private-box - npm Package Compare versions

Comparing version 0.1.0 to 0.1.1

package.json

 {
   "name": "private-box",
   "description": "encrypt a message to a secret number of recipients",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "homepage": "https://github.com/auditdrivencrypto/private-box",
@@ -6,0 +6,0 @@ "repository": {

README.md

 # private-box
 
-format for encrypting a private message between from 1 to many parties.
+A format for encrypting a private message to many parties.
 `private-box` is designed according to the [auditdrivencrypto design process](https://github.com/crypto-browserify/crypto-browserify/issues/128)
@@ -10,3 +10,3 @@
 
-Take a `plaintext` Buffer of the message you want to encrypt,
+Takes a `plaintext` Buffer of the message you want to encrypt,
 and an array of recipient public keys.
@@ -17,4 +17,4 @@ Returns a message that is encrypted to all recipients
 
-The encrypted length will be between `56 + (recipients.length * 33) + plaintext.length` bytes long.
-(minimum 89 and maximum 287 bytes longer than the plaintext)
+The encrypted length will be `56 + (recipients.length * 33) + plaintext.length` bytes long,
+between 89 and 287 bytes longer than the plaintext.
 
@@ -27,12 +27,12 @@ ### decrypt (cyphertext Buffer, secretKey curve25519_sk)
 
-## protocol
+## Protocol
 
-### encryption
+### Encryption
 
-`private-box` generates an ephemeral curve25519 keypair that will only be used with this message (`ephemeral_keys`),
-and a random `key` that will be used to encrypt the plaintext body (`body_key`).
-first, private-box outputs the ephemeral public key, then takes each recipient public key and 
-multiplies it with the ephemeral private key to produce ephemeral shared keys (`shared_keys[1..n]`).
-Then private-box concatenates `body_key` with the number of recipients,
-and then encrypts that to each shared key, then concatenates the encrypted body.
+`private-box` generates an ephemeral curve25519 keypair that will only be used with this message (`ephemeral`),
+and a random key that will be used to encrypt the plaintext body (`body_key`).
+First, private-box outputs the ephemeral public key, then multiplies each recipient public key
+with its secret to produce ephemeral shared keys (`shared_keys[1..n]`).
+Then, private-box concatenates `body_key` with the number of recipients,
+encrypts that to each shared key, and concatenates the encrypted body.
 
@@ -43,4 +43,4 @@ ```
   var nonce     = random(24)
-  var key       = random(32)
-  var key_with_length = concat([key, recipients.length])
+  var body_key  = random(32)
+  var body_key_with_length = concat([body_key, recipients.length])
   return concat([
@@ -51,3 +51,3 @@ nonce,
       return secretbox(
-        key_with_length,
+        body_key_with_length,
         nonce,
@@ -57,3 +57,3 @@ scalarmult(publicKey, ephemeral.secretKey)
     }),
-    secretbox(plaintext, nonce, key)
+    secretbox(plaintext, nonce, body_key)
   ])
@@ -63,5 +63,5 @@ }
 
-## decrypt
+## Decryption
 
-private-box takes the nonce and ephemeral public key,
+`private-box` takes the nonce and ephemeral public key,
 multiplies that with your secret key, then tests each possible
@@ -75,3 +75,3 @@ recipient slot until it either decrypts a key or runs out of slots.
 function decrypt (cyphertext, secretKey) {
-  var next = reader(cyphertext) //reader returns a function that 
+  var next = reader(cyphertext) // next() will read the passed N bytes
   var nonce = next(24)
@@ -84,3 +84,3 @@ var publicKey = next(32)
     var key_with_length = secretbox_open(maybe_key, nonce, sharedKey)
-    if(key_with_length) {//decrypted!
+    if (key_with_length) { // decrypted!
       var key = key_with_length.slice(0, 32)
@@ -94,3 +94,3 @@ var length = key_with_length[32]
   }
-  //this message was not addressed to the owner of secretKey
+  // this message was not addressed to the owner of secretKey
   return undefined
@@ -103,4 +103,4 @@ }
 Messages will be posted in public, so that the sender is likely to be known,
-but everyone can read the messages. (this makes it possible to hide the recipient,
-but probably not the sender)
+and everyone can read the messages. (This makes it possible to hide the recipient,
+but probably not the sender.)
 
@@ -111,11 +111,11 @@ Resisting traffic analysis of the timing or size of messages is out of scope of this spec.
 
-### pgp
+### PGP
 
-In pgp the recipient, the sender, and the subject are sent as plaintext.
-If the recipient is known then the metadata graph of who is communicating with who can be read,
+In PGP the recipient, the sender, and the subject are sent as plaintext.
+If the recipient is known, then the metadata graph of who is communicating with who can be read,
 which, since it is easier to analyze than the content, is important to protect.
 
-### sodium seal
+### Sodium seal
 
-The sodium library provides a _seal_ function that generates an ephemeral keypair,
+The Sodium library provides a _seal_ function that generates an ephemeral keypair,
 derives a shared key to encrypt a message, and then sends the ephemeral public key and the message.
@@ -125,5 +125,5 @@ The recipient is hidden, and it is forward secure if the sender throws out the ephemeral key.
 
-### minilock
+### Minilock
 
-minilock uses a similar approach to `private-box` but does not hide the
+Minilock uses a similar approach to `private-box` but does not hide the
 number of recipients. In the case of a group discussion where multiple rounds
@@ -135,10 +135,10 @@ of messages are sent to everyone, this may enable an eavesdropper to deanonymize
 
-This protocol was designed for use with secure-scuttlebutt,
-in this place, messages are placed in public, and the sender is known.
-(via a signature) but we can hide the recipient and the content.
+This protocol was designed for use with secure-scuttlebutt.
+In this place, messages are placed in public, and the sender is known via a signature,
+but we can hide the recipient and the content.
 
-### recipients are hidden.
+### Recipients are hidden.
 
-An eaves dropper cannot know the recipients or their number.
-since the message is encrypted to each recipient, and then placed in public,
+An eaves-dropper cannot know the recipients or their number.
+Since the message is encrypted to each recipient, and then placed in public,
 to receive a message you will have to decrypt every message posted.
@@ -150,8 +150,9 @@ This would not be scalable if you had to decrypt every message on the internet,
 reveal that you where talking to some other member of that forum.
-Hiding access to such a forum is another problem, out of the current scope.
 
-### the number of recipients are hidden.
+Hiding access to such a forum is another problem that's out of the current scope.
 
+### The number of recipients are hidden.
+
 If the number of recipients was not hidden, then sometimes it would be possible
-to deanonymise the number of recipients, if there was a large group discussion with
+to deanonymise the recipients, if there was a large group discussion with
 an unusual number of recipients. Encrypting the number of recipients means that
@@ -161,3 +162,3 @@ when you fail to decrypt a message you must attempt to decrypt same number of times
 
-### a valid recipient does not know the other recipients.
+### A valid recipient does not know the other recipients.
 
@@ -167,7 +168,7 @@ A valid recipient knows the number of recipients but now who they are.
 
-### by providing the `key` for a message a outside party could decrypt the message.
+### By providing the `key` for a message a outside party could decrypt the message.
 
 When you tell someone a secret you must trust them not to reveal it.
 Anyone who knows the `key` could reveal that to some other party who could then read the message content,
-but not the recipients (unless the sender revealed the ephemeral secret key)
+but not the recipients (unless the sender revealed the ephemeral secret key).
 
@@ -174,0 +175,0 @@ ## License

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Number of lines in readme file

169

increased by0.6%

Worsened metrics

Total package byte prevSize

19028

decreased by-0.22%

No dependency changes