derive-key - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

index.js

@@ -1,2 +0,2 @@
-const sodium = require('sodium-universal')
+const blake2b = require('blake2b-universal')
 
@@ -8,3 +8,3 @@ module.exports = derive
 
-  sodium.crypto_generichash_batch(output, [
+  blake2b.batch(output, [
     Buffer.from(Buffer.byteLength(ns, 'ascii') + '\n' + ns, 'ascii'),
@@ -11,0 +11,0 @@ Buffer.isBuffer(input) ? input : Buffer.from(input)

package.json

 {
   "name": "derive-key",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Derive a named key from a master key",
   "main": "index.js",
   "dependencies": {
-    "sodium-universal": "^2.0.0"
+    "blake2b-universal": "^1.0.0"
   },
@@ -9,0 +9,0 @@ "devDependencies": {

README.md

 # derive-key
 
-Derive a named key from a master key
+Derive a named key from a high-entropy master key
 
@@ -13,3 +13,3 @@ ```
 const derive = require('derive-key')
-const masterKey = crypto.randomBytes(32) // make sure this is cryptographic seed
+const masterKey = crypto.randomBytes(32) // make sure this is high-entropy master key, eg. from a CSPRNG
 
@@ -25,3 +25,5 @@ const key = derive('a namespace', masterKey, 'my-named-key')
 
-Derive a named key from a 32 byte master key.
+Derive a named key from a 32 byte high-entropy master key. This can be 32-bytes of
+cryptographically secure randomness, eg from a CSPRNG. Do **NOT** use low entropy
+soruces such a passwords, passphrases or randomness from a predictable RNG.
 
@@ -31,3 +33,3 @@ The namespace should be an ascii string (fx your application name) and name can be a buffer
 
-Optionally you can pass in the output key parameter and the result will be copied into that
+Optionally you can pass in the output key parameter and the result will be written into this
 buffer instead of a new buffer being allocated internally.
@@ -34,0 +36,0 @@

No alert changes

Improved metrics

Total package byte prevSize

3578

increased by6.49%

Number of lines in readme file

37

increased by5.71%

Dependency changes

• + Addedblake2b-universal@^1.0.0

• + Addedblake2b-universal@1.0.1(transitive)

• + Addedsodium-native@3.4.1(transitive)

• - Removedsodium-universal@^2.0.0

• - Removedini@1.3.8(transitive)

• - Removednan@2.20.0(transitive)

• - Removednanoassert@1.1.0(transitive)

• - Removedsiphash24@1.3.1(transitive)

• - Removedsodium-javascript@0.5.6(transitive)

• - Removedsodium-native@2.4.9(transitive)

• - Removedsodium-universal@2.0.0(transitive)

• - Removedxsalsa20@1.2.0(transitive)