bip322-js - npm Package Compare versions

Comparing version 1.0.3 to 1.1.0

dist/helpers/index.d.ts

 import Address from "./Address";
+import BIP137 from "./BIP137";
 import VarInt from "./VarInt";
 import VarStr from "./VarStr";
 import Witness from "./Witness";
-export { Address, VarInt, VarStr, Witness };
+export { Address, BIP137, VarInt, VarStr, Witness };

dist/helpers/index.js

@@ -6,5 +6,7 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Witness = exports.VarStr = exports.VarInt = exports.Address = void 0;
+exports.Witness = exports.VarStr = exports.VarInt = exports.BIP137 = exports.Address = void 0;
 const Address_1 = __importDefault(require("./Address"));
 exports.Address = Address_1.default;
+const BIP137_1 = __importDefault(require("./BIP137"));
+exports.BIP137 = BIP137_1.default;
 const VarInt_1 = __importDefault(require("./VarInt"));
@@ -11,0 +13,0 @@ exports.VarInt = VarInt_1.default;

dist/index.d.ts

 import BIP322 from "./BIP322";
 import Signer from "./Signer";
 import Verifier from "./Verifier";
-import { Witness, Address } from "./helpers";
-export { BIP322, Signer, Verifier, Witness, Address };
+import { Witness, Address, BIP137 } from "./helpers";
+export { BIP322, Signer, Verifier, Witness, Address, BIP137 };

dist/index.js

@@ -29,3 +29,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Address = exports.Witness = exports.Verifier = exports.Signer = exports.BIP322 = void 0;
+exports.BIP137 = exports.Address = exports.Witness = exports.Verifier = exports.Signer = exports.BIP322 = void 0;
 // Import modules to be exported
@@ -41,2 +41,3 @@ const BIP322_1 = __importDefault(require("./BIP322"));
 Object.defineProperty(exports, "Address", { enumerable: true, get: function () { return helpers_1.Address; } });
+Object.defineProperty(exports, "BIP137", { enumerable: true, get: function () { return helpers_1.BIP137; } });
 // Provide a ECC library to bitcoinjs-lib
@@ -43,0 +44,0 @@ const secp256k1_1 = __importDefault(require("@bitcoinerlab/secp256k1"));

dist/Verifier.d.ts

@@ -16,2 +16,12 @@ /**
     /**
+     * Verify a legacy BIP-137 signature.
+     * Note that a signature is considered valid for all types of addresses that can be derived from the recovered public key.
+     * @param signerAddress Address of the signing address
+     * @param message message_challenge signed by the address
+     * @param signatureBase64 Signature produced by the signing address
+     * @returns True if the provided signature is a valid BIP-137 signature for the given message and address, false if otherwise
+     * @throws If the provided signature fails basic validation, or if unsupported address and signature are provided
+     */
+    private static verifyBIP137Signature;
+    /**
      * Compute the hash to be signed for a given P2WPKH BIP-322 toSign transaction.
@@ -18,0 +28,0 @@ * @param toSignTx PSBT instance of the toSign transaction

dist/Verifier.js

@@ -50,6 +50,6 @@ "use strict";
     static verifySignature(signerAddress, message, signatureBase64) {
-        // Handle legacy P2PKH signature
-        if (helpers_1.Address.isP2PKH(signerAddress)) {
-            // For P2PKH address, assume the signature is a legacy signature
-            return bitcoinMessage.verify(message, signerAddress, signatureBase64);
+        // Handle legacy BIP-137 signature
+        // For P2PKH address, assume the signature is also a legacy signature
+        if (helpers_1.Address.isP2PKH(signerAddress) || helpers_1.BIP137.isBIP137Signature(signatureBase64)) {
+            return this.verifyBIP137Signature(signerAddress, message, signatureBase64);
         }
@@ -141,2 +141,52 @@ // Convert address into corresponding script pubkey
     /**
+     * Verify a legacy BIP-137 signature.
+     * Note that a signature is considered valid for all types of addresses that can be derived from the recovered public key.
+     * @param signerAddress Address of the signing address
+     * @param message message_challenge signed by the address
+     * @param signatureBase64 Signature produced by the signing address
+     * @returns True if the provided signature is a valid BIP-137 signature for the given message and address, false if otherwise
+     * @throws If the provided signature fails basic validation, or if unsupported address and signature are provided
+     */
+    static verifyBIP137Signature(signerAddress, message, signatureBase64) {
+        if (helpers_1.Address.isP2PKH(signerAddress)) {
+            return bitcoinMessage.verify(message, signerAddress, signatureBase64);
+        }
+        else {
+            // Recover the public key associated with the signature
+            const publicKeySigned = helpers_1.BIP137.derivePubKey(message, signatureBase64);
+            // Set the equivalent legacy address to prepare for validation from bitcoinjs-message
+            const legacySigningAddress = helpers_1.Address.convertPubKeyIntoAddress(publicKeySigned, 'p2pkh').mainnet;
+            // Make sure that public key recovered corresponds to the claimed signing address
+            if (helpers_1.Address.isP2SH(signerAddress)) {
+                // Assume it is a P2SH-P2WPKH address, derive a P2SH-P2WPKH address based on the public key recovered
+                const p2shAddressDerived = helpers_1.Address.convertPubKeyIntoAddress(publicKeySigned, 'p2sh-p2wpkh');
+                // Assert that the derived address is identical to the claimed signing address
+                if (p2shAddressDerived.mainnet !== signerAddress && p2shAddressDerived.testnet !== signerAddress) {
+                    return false; // Derived address did not match with the claimed signing address
+                }
+            }
+            else if (helpers_1.Address.isP2WPKH(signerAddress)) {
+                // Assume it is a P2WPKH address, derive a P2WPKH address based on the public key recovered
+                const p2wpkhAddressDerived = helpers_1.Address.convertPubKeyIntoAddress(publicKeySigned, 'p2wpkh');
+                // Assert that the derived address is identical to the claimed signing address
+                if (p2wpkhAddressDerived.mainnet !== signerAddress && p2wpkhAddressDerived.testnet !== signerAddress) {
+                    return false; // Derived address did not match with the claimed signing address
+                }
+            }
+            else if (helpers_1.Address.isP2TR(signerAddress)) {
+                // Assume it is a P2TR address, derive a P2TR address based on the public key recovered
+                const p2trAddressDerived = helpers_1.Address.convertPubKeyIntoAddress(publicKeySigned, 'p2tr');
+                // Assert that the derived address is identical to the claimed signing address
+                if (p2trAddressDerived.mainnet !== signerAddress && p2trAddressDerived.testnet !== signerAddress) {
+                    return false; // Derived address did not match with the claimed signing address
+                }
+            }
+            else {
+                return false; // Unsupported address type
+            }
+            // Validate the signature using bitcoinjs-message if address assertion succeeded
+            return bitcoinMessage.verify(message, legacySigningAddress, signatureBase64);
+        }
+    }
+    /**
      * Compute the hash to be signed for a given P2WPKH BIP-322 toSign transaction.
@@ -143,0 +193,0 @@ * @param toSignTx PSBT instance of the toSign transaction

package.json

 {
     "name": "bip322-js",
-    "version": "1.0.3",
+    "version": "1.1.0",
     "description": "A Javascript library that provides utility functions related to the BIP-322 signature scheme",
@@ -28,2 +28,3 @@ "main": "dist/index.js",
         "@types/node": "^20.2.5",
+        "@types/secp256k1": "^4.0.3",
         "chai": "^4.3.7",
@@ -42,4 +43,5 @@ "chai-bytes": "^0.1.2",
         "ecpair": "^2.1.0",
-        "fast-sha256": "^1.3.0"
+        "fast-sha256": "^1.3.0",
+        "secp256k1": "^5.0.0"
     }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

99911

increased by13.59%

Number of package files

39

increased by8.33%

Lines of code

1419

increased by14.16%

Worsened metrics

Dependency count

6

increased by20%

Dev dependency count

11

increased by10%

Dependency changes

• + Addedsecp256k1@^5.0.0

• + Addednode-addon-api@5.1.0(transitive)

• + Addednode-gyp-build@4.8.4(transitive)

• + Addedsecp256k1@5.0.1(transitive)