Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@digitalcredentials/x25519-key-agreement-key-2020
Advanced tools
An X25519 (Curve25519) DH (Diffie-Hellman) key implementation to work with the X25519 2020 Crypto suite.
An X25519 (Curve25519) DH (Diffie-Hellman) key implementation to work with the X25519 2020 Crypto suite.
TBD
(Forked from digitalbazaar/x25519-key-agreement-key-2020
v2.0.0
to provide TypeScript compatibility.)
For use with crypto-ld
>= 5.0
.
To actually perform encryption with those keys, we recommend you use
the minimal-cipher
library.
This is a low-level level library to generate and serialize X25519 (Curve25519)
key pairs (uses nacl.box
under the hood).
See also (related specs):
Requires Node.js 12+
To install locally (for development):
git clone https://github.com/digitalcredentials/x25519-key-agreement-key-2020.git
cd x25519-key-agreement-key-2020
npm install
Importing:
const {X25519KeyAgreementKey2020} = require('@digitalcredentials/x25519-key-agreement-key-2020');
// Or, if you're testing code in the interactive Node CLI, right in this repo:
const {X25519KeyAgreementKey2020} = require('./');
Generating:
const keyPair = await X25519KeyAgreementKey2020.generate({
controller: 'did:example:1234'
});
// ->
{
"id": "did:example:1234#z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"controller": "did:example:1234",
"type": "X25519KeyAgreementKey2020",
"publicKeyMultibase": "z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"privateKeyMultibase": "z3weeMD56C1T347EmB6kYNS7trpQwjvtQCpCYRpqGz6mcemT"
}
Serializing just the public key:
keyPair.export({publicKey: true});
// ->
{
"id": "did:example:1234#z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"controller": "did:example:1234",
"type": "X25519KeyAgreementKey2020",
"publicKeyMultibase": "z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM"
}
Serializing both the private and public key:
// a different key pair than the previous example
await keyPair.export({publicKey: true, privateKey: true})
// ->
{
"id": "did:example:1234#z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"controller": "did:example:1234",
"type": "X25519KeyAgreementKey2020",
"publicKeyMultibase": "z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"privateKeyMultibase": "z3weeMD56C1T347EmB6kYNS7trpQwjvtQCpCYRpqGz6mcemT"
}
Deserializing:
// Loading public key only
const keyPair = await X25519KeyAgreementKey2020.from({
"id": "did:example:1234#z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM",
"controller": "did:example:1234",
"type": "X25519KeyAgreementKey2020",
"publicKeyMultibase": "z6LSeRSE5Em5oJpwdk3NBaLVERBS332ULC7EQq5EtMsmXhsM"
});
See the contribute file!
PRs accepted.
If editing the Readme, please conform to the standard-readme specification.
3.0.0 - 2022-09-08
ed2curve
dependency to
be removed.FAQs
An X25519 (Curve25519) DH (Diffie-Hellman) key implementation to work with the X25519 2020 Crypto suite.
The npm package @digitalcredentials/x25519-key-agreement-key-2020 receives a total of 301 weekly downloads. As such, @digitalcredentials/x25519-key-agreement-key-2020 popularity was classified as not popular.
We found that @digitalcredentials/x25519-key-agreement-key-2020 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.