ssb-keys - npm Package Compare versions

Comparing version 8.4.1 to 8.5.0

package.json

 {
   "name": "ssb-keys",
   "description": "keyfile operations for ssb",
-  "version": "8.4.1",
+  "version": "8.5.0",
   "homepage": "https://github.com/ssbc/ssb-keys",
@@ -14,3 +14,3 @@ "repository": {
     "private-box": "~0.3.0",
-    "ssb-uri2": "^2.0.1"
+    "ssb-uri2": "^2.1.0"
   },
@@ -28,6 +28,2 @@ "devDependencies": {
   },
-  "scripts": {
-    "test": "eslint *.js && nyc tape test/*",
-    "test-verbose": "VERBOSE_TESTS=1 npm run test"
-  },
   "author": "Paul Frazee <[e-mail]>",
@@ -39,3 +35,8 @@ "license": "MIT",
     }
-  }
-}
+  },
+  "scripts": {
+    "test": "eslint *.js && nyc tape test/*",
+    "test-verbose": "VERBOSE_TESTS=1 npm run test"
+  },
+  "readme": "# SSB-Keys\n\nsupplies key loading and other cryptographic functions needed in secure-scuttlebutt apps.\n\n```js\nvar ssbKeys = require(\"ssb-keys\");\n\n// Load or create keys in this way:\nvar keys = ssbKeys.loadOrCreateSync(\"<path-to-file>\");\n/* keys =>\n  {\n    \"curve\": \"ed25519\",\n    \"public\": \"cFVodZoKwLcmXbM6UeASdl8+7+Uo8PNOuFnlcqk7qUc=.ed25519\",\n    \"private\": \"lUqlXYxjkM0/ljtGnwoM0CfP6ORA2DKZnzsQ4dJ1tKJwVWh1mgrAtyZdszpR4BJ2Xz7v5Sjw8064WeVyqTupRw==.ed25519\",\n    \"id\": \"@cFVodZoKwLcmXbM6UeASdl8+7+Uo8PNOuFnlcqk7qUc=.ed25519\"\n  }\n*/\n\n// `.generate()` is useful for testing purposes.\nvar keys = ssbKeys.generate();\n/* keys =>\n  {\n    \"curve\": \"ed25519\",\n    \"public\": \"YSa2zbx07RNKQrrFX1vS5mFN+Pbnul61hd9GGymao1o=.ed25519\",\n    \"private\": \"XhEkyFWb0TkhRU5t/yDTCI6Q9gwhsJM/SpL02UUwVtZhJrbNvHTtE0pCusVfW9LmYU349ue6XrWF30YbKZqjWg==.ed25519\",\n    \"id\": \"@YSa2zbx07RNKQrrFX1vS5mFN+Pbnul61hd9GGymao1o=.ed25519\"\n  }\n*/\n\n// hmac_key` is a shared secret between two peers used to authenticate the sent\n// data and can be an empty 32-byte Buffer:\nvar hmac_key = Buffer.alloc(32);\n// Or a random Crypto buffer:\nvar hmac_key = crypto.randomBytes(32);\n// Or a 32-byte Buffer as base-64 string:\nvar hmac_key = Buffer.from(\"7b6m0wZtYR0TevSgeNstWZUZam3IIG2B\").toString(\n  \"base64\"\n);\n\n// The `hmac_key` is a fixed value that applies to _THIS_ signature and is used\n// to authenticate the data, `k` is the sender keys\nvar obj = ssbKeys.signObj(k, hmac_key, { foo: \"bar\" });\n/* obj =>\n  {\n    \"foo\": \"bar\",\n    \"signature\": \"H39taOYa2emULWa1YDEaoLJBrbZ2GHsuVA6VsE9A1hbtpMcWpqXmZisH+nItx8BQR6JOO58K/uohMJkCrUKABQ==.sig.ed25519\"\n  }\n*/\n\n// Share your `hmac_key` with the message receiver so it can verify it.\nssbKeys.verifyObj(k, hmac_key, obj); // => true\n```\n\n## api\n\n### `keys`\n\nin the below methods, `keys` is an object of the following form:\n\n```js\n{\n  \"curve\": \"ed25519\",\n  \"public\": \"<base64_public_key>.ed25519\",\n  \"private\": \"<base64_private_key>.ed25519\",\n  \"id\": \"@<base64_public_key>.ed25519\"\n}\n```\n\nThe format of the id feed is described in the [protocol guide - keys and identities](https://ssbc.github.io/scuttlebutt-protocol-guide/#keys-and-identities)\n\nwhen stored in a file, the file also contains a comment warning the reader\nabout safe private key security.\nComment lines are prefixed with `#` after removing them the result is valid JSON.\n\n### hash (data, encoding) => id\n\nReturns the sha256 hash of a given data. If encoding is not provided then it is assumed to be _binary_.\n\n### getTag (ssb_id) => tag\n\nThe SSB ids contain a tag at the end. This function returns it.\nSo if you have a string like `@gaQw6zD4pHrg8zmrqku24zTSAINhRg=.ed25519` this function would return `ed25519`.\nThis is useful as SSB start providing features for different encryption methods and cyphers.\n\n### loadOrCreateSync (filename) => keys\n\nLoad a file containing the your private key. the file will also\ncontain a comment with a warning about keeping the file secret.\n\nWorks in the browser, or stores the keys is localStorage in the browser.\n(web apps should be hosted a secure way, for example [web-bootloader](https://github.com/dominictarr/web-bootloader))\nIn the browser, the `filename` is used as the `localStorage` key.\n(note: web workers do not support localStorage, so the browser storage localtion will likely\nbe changed to indexeddb in the future)\n\nIf the file does not exist it will be created. there is also\nvariations and parts `loadOrCreate` (async), `load`, `create`\n`createSync` `loadSync`. But since you only need to load once,\nusing the combined function is easiest.\n\n`keys` is an object as described in [`keys`](#keys) section.\n\n### loadOrCreate (filename, cb)\n\nIf a sync file access method is not available, `loadOrCreate` can be called with a\ncallback. that callback will be called with `cb(null, keys)`. If loading\nthe keys errored, new keys are created.\n\n### generate(curve, seed, feedFormat) => keys\n\ngenerate a key, with optional `seed` (which should be a 32 byte buffer, but\ncan be a string of any length which is then converted to a 32 byte buffer).\n\n`curve` defaults to `ed25519` (and no other type is currently supported)\n\n`feedFormat` can be either `classic`, `bendybutt-v1`, `gabbygrove-v1`,\n`buttwoo-v1`, or `indexed-v1`. By default it's \"classic\".\n\n`keys` is an object as described in [`keys`](#keys) section. `keys.id` is an\n`@` sigil ID in the case of `classic` feed format and it's an SSB URI otherwise.\n\n### sign(keys, hmac_key?, str)\n\nsigns a string `str`, and returns the signature string.\n\n### verify(keys, sig, hmac_key?, str)\n\nverifies a signature `sig` of the original content `str` by the author known by `keys`.\n\n### signObj(keys, hmac_key?, obj)\n\nsigns a javascript object, and then adds a signature property to it.\n\nIf `hmac_key` is provided, the object is hmaced before signing,\nwhich means it cannot be verified without the correct `hmac_key`.\nIf each way that signatures are used in your application use a different\nhmac key, it means that a signature intended for one use cannot be reused in another\n(chosen protocol attack)\n\nThe fine details of the signature format are described in the [protocol guide](https://ssbc.github.io/scuttlebutt-protocol-guide/#signature)\n\n### verifyObj(keys, hmac_key?, obj)\n\nverify a signed object. `hmac_key` must be the same value as passed to `signObj`.\n\n### box(content, recipients) => boxed\n\nencrypt a message content to many recipients. msg will be JSON encoded, then encrypted\nwith [private-box](https://github.com/auditdrivencrypto/private-box)\n\n`recipients` must be an array of feed ids. your own feed id should be included.\n\nthe encryption format is described in the [protocol guide - encrypting](https://ssbc.github.io/scuttlebutt-protocol-guide/#encrypting)\n\n### unbox (boxed, keys) => content\n\ndecrypt a message encrypted with `box`. If the `boxed` successfully decrypted,\nthe parsed JSON is returned, if not, `undefined` is returned.\n\nthe decryption process is described in the [protocol guide - decrypting](https://ssbc.github.io/scuttlebutt-protocol-guide/#decrypting)\n\n### unboxKey (boxed, keys) => msg_key\n\nextract the `msg_key` used to encrypt this message, or null if it cannot be decrypted.\nthe `msg_key` if not null, can then be passed to `unboxBody`\n\n### unboxBody (boxed, msg_key) => content\n\ndecrypt a message `content` with a `msg_key`. returns the plaintext message content or null if\nthis is not the correct `msg_key`. The purpose of `unboxBody` and `unboxKey` is so support\nmessages that are shared then later revealed.\n\n### secretBox (obj, key) => boxed\n\nsymmetrically encrypt an object with `key` (a buffer)\n\n### secretUnbox (boxed, key) => obj\n\nsymmetrically decrypt an object with `key` (a buffer)\n\n### ssbSecretKeyToPrivateBoxSecret(keys)\n\nConvert from the ed25519 secret key (ssb secret key type) to the curve25519 key type that is used by `private-box`.\n\n### LICENSE\n\nMIT\n"
+}

README.md

@@ -116,3 +116,4 @@ # SSB-Keys
 
-`feedFormat` can be either `classic`, `bendybutt-v1`, `gabbygrove-v1`, or `buttwoo-v1`. By default it's "classic".
+`feedFormat` can be either `classic`, `bendybutt-v1`, `gabbygrove-v1`,
+`buttwoo-v1`, or `indexed-v1`. By default it's "classic".
 
@@ -119,0 +120,0 @@ `keys` is an object as described in [`keys`](#keys) section. `keys.id` is an

test/index.js

@@ -62,2 +62,10 @@ var tape = require("tape");
 
+tape("generate indexed-v1 keys", function (t) {
+  var keys = ssbkeys.generate(null, null, "indexed-v1");
+  t.true(keys.id.startsWith("ssb:feed/indexed-v1/"));
+  t.equals(keys.id.length, 64);
+  t.false(keys.id.endsWith(".ed25519"));
+  t.end();
+});
+
 tape("sign and verify a string, no hmac key", function (t) {
@@ -64,0 +72,0 @@ var str = "secure scuttlebutt";

util.js

@@ -31,2 +31,3 @@ "use strict";
     feedFormat === "buttwoo-v1" ||
+    feedFormat === "indexed-v1" ||
     feedFormat === "gabbygrove-v1"
@@ -33,0 +34,0 @@ ) {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

126021

increased by259.48%

Number of package files

17

increased by6.25%

Lines of code

761

increased by1.06%

Number of lines in readme file

188

increased by0.53%

Dependency changes

• Updatedssb-uri2@^2.1.0