App private keys should use longer derivation paths

App private keys should use a longer derivation path to take advantage of all the bits of entropy in the SHA256 hash: (see https://github.com/blockstack/blockstack-browser/blob/master/app/js/utils/account-utils.js#L55)

This PR https://github.com/blockstack/blockstack.js/pull/433 adds a function which will generate such a lengthened key, and it includes a function for generating the old derivation as well (using the hashCode function).

To address this in a backwards compatible fashion, we should:

1. On authentication with multi-player apps, check whether an entry already exists for the app (and uses the legacy derived app key), and if so, use the legacy path, otherwise use the new path.
2. On authentication with single-player apps, check whether the app is in a whitelisted set of legacy apps (use the current set of single-player apps in the browser as the whitelist) and if so, use the legacy path, otherwise use the new path.

[jcnelson]

I’m in favor of the longer derivation path by default. I think we have determined that derivation performance is a non-issue.

[jcnelson]

but would tend towards saying it’s not a problem

That’s what I meant 😃 We could easily add a “loading…” dialog on the sign-in page, or do the key derivation once the user is presented with the login dialog (so it occurs before the user clicks “sign-in”), etc.

On an iPhone 8, it took ~200 ms (page takes much longer to load because it downloads blockstack.js).

On my Pixel 2 XL, it took 693 ms. On my laptop, it took 340 ms.