@atproto/crypto 0.2.3 → 0.3.1-next.0

package/src/did.ts

@@ -1,13 +1,8 @@
 import * as uint8arrays from 'uint8arrays'
-import * as p256 from './p256/encoding'
-import * as secp from './secp256k1/encoding'
+
+import { BASE58_MULTIBASE_PREFIX, DID_KEY_PREFIX } from './const'
 import plugins from './plugins'
-import {
-  BASE58_MULTIBASE_PREFIX,
-  DID_KEY_PREFIX,
-  P256_JWT_ALG,
-  SECP256K1_JWT_ALG,
-} from './const'
+import { extractMultikey, extractPrefixedBytes, hasPrefix } from './utils'
 
 export type ParsedMultikey = {
   jwtAlg: string
@@ -15,23 +10,14 @@ export type ParsedMultikey = {
 }
 
 export const parseMultikey = (multikey: string): ParsedMultikey => {
-  if (!multikey.startsWith(BASE58_MULTIBASE_PREFIX)) {
-    throw new Error(`Incorrect prefix for multikey: ${multikey}`)
-  }
-  const prefixedBytes = uint8arrays.fromString(
-    multikey.slice(BASE58_MULTIBASE_PREFIX.length),
-    'base58btc',
-  )
+  const prefixedBytes = extractPrefixedBytes(multikey)
   const plugin = plugins.find((p) => hasPrefix(prefixedBytes, p.prefix))
   if (!plugin) {
     throw new Error('Unsupported key type')
   }
-  let keyBytes = prefixedBytes.slice(plugin.prefix.length)
-  if (plugin.jwtAlg === P256_JWT_ALG) {
-    keyBytes = p256.decompressPubkey(keyBytes)
-  } else if (plugin.jwtAlg === SECP256K1_JWT_ALG) {
-    keyBytes = secp.decompressPubkey(keyBytes)
-  }
+  const keyBytes = plugin.decompressPubkey(
+    prefixedBytes.slice(plugin.prefix.length),
+  )
   return {
     jwtAlg: plugin.jwtAlg,
     keyBytes,
@@ -46,28 +32,20 @@ export const formatMultikey = (
   if (!plugin) {
     throw new Error('Unsupported key type')
   }
-  if (jwtAlg === P256_JWT_ALG) {
-    keyBytes = p256.compressPubkey(keyBytes)
-  } else if (jwtAlg === SECP256K1_JWT_ALG) {
-    keyBytes = secp.compressPubkey(keyBytes)
-  }
-  const prefixedBytes = uint8arrays.concat([plugin.prefix, keyBytes])
+  const prefixedBytes = uint8arrays.concat([
+    plugin.prefix,
+    plugin.compressPubkey(keyBytes),
+  ])
   return (
     BASE58_MULTIBASE_PREFIX + uint8arrays.toString(prefixedBytes, 'base58btc')
   )
 }
 
 export const parseDidKey = (did: string): ParsedMultikey => {
-  if (!did.startsWith(DID_KEY_PREFIX)) {
-    throw new Error(`Incorrect prefix for did:key: ${did}`)
-  }
-  return parseMultikey(did.slice(DID_KEY_PREFIX.length))
+  const multikey = extractMultikey(did)
+  return parseMultikey(multikey)
 }
 
 export const formatDidKey = (jwtAlg: string, keyBytes: Uint8Array): string => {
   return DID_KEY_PREFIX + formatMultikey(jwtAlg, keyBytes)
 }
-
-const hasPrefix = (bytes: Uint8Array, prefix: Uint8Array): boolean => {
-  return uint8arrays.equals(prefix, bytes.subarray(0, prefix.byteLength))
-}

package/src/p256/keypair.ts

@@ -1,7 +1,11 @@
 import { p256 } from '@noble/curves/p256'
 import { sha256 } from '@noble/hashes/sha256'
-import * as uint8arrays from 'uint8arrays'
-import { SupportedEncodings } from 'uint8arrays/util/bases'
+import { SupportedEncodings } from 'uint8arrays/to-string'
+import {
+  fromString as ui8FromString,
+  toString as ui8ToString,
+} from 'uint8arrays'
+
 import * as did from '../did'
 import { P256_JWT_ALG } from '../const'
 import { Keypair } from '../types'
@@ -32,9 +36,7 @@ export class P256Keypair implements Keypair {
   ): Promise<P256Keypair> {
     const { exportable = false } = opts || {}
     const privKeyBytes =
-      typeof privKey === 'string'
-        ? uint8arrays.fromString(privKey, 'hex')
-        : privKey
+      typeof privKey === 'string' ? ui8FromString(privKey, 'hex') : privKey
     return new P256Keypair(privKeyBytes, exportable)
   }
 
@@ -43,7 +45,7 @@ export class P256Keypair implements Keypair {
   }
 
   publicKeyStr(encoding: SupportedEncodings = 'base64pad'): string {
-    return uint8arrays.toString(this.publicKey, encoding)
+    return ui8ToString(this.publicKey, encoding)
   }
 
   did(): string {

package/src/p256/operations.ts

@@ -1,8 +1,10 @@
 import { p256 } from '@noble/curves/p256'
 import { sha256 } from '@noble/hashes/sha256'
-import { P256_JWT_ALG } from '../const'
-import { parseDidKey } from '../did'
+import { equals as ui8equals } from 'uint8arrays'
+
+import { P256_DID_PREFIX } from '../const'
 import { VerifyOptions } from '../types'
+import { extractMultikey, extractPrefixedBytes, hasPrefix } from '../utils'
 
 export const verifyDidSig = async (
   did: string,
@@ -10,10 +12,11 @@ export const verifyDidSig = async (
   sig: Uint8Array,
   opts?: VerifyOptions,
 ): Promise<boolean> => {
-  const { jwtAlg, keyBytes } = parseDidKey(did)
-  if (jwtAlg !== P256_JWT_ALG) {
+  const prefixedBytes = extractPrefixedBytes(extractMultikey(did))
+  if (!hasPrefix(prefixedBytes, P256_DID_PREFIX)) {
     throw new Error(`Not a P-256 did:key: ${did}`)
   }
+  const keyBytes = prefixedBytes.slice(P256_DID_PREFIX.length)
   return verifySig(keyBytes, data, sig, opts)
 }
 
@@ -23,8 +26,23 @@ export const verifySig = async (
   sig: Uint8Array,
   opts?: VerifyOptions,
 ): Promise<boolean> => {
+  const allowMalleable = opts?.allowMalleableSig ?? false
   const msgHash = await sha256(data)
+  // parse as compact sig to prevent signature malleability
+  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false
+  }
   return p256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true,
+    lowS: !allowMalleable,
   })
 }
+
+export const isCompactFormat = (sig: Uint8Array) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig)
+    return ui8equals(parsed.toCompactRawBytes(), sig)
+  } catch {
+    return false
+  }
+}

package/src/p256/plugin.ts

@@ -1,11 +1,16 @@
-import * as operations from './operations'
+import { verifyDidSig } from './operations'
+import { compressPubkey, decompressPubkey } from './encoding'
+
 import { DidKeyPlugin } from '../types'
 import { P256_DID_PREFIX, P256_JWT_ALG } from '../const'
 
 export const p256Plugin: DidKeyPlugin = {
   prefix: P256_DID_PREFIX,
   jwtAlg: P256_JWT_ALG,
-  verifySignature: operations.verifyDidSig,
+  verifySignature: verifyDidSig,
+
+  compressPubkey,
+  decompressPubkey,
 }
 
 export default p256Plugin

package/src/secp256k1/keypair.ts

@@ -1,9 +1,13 @@
 import { secp256k1 as k256 } from '@noble/curves/secp256k1'
 import { sha256 } from '@noble/hashes/sha256'
-import * as uint8arrays from 'uint8arrays'
-import { SupportedEncodings } from 'uint8arrays/util/bases'
-import * as did from '../did'
+import {
+  fromString as ui8FromString,
+  toString as ui8ToString,
+} from 'uint8arrays'
+import { SupportedEncodings } from 'uint8arrays/to-string'
+
 import { SECP256K1_JWT_ALG } from '../const'
+import * as did from '../did'
 import { Keypair } from '../types'
 
 export type Secp256k1KeypairOptions = {
@@ -32,9 +36,7 @@ export class Secp256k1Keypair implements Keypair {
   ): Promise<Secp256k1Keypair> {
     const { exportable = false } = opts || {}
     const privKeyBytes =
-      typeof privKey === 'string'
-        ? uint8arrays.fromString(privKey, 'hex')
-        : privKey
+      typeof privKey === 'string' ? ui8FromString(privKey, 'hex') : privKey
     return new Secp256k1Keypair(privKeyBytes, exportable)
   }
 
@@ -43,7 +45,7 @@ export class Secp256k1Keypair implements Keypair {
   }
 
   publicKeyStr(encoding: SupportedEncodings = 'base64pad'): string {
-    return uint8arrays.toString(this.publicKey, encoding)
+    return ui8ToString(this.publicKey, encoding)
   }
 
   did(): string {

package/src/secp256k1/operations.ts

@@ -1,8 +1,10 @@
 import { secp256k1 as k256 } from '@noble/curves/secp256k1'
 import { sha256 } from '@noble/hashes/sha256'
-import { SECP256K1_JWT_ALG } from '../const'
-import { parseDidKey } from '../did'
+import * as ui8 from 'uint8arrays'
+
+import { SECP256K1_DID_PREFIX } from '../const'
 import { VerifyOptions } from '../types'
+import { extractMultikey, extractPrefixedBytes, hasPrefix } from '../utils'
 
 export const verifyDidSig = async (
   did: string,
@@ -10,10 +12,11 @@ export const verifyDidSig = async (
   sig: Uint8Array,
   opts?: VerifyOptions,
 ): Promise<boolean> => {
-  const { jwtAlg, keyBytes } = parseDidKey(did)
-  if (jwtAlg !== SECP256K1_JWT_ALG) {
+  const prefixedBytes = extractPrefixedBytes(extractMultikey(did))
+  if (!hasPrefix(prefixedBytes, SECP256K1_DID_PREFIX)) {
     throw new Error(`Not a secp256k1 did:key: ${did}`)
   }
+  const keyBytes = prefixedBytes.slice(SECP256K1_DID_PREFIX.length)
   return verifySig(keyBytes, data, sig, opts)
 }
 
@@ -23,8 +26,23 @@ export const verifySig = async (
   sig: Uint8Array,
   opts?: VerifyOptions,
 ): Promise<boolean> => {
+  const allowMalleable = opts?.allowMalleableSig ?? false
   const msgHash = await sha256(data)
+  // parse as compact sig to prevent signature malleability
+  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false
+  }
   return k256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true,
+    lowS: !allowMalleable,
   })
 }
+
+export const isCompactFormat = (sig: Uint8Array) => {
+  try {
+    const parsed = k256.Signature.fromCompact(sig)
+    return ui8.equals(parsed.toCompactRawBytes(), sig)
+  } catch {
+    return false
+  }
+}

package/src/secp256k1/plugin.ts

@@ -1,11 +1,16 @@
-import * as operations from './operations'
+import { verifyDidSig } from './operations'
+import { compressPubkey, decompressPubkey } from './encoding'
+
 import { DidKeyPlugin } from '../types'
 import { SECP256K1_DID_PREFIX, SECP256K1_JWT_ALG } from '../const'
 
 export const secp256k1Plugin: DidKeyPlugin = {
   prefix: SECP256K1_DID_PREFIX,
   jwtAlg: SECP256K1_JWT_ALG,
-  verifySignature: operations.verifyDidSig,
+  verifySignature: verifyDidSig,
+
+  compressPubkey,
+  decompressPubkey,
 }
 
 export default secp256k1Plugin

package/src/sha.ts

@@ -9,3 +9,10 @@ export const sha256 = async (
     typeof input === 'string' ? uint8arrays.fromString(input, 'utf8') : input
   return noble.sha256(bytes)
 }
+
+export const sha256Hex = async (
+  input: Uint8Array | string,
+): Promise<string> => {
+  const hash = await sha256(input)
+  return uint8arrays.toString(hash, 'hex')
+}

package/src/types.ts

@@ -9,6 +9,10 @@ export interface Didable {
 
 export interface Keypair extends Signer, Didable {}
 
+export interface ExportableKeypair extends Keypair {
+  export(): Promise<Uint8Array>
+}
+
 export type DidKeyPlugin = {
   prefix: Uint8Array
   jwtAlg: string
@@ -18,8 +22,11 @@ export type DidKeyPlugin = {
     data: Uint8Array,
     opts?: VerifyOptions,
   ) => Promise<boolean>
+
+  compressPubkey: (uncompressed: Uint8Array) => Uint8Array
+  decompressPubkey: (compressed: Uint8Array) => Uint8Array
 }
 
 export type VerifyOptions = {
-  lowS?: boolean
+  allowMalleableSig?: boolean
 }

package/src/utils.ts

@@ -0,0 +1,23 @@
+import * as uint8arrays from 'uint8arrays'
+import { BASE58_MULTIBASE_PREFIX, DID_KEY_PREFIX } from './const'
+
+export const extractMultikey = (did: string): string => {
+  if (!did.startsWith(DID_KEY_PREFIX)) {
+    throw new Error(`Incorrect prefix for did:key: ${did}`)
+  }
+  return did.slice(DID_KEY_PREFIX.length)
+}
+
+export const extractPrefixedBytes = (multikey: string): Uint8Array => {
+  if (!multikey.startsWith(BASE58_MULTIBASE_PREFIX)) {
+    throw new Error(`Incorrect prefix for multikey: ${multikey}`)
+  }
+  return uint8arrays.fromString(
+    multikey.slice(BASE58_MULTIBASE_PREFIX.length),
+    'base58btc',
+  )
+}
+
+export const hasPrefix = (bytes: Uint8Array, prefix: Uint8Array): boolean => {
+  return uint8arrays.equals(prefix, bytes.subarray(0, prefix.byteLength))
+}

package/tests/signatures.test.ts

@@ -2,11 +2,11 @@ import fs from 'node:fs'
 import * as uint8arrays from 'uint8arrays'
 import { secp256k1 as nobleK256 } from '@noble/curves/secp256k1'
 import { p256 as nobleP256 } from '@noble/curves/p256'
+import { cborEncode } from '@atproto/common'
 import EcdsaKeypair from '../src/p256/keypair'
 import Secp256k1Keypair from '../src/secp256k1/keypair'
 import * as p256 from '../src/p256/operations'
 import * as secp from '../src/secp256k1/operations'
-import { cborEncode } from '@atproto/common'
 import {
   bytesToMultibase,
   multibaseToBytes,
@@ -78,7 +78,46 @@ describe('signatures', () => {
           keyBytes,
           messageBytes,
           signatureBytes,
-          { lowS: false },
+          { allowMalleableSig: true },
+        )
+        expect(verified).toEqual(true)
+        expect(vector.validSignature).toEqual(false) // otherwise would fail per low-s requirement
+      } else if (vector.algorithm === SECP256K1_JWT_ALG) {
+        const verified = await secp.verifySig(
+          keyBytes,
+          messageBytes,
+          signatureBytes,
+          { allowMalleableSig: true },
+        )
+        expect(verified).toEqual(true)
+        expect(vector.validSignature).toEqual(false) // otherwise would fail per low-s requirement
+      } else {
+        throw new Error('Unsupported test vector')
+      }
+    }
+  })
+
+  it('verifies der-encoded signatures with explicit option', async () => {
+    const DERVectors = vectors.filter((vec) => vec.tags.includes('der-encoded'))
+    expect(DERVectors.length).toBeGreaterThanOrEqual(2)
+    for (const vector of DERVectors) {
+      const messageBytes = uint8arrays.fromString(
+        vector.messageBase64,
+        'base64',
+      )
+      const signatureBytes = uint8arrays.fromString(
+        vector.signatureBase64,
+        'base64',
+      )
+      const keyBytes = multibaseToBytes(vector.publicKeyMultibase)
+      const didKey = parseDidKey(vector.publicKeyDid)
+      expect(uint8arrays.equals(keyBytes, didKey.keyBytes))
+      if (vector.algorithm === P256_JWT_ALG) {
+        const verified = await p256.verifySig(
+          keyBytes,
+          messageBytes,
+          signatureBytes,
+          { allowMalleableSig: true },
         )
         expect(verified).toEqual(true)
         expect(vector.validSignature).toEqual(false) // otherwise would fail per low-s requirement
@@ -87,7 +126,7 @@ describe('signatures', () => {
           keyBytes,
           messageBytes,
           signatureBytes,
-          { lowS: false },
+          { allowMalleableSig: true },
         )
         expect(verified).toEqual(true)
         expect(vector.validSignature).toEqual(false) // otherwise would fail per low-s requirement
@@ -98,6 +137,7 @@ describe('signatures', () => {
   })
 })
 
+// @ts-expect-error
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 async function generateTestVectors(): Promise<TestVector[]> {
   const p256Key = await EcdsaKeypair.create({ exportable: true })
@@ -168,6 +208,39 @@ async function generateTestVectors(): Promise<TestVector[]> {
       validSignature: false,
       tags: ['high-s'],
     },
+    // these vectors test to ensure we don't allow der-encoded signatures
+    {
+      messageBase64,
+      algorithm: P256_JWT_ALG, // "ES256" / ecdsa p-256
+      publicKeyDid: p256Key.did(),
+      publicKeyMultibase: bytesToMultibase(
+        p256Key.publicKeyBytes(),
+        'base58btc',
+      ),
+      signatureBase64: await makeDerEncodedSig(
+        messageBytes,
+        await p256Key.export(),
+        P256_JWT_ALG,
+      ),
+      validSignature: false,
+      tags: ['der-encoded'],
+    },
+    {
+      messageBase64,
+      algorithm: SECP256K1_JWT_ALG, // "ES256K" / secp256k
+      publicKeyDid: secpKey.did(),
+      publicKeyMultibase: bytesToMultibase(
+        secpKey.publicKeyBytes(),
+        'base58btc',
+      ),
+      signatureBase64: await makeDerEncodedSig(
+        messageBytes,
+        await secpKey.export(),
+        SECP256K1_JWT_ALG,
+      ),
+      validSignature: false,
+      tags: ['der-encoded'],
+    },
   ]
 }
 
@@ -195,6 +268,24 @@ async function makeHighSSig(
   return sig
 }
 
+async function makeDerEncodedSig(
+  msgBytes: Uint8Array,
+  keyBytes: Uint8Array,
+  alg: string,
+): Promise<string> {
+  const hash = await sha256(msgBytes)
+
+  let sig: string
+  if (alg === SECP256K1_JWT_ALG) {
+    const attempt = await nobleK256.sign(hash, keyBytes, { lowS: true })
+    sig = uint8arrays.toString(attempt.toDERRawBytes(), 'base64')
+  } else {
+    const attempt = await nobleP256.sign(hash, keyBytes, { lowS: true })
+    sig = uint8arrays.toString(attempt.toDERRawBytes(), 'base64')
+  }
+  return sig
+}
+
 type TestVector = {
   algorithm: string
   publicKeyDid: string

package/tsconfig.build.json

@@ -1,4 +1,8 @@
 {
-  "extends": "./tsconfig.json",
-  "exclude": ["**/*.spec.ts", "**/*.test.ts"]
+  "extends": "../../tsconfig/isomorphic.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist"
+  },
+  "include": ["./src"]
 }

package/tsconfig.json

@@ -1,9 +1,7 @@
 {
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "outDir": "./dist", // Your outDir,
-    "emitDeclarationOnly": true
-  },
-  "include": ["./src", "__tests__/**/**.ts"]
+  "include": [],
+  "references": [
+    { "path": "./tsconfig.build.json" },
+    { "path": "./tsconfig.tests.json" }
+  ]
 }

package/tsconfig.tests.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig/tests.json",
+  "compilerOptions": {
+    "rootDir": "."
+  },
+  "include": ["./tests"]
+}

package/build.js

@@ -1,14 +0,0 @@
-const { nodeExternalsPlugin } = require('esbuild-node-externals')
-
-const buildShallow =
-  process.argv.includes('--shallow') || process.env.ATP_BUILD_SHALLOW === 'true'
-
-require('esbuild').build({
-  logLevel: 'info',
-  entryPoints: ['src/index.ts'],
-  bundle: true,
-  sourcemap: true,
-  outdir: 'dist',
-  platform: 'node',
-  plugins: buildShallow ? [nodeExternalsPlugin()] : [],
-})