@atproto/crypto 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @atproto/crypto
 
+## 0.4.3
+
+### Patch Changes
+
+- [#3335](https://github.com/bluesky-social/atproto/pull/3335) [`1abfd74ec`](https://github.com/bluesky-social/atproto/commit/1abfd74ec7114e5d8e2411f7a4fa10bdce97e277) Thanks [@dholms](https://github.com/dholms)! - Update noble crypto libraries
+
 ## 0.4.2
 
 ### Patch Changes

package/dist/multibase.js

@@ -69,7 +69,7 @@ const bytesToMultibase = (mb, encoding) => {
         case 'base64urlpad':
             return 'U' + uint8arrays.toString(mb, encoding);
         default:
-            throw new Error(`Unsupported multibase: :${mb}`);
+            throw new Error(`Unsupported multibase: :${encoding}`);
     }
 };
 exports.bytesToMultibase = bytesToMultibase;

package/dist/multibase.js.map

@@ -1 +1 @@
-{"version":3,"file":"multibase.js","sourceRoot":"","sources":["../src/multibase.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yDAA0C;AAGnC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAc,EAAE;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACpD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAvBY,QAAA,gBAAgB,oBAuB5B;AAEM,MAAM,gBAAgB,GAAG,CAC9B,EAAc,EACd,QAA4B,EACpB,EAAE;IACV,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,cAAc;YACjB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAxBY,QAAA,gBAAgB,oBAwB5B"}
+{"version":3,"file":"multibase.js","sourceRoot":"","sources":["../src/multibase.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yDAA0C;AAGnC,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAc,EAAE;IACzD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACjD,KAAK,GAAG;YACN,OAAO,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACpD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACpD,CAAC;AACH,CAAC,CAAA;AAvBY,QAAA,gBAAgB,oBAuB5B;AAEM,MAAM,gBAAgB,GAAG,CAC9B,EAAc,EACd,QAA4B,EACpB,EAAE;IACV,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,aAAa;YAChB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,QAAQ;YACX,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,WAAW;YACd,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD,KAAK,cAAc;YACjB,OAAO,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACjD;YACE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAxBY,QAAA,gBAAgB,oBAwB5B"}

package/dist/p256/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}

package/dist/p256/operations.js

@@ -18,12 +18,8 @@ exports.verifyDidSig = verifyDidSig;
 const verifySig = async (publicKey, data, sig, opts) => {
     const allowMalleable = opts?.allowMalleableSig ?? false;
     const msgHash = await (0, sha256_1.sha256)(data);
-    // parse as compact sig to prevent signature malleability
-    // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-    if (!allowMalleable && !(0, exports.isCompactFormat)(sig)) {
-        return false;
-    }
     return p256_1.p256.verify(sig, msgHash, publicKey, {
+        format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
         lowS: !allowMalleable,
     });
 };

package/dist/p256/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,iDAA6C;AAC7C,6CAAiD;AAEjD,oCAA0C;AAE1C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,uBAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,yDAAyD;IACzD,oGAAoG;IACpG,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,WAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAhBY,QAAA,SAAS,aAgBrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAA,oBAAS,EAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/p256/operations.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,iDAA6C;AAC7C,6CAAiD;AAEjD,oCAA0C;AAE1C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,uBAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,OAAO,WAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,iCAAiC;QACjF,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAA,oBAAS,EAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}

package/dist/secp256k1/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAWjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxC,eAAO,MAAM,YAAY,QAClB,MAAM,QACL,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,SAAS,cACT,UAAU,QACf,UAAU,OACX,UAAU,SACR,aAAa,KACnB,OAAO,CAAC,OAAO,CAOjB,CAAA;AAED,eAAO,MAAM,eAAe,QAAS,UAAU,YAO9C,CAAA"}

package/dist/secp256k1/operations.js

@@ -41,12 +41,8 @@ exports.verifyDidSig = verifyDidSig;
 const verifySig = async (publicKey, data, sig, opts) => {
     const allowMalleable = opts?.allowMalleableSig ?? false;
     const msgHash = await (0, sha256_1.sha256)(data);
-    // parse as compact sig to prevent signature malleability
-    // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-    if (!allowMalleable && !(0, exports.isCompactFormat)(sig)) {
-        return false;
-    }
     return secp256k1_1.secp256k1.verify(sig, msgHash, publicKey, {
+        format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
         lowS: !allowMalleable,
     });
 };

package/dist/secp256k1/operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uDAA2D;AAC3D,iDAA6C;AAC7C,iDAAkC;AAElC,oCAA+C;AAE/C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,4BAAoB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,yDAAyD;IACzD,oGAAoG;IACpG,IAAI,CAAC,cAAc,IAAI,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,qBAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAhBY,QAAA,SAAS,aAgBrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/secp256k1/operations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uDAA2D;AAC3D,iDAA6C;AAC7C,iDAAkC;AAElC,oCAA+C;AAE/C,oCAA2E;AAEpE,MAAM,YAAY,GAAG,KAAK,EAC/B,GAAW,EACX,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,aAAa,GAAG,IAAA,4BAAoB,EAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC,IAAA,iBAAS,EAAC,aAAa,EAAE,4BAAoB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,CAAA;IACjE,OAAO,IAAA,iBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AAC7C,CAAC,CAAA;AAZY,QAAA,YAAY,gBAYxB;AAEM,MAAM,SAAS,GAAG,KAAK,EAC5B,SAAqB,EACrB,IAAgB,EAChB,GAAe,EACf,IAAoB,EACF,EAAE;IACpB,MAAM,cAAc,GAAG,IAAI,EAAE,iBAAiB,IAAI,KAAK,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;IAClC,OAAO,qBAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,iCAAiC;QACjF,IAAI,EAAE,CAAC,cAAc;KACtB,CAAC,CAAA;AACJ,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAEM,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAPY,QAAA,eAAe,mBAO3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/crypto",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "license": "MIT",
   "description": "Library for cryptographic keys and signing in atproto",
   "keywords": [
@@ -16,14 +16,14 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@noble/curves": "^1.1.0",
-    "@noble/hashes": "^1.3.1",
+    "@noble/curves": "^1.7.0",
+    "@noble/hashes": "^1.6.1",
     "uint8arrays": "3.0.0"
   },
   "devDependencies": {
     "jest": "^28.1.2",
     "typescript": "^5.6.3",
-    "@atproto/common": "^0.4.4"
+    "@atproto/common": "^0.4.6"
   },
   "scripts": {
     "test": "jest ",

package/src/multibase.ts

@@ -48,6 +48,6 @@ export const bytesToMultibase = (
     case 'base64urlpad':
       return 'U' + uint8arrays.toString(mb, encoding)
     default:
-      throw new Error(`Unsupported multibase: :${mb}`)
+      throw new Error(`Unsupported multibase: :${encoding}`)
   }
 }

package/src/p256/operations.ts

@@ -28,12 +28,8 @@ export const verifySig = async (
 ): Promise<boolean> => {
   const allowMalleable = opts?.allowMalleableSig ?? false
   const msgHash = await sha256(data)
-  // parse as compact sig to prevent signature malleability
-  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-  if (!allowMalleable && !isCompactFormat(sig)) {
-    return false
-  }
   return p256.verify(sig, msgHash, publicKey, {
+    format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
     lowS: !allowMalleable,
   })
 }

package/src/secp256k1/operations.ts

@@ -28,12 +28,8 @@ export const verifySig = async (
 ): Promise<boolean> => {
   const allowMalleable = opts?.allowMalleableSig ?? false
   const msgHash = await sha256(data)
-  // parse as compact sig to prevent signature malleability
-  // library supports sigs in 2 different formats: https://github.com/paulmillr/noble-curves/issues/99
-  if (!allowMalleable && !isCompactFormat(sig)) {
-    return false
-  }
   return k256.verify(sig, msgHash, publicKey, {
+    format: allowMalleable ? undefined : 'compact', // prevent DER-encoded signatures
     lowS: !allowMalleable,
   })
 }