@1auth/crypto 0.0.0-beta.0 → 0.0.0-beta.2

package/README.md

@@ -0,0 +1,44 @@
+<div align="center">
+  <h1>@1auth/crypto</h1>
+  <!--<img alt="1auth logo" src="https://raw.githubusercontent.com/willfarrell/1auth/main/docs/img/logo.svg"/>-->
+  <p><strong>Cryptographic utilities for encryption, hashing, and signing with modern algorithms</strong></p>
+<p>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-perf.yml/badge.svg" alt="GitHub Actions perf test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
+  <a href="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml"><img src="https://github.com/willfarrell/1auth/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
+  <br/>
+  <a href="https://www.npmjs.com/package/@1auth/crypto"><img alt="npm version" src="https://img.shields.io/npm/v/@1auth/crypto.svg"></a>
+  <a href="https://packagephobia.com/result?p=@1auth/crypto"><img src="https://packagephobia.com/badge?p=@1auth/crypto" alt="npm install size"></a>
+  <a href="https://www.npmjs.com/package/@1auth/crypto">
+  <img alt="npm weekly downloads" src="https://img.shields.io/npm/dw/@1auth/crypto.svg"></a>
+  <a href="https://www.npmjs.com/package/@1auth/crypto#provenance">
+  <img alt="npm provenance" src="https://img.shields.io/badge/provenance-Yes-brightgreen"></a>
+  <br/>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/willfarrell/1auth"><img src="https://api.scorecard.dev/projects/github.com/willfarrell/1auth/badge" alt="Open Source Security Foundation (OpenSSF) Scorecard"></a>
+  <a href="https://slsa.dev"><img src="https://slsa.dev/images/gh-badge-level3.svg" alt="SLSA 3"></a>
+  <a href="https://github.com/willfarrell/1auth/blob/main/docs/CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg"></a>
+  <a href="https://biomejs.dev"><img alt="Checked with Biome" src="https://img.shields.io/badge/Checked_with-Biome-60a5fa?style=flat&logo=biome"></a>
+  <a href="https://conventionalcommits.org"><img alt="Conventional Commits" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white"></a>
+</p>
+<p>You can read the documentation at: <a href="https://1auth.js.org">https://1auth.js.org</a></p>
+</div>
+
+## Install
+
+```bash
+npm install @1auth/crypto
+```
+
+## Documentation and examples
+
+For documentation and examples, refer to the main [1auth monorepo on GitHub](https://github.com/willfarrell/1auth) or the [1auth website](https://1auth.js.org).
+
+## Contributing
+
+Everyone is very welcome to contribute to this repository. Feel free to [raise issues](https://github.com/willfarrell/1auth/issues) or to [submit Pull Requests](https://github.com/willfarrell/1auth/pulls).
+
+## License
+
+Licensed under [MIT License](LICENSE). Copyright (c) 2020-2026 [will Farrell](https://github.com/willfarrell) and [contributors](https://github.com/willfarrell/1auth/graphs/contributors).

package/index.js

@@ -1,3 +1,5 @@
+// Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+// SPDX-License-Identifier: MIT
 import {
 	argon2Sync,
 	createCipheriv,
@@ -32,13 +34,17 @@ const defaults = {
 	digestChecksumEncoding: undefined,
 	digestChecksumSalt: undefined, // randomChecksumSalt()
 	digestChecksumPepper: undefined, // randomChecksumPepper()
+	// Password hashing defaults - based on OWASP Password Storage Cheat Sheet
+	// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+	// OWASP minimums: 19 MiB memory, 2 iterations, 1 parallelism
+	// We use 32 MiB (exceeds minimum) for enhanced security
 	secretArgon2Algorithm: "argon2id",
-	secretArgon2Version: 19, // argon2id
-	secretArgon2Parallelism: 1, // argon2id
-	secretArgon2MemoryCost: 15, // argon2id
-	secretArgon2TimeCost: 3, // argon2id
-	secretArgon2NonceLength: 16, // argon2id
-	secretArgon2HashLength: 64, // argon2id
+	secretArgon2Version: 19,
+	secretArgon2Parallelism: 1, // OWASP: 1 (matches)
+	secretArgon2MemoryCost: 15, // 2^15 KiB = 32 MiB (exceeds OWASP minimum of 19 MiB)
+	secretArgon2TimeCost: 3, // OWASP: 2 (we use 3 for better security)
+	secretArgon2NonceLength: 16,
+	secretArgon2HashLength: 64,
 
 	defaultEncoding: "base64",
 	defaultHashAlgorithm: "sha3-384",
@@ -119,35 +125,12 @@ export const makeOptionsBuffer = (
 
 export const getOptions = () => options;
 
-// *** entropy *** //
-// export const characterPoolSize = (value) => {
-//   const chars = value.split('')
-//   let min = chars[0].charCodeAt()
-//   let max = chars[0].charCodeAt()
-//   for(const char of value.split('')) {
-//     const code = char.charCodeAt()
-//     if (code < min) {
-//       min = code
-//     } else if (max < code) {
-//       max = code
-//     }
-//   }
-//   return max - min
-// }
-
 // *** Helpers *** //
 // Ref: https://therootcompany.com/blog/how-many-bits-of-entropy-per-character/
 export const entropyToCharacterLength = (bits, characterPoolSize) => {
 	// bits*ln(2)/ln(characterPoolSize)
 	return Math.ceil((bits * Math.LN2) / Math.log(characterPoolSize));
 };
-/* export const characterLengthToEntropy = (
-  characterLength,
-  characterPoolSize,
-) => {
-  // log_2(characterPoolSize^characterLength)
-  return Math.floor(Math.log2(characterPoolSize ** characterLength));
-}; */
 
 // *** Random generators *** //
 export { randomBytes, randomInt, randomUUID } from "node:crypto";
@@ -177,7 +160,7 @@ export const randomAlphaNumeric = (characterLength) => {
 export const randomNumeric = (characterLength) => {
 	let value = "";
 	for (let i = characterLength; i--; ) {
-		value += randomInt(9);
+		value += randomInt(0, 10);
 	}
 	return value;
 };
@@ -440,7 +423,7 @@ export const symmetricGenerateEncryptionKey = (
 	{ encryptionKey, signatureSecret } = {},
 ) => {
 	encryptionKey ??= options.symmetricEncryptionKey;
-	signatureSecret ??= options.symemeticSignatureSecret;
+	signatureSecret ??= options.symmetricSignatureSecret;
 
 	const rowEncryptionKey = symmetricRandomEncryptionKey();
 	const rowEncryptedKey = symmetricEncrypt(rowEncryptionKey, {
@@ -537,7 +520,7 @@ export const symmetricDecryptKey = (
 	{ sub, encryptionKey, signatureSecret } = {},
 ) => {
 	encryptionKey ??= options.symmetricEncryptionKey;
-	signatureSecret ??= options.symemeticSignatureSecret;
+	signatureSecret ??= options.symmetricSignatureSecret;
 	return Buffer.from(
 		symmetricDecrypt(encryptedKey, {
 			encryptionKey,
@@ -573,7 +556,9 @@ export const symmetricDecrypt = (
 	);
 
 	if (encryptedDataPacket === false) {
-		throw new Error("Signature incorrect");
+		throw new Error("Signature incorrect", {
+			cause: { signedEncryptedDataPacket },
+		});
 	}
 	const iv = Buffer.from(
 		encryptedDataPacket.substring(0, symmetricEncryptionEncodingLengths.iv),
@@ -664,7 +649,10 @@ export const symmetricRotation = (
 		return data;
 	},
 ) => {
-	if (oldOptions.sub !== newOptions.sub) throw new Error("Mismatching `sub`");
+	if (oldOptions.sub !== newOptions.sub)
+		throw new Error("Mismatching `sub`", {
+			cause: { sub: oldOptions.sub },
+		});
 
 	const oldEncryptedValuesClone = structuredClone(oldEncryptedValues);
 	// Don't use structuredClone, converts Buffer to Uint8Array ...
@@ -752,6 +740,8 @@ export const verifyAsymmetricSignature = async (
 	);
 };
 
+export const nowInSeconds = () => Math.floor(Date.now() / 1000);
+
 export const safeEqual = (input, expected) => {
 	const bufferInput = Buffer.from(input);
 	const bufferExpected = Buffer.from(expected);

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@1auth/crypto",
-	"version": "0.0.0-beta.0",
-	"description": "",
+	"version": "0.0.0-beta.2",
+	"description": "Cryptographic utilities for encryption, hashing, and signing with modern algorithms",
 	"type": "module",
 	"engines": {
 		"node": ">=24"
@@ -12,18 +12,14 @@
 	},
 	"main": "./index.js",
 	"module": "./index.js",
+	"sideEffects": false,
 	"exports": {
 		".": {
-			"import": {
-				"types": "./index.d.ts",
-				"default": "./index.js"
-			}
+			"import": "./index.js"
 		}
 	},
-	"types": "index.d.ts",
 	"files": [
-		"index.js",
-		"index.d.ts"
+		"index.js"
 	],
 	"scripts": {
 		"test": "npm run test:unit",
@@ -34,7 +30,14 @@
 		"type": "github",
 		"url": "https://github.com/sponsors/willfarrell"
 	},
-	"keywords": [],
+	"keywords": [
+		"1auth",
+		"OWASP",
+		"ASVS",
+		"crypto",
+		"encryption",
+		"hashing"
+	],
 	"author": {
 		"name": "1auth contributors",
 		"url": "https://github.com/willfarrell/1auth/graphs/contributors"