envelope-js - npm Package Compare versions

Comparing version 1.0.0 to 1.1.0

box.js

@@ -15,5 +15,8 @@ const { Buffer } = require('buffer')
 
+  // read_key
+  //   ├──> header_key
+  //   └──> body_key
   const read_key = derive(msg_key, [LABELS.read_key])
-    const header_key = derive(read_key, [LABELS.header_key])
-    const body_key   = derive(read_key, [LABELS.body_key])
+  const header_key = derive(read_key, [LABELS.header_key])
+  const body_key = derive(read_key, [LABELS.body_key])
 
@@ -33,8 +36,8 @@ const offset = (
   const header_box = ciphertext.slice(0, 32)
-    const header = header_box.slice(16)
-    header.writeUInt16LE(offset, 0)
-    /* TODO
-    header.write...(flags, 2)
-    header.write...(header_extensions, 3)
-    */
+  const header = header_box.slice(16)
+  header.writeUInt16LE(offset, 0)
+  /* TODO
+     header.write...(flags, 2)
+     header.write...(header_extensions, 3)
+  */
 
@@ -41,0 +44,0 @@ na.crypto_secretbox_easy(header_box, header, zerodNonce, header_key)

package.json

 {
   "name": "envelope-js",
   "description": "new private message format for ssb",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "homepage": "https://github.com/ssbc/envelope-js",
@@ -21,3 +21,4 @@ "repository": {
     "futoin-hkdf": "^1.3.2",
-    "sodium-native": "^3.2.0"
+    "sodium-native": "^3.2.0",
+    "ssb-bfe": "^1.0.0"
   },
@@ -24,0 +25,0 @@ "devDependencies": {

test/derive-secret.test.js

@@ -17,5 +17,8 @@ const test = require('tape')
 
+    // read_key
+    //   ├──> header_key
+    //   └──> body_key
     const read_key = derive(msg_key, [labels.read_key])
-      const header_key = derive(read_key, [labels.header_key])
-      const body_key   = derive(read_key, [labels.body_key])
+    const header_key = derive(read_key, [labels.header_key])
+    const body_key   = derive(read_key, [labels.body_key])
 
@@ -22,0 +25,0 @@ t.deepEqual(read_key, vector.output.read_key, 'derive read_key')

unbox.js

@@ -10,2 +10,4 @@ const { Buffer } = require('buffer')
 function unbox (ciphertext, feed_id, prev_msg_id, trial_keys, opts = {}) {
+  if (trial_keys.length === 0) return null
+
   const {
@@ -23,2 +25,4 @@ maxAttempts = 8
 function unboxKey (ciphertext, feed_id, prev_msg_id, trial_keys, opts = {}) {
+  if (trial_keys.length === 0) return null
+  
   const {
@@ -25,0 +29,0 @@ maxAttempts = 8,

util/cipherlink.js

 const na = require('sodium-native')
-const TYPES = require('envelope-spec/encoding/tfk.json')
+const { bfeTypes } = require('ssb-bfe')
 
@@ -11,3 +11,3 @@ module.exports = class Cipherlink {
     if (this.key) {
-      const expected = TYPES[this.type].formats[this.format].key_bytes
+      const expected = bfeTypes[this.type].formats[this.format].data_length
       if (this.key.length !== expected) {
@@ -33,3 +33,3 @@ throw new Error(`Cypherlink expected to have key of length ${expected} bytes, got ${this.key.length}`)
   // toSSB () {
-  //   const { sigil, suffix } = TYPES[this.type].formats[this.format]
+  //   const { sigil, suffix } = bfeTypes[this.type].formats[this.format]
 
@@ -42,3 +42,3 @@ //   return sigil + this.key.toString('base64') + suffix
       ? 32 //
-      : TYPES[this.type].formats[this.format].key_bytes
+      : bfeTypes[this.type].formats[this.format].data_length
     this.key = Buffer.alloc(bytes)
@@ -45,0 +45,0 @@ na.randombytes_buf(this.key)

util/derive-secret.js

 const hkdf = require('futoin-hkdf')
 const encode = require('./slp-encode')
+const convertBFENilMsg = require('./bfe-nil-msg')
 
@@ -9,2 +10,4 @@ const hash = 'sha256'
 module.exports = function DeriveSecret (feed_id, prev_msg_id) {
+  prev_msg_id = convertBFENilMsg(prev_msg_id, feed_id)
+
   return function derive (pk, labels, length = key_length) {
@@ -11,0 +14,0 @@ const info = [

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

40760

increased by7.67%

Number of package files

37

increased by5.71%

Lines of code

1073

increased by5.61%

Worsened metrics

Dependency count

5

increased by25%

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Addedssb-bfe@^1.0.0