@1shotapi/ows-signer 0.4.1 → 0.4.2

package/README.md

@@ -68,8 +68,8 @@ Ceremony UI params (optional on WebAuthn-triggering methods): `explanationHeader
 
 ## PRF labels
 
-- `ows-v1/secp256k1`
-- `ows-v1/ed25519` (derived via HKDF from PRF output)
+- `ows-v1/secp256k1` (HKDF from PRF output, rejection sampling into the curve order)
+- `ows-v1/ed25519` (HKDF from the secp256k1 scalar — same material as `signDigest` / recovery)
 - `ows-v1/aes256-gcm` (HKDF from the secp256k1 scalar — same material as `signDigest`)
 
 ## Recovery envelope

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/constants.js

@@ -4,6 +4,7 @@ export const API_VERSION = 1;
 export const SIGNER_VERSION = "0.1.0";
 
 export const PRF_LABEL_SECP256K1 = new TextEncoder().encode("ows-v1/secp256k1");
+/** HKDF info for Ed25519 — IKM is the secp256k1 scalar (`signDigest` material). */
 export const PRF_LABEL_ED25519 = new TextEncoder().encode("ows-v1/ed25519");
 /** HKDF info for AES-256-GCM — IKM is the secp256k1 scalar (`signDigest` material). */
 export const PRF_LABEL_AES256 = new TextEncoder().encode("ows-v1/aes256-gcm");

package/src/crypto/prf.js

@@ -76,16 +76,27 @@ export async function deriveScalarFromPrf(prfBuffer, infoLabel) {
 }
 
 /**
- * @param {ArrayBuffer} prfBuffer
+ * HKDF info `ows-v1/ed25519` — IKM is the secp256k1 scalar (`signDigest`
+ * material), not raw PRF. Recovery / import only hold that scalar, so Ed25519
+ * must chain through it or a recovery session would emit a different pubkey.
+ *
+ * @param {Uint8Array} secp256k1Scalar
  * @returns {Promise<Uint8Array>}
  */
-export async function deriveEd25519SeedFromPrf(prfBuffer) {
-  return hkdfExpand(prfBuffer, PRF_LABEL_ED25519, 32);
+export async function deriveEd25519SeedFromSecp256k1Scalar(secp256k1Scalar) {
+  return hkdfExpand(
+    secp256k1Scalar.buffer.slice(
+      secp256k1Scalar.byteOffset,
+      secp256k1Scalar.byteOffset + secp256k1Scalar.byteLength,
+    ),
+    PRF_LABEL_ED25519,
+    32,
+  );
 }
 
 /**
  * @param {PublicKeyCredential} credential
- * @returns {Promise<{ secp256k1PrivateKey: Uint8Array, secp256k1PublicKey: Uint8Array, ed25519PublicKey: Uint8Array }>}
+ * @returns {Promise<{ secp256k1PrivateKey: Uint8Array, secp256k1PublicKey: Uint8Array, ed25519Seed: Uint8Array, ed25519PublicKey: Uint8Array }>}
  */
 export async function deriveKeysFromCredential(credential) {
   const rawPrf = /** @type {{ prf?: { results?: { first?: unknown } } }} */ (
@@ -100,12 +111,18 @@ export async function deriveKeysFromCredential(credential) {
     prfBuffer,
     PRF_LABEL_SECP256K1,
   );
-  const ed25519Seed = await deriveEd25519SeedFromPrf(prfBuffer);
+  const ed25519Seed =
+    await deriveEd25519SeedFromSecp256k1Scalar(secp256k1PrivateKey);
   // Uncompressed (0x04 ‖ X ‖ Y) — required by viem `publicKeyToAddress`.
   const secp256k1PublicKey = secpGetPublicKey(secp256k1PrivateKey, false);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
 
-  return { secp256k1PrivateKey, secp256k1PublicKey, ed25519PublicKey };
+  return {
+    secp256k1PrivateKey,
+    secp256k1PublicKey,
+    ed25519Seed,
+    ed25519PublicKey,
+  };
 }
 
 /**

package/src/debug.js

@@ -1,13 +1,74 @@
 const DEBUG_KEY = "ows-signer:debug";
 
+/**
+ * True when a chrome-extension:// (or similar) page is an ancestor.
+ * Chromium exposes this via `location.ancestorOrigins` even when top is
+ * cross-origin — useful for side-panel embeds where WebAuthn often misbehaves.
+ * @returns {boolean}
+ */
+export function isExtensionAncestor() {
+  try {
+    const origins = globalThis.location?.ancestorOrigins;
+    if (!origins || origins.length === 0) return false;
+    for (let i = 0; i < origins.length; i++) {
+      const origin = origins[i];
+      if (
+        typeof origin === "string" &&
+        (origin.startsWith("chrome-extension://") ||
+          origin.startsWith("moz-extension://") ||
+          origin.startsWith("safari-web-extension://"))
+      ) {
+        return true;
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return false;
+}
+
 /** @returns {boolean} */
 export function isDebug() {
   if (typeof globalThis === "undefined") return false;
-  return (
-    globalThis.OWS_SIGNER_DEBUG === true ||
-    (typeof localStorage !== "undefined" &&
-      localStorage.getItem(DEBUG_KEY) === "1")
-  );
+  if (globalThis.OWS_SIGNER_DEBUG === true) return true;
+  // Always log in extension side-panel embeds — GPM get() often hangs with no UI.
+  if (isExtensionAncestor()) return true;
+  try {
+    return (
+      typeof localStorage !== "undefined" &&
+      localStorage.getItem(DEBUG_KEY) === "1"
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** @returns {Record<string, unknown>} */
+export function describeCeremonyEnvironment() {
+  let visibilityState = null;
+  let hasFocus = null;
+  try {
+    visibilityState = document.visibilityState;
+    hasFocus = document.hasFocus?.() ?? null;
+  } catch {
+    // ignore
+  }
+  let ancestorOrigins = null;
+  try {
+    ancestorOrigins = globalThis.location?.ancestorOrigins
+      ? Array.from(globalThis.location.ancestorOrigins)
+      : null;
+  } catch {
+    ancestorOrigins = null;
+  }
+  return {
+    extensionAncestor: isExtensionAncestor(),
+    ancestorOrigins,
+    visibilityState,
+    hasFocus,
+    userActivationActive: navigator.userActivation?.isActive ?? null,
+    userActivationHasBeenActive: navigator.userActivation?.hasBeenActive ?? null,
+  };
 }
 
 /** @param {...unknown} args */

package/src/handlers.js

@@ -1,7 +1,6 @@
 import {
   API_VERSION,
   METHODS,
-  PRF_LABEL_ED25519,
   SIGN_SCHEMES,
   SIGNER_VERSION,
 } from "./constants.js";
@@ -10,9 +9,8 @@ import {
   encryptAes256Batch,
 } from "./crypto/aes256.js";
 import {
-  deriveEd25519SeedFromPrf,
+  deriveEd25519SeedFromSecp256k1Scalar,
   deriveKeysFromCredential,
-  hkdfExpand,
   normalizePrfOutputToArrayBuffer,
 } from "./crypto/prf.js";
 import { getPublicKeyAsync as edGetPublicKeyAsync } from "./crypto/vendor/noble-ed25519.js";
@@ -47,34 +45,6 @@ import {
   getCosePublicKeyBase64Url,
 } from "./webauthn.js";
 
-/**
- * @param {PublicKeyCredential} credential
- * @returns {Promise<Uint8Array>}
- */
-async function ed25519SeedFromCredential(credential) {
-  const prfRaw = /** @type {{ prf?: { results?: { first?: unknown } } }} */ (
-    credential.getClientExtensionResults()
-  ).prf?.results?.first;
-  const prfBuf = normalizePrfOutputToArrayBuffer(prfRaw);
-  if (!prfBuf) throw new Error("noPrf");
-  return deriveEd25519SeedFromPrf(prfBuf);
-}
-
-/**
- * @param {Uint8Array} secp256k1Scalar
- * @returns {Promise<Uint8Array>}
- */
-async function ed25519SeedFromSecp256k1Scalar(secp256k1Scalar) {
-  return hkdfExpand(
-    secp256k1Scalar.buffer.slice(
-      secp256k1Scalar.byteOffset,
-      secp256k1Scalar.byteOffset + secp256k1Scalar.byteLength,
-    ),
-    PRF_LABEL_ED25519,
-    32,
-  );
-}
-
 /**
  * @param {string} targetOrigin
  * @param {string | undefined} correlationId
@@ -311,6 +281,7 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
       secp256k1PublicKey: to0xHex(keys.secp256k1PublicKey),
     });
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
   });
 }
 
@@ -432,7 +403,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
   if (hasRecoverySession()) {
     const cached = getRecoveryPrivateKey();
     if (!cached) throw new Error("recoverySessionEmpty");
-    const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+    const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
     try {
       const results = await signParsedDigests(
         items,
@@ -455,7 +426,6 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       () => getPasskeyAssertion(undefined, credentialId),
     );
     const keys = await deriveKeysFromCredential(credential);
-    const ed25519Seed = await ed25519SeedFromCredential(credential);
     emitKeyDerived(
       targetOrigin,
       correlationId,
@@ -466,7 +436,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       const results = await signParsedDigests(
         items,
         keys.secp256k1PrivateKey,
-        ed25519Seed,
+        keys.ed25519Seed,
         credentialId ?? getCredentialId(credential),
       );
       emitEvent(window.parent, targetOrigin, "DigestSigned", correlationId, {
@@ -474,7 +444,7 @@ async function handleSignDigest(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
-      zeroize(ed25519Seed);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -506,6 +476,7 @@ async function handleRevealPrivateKey(params, correlationId, targetOrigin) {
       await dismiss;
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
   emitEvent(
@@ -543,7 +514,7 @@ async function handleImportPrivateKey(_params, correlationId, targetOrigin) {
   setRecoveryPrivateKey(privateKey);
 
   const secp256k1PublicKey = secpGetPublicKey(privateKey, false);
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(privateKey);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(privateKey);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(
     targetOrigin,
@@ -607,7 +578,7 @@ async function handleCreateRecoveryData(params, correlationId, targetOrigin) {
     const cached = getRecoveryPrivateKey();
     if (!cached) throw new Error("recoverySessionEmpty");
     const secp256k1PublicKey = secpGetPublicKey(cached, false);
-    const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+    const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
     const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
     emitKeyDerived(
       targetOrigin,
@@ -645,6 +616,7 @@ async function handleCreateRecoveryData(params, correlationId, targetOrigin) {
       passphrase,
     );
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
     emitEvent(
       window.parent,
       targetOrigin,
@@ -683,7 +655,7 @@ async function handleRecoverKey(params, correlationId, targetOrigin) {
   // Emit public keys so OWSSigner can cache addresses (uncompressed secp256k1 —
   // viem publicKeyToAddress requires 0x04 ‖ X ‖ Y).
   const secp256k1PublicKey = secpGetPublicKey(privateKey, false);
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(privateKey);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(privateKey);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(
     targetOrigin,
@@ -787,6 +759,7 @@ async function handleEncryptAES256(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -847,6 +820,7 @@ async function handleDecryptAES256(params, correlationId, targetOrigin) {
       });
     } finally {
       zeroize(keys.secp256k1PrivateKey);
+      zeroize(keys.ed25519Seed);
     }
   });
 }
@@ -901,6 +875,7 @@ async function handleGetPublicKey(params, correlationId, targetOrigin) {
     }
 
     zeroize(keys.secp256k1PrivateKey);
+    zeroize(keys.ed25519Seed);
   });
 }
 
@@ -1031,7 +1006,6 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
         () => getPasskeyAssertion(challenge, credentialId),
       );
       const keys = await deriveKeysFromCredential(credential);
-      const ed25519Seed = await ed25519SeedFromCredential(credential);
       emitKeyDerived(
         targetOrigin,
         correlationId,
@@ -1041,7 +1015,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
       try {
         await runOps(
           keys.secp256k1PrivateKey,
-          ed25519Seed,
+          keys.ed25519Seed,
           keys.secp256k1PublicKey,
           keys.ed25519PublicKey,
           credentialId ?? getCredentialId(credential),
@@ -1049,7 +1023,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
         );
       } finally {
         zeroize(keys.secp256k1PrivateKey);
-        zeroize(ed25519Seed);
+        zeroize(keys.ed25519Seed);
       }
     });
     return;
@@ -1057,7 +1031,7 @@ async function handleExecuteBatch(params, correlationId, targetOrigin) {
 
   const cached = getRecoveryPrivateKey();
   if (!cached) throw new Error("recoverySessionEmpty");
-  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(cached);
+  const ed25519Seed = await deriveEd25519SeedFromSecp256k1Scalar(cached);
   const secp256k1PublicKey = secpGetPublicKey(cached, false);
   const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
   emitKeyDerived(

package/src/ui.js

@@ -1,4 +1,5 @@
 import { to0xHex } from "./hex.js";
+import { debugLog, describeCeremonyEnvironment } from "./debug.js";
 
 /** @type {HTMLElement | null} */
 let root = null;
@@ -223,6 +224,7 @@ export function promptCeremonyConfirm(fields, runOnConfirm) {
       try {
         // Start WebAuthn in the same turn as the click (no prior await).
         // Keep copy visible until the ceremony settles.
+        debugLog("ceremony Confirm click", describeCeremonyEnvironment());
         Promise.resolve(runOnConfirm()).then(settleSuccess, settleFailure);
       } catch (error) {
         settleFailure(error);

package/src/webauthn.js

@@ -1,7 +1,11 @@
 import { getCeremonyAbortSignal, getRpId } from "./state.js";
 import { PRF_LABEL_SECP256K1 } from "./constants.js";
 import { bufferToBase64Url } from "./hex.js";
-import { debugLog, describePrfExtensionResults } from "./debug.js";
+import {
+  debugLog,
+  describeCeremonyEnvironment,
+  describePrfExtensionResults,
+} from "./debug.js";
 
 /**
  * @param {Uint8Array} [userId]
@@ -29,9 +33,7 @@ export async function createPasskeyCredential(name, options = {}) {
   const displayName = options.userDisplayName ?? name;
   const signal = getCeremonyAbortSignal();
 
-  debugLog("createPasskeyCredential userActivation.isActive", {
-    isActive: navigator.userActivation?.isActive ?? false,
-  });
+  debugLog("createPasskeyCredential start", describeCeremonyEnvironment());
 
   const credential = await navigator.credentials.create({
     publicKey: {
@@ -88,27 +90,46 @@ export async function getPasskeyAssertion(challenge, credentialId) {
     : undefined;
   const signal = getCeremonyAbortSignal();
 
-  const credential = await navigator.credentials.get({
-    publicKey: {
-      challenge: challenge ?? crypto.getRandomValues(new Uint8Array(32)),
-      rpId,
-      userVerification: "required",
-      allowCredentials,
-      extensions: {
-        prf: {
-          eval: {
-            first: PRF_LABEL_SECP256K1,
+  debugLog("getPasskeyAssertion start", {
+    ...describeCeremonyEnvironment(),
+    rpId,
+    hasChallenge: Boolean(challenge),
+    hasAllowCredentials: Boolean(allowCredentials),
+    credentialIdPrefix:
+      typeof credentialId === "string" ? credentialId.slice(0, 8) : null,
+  });
+
+  let credential;
+  try {
+    credential = await navigator.credentials.get({
+      publicKey: {
+        challenge: challenge ?? crypto.getRandomValues(new Uint8Array(32)),
+        rpId,
+        userVerification: "required",
+        allowCredentials,
+        extensions: {
+          prf: {
+            eval: {
+              first: PRF_LABEL_SECP256K1,
+            },
           },
         },
       },
-    },
-    ...(signal ? { signal } : {}),
-  });
+      ...(signal ? { signal } : {}),
+    });
+  } catch (error) {
+    debugLog("getPasskeyAssertion rejected", {
+      ...describeCeremonyEnvironment(),
+      name: error instanceof Error ? error.name : typeof error,
+      message: error instanceof Error ? error.message : String(error),
+    });
+    throw error;
+  }
 
   if (!credential || !(credential instanceof PublicKeyCredential)) {
     throw new Error("credentialGetFailed");
   }
-  debugLog("getPasskeyAssertion", describePrfExtensionResults(credential));
+  debugLog("getPasskeyAssertion ok", describePrfExtensionResults(credential));
   return credential;
 }