Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@privy-io/crypto
Advanced tools
Readme
JavaScript library for encrypting and decrypting data with Privy.
This library is intended to be used by the @privy-io/privy-browser
and @privy-io/privy-node
libraries to handle all cryptographic operations.
npm install --save @privy-io/crypto
import {CryptoEngine, CryptoVersion} from '@privy-io/crypto';
// Grab the engine (implementation) corresponding to the version
const x0 = CryptoEngine(CryptoVersion.x0);
// Crypto module expects Uint8Arrays.
const plaintext = new TextEncoder().encode('{"ssn": "123-45-6789"}');
// Encryption
const privyEncryption = new x0.Encryption(plaintext, {
wrapperKey: wrapperKey, // RSA public key from privy server
wrapperKeyId: wrapperKeyId, // Metadata id of RSA public key from Privy's KMS
});
const encryptionResult = await privyEncryption.encrypt();
const ciphertext = encryptionResult.ciphertext();
// Commitment id's are computed from the hash of a nonce concatenated with the
// plaintext. Can be used for an optional data integrity check.
const commitmentId = encryptionResult.commitmentId();
// Decryption
const privyDecryption = new x0.Decryption(ciphertext);
// This is where Privy would decrypt the encrypted data
// key against the Privy server, ultimately doing so in an HSM.
const decryptedDataKey = decryptDataKey(
privyDecryption.wrapperKeyId(),
privyDecryption.encryptedDataKey(),
);
const decryptionResult = await privyDecryption.decrypt(decryptedDataKey);
// Optional data integrity check.
if (!(await privyDecryption.verify(decryptionResult, commitmentId))) {
throw 'Data integrity check failed.';
}
// Crypto module returns Uint8Arrays.
const decryptedPlaintext = new TextDecoder().decode(decryptionResult.plaintext());
console.log(decryptedPlaintext); // {"ssn": "123-45-6789"}
To test the module interfaces, run:
npm test
To test the node crypto operations against the browser ones (which use the webcrypto standard), run:
# Requires node >= 15
npm run test-webcrypto
FAQs
Privy encryption and decryption library
The npm package @privy-io/crypto receives a total of 197 weekly downloads. As such, @privy-io/crypto popularity was classified as not popular.
We found that @privy-io/crypto demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.