretKeyStorageSuffix(keyPrefix);
+      const secretKeyBuffer = await this.#keys.getAsync(`${account.toString()}-${skStorageSuffix}`);
+      if (!secretKeyBuffer) {
+        throw new Error(
+          `Could not find ${skStorageSuffix} for ${keyPrefix}pk_m_hash ${pkMHash.toString()}. This should not happen.`,
+        );
+      }
+
+      const skM = GrumpkinScalar.fromBuffer(secretKeyBuffer);
+
+      // Non-DB computation — safe because no further IDB operations follow.
+      // Integrity check: confirm the stored secret key still derives the requested hash. The check
+      // is hash-based rather than point-equal because the on-disk identifier is `pk_m_hash`;
+      // cryptographic collision resistance of `hashPublicKey` makes this equivalent to a
+      // direct point comparison in practice.
+      const derivedPkM = await derivePublicKeyFromSecretKey(skM);
+      const derivedPkMHash = await hashPublicKey(derivedPkM);
+      if (!derivedPkMHash.equals(pkMHash)) {
+        throw new Error(
+          `Could not find ${skStorageSuffix} for ${keyPrefix}pk_m_hash ${pkMHash.toString()} in secret keys buffer.`,
+        );
+      }
+
+      return skM;
+    });
+  }
+
+  /**
+   * Checks whether a given account has a key matching the provided master public key hash.
+   * @param account - The account address to check.
+   * @param pkMHash - The master public key hash to look for.
+   * @returns True if the account has a key with the given hash.
+   */
+  public accountHasKey(account: AztecAddress, pkMHash: Fr): Promise<boolean> {
+    return this.#db.transactionAsync(async () => {
+      const pkMHashBuffer = serializeToBuffer(pkMHash);
+      for (const prefix of KEY_PREFIXES) {
+        const stored = await this.#keys.getAsync(`${account.toString()}-${prefix}pk_m_hash`);
+        if (stored && Buffer.from(stored).equals(pkMHashBuffer)) {
+          return true;
+        }
+      }
+      return false;
+    });
+  }
+
+  /**
+   * Gets the key prefix and account address for a given value.
+   * @returns A tuple containing the key prefix and account address.
+   * @dev Note that this is quite inefficient but it should not matter because there should never be too many keys
+   * in the key store.
+   */
+  public async getKeyPrefixAndAccount(value: Bufferable): Promise<[KeyPrefix, AztecAddress]> {
+    const valueBuffer = serializeToBuffer(value);
+    for await (const [key, val] of this.#keys.entriesAsync()) {
+      // Browser returns Uint8Array, Node.js returns Buffer
+      if (Buffer.from(val).equals(valueBuffer)) {
+        for (const prefix of KEY_PREFIXES) {
+          if (key.includes(`-${prefix}`)) {
+            const account = AztecAddress.fromStringUnsafe(key.split('-')[0]);
+            return [prefix, account];
+          }
+        }
+      }
+    }
+    throw new Error(`Could not find key prefix.`);
+  }
+
+  /**
+   * Persists a completed set of account keys and returns the resulting complete address.
+   */
+  async #storeAccountKeys(
+    accountKeys: Awaited<ReturnType<typeof completeAccountKeys>>,
+    partialAddress: PartialAddress,
+  ): Promise<CompleteAddress> {
+    const {
+      masterNullifierHidingSecretKey,
+      masterIncomingViewingSecretKey,
+      masterOutgoingViewingSecretKey,
+      masterTaggingSecretKey,
+      masterNullifierHidingPublicKey,
+      masterOutgoingViewingPublicKey,
+      masterTaggingPublicKey,
+      publicKeys,
+    } = accountKeys;
+
+    const completeAddress = await CompleteAddress.fromPublicKeysAndPartialAddress(publicKeys, partialAddress);
+    const { address: account } = completeAddress;
+
+    // completeAccountKeys has already guaranteed these master public keys are non-infinity, which the kernel cannot
+    // check but the address relies on.
+
+    // The npk/ovpk/tpk hashes are already in publicKeys; ivpk_m_hash is computed for indexing.
+    const masterIncomingViewingPublicKeyHash = await hashPublicKey(publicKeys.ivpkM);
+
+    await this.#db.transactionAsync(async () => {
+      // Naming of keys is as follows ${account}-${n/iv/ov/t}${sk/pk}_m.
+      //
+      // The message-signing and fallback keys are not stored: their secret keys are withheld from the key store, and
+      // their public keys are only needed transiently to compute the address (they live in the AddressStore).
+      await this.#keys.set(`${account.toString()}-ivsk_m`, masterIncomingViewingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovsk_m`, masterOutgoingViewingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-tsk_m`, masterTaggingSecretKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-nhk_m`, masterNullifierHidingSecretKey.toBuffer());
+
+      await this.#keys.set(`${account.toString()}-npk_m`, masterNullifierHidingPublicKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-ivpk_m`, publicKeys.ivpkM.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovpk_m`, masterOutgoingViewingPublicKey.toBuffer());
+      await this.#keys.set(`${account.toString()}-tpk_m`, masterTaggingPublicKey.toBuffer());
+
+      // We store pk_m_hash under `account-{n/iv/ov/t}pk_m_hash` key to be able to obtain address and key prefix
+      // using the #getKeyPrefixAndAccount function later on
+      await this.#keys.set(`${account.toString()}-npk_m_hash`, publicKeys.npkMHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-ivpk_m_hash`, masterIncomingViewingPublicKeyHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-ovpk_m_hash`, publicKeys.ovpkMHash.toBuffer());
+      await this.#keys.set(`${account.toString()}-tpk_m_hash`, publicKeys.tpkMHash.toBuffer());
+    });
+
+    return completeAddress;
+  }
+
+  /**
+   * Fetches a stored master key buffer for an account by its storage suffix (e.g. `npk_m`, `ivsk_m`).
+   * @throws If the account does not exist in the key store.
+   */
+  async #getMasterKeyBuffer(account: AztecAddress, suffix: string): Promise<Buffer> {
+    const [buffer] = await this.#getMasterKeyBuffers(account, [suffix]);
+    return buffer;
+  }
+
+  /**
+   * Fetches multiple stored master key buffers for an account in a single transaction, returning them in the order of
+   * the requested storage suffixes.
+   * @throws If any of the keys is missing (i.e. the account does not exist in the key store).
+   */
+  async #getMasterKeyBuffers(account: AztecAddress, suffixes: string[]): Promise<Buffer[]> {
+    const buffers = await this.#db.transactionAsync(() =>
+      Promise.all(suffixes.map(suffix => this.#keys.getAsync(`${account.toString()}-${suffix}`))),
+    );
+    if (!buffers.every((buffer): buffer is Buffer => buffer !== undefined)) {
+      throw new Error(
+        `Account ${account.toString()} does not exist. Registered accounts: ${await this.getAccounts()}.`,
+      );
+    }
+    return buffers;
+  }
+}