hdkey - npm Package Compare versions

Comparing version 1.0.0 to 1.1.0

CHANGELOG.md

@@ -0,1 +1,7 @@
+1.1.0 / 2018-08-14
+------------------
+
+- Add `wipePrivateData()` method ([#22](https://github.com/cryptocoinjs/hdkey/pull/22))
+- Add missing LICENSE file ([#21](https://github.com/cryptocoinjs/hdkey/pull/21))
+
 1.0.0 / 2018-05-24
@@ -2,0 +8,0 @@ ------------------

lib/hdkey.js

@@ -163,2 +163,8 @@ var assert = require('assert')
 
+HDKey.prototype.wipePrivateData = function () {
+  if (this._privateKey) crypto.randomBytes(this._privateKey.length).copy(this._privateKey)
+  this._privateKey = null
+  return this
+}
+
 HDKey.prototype.toJSON = function () {
@@ -165,0 +171,0 @@ return {

package.json

 {
   "name": "hdkey",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Bitcoin BIP32 hierarchical deterministic keys",
@@ -5,0 +5,0 @@ "main": "lib/hdkey.js",

README.md

@@ -87,2 +87,6 @@ hdkey
 
+### `hdkey.wipePrivateData()`
+
+Wipes all record of the private key from the `hdkey` instance. After calling this method, the instance will behave as if it was created via `HDKey.fromExtendedKey(xpub)`.
+
 ### `hdkey.toJSON()`
@@ -89,0 +93,0 @@

test/hdkey.test.js

@@ -214,2 +214,44 @@ var assert = require('assert')
   })
+
+  describe('- after wipePrivateData()', function () {
+    it('should not have private data', function () {
+      const hdkey = HDKey.fromMasterSeed(Buffer.from(fixtures.valid[6].seed, 'hex')).wipePrivateData()
+      assert.equal(hdkey.privateKey, null)
+      assert.equal(hdkey.privateExtendedKey, null)
+      assert.throws(() => hdkey.sign(Buffer.alloc(32)), "shouldn't be able to sign")
+      const childKey = hdkey.derive('m/0')
+      assert.equal(childKey.publicExtendedKey, fixtures.valid[7].public)
+      assert.equal(childKey.privateKey, null)
+      assert.equal(childKey.privateExtendedKey, null)
+    })
+
+    it('should have correct data', function () {
+      // m/0/2147483647'/1/2147483646'/2
+      const key = 'xprvA2nrNbFZABcdryreWet9Ea4LvTJcGsqrMzxHx98MMrotbir7yrKCEXw7nadnHM8Dq38EGfSh6dqA9QWTyefMLEcBYJUuekgW4BYPJcr9E7j'
+      const hdkey = HDKey.fromExtendedKey(key).wipePrivateData()
+      assert.equal(hdkey.versions.private, 0x0488ade4)
+      assert.equal(hdkey.versions.public, 0x0488b21e)
+      assert.equal(hdkey.depth, 5)
+      assert.equal(hdkey.parentFingerprint, 0x31a507b8)
+      assert.equal(hdkey.index, 2)
+      assert.equal(hdkey.chainCode.toString('hex'), '9452b549be8cea3ecb7a84bec10dcfd94afe4d129ebfd3b3cb58eedf394ed271')
+      assert.equal(hdkey.publicKey.toString('hex'), '024d902e1a2fc7a8755ab5b694c575fce742c48d9ff192e63df5193e4c7afe1f9c')
+      assert.equal(hdkey.identifier.toString('hex'), '26132fdbe7bf89cbc64cf8dafa3f9f88b8666220')
+    })
+
+    it('should be able to verify signatures', function () {
+      const fullKey = HDKey.fromMasterSeed(fixtures.valid[0].seed)
+      // using JSON methods to clone before mutating
+      const wipedKey = HDKey.fromJSON(fullKey.toJSON()).wipePrivateData()
+
+      const hash = Buffer.alloc(32, 8)
+      assert.ok(wipedKey.verify(hash, fullKey.sign(hash)))
+    })
+
+    it('should not throw if called on hdkey without private data', function () {
+      const hdkey = HDKey.fromExtendedKey(fixtures.valid[0].public)
+      assert.doesNotThrow(() => hdkey.wipePrivateData())
+      assert.equal(hdkey.publicExtendedKey, fixtures.valid[0].public)
+    })
+  })
 })

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

33559

increased by12.75%

Number of package files

8

increased by14.29%

Lines of code

495

increased by9.27%

Number of lines in readme file

135

increased by3.05%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes