@atlasauth/pca-aggsig 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +13 -2
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -52,9 +52,20 @@ verifyAggregatedWitnessCosignatures(statement, cosigs.map((c) => c.key), agg); /
52
52
 
53
53
  ## Status
54
54
 
55
- Experimental. The cryptography is built on `@noble/curves` but this package has not been independently audited, and BLS12-381 is not post-quantum. Aggregate signatures over distinct messages rely on every signer's key being proven (proof-of-possession) before it is trusted; use `popProve` / `popVerify` when accepting keys from third parties.
55
+ Part of [Proof-Carrying Authority](https://github.com/Atlas-Authorization/pca). **Experimental and unaudited.** BLS12-381 is not post-quantum.
56
56
 
57
- Source and issues: https://github.com/Atlas-Authorization/pca
57
+ What is validated (proof-of-possession scheme, public keys in G1, signatures in G2):
58
+
59
+ - **Reference vectors**: the 90 community-standard vectors of `ethereum/bls12-381-tests` v0.1.2 for this exact ciphersuite (sign, verify, aggregate, fast-aggregate-verify, aggregate-verify, and G1/G2 point deserialization), vendored in `test-vectors/` with source, release hash and per-file SHA-256. All pass, including infinity-key, infinity-signature, tampered-signature, wrong-key, extra-key and malformed-encoding cases. The IETF draft itself publishes no test vectors (its test-vector appendix is still to be written), so these are the reference vectors for the scheme, not vectors from the draft text.
60
+ - **Independent implementation**: `py_ecc` 8.0.0. Its public keys, proofs of possession, signatures and aggregates are reproduced byte-for-byte, and artifacts produced here verify there (and tampered ones are rejected there).
61
+ - **Rogue-key behavior** is exercised: a key chosen as `a*G - pk_victim` lets an adversary forge a same-message aggregate, which is why `fastAggregateVerify` must only be given keys admitted with `popVerify`; the adversary cannot produce a valid proof of possession for such a key. Proofs of possession and message signatures are domain-separated.
62
+
63
+ What is not validated:
64
+
65
+ - Only the minimal-pubkey-size, proof-of-possession variant is implemented. The basic and message-augmentation schemes and the signatures-in-G1 variant are not.
66
+ - `aggregateVerify` additionally refuses repeated messages (stricter than the proof-of-possession scheme requires).
67
+ - The delegation-chain and witness-cosignature layers are PCA-specific and have no external standard; they are covered by this package's own tests only.
68
+ - Not constant-time, and no independent security audit.
58
69
 
59
70
  ## License
60
71
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@atlasauth/pca-aggsig",
3
- "version": "0.2.0",
3
+ "version": "0.3.0",
4
4
  "description": "BLS signature aggregation for PCA: collapse a delegation chain per-hop signatures and transparency-ledger witness cosignatures into one compact BLS12-381 aggregate with aggregate-verify.",
5
5
  "keywords": [
6
6
  "bls",
@@ -34,7 +34,7 @@
34
34
  "dependencies": {
35
35
  "@noble/curves": "^1.6.0",
36
36
  "@noble/hashes": "^1.5.0",
37
- "@atlasauth/pca": "0.2.0"
37
+ "@atlasauth/pca": "0.3.0"
38
38
  },
39
39
  "devDependencies": {
40
40
  "typescript": "^5.6.3",