@atproto/crypto - npm Package Compare versions

Comparing version 0.4.2 to 0.4.3

CHANGELOG.md

 # @atproto/crypto
 
+## 0.4.3
+
+### Patch Changes
+
+- [#3335](https://github.com/bluesky-social/atproto/pull/3335) [`1abfd74ec`](https://github.com/bluesky-social/atproto/commit/1abfd74ec7114e5d8e2411f7a4fa10bdce97e277) Thanks [@dholms](https://github.com/dholms)! - Update noble crypto libraries
+
 ## 0.4.2
@@ -4,0 +10,0 @@

dist/multibase.js

@@ -72,3 +72,3 @@ "use strict";
         default:
-            throw new Error(`Unsupported multibase: :${mb}`);
+            throw new Error(`Unsupported multibase: :${encoding}`);
     }
@@ -75,0 +75,0 @@ };

dist/multibase.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"multibase.js","sourceRoot":"","sources":["../src/multibase.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yDAA0C;AAGnC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAc,EAAE;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACpD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAvBY,QAAA,gBAAgB,oBAuB5B;AAEM,MAAM,gBAAgB,GAAG,CAC9B,EAAc,EACd,QAA4B,EACpB,EAAE;IACV,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,cAAc;YACjB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAxBY,QAAA,gBAAgB,oBAwB5B"}
+{"version":3,"file":"multibase.js","sourceRoot":"","sources":["../src/multibase.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yDAA0C;AAGnC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAc,EAAE;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACpD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAvBY,QAAA,gBAAgB,oBAuB5B;AAEM,MAAM,gBAAgB,GAAG,CAC9B,EAAc,EACd,QAA4B,EACpB,EAAE;IACV,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,cAAc;YACjB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAxBY,QAAA,gBAAgB,oBAwB5B"}

dist/p256/operations.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}

dist/p256/operations.js

@@ -21,8 +21,4 @@ "use strict";
     const msgHash = await (0, sha256_1.sha256)(data);
-    // parse as compact sig to prevent signature malleability
-    // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-    if (!allowMalleable && !(0, exports.isCompactFormat)(sig)) {
-        return false;
-    }
     return p256_1.p256.verify(sig, msgHash, publicKey, {
+        format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
         lowS: !allowMalleable,
@@ -29,0 +25,0 @@ });

dist/p256/operations.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,iDAA6C;AAC7C,6CAAiD;AAEjD,oCAA0C;AAE1C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,uBAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,yDAAyD;IACzD,oGAAoG;IACpG,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,WAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAhBY,QAAA,SAAS,aAgBrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAA,oBAAS,EAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,iDAA6C;AAC7C,6CAAiD;AAEjD,oCAA0C;AAE1C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,uBAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,OAAO,WAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,iCAAiC;QACjF,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAA,oBAAS,EAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}

dist/secp256k1/operations.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}

dist/secp256k1/operations.js

@@ -44,8 +44,4 @@ "use strict";
     const msgHash = await (0, sha256_1.sha256)(data);
-    // parse as compact sig to prevent signature malleability
-    // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-    if (!allowMalleable && !(0, exports.isCompactFormat)(sig)) {
-        return false;
-    }
     return secp256k1_1.secp256k1.verify(sig, msgHash, publicKey, {
+        format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
         lowS: !allowMalleable,
@@ -52,0 +48,0 @@ });

dist/secp256k1/operations.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uDAA2D;AAC3D,iDAA6C;AAC7C,iDAAkC;AAElC,oCAA+C;AAE/C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,4BAAoB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,yDAAyD;IACzD,oGAAoG;IACpG,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,qBAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAhBY,QAAA,SAAS,aAgBrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uDAA2D;AAC3D,iDAA6C;AAC7C,iDAAkC;AAElC,oCAA+C;AAE/C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,4BAAoB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,OAAO,qBAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,iCAAiC;QACjF,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}

package.json

 {
   "name": "@atproto/crypto",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "license": "MIT",
@@ -19,4 +19,4 @@ "description": "Library for cryptographic keys and signing in atproto",
   "dependencies": {
-    "@noble/curves": "^1.1.0",
-    "@noble/hashes": "^1.3.1",
+    "@noble/curves": "^1.7.0",
+    "@noble/hashes": "^1.6.1",
     "uint8arrays": "3.0.0"
@@ -27,3 +27,3 @@ },
     "typescript": "^5.6.3",
-    "@atproto/common": "^0.4.4"
+    "@atproto/common": "^0.4.6"
   },
@@ -30,0 +30,0 @@ "scripts": {

src/multibase.ts

@@ -51,4 +51,4 @@ import * as uint8arrays from 'uint8arrays'
     default:
-      throw new Error(`Unsupported multibase: :${mb}`)
+      throw new Error(`Unsupported multibase: :${encoding}`)
   }
 }

src/p256/operations.ts

@@ -31,8 +31,4 @@ import { p256 } from '@noble/curves/p256'
   const msgHash = await sha256(data)
-  // parse as compact sig to prevent signature malleability
-  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-  if (!allowMalleable && !isCompactFormat(sig)) {
-    return false
-  }
   return p256.verify(sig, msgHash, publicKey, {
+    format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
     lowS: !allowMalleable,
@@ -39,0 +35,0 @@ })

src/secp256k1/operations.ts

@@ -31,8 +31,4 @@ import { secp256k1 as k256 } from '@noble/curves/secp256k1'
   const msgHash = await sha256(data)
-  // parse as compact sig to prevent signature malleability
-  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-  if (!allowMalleable && !isCompactFormat(sig)) {
-    return false
-  }
   return k256.verify(sig, msgHash, publicKey, {
+    format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
     lowS: !allowMalleable,
@@ -39,0 +35,0 @@ })

No alert changes

Worsened metrics

Total package byte prevSize

99249

-0.45%

Lines of code

1848

-0.86%

Dependency changes

• Updated

  @noble/curves@^1.7.0

• Updated

  @noble/hashes@^1.6.1