@celo/cryptographic-utils - npm Package Compare versions

Comparing version 5.0.8 to 5.1.0-beta.0

lib/account.d.ts

@@ -26,2 +26,3 @@ /// <reference types="node" />
 export declare function formatNonAccentedCharacters(mnemonic: string): string;
+export declare function getWordList(language?: MnemonicLanguages): string[];
 export declare function getAllLanguages(): MnemonicLanguages[];
@@ -28,0 +29,0 @@ export declare function mnemonicLengthFromStrength(strength: MnemonicStrength): number;

lib/account.js

@@ -38,3 +38,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccountUtils = exports.generateKeysFromSeed = exports.generateSeed = exports.generateDeterministicInviteCode = exports.generateKeys = exports.suggestMnemonicCorrections = exports.detectMnemonicLanguage = exports.mnemonicLengthFromStrength = exports.getAllLanguages = exports.formatNonAccentedCharacters = exports.normalizeMnemonic = exports.invalidMnemonicWords = exports.validateMnemonic = exports.generateMnemonic = exports.MnemonicStrength = exports.MnemonicLanguages = exports.CELO_DERIVATION_PATH_BASE = void 0;
+exports.AccountUtils = exports.generateKeysFromSeed = exports.generateSeed = exports.generateDeterministicInviteCode = exports.generateKeys = exports.suggestMnemonicCorrections = exports.detectMnemonicLanguage = exports.mnemonicLengthFromStrength = exports.getAllLanguages = exports.getWordList = exports.formatNonAccentedCharacters = exports.normalizeMnemonic = exports.invalidMnemonicWords = exports.validateMnemonic = exports.generateMnemonic = exports.MnemonicStrength = exports.MnemonicLanguages = exports.CELO_DERIVATION_PATH_BASE = void 0;
 const account_1 = require("@celo/base/lib/account");
@@ -44,8 +44,8 @@ const string_1 = require("@celo/base/lib/string");
 const levenshtein_1 = require("@celo/utils/lib/levenshtein");
-const bip32_1 = __importDefault(require("bip32"));
-const bip39 = __importStar(require("bip39"));
-const keccak_1 = require("ethereum-cryptography/keccak");
-const utils_1 = require("ethereum-cryptography/utils");
-const randombytes_1 = __importDefault(require("randombytes"));
-const ecc = __importStar(require("tiny-secp256k1"));
+const sha3_1 = require("@noble/hashes/sha3");
+const utils_1 = require("@noble/hashes/utils");
+const bip32_1 = require("@scure/bip32");
+const bip39 = __importStar(require("@scure/bip39"));
+const crypto_1 = require("crypto");
+const wordlists_1 = __importDefault(require("./wordlists"));
 // Exports moved to @celo/base, forwarding them
@@ -57,7 +57,6 @@ // here for backwards compatibility
 Object.defineProperty(exports, "MnemonicStrength", { enumerable: true, get: function () { return account_2.MnemonicStrength; } });
-const bip32 = (0, bip32_1.default)(ecc);
-function defaultGenerateMnemonic(strength, rng, wordlist) {
+function defaultGenerateMnemonic(strength, rng, wordlist = wordlists_1.default[account_1.MnemonicLanguages.english]) {
     return new Promise((resolve, reject) => {
         strength = strength || 128;
-        rng = rng || randombytes_1.default;
+        rng = rng || crypto_1.randomBytes;
         rng(strength / 8, (error, randomBytesBuffer) => {
@@ -68,3 +67,3 @@ if (error) {
             else {
-                resolve(bip39.entropyToMnemonic(randomBytesBuffer.toString('hex'), wordlist));
+                resolve(bip39.entropyToMnemonic(randomBytesBuffer, wordlist));
             }
@@ -74,2 +73,5 @@ });
 }
+function _validateMnemonic(mnemonic, wordlist = wordlists_1.default[account_1.MnemonicLanguages.english]) {
+    return bip39.validateMnemonic(mnemonic, wordlist);
+}
 const bip39Wrapper = {
@@ -79,3 +81,3 @@ mnemonicToSeedSync: bip39.mnemonicToSeedSync,
     generateMnemonic: defaultGenerateMnemonic,
-    validateMnemonic: bip39.validateMnemonic,
+    validateMnemonic: _validateMnemonic,
 };
@@ -175,25 +177,6 @@ function generateMnemonic(strength = account_1.MnemonicStrength.s256_24words, language, bip39ToUse = bip39Wrapper) {
 // Unify the bip39.wordlists (otherwise depends on the instance of the bip39)
-function getWordList(language) {
-    // Use exhaustive switch to ensure that every language is accounted for.
-    switch (language !== null && language !== void 0 ? language : account_1.MnemonicLanguages.english) {
-        case account_1.MnemonicLanguages.chinese_simplified:
-            return bip39.wordlists.chinese_simplified;
-        case account_1.MnemonicLanguages.chinese_traditional:
-            return bip39.wordlists.chinese_traditional;
-        case account_1.MnemonicLanguages.english:
-            return bip39.wordlists.english;
-        case account_1.MnemonicLanguages.french:
-            return bip39.wordlists.french;
-        case account_1.MnemonicLanguages.italian:
-            return bip39.wordlists.italian;
-        case account_1.MnemonicLanguages.japanese:
-            return bip39.wordlists.japanese;
-        case account_1.MnemonicLanguages.korean:
-            return bip39.wordlists.korean;
-        case account_1.MnemonicLanguages.spanish:
-            return bip39.wordlists.spanish;
-        case account_1.MnemonicLanguages.portuguese:
-            return bip39.wordlists.portuguese;
-    }
+function getWordList(language = account_1.MnemonicLanguages.english) {
+    return wordlists_1.default[language];
 }
+exports.getWordList = getWordList;
 function getAllLanguages() {
@@ -389,3 +372,3 @@ return [
 function generateDeterministicInviteCode(recipientPhoneHash, recipientPepper, addressIndex = 0, changeIndex = 0, derivationPath = account_1.CELO_DERIVATION_PATH_BASE) {
-    const seed = (0, keccak_1.keccak256)((0, utils_1.utf8ToBytes)(recipientPhoneHash + recipientPepper));
+    const seed = Buffer.from((0, sha3_1.keccak_256)((0, utils_1.utf8ToBytes)(recipientPhoneHash + recipientPepper)));
     return generateKeysFromSeed(seed, changeIndex, addressIndex, derivationPath);
@@ -398,3 +381,3 @@ }
     return __awaiter(this, void 0, void 0, function* () {
-        let seed = yield bip39ToUse.mnemonicToSeed(mnemonic, password);
+        let seed = Buffer.from(yield bip39ToUse.mnemonicToSeed(mnemonic, password));
         if (keyByteLength > 0 && seed.byteLength > keyByteLength) {
@@ -410,4 +393,4 @@ const bufAux = Buffer.allocUnsafe(keyByteLength);
 function generateKeysFromSeed(seed, changeIndex = 0, addressIndex = 0, derivationPath = account_1.CELO_DERIVATION_PATH_BASE) {
-    const node = bip32.fromSeed(seed);
-    const newNode = node.derivePath(`${derivationPath ? `${derivationPath}/` : ''}${changeIndex}/${addressIndex}`);
+    const node = bip32_1.HDKey.fromMasterSeed(seed);
+    const newNode = node.derive(`${derivationPath ? `${derivationPath}/` : ''}${changeIndex}/${addressIndex}`);
     if (!newNode.privateKey) {
@@ -417,6 +400,8 @@ // As we are generating the node from a seed, the node will always have a private key and this would never happened
     }
+    const privateKey = (0, utils_1.bytesToHex)(newNode.privateKey);
+    const publicKey = (0, utils_1.bytesToHex)(newNode.publicKey);
     return {
-        privateKey: newNode.privateKey.toString('hex'),
-        publicKey: newNode.publicKey.toString('hex'),
-        address: (0, address_1.privateKeyToAddress)(newNode.privateKey.toString('hex')),
+        privateKey,
+        publicKey,
+        address: (0, address_1.privateKeyToAddress)(privateKey),
     };
@@ -423,0 +408,0 @@ }

lib/bls.d.ts

@@ -0,5 +1,6 @@
+/// <reference types="node" />
 export declare const BLS_PUBLIC_KEY_SIZE = 96;
 export declare const BLS_POP_SIZE = 48;
-export declare const blsPrivateKeyToProcessedPrivateKey: (privateKeyHex: string) => any;
+export declare const blsPrivateKeyToProcessedPrivateKey: (privateKeyHex: string) => Buffer;
 export declare const getBlsPublicKey: (privateKeyHex: string) => string;
 export declare const getBlsPoP: (address: string, privateKeyHex: string) => string;

lib/bls.js

@@ -7,6 +7,5 @@ "use strict";
 const address_1 = require("@celo/utils/lib/address");
-const keccak_1 = require("ethereum-cryptography/keccak");
-const BigInteger = require('bigi');
-const reverse = require('buffer-reverse');
-const n = BigInteger.fromHex('12ab655e9a2ca55660b44d1e5c37b00159aa76fed00000010a11800000000001', 16);
+const sha3_1 = require("@noble/hashes/sha3");
+const utils_1 = require("@noble/hashes/utils");
+const n = BigInt('0x12ab655e9a2ca55660b44d1e5c37b00159aa76fed00000010a11800000000001');
 const MODULUSMASK = 31;
@@ -25,11 +24,11 @@ exports.BLS_PUBLIC_KEY_SIZE = 96;
         ]);
-        const privateKeyBLSBytes = (0, keccak_1.keccak256)(keyBytes);
+        const privateKeyBLSBytes = (0, sha3_1.keccak_256)(keyBytes);
         // eslint-disable-next-line no-bitwise
         privateKeyBLSBytes[0] &= MODULUSMASK;
-        const privateKeyNum = BigInteger.fromBuffer(privateKeyBLSBytes);
-        if (privateKeyNum.compareTo(n) >= 0) {
+        const _privateKeyHex = `0x${(0, utils_1.bytesToHex)(privateKeyBLSBytes)}`;
+        const privateKeyNum = BigInt(_privateKeyHex);
+        if (privateKeyNum >= n) {
             continue;
         }
-        const privateKeyBytes = reverse(privateKeyNum.toBuffer());
-        return privateKeyBytes;
+        return Buffer.from(privateKeyBLSBytes.reverse());
     }
@@ -36,0 +35,0 @@ throw new Error("couldn't derive BLS key from ECDSA key");

lib/commentEncryption.js

@@ -5,3 +5,4 @@ "use strict";
 const ecies_1 = require("@celo/utils/lib/ecies");
-const crypto_1 = require("crypto");
+const utils_1 = require("@noble/ciphers/utils");
+const utils_2 = require("@noble/ciphers/webcrypto/utils");
 const dataEncryptionKey_1 = require("./dataEncryptionKey");
@@ -20,6 +21,6 @@ const ECIES_SESSION_KEY_LEN = 129;
 function encryptData(data, pubKeyRecipient, pubKeySelf) {
-    const sessionKey = (0, crypto_1.randomBytes)(16);
+    const sessionKey = (0, utils_2.randomBytes)(16);
     const sessionKeyToSelf = (0, ecies_1.Encrypt)(pubKeySelf, sessionKey);
     const sessionKeyToOther = (0, ecies_1.Encrypt)(pubKeyRecipient, sessionKey);
-    const ciphertext = (0, ecies_1.AES128EncryptAndHMAC)(sessionKey, sessionKey, data);
+    const ciphertext = (0, ecies_1.AES128EncryptAndHMAC)((0, utils_1.u8)(sessionKey), sessionKey, (0, utils_1.u8)(data));
     return Buffer.concat([sessionKeyToOther, sessionKeyToSelf, ciphertext]);
@@ -42,7 +43,10 @@ }
     const sessionKeyEncrypted = sender
-        ? data.slice(ECIES_SESSION_KEY_LEN, ECIES_SESSION_KEY_LEN * 2)
-        : data.slice(0, ECIES_SESSION_KEY_LEN);
-    const sessionKey = (0, ecies_1.Decrypt)(key, sessionKeyEncrypted);
-    const encryptedMessage = data.slice(ECIES_SESSION_KEY_LEN * 2);
-    return (0, ecies_1.AES128DecryptAndHMAC)(sessionKey, sessionKey, encryptedMessage);
+        ? data.subarray(ECIES_SESSION_KEY_LEN, ECIES_SESSION_KEY_LEN * 2)
+        : data.subarray(0, ECIES_SESSION_KEY_LEN);
+    const sessionKey = (0, ecies_1.Decrypt)((0, utils_1.u8)(key), sessionKeyEncrypted);
+    if (sender) {
+        console.log(sessionKeyEncrypted);
+    }
+    const encryptedMessage = data.subarray(ECIES_SESSION_KEY_LEN * 2);
+    return Buffer.from((0, ecies_1.AES128DecryptAndHMAC)((0, utils_1.u8)(sessionKey), (0, utils_1.u8)(sessionKey), (0, utils_1.u8)(encryptedMessage)));
 }
@@ -49,0 +53,0 @@ exports.decryptData = decryptData;

lib/dataEncryptionKey.d.ts

@@ -7,3 +7,3 @@ /// <reference types="node" />
  * @param {Buffer} privateKey Private key.
- * @returns {string} Corresponding compessed public key in hex encoding with '0x' leader.
+ * @returns {string} Corresponding compressed public key in hex encoding with '0x' leader.
  */
@@ -10,0 +10,0 @@ export declare function compressedPubKey(privateKey: Buffer): string;

lib/dataEncryptionKey.js

@@ -5,2 +5,4 @@ "use strict";
 const address_1 = require("@celo/utils/lib/address");
+const utils_1 = require("@noble/curves/abstract/utils");
+const secp256k1_1 = require("@noble/curves/secp256k1");
 const account_1 = require("./account");
@@ -11,12 +13,6 @@ /**
  * @param {Buffer} privateKey Private key.
- * @returns {string} Corresponding compessed public key in hex encoding with '0x' leader.
+ * @returns {string} Corresponding compressed public key in hex encoding with '0x' leader.
  */
 function compressedPubKey(privateKey) {
-    // NOTE: elliptic is disabled elsewhere in this library to prevent
-    // accidental signing of truncated messages.
-    // tslint:disable-next-line:import-blacklist
-    const EC = require('elliptic').ec;
-    const ec = new EC('secp256k1');
-    const key = ec.keyFromPrivate(privateKey);
-    return (0, address_1.ensureLeading0x)(key.getPublic(true, 'hex'));
+    return (0, address_1.ensureLeading0x)((0, utils_1.bytesToHex)(secp256k1_1.secp256k1.getPublicKey(privateKey))).slice(1);
 }
@@ -32,8 +28,3 @@ exports.compressedPubKey = compressedPubKey;
 function decompressPublicKey(publicKey) {
-    // NOTE: elliptic is disabled elsewhere in this library to prevent
-    // accidental signing of truncated messages.
-    // tslint:disable-next-line:import-blacklist
-    const EC = require('elliptic').ec;
-    const ec = new EC('secp256k1');
-    return Buffer.from(ec.keyFromPublic(publicKey).getPublic(false, 'hex'), 'hex').slice(1);
+    return Buffer.from(secp256k1_1.secp256k1.getSharedSecret(BigInt(1), publicKey, false)).slice(1);
 }
@@ -40,0 +31,0 @@ exports.decompressPublicKey = decompressPublicKey;

package.json

 {
   "name": "@celo/cryptographic-utils",
-  "version": "5.0.8",
+  "version": "5.1.0-beta.0",
   "description": "Some Celo utils for comment/data encryption, bls, and mnemonics",
@@ -25,22 +25,16 @@ "author": "Celo",
   "dependencies": {
-    "@celo/base": "^6.0.1",
+    "@celo/base": "^6.1.0-beta.0",
     "@celo/bls12377js": "0.1.1",
-    "@celo/utils": "^6.0.1",
-    "@ethereumjs/util": "8.0.5",
+    "@celo/utils": "^7.0.0-beta.0",
+    "@noble/ciphers": "0.4.1",
+    "@noble/curves": "1.3.0",
+    "@noble/hashes": "1.3.3",
+    "@scure/bip32": "^1.3.3",
+    "@scure/bip39": "^1.2.2",
     "@types/bn.js": "^5.1.0",
-    "@types/elliptic": "^6.4.9",
-    "@types/node": "^18.7.16",
-    "@types/randombytes": "^2.0.0",
-    "bigi": "^1.4.2",
-    "bip32": "^3.1.0",
-    "bip39": "https://github.com/bitcoinjs/bip39#a7ecbfe2e60d0214ce17163d610cad9f7b23140c",
-    "buffer-reverse": "^1.0.1",
-    "elliptic": "^6.5.4",
-    "ethereum-cryptography": "1.2.0",
-    "randombytes": "^2.0.1",
-    "tiny-secp256k1": "2.2.1"
+    "@types/node": "^18.7.16"
   },
   "devDependencies": {
-    "@celo/typescript": "0.0.1"
+    "@celo/typescript": "workspace:^"
   }
 }

README.md

@@ -18,3 +18,3 @@ # @celo/cryptographic-utils
 
-✨ [Suggest a feature](httpsi//github.com/celo-org/developer-tooling/issues/new/choose)
+✨ [Suggest a feature](https://github.com/celo-org/developer-tooling/issues/new/choose)
 
@@ -21,0 +21,0 @@ 🧑‍💻 [Contribute!](/CONTRIBUTING.md)

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

HTTP dependency

Supply chain risk

Contains a dependency which resolves to a remote HTTP URL which could be used to inject untrusted code and reduce overall package reliability.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

60672

increased by1.04%

Dependency count

10

decreased by-37.5%

Number of package files

20

increased by17.65%

Lines of code

839

increased by0.96%

Number of high supply chain risk alerts

0

decreased by-100%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Number of low quality alerts

2

increased by100%

Dependency changes

• + Added@noble/ciphers@0.4.1

• + Added@noble/curves@1.3.0

• + Added@noble/hashes@1.3.3

• + Added@scure/bip32@^1.3.3

• + Added@scure/bip39@^1.2.2

• + Added@celo/utils@7.0.0(transitive)

• + Added@ethereumjs/rlp@5.0.2(transitive)

• + Added@noble/ciphers@0.4.1(transitive)

• + Added@noble/curves@1.3.01.6.0(transitive)

• + Added@noble/hashes@1.3.3(transitive)

• + Added@scure/bip32@1.5.0(transitive)

• + Added@scure/bip39@1.4.0(transitive)

• - Removed@ethereumjs/util@8.0.5

• - Removed@types/elliptic@^6.4.9

• - Removed@types/randombytes@^2.0.0

• - Removedbigi@^1.4.2

• - Removedbip32@^3.1.0

• - Removedbip39@https://github.com/bitcoinjs/bip39#a7ecbfe2e60d0214ce17163d610cad9f7b23140c

• - Removedbuffer-reverse@^1.0.1

• - Removedelliptic@^6.5.4

• - Removedethereum-cryptography@1.2.0

• - Removedrandombytes@^2.0.1

• - Removedtiny-secp256k1@2.2.1

• - Removed@celo/utils@6.0.1(transitive)

• - Removed@types/elliptic@6.4.18(transitive)

• - Removed@types/randombytes@2.0.3(transitive)

• - Removedbase-x@3.0.10(transitive)

• - Removedbigi@1.4.2(transitive)

• - Removedbip32@3.1.0(transitive)

• - Removedbs58@4.0.1(transitive)

• - Removedbs58check@2.1.2(transitive)

• - Removedbuffer-reverse@1.0.1(transitive)

• - Removedcipher-base@1.0.4(transitive)

• - Removedcreate-hash@1.2.0(transitive)

• - Removedcreate-hmac@1.1.7(transitive)

• - Removedelliptic@6.5.7(transitive)

• - Removedhash-base@3.1.0(transitive)

• - Removedmd5.js@1.3.5(transitive)

• - Removedreadable-stream@3.6.2(transitive)

• - Removedripemd160@2.0.2(transitive)

• - Removedrlp@2.2.7(transitive)

• - Removedsha.js@2.4.11(transitive)

• - Removedstring_decoder@1.3.0(transitive)

• - Removedtiny-secp256k1@2.2.1(transitive)

• - Removedtypeforce@1.18.0(transitive)

• - Removeduint8array-tools@0.0.7(transitive)

• - Removedutil-deprecate@1.0.2(transitive)

• - Removedwif@2.0.6(transitive)

• Updated@celo/base@^6.1.0-beta.0

• Updated@celo/utils@^7.0.0-beta.0