@noble/curves - npm Package Compare versions

Comparing version 0.8.0 to 0.8.1

package.json

 {
   "name": "@noble/curves",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Minimal, auditable JS implementation of elliptic curve cryptography",
   "files": [
     "abstract",
+    "esm",
     "src",
@@ -14,6 +15,6 @@ "*.js",
   "scripts": {
-    "bench": "cd benchmark; node secp256k1.js; node curves.js; node ecdh.js; node stark.js; node bls.js",
-    "build": "tsc",
-    "build:clean": "rm *.{js,d.ts,js.map} esm/*.{js,js.map} 2> /dev/null",
+    "bench": "cd benchmark; node secp256k1.js; node curves.js; node ecdh.js; node hash-to-curve.js; node modular.js; node bls.js",
+    "build": "tsc && tsc -p tsconfig.esm.json",
     "build:release": "rollup -c rollup.config.js",
+    "build:clean": "rm *.{js,d.ts,d.ts.map,js.map} esm/*.{js,d.ts,d.ts.map,js.map} 2> /dev/null",
     "lint": "prettier --check 'src/**/*.{js,ts}' 'test/*.js'",
@@ -44,6 +45,6 @@ "format": "prettier --write 'src/**/*.{js,ts}' 'test/*.js'",
   "main": "index.js",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./index.d.ts",
+      "import": "./esm/index.js",
       "default": "./index.js"
@@ -53,2 +54,3 @@ },
       "types": "./abstract/edwards.d.ts",
+      "import": "./esm/abstract/edwards.js",
       "default": "./abstract/edwards.js"
@@ -58,2 +60,3 @@ },
       "types": "./abstract/modular.d.ts",
+      "import": "./esm/abstract/modular.js",
       "default": "./abstract/modular.js"
@@ -63,2 +66,3 @@ },
       "types": "./abstract/montgomery.d.ts",
+      "import": "./esm/abstract/montgomery.js",
       "default": "./abstract/montgomery.js"
@@ -68,2 +72,3 @@ },
       "types": "./abstract/weierstrass.d.ts",
+      "import": "./esm/abstract/weierstrass.js",
       "default": "./abstract/weierstrass.js"
@@ -73,2 +78,3 @@ },
       "types": "./abstract/bls.d.ts",
+      "import": "./esm/abstract/bls.js",
       "default": "./abstract/bls.js"
@@ -78,2 +84,3 @@ },
       "types": "./abstract/hash-to-curve.d.ts",
+      "import": "./esm/abstract/hash-to-curve.js",
       "default": "./abstract/hash-to-curve.js"
@@ -83,2 +90,3 @@ },
       "types": "./abstract/curve.d.ts",
+      "import": "./esm/abstract/curve.js",
       "default": "./abstract/curve.js"
@@ -88,2 +96,3 @@ },
       "types": "./abstract/utils.d.ts",
+      "import": "./esm/abstract/utils.js",
       "default": "./abstract/utils.js"
@@ -93,2 +102,3 @@ },
       "types": "./abstract/poseidon.d.ts",
+      "import": "./esm/abstract/poseidon.js",
       "default": "./abstract/poseidon.js"
@@ -98,2 +108,3 @@ },
       "types": "./_shortw_utils.d.ts",
+      "import": "./esm/_shortw_utils.js",
       "default": "./_shortw_utils.js"
@@ -103,2 +114,3 @@ },
       "types": "./bls12-381.d.ts",
+      "import": "./esm/bls12-381.js",
       "default": "./bls12-381.js"
@@ -108,2 +120,3 @@ },
       "types": "./bn.d.ts",
+      "import": "./esm/bn.js",
       "default": "./bn.js"
@@ -113,2 +126,3 @@ },
       "types": "./ed25519.d.ts",
+      "import": "./esm/ed25519.js",
       "default": "./ed25519.js"
@@ -118,2 +132,3 @@ },
       "types": "./ed448.d.ts",
+      "import": "./esm/ed448.js",
       "default": "./ed448.js"
@@ -123,2 +138,3 @@ },
       "types": "./index.d.ts",
+      "import": "./esm/index.js",
       "default": "./index.js"
@@ -128,2 +144,3 @@ },
       "types": "./jubjub.d.ts",
+      "import": "./esm/jubjub.js",
       "default": "./jubjub.js"
@@ -133,2 +150,3 @@ },
       "types": "./p256.d.ts",
+      "import": "./esm/p256.js",
       "default": "./p256.js"
@@ -138,2 +156,3 @@ },
       "types": "./p384.d.ts",
+      "import": "./esm/p384.js",
       "default": "./p384.js"
@@ -143,2 +162,3 @@ },
       "types": "./p521.d.ts",
+      "import": "./esm/p521.js",
       "default": "./p521.js"
@@ -148,2 +168,3 @@ },
       "types": "./pasta.d.ts",
+      "import": "./esm/pasta.js",
       "default": "./pasta.js"
@@ -153,7 +174,4 @@ },
       "types": "./secp256k1.d.ts",
+      "import": "./esm/secp256k1.js",
       "default": "./secp256k1.js"
-    },
-    "./stark": {
-      "types": "./stark.d.ts",
-      "default": "./stark.js"
     }
@@ -160,0 +178,0 @@ },

README.md

 # noble-curves
 
-Audited & minimal JS implementation of elliptic curve cryptography.
+[Audited](#security) & minimal JS implementation of elliptic curve cryptography.
 
@@ -59,3 +59,3 @@ - **noble** family, zero dependencies
 ```ts
-import { secp256k1 } from '@noble/curves/secp256k1'; // ECMAScript Modules (ESM)
+import { secp256k1 } from '@noble/curves/secp256k1'; // ECMAScript Modules (ESM) and Common.js
 // import { secp256k1 } from 'npm:@noble/curves@1.2.0/secp256k1'; // Deno
@@ -82,3 +82,2 @@ const priv = secp256k1.utils.randomPrivateKey();
 import { pallas, vesta } from '@noble/curves/pasta';
-import * as stark from '@noble/curves/stark';
 import { bls12_381 } from '@noble/curves/bls12-381';
@@ -535,3 +534,3 @@ import { bn254 } from '@noble/curves/bn';
 We don't provide them: you should construct them manually.
-The only variant provided resides in `stark` module: inspect it for proper usage.
+Check out [micro-starknet](https://github.com/paulmillr/micro-starknet) package for a proper example.
 
@@ -547,3 +546,3 @@ ```ts
   sboxPower?: number;
-  reversePartialPowIdx?: boolean; // Hack for stark
+  reversePartialPowIdx?: boolean;
   mds: bigint[][];
@@ -619,6 +618,8 @@ roundConstants: bigint[][];
 
-The library had no prior security audit. The library has been fuzzed by [Guido Vranken's cryptofuzz](https://github.com/guidovranken/cryptofuzz): you can run the fuzzer by yourself to check it.
+1. The library has been audited during Jan-Feb 2023 by an independent security firm [Trail of Bits](https://www.trailofbits.com):
+[PDF](https://github.com/trailofbits/publications/blob/master/reviews/2023-01-ryanshea-noblecurveslibrary-securityreview.pdf).
+The audit has been funded by Ryan Shea. Audit scope was abstract modules `curve`, `hash-to-curve`, `modular`, `poseidon`, `utils`, `weierstrass`, and top-level modules `_shortw_utils` and `secp256k1`. See [changes since audit](https://github.com/paulmillr/noble-curves/compare/0.7.3..main).
+2. The library has been fuzzed by [Guido Vranken's cryptofuzz](https://github.com/guidovranken/cryptofuzz). You can run the fuzzer by yourself to check it.
+3. [Timing attack](https://en.wikipedia.org/wiki/Timing_attack) considerations: _JIT-compiler_ and _Garbage Collector_ make "constant time" extremely hard to achieve in a scripting language. Which means _any other JS library can't have constant-timeness_. Even statically typed Rust, a language without GC, [makes it harder to achieve constant-time](https://www.chosenplaintext.ca/open-source/rust-timing-shield/security) for some cases. If your goal is absolute security, don't use any JS lib — including bindings to native ones. Use low-level libraries & languages. Nonetheless we're targetting algorithmic constant time.
 
-[Timing attack](https://en.wikipedia.org/wiki/Timing_attack) considerations: we are using non-CT bigints. However, _JIT-compiler_ and _Garbage Collector_ make "constant time" extremely hard to achieve in a scripting language. Which means _any other JS library can't have constant-timeness_. Even statically typed Rust, a language without GC, [makes it harder to achieve constant-time](https://www.chosenplaintext.ca/open-source/rust-timing-shield/security) for some cases. If your goal is absolute security, don't use any JS lib — including bindings to native ones. Use low-level libraries & languages. Nonetheless we're targetting algorithmic constant time.
-
 We consider infrastructure attacks like rogue NPM modules very important; that's why it's crucial to minimize the amount of 3rd-party dependencies & native bindings. If your app uses 500 dependencies, any dep could get hacked and you'll be downloading malware with every `npm install`. Our goal is to minimize this attack vector. As for devDependencies used by the library:
@@ -678,8 +679,2 @@
 
-stark
-init x 35 ops/sec @ 28ms/op
-pedersen x 884 ops/sec @ 1ms/op
-poseidon x 8,598 ops/sec @ 116μs/op
-verify x 528 ops/sec @ 1ms/op
-
 ecdh
@@ -722,4 +717,2 @@ ├─x25519 x 1,337 ops/sec @ 747μs/op
 
-Demo: Elliptic curve calculator [paulmillr.com/ecc](https://paulmillr.com/ecc).
-
 Projects using the library:
@@ -735,3 +728,5 @@
   - BBS signatures [github.com/Wind4Greg/BBS-Draft-Checks](https://github.com/Wind4Greg/BBS-Draft-Checks) following [draft-irtf-cfrg-bbs-signatures-latest](https://identity.foundation/bbs-signature/draft-irtf-cfrg-bbs-signatures.html)
-
+- Others
+  - All curves demo: Elliptic curve calculator [paulmillr.com/ecc](https://paulmillr.com/ecc)
+  - [micro-starknet](https://github.com/paulmillr/micro-starknet) for stark-friendly elliptic curve.
 ## Upgrading
@@ -738,0 +733,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1237063

increased by46.48%

Number of package files

151

increased by33.63%

Lines of code

17003

increased by35.01%

Worsened metrics

Number of lines in readme file

769

decreased by-0.65%

Is type module

No

No dependency changes