Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@iota/signing
Advanced tools
IOTA Signing Scheme
Install using npm:
npm install @iota/signing
or using yarn:
yarn add @iota/signing
Summary: Generates a subseed.
Throws:
errors.ILLEGAL_SUBSEED_INDEX
: Make sure that the index
argument is a number greater than 0.Param | Type | Description |
---|---|---|
seed | Int8Array | A 243-trit seed to use to derive the subseed |
index | number | The private key index to use to derive the subseed |
This method derives a subseed from a seed and a private key index.
You can use the subseed to derive private keys and their addresses.
Note: If the given seed is less then 243 trits, 0 trits are appended to it until it is 243 trits long.
To convert a seed from trytes to trits, use the trytesToTrits()
method.
To derive a private key from the subseed, use the key()
method.
Returns: Int8Array
- subseed - A subseed in trits
Example
const seed = 'MYSUPERSECRETSEED...';
const subseed = Sign.subseed(Converter.trytesToTrits(seed), 0);
Summary: Generates a private key.
Throws:
errors.ILLEGAL_SUBSEED_LENGTH
: Make sure that the subseedTrits
argument contains 243 trits.errors.ILLEGAL_NUMBER_OF_FRAGMENTS
: Make sure that the numberOfFragments
argument is a valid security level (between 1 and 3).Param | Type | Description |
---|---|---|
subseedTrits | Int8Array | A subseed in trits |
numberOfFragments | number | The security level that you want the private key to have |
This method derives a private key from a subseed.
You can use the private key to derive an address and to sign bundles that withdraw from that address.
To generate a subseed, use the subseed()
method.
Returns: Int8Array
- privateKey - A private key in trits.
Example
const seed = 'MYSUPERSECRETSEED...';
const subseed = Signing.subseed(Converter.trytesToTrits(seed), 0);
const privateKey = Signing.key(subseed, 2);
Summary: Generates key digests for a given private key.
Throws:
errors.ILLEGAL_KEY_LENGTH
: Make sure that the key
argument contains 2,187, 4,374, or 6,561 trits.Param | Type | Description |
---|---|---|
key | Int8Array | Private key in trits |
This method derives key digests from a private key.
You can use the key digests to generate an address.
To generate a private key, use the key()
method.
Returns: Int8Array
- digests - Key digests in trits
Example
const seed = 'MYSUPERSECRETSEED...';
const subseed = Signing.subseed(Converter.trytesToTrits(seed), 0);
const privateKey = Signing.key(subseed, 2);
const digests = Signing.digests(privateKey);
Summary: Derives an address from the given key digests.
Throws:
errors.ILLEGAL_DIGESTS_LENGTH
: Make sure that the digests
argument contains a multiple of 243 trits.Param | Type | Description |
---|---|---|
digests | Int8Array | Key digests in trits |
This method derives a 243-trit address from the given key digests.
To generate a private key, use the key()
method.
Returns: Int8Array
- address - Address in trits
Example
const seed = 'MYSUPERSECRETSEED...';
const subseed = Signing.subseed(Converter.trytesToTrits(seed), 0);
const privateKey = Signing.key(subseed, 2);
const digests = Signing.digests(privateKey);
const address = Signing.address(digests);
Summary: Validates the given signature, using the given bundle and address.
Throws:
errors.ILLEGAL_BUNDLE_HASH_LENGTH
: Make sure that the bundle
argument contains a 243-trit bundle hash.Param | Type | Description |
---|---|---|
expectedAddress | Int8Array | Input address in trits |
signatureFragments | Array.<Int8Array> | Signature fragments in trits |
bundle | Int8Array | Bundle hash in trits |
This method validates a signature by doing the following:
expectedAddress
argument to find out if they matchIf the addresses match, the signature is valid.
For more information about signatures see the documentation portal.
To convert trytes such as bundle hashes and addresses to trits, use the trytesToTrits()
method.
Returns: boolean
- valid - Whether the signatures are valid.
Example
let valid = Signing.validateSignatures(expectedAddress, signatureFragments, bundle);
Summary: Normalizes the bundle hash.
Throws:
errors.ILLEGAL_BUNDLE_HASH_LENGTH
: Make sure that the bundle
argument contains a 243-trit bundle hash.Param | Type | Description |
---|---|---|
bundle | Int8Array | Bundle hash in trits |
This method normalizes the given bundle hash to make sure that only around half of the private key is revealed when the bundle hash is signed.
For more information about signatures see the documentation portal.
To find out more about why the bundle hash is normalized, see this answer on StackExchange.
To convert a bundle hash from trytes to trits, use the trytesToTrits()
method.
Returns: Int8Array
- Normalized bundle hash in trits
Example
let normalizedBundleHash = Signing.normalizedBundle(bundle);
FAQs
IOTA Signing Scheme
The npm package @iota/signing receives a total of 9,601 weekly downloads. As such, @iota/signing popularity was classified as popular.
We found that @iota/signing demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.