@digitalbazaar/ed25519-verification-key-2020 - npm Package Compare versions

Comparing version 4.0.0 to 4.1.0

lib/ed25519-browser.js

 /*!
  * Copyright (c) 2020-2022 Digital Bazaar, Inc. All rights reserved.
  */
+import {assertKeyBytes} from './validators.js';
 import * as ed25519 from '@noble/ed25519';
@@ -33,2 +34,6 @@
 async function generateKeyPairFromSeed(seed) {
+  assertKeyBytes({
+    bytes: seed,
+    expectedLength: 32,
+  });
   const publicKey = await ed25519.getPublicKey(seed);
@@ -35,0 +40,0 @@ const secretKey = new Uint8Array(64);

lib/ed25519.js

@@ -12,3 +12,3 @@ /*!
 } from 'node:crypto';
-
+import {assertKeyBytes} from './validators.js';
 import {promisify} from 'node:util';
@@ -115,9 +115,13 @@
   }
-  if(!privateKeyBytes && !(seedBytes instanceof Uint8Array &&
-    seedBytes.length === 32)) {
-    throw new TypeError('`seedBytes` must be a 32 byte Buffer.');
+  if(!privateKeyBytes) {
+    assertKeyBytes({
+      bytes: seedBytes,
+      expectedLength: 32
+    });
   }
-  if(!seedBytes && !(privateKeyBytes instanceof Uint8Array &&
-    privateKeyBytes.length === 64)) {
-    throw new TypeError('`privateKeyBytes` must be a 64 byte Buffer.');
+  if(!seedBytes) {
+    assertKeyBytes({
+      bytes: privateKeyBytes,
+      expectedLength: 64
+    });
   }
@@ -147,6 +151,8 @@ let p;
 function publicKeyDerEncode({publicKeyBytes}) {
-  if(!(publicKeyBytes instanceof Uint8Array && publicKeyBytes.length === 32)) {
-    throw new TypeError('`publicKeyBytes` must be a 32 byte Buffer.');
-  }
+  assertKeyBytes({
+    bytes: publicKeyBytes,
+    expectedLength: 32,
+    code: 'invalidPublicKeyLength'
+  });
   return Buffer.concat([DER_PUBLIC_KEY_PREFIX, publicKeyBytes]);
 }

lib/Ed25519VerificationKey2020.js

@@ -6,2 +6,3 @@ /*!
 import * as base64url from 'base64url-universal';
+import {assertKeyBytes} from './validators.js';
 import ed25519 from './ed25519.js';
@@ -69,2 +70,8 @@ import {LDKeyPair} from 'crypto-ld';
     }
+    // check that the passed in keyBytes are 32 bytes
+    assertKeyBytes({
+      bytes: this._publicKeyBuffer,
+      code: 'invalidPublicKeyLength',
+      expectedLength: 32
+    });
   }
@@ -71,0 +78,0 @@

package.json

 {
   "name": "@digitalbazaar/ed25519-verification-key-2020",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Javascript library for generating and working with Ed25519VerificationKey2020 key pairs, for use with crypto-ld.",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/digitalbazaar/ed25519-verification-key-2020",

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

33076

increased by4.02%

Number of package files

8

increased by14.29%

Lines of code

655

increased by8.26%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes