
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
cubehash-wasm
Advanced tools
THIS LIBRARY IS MEANT AS A REFERENCE IMPLEMENTATION. A REFERENCE IMPLEMENTATION. I AM NOT AN EXPERIENCED CRYPTOGRAPHER AND I CANNOT GUARANTEE THAT THIS LIBRARY IS SECURE. DO NOT USE THIS FOR ANYTHING IMPORTANT! YOU HAVE BEEN WARNED.
this library is a port of my js cubehash library to assemblyscript. i believed that it would provide for higher optimization (which i was wrong about). this took hours of work, and frankly, i regret it deeply. it runs 3 times slower than the pure JS version on 1MB arrays, and cannot run at all on 500MB arrays. if you understand this and are still curious, feel free to read the below.
browser:
export function hash(m: Uint8Array, i: u32, r: u32, b: u32, f: u32, h: u32): Uint8Array // this is the hash function's signature.
export const Uint8Array_ID = idof<Uint8Array>(); // you need this if you want to hash anything!
node:
npm i --save cubehash-wasm will install cubehash-wasm for you.the module.exports of this library is an async function aptly called load. when load is called, it will load in the wasm library and then return a class called CubeHash. its methods are provided below for reference.
constructor() - sets the parameters for CubeHash512, or CubeHash16+16/32+32-512, and precomputes the initialization vector. this is a sane default and no further configuration is required after creating the object.constructor(Number i, Number r, Number b, Number f, Number h) - sets the parameters for CubeHashi+r/b+f-h. NOTE THAT NO INPUT CHECKING IS DONE ON THE PARAMETERS AND YOU SHOULD VERIFY THAT THEY ARE CORRECT YOURSELF. ALSO, UNLIKE THE JS IMPLEMENTATION, THE INITIALIZATION VECTOR IS NOT PRECOMPUTED. i should be a member of the set {1,2,3,...}, r should be a member of the set {1,2,3,...}, b should be a member of the set {1,2,3,...,128}, f should be a member of the set {1,2,3,...}, and h should be a member of the set {8,16,24,...,512}.Uint8Array hash(Uint8Array m) - returns the hash for m with the parameters specified in the constructor.Uint8Array mac(Uint8Array message, Uint8Array key) - returns the CubeMAC with key key and message message with the parameters specified in the constructor. the key must be 512 bits (64 bytes). for more information, click here.in other words, the class provides the exact same interface as the pure-JS CubeHash implementation.
reference usage:
async function main() {
// require cubehash
const CubeHash = await (require("cubehash-wasm"))();
// create a new cubehash object. cubehash512 by default.
const cubehash512 = new CubeHash();
// create a message uint8array
let message = new Uint8Array(Buffer.from("cubehash"));
// compute our hash
let rawHash = cubehash512.hash(message);
// log our hash as base64
console.log(Buffer.from(rawHash).toString("base64"));
}
main();
first, make sure any dependencies are installed with npm i. then, run npm test to run the test suite (this will also compile the WASM). the test suite includes a speedtest and verifies the output based on certain test vectors (found here).
you honestly shouldn't be implementing cubehash in assemblyscript (the performance gets worse), but if you want to, there are some comments around in the code. i recommend using my js implementation (linked in the introduction) for reference instead.
FAQs
A port of CubeHash to WASM.
We found that cubehash-wasm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.