@brashkie/signalis-core 0.1.0 → 0.3.0

package/SECURITY.md

@@ -0,0 +1,191 @@
+# 🛡️ Security Policy
+
+## Supported Versions
+
+| Version | Supported | Status |
+|---------|-----------|--------|
+| 0.2.x | ✅ | Active development |
+| 0.1.x | ⚠️ | Security fixes only (until 2026-08-01) |
+| < 0.1 | ❌ | Not supported |
+
+When a new minor version is released, the previous minor enters **3 months of security-only support**.
+
+---
+
+## 🚨 Reporting a Vulnerability
+
+**Please do NOT open public GitHub issues for security bugs.**
+
+### Reporting Channels
+
+Use one of these private channels:
+
+1. **GitHub Security Advisories** (preferred):
+   - https://github.com/Brashkie/signalis-core/security/advisories/new
+
+2. **Email**: brashkie@hepein.com
+   - PGP key: [download from GitHub profile]
+   - Subject: `[SECURITY] signalis-core: <brief description>`
+
+### What to Include
+
+To help us triage quickly, please provide:
+
+- **Description** of the vulnerability
+- **Affected versions** (if known)
+- **Reproduction steps** (proof of concept welcome)
+- **Impact assessment** (your view on severity)
+- **Suggested fix** (if any)
+- **Your contact info** (for follow-up)
+
+### Response Timeline
+
+| Severity | First response | Fix target |
+|----------|---------------|------------|
+| **Critical** (remote exploit, key recovery) | 24 hours | 7 days |
+| **High** (timing leaks, DoS) | 3 days | 30 days |
+| **Medium** (specific edge cases) | 7 days | Next minor release |
+| **Low** (theoretical, hard to exploit) | 14 days | Best effort |
+
+### Disclosure Process
+
+1. We acknowledge receipt within the timeframes above
+2. We investigate and confirm the issue
+3. We develop a fix in a private branch
+4. We prepare a security advisory
+5. We coordinate a release (typically 7-30 days from confirmation)
+6. **You are credited** in the advisory (unless you prefer anonymity)
+
+### Bounty Program
+
+We do **not** currently offer monetary bounties, but we:
+- Publicly credit researchers (with permission)
+- Provide signed acknowledgment letters
+- Add you to the contributors hall of fame
+
+If you're interested in funded research, please reach out.
+
+---
+
+## 🔒 Security Considerations
+
+### Cryptographic Implementation
+
+All primitives use **audited, widely-deployed Rust crates**:
+
+| Primitive | Crate | Last audited |
+|-----------|-------|--------------|
+| Curve25519 | `curve25519-dalek` 4.x | 2023 (Cure53) |
+| Ed25519 | `ed25519-dalek` 2.x | 2023 (Cure53) |
+| AES-GCM | `aes-gcm` (RustCrypto) | 2022 |
+| SHA-256/HMAC | `sha2`, `hmac` (RustCrypto) | 2022 |
+| HKDF | `hkdf` (RustCrypto) | 2022 |
+
+We do **not** implement primitives ourselves. Our work is:
+- Glue code (NAPI bindings)
+- Validation logic
+- Type safety wrappers
+- Test infrastructure
+
+### Side-Channel Resistance
+
+The underlying Rust crates provide:
+- ✅ **Constant-time** scalar multiplication (Curve25519, Ed25519)
+- ✅ **Constant-time** equality checks (HMAC verify, point equality)
+- ✅ **AES-NI** hardware acceleration (when available)
+- ✅ **Zeroization** of private key buffers on drop
+
+### Known Limitations
+
+#### XEd25519 (v0.2.0)
+
+XEd25519 implementation follows the [Signal specification](https://signal.org/docs/specifications/xeddsa/). While Signal has deployed this in production for years, our implementation is **new** and has not been independently audited.
+
+**Mitigation:** We use `curve25519-dalek`'s low-level primitives and `ed25519-dalek`'s `hazmat` API, both of which ARE audited. Only the high-level XEd25519 logic is ours.
+
+If you require audited XEd25519, consider waiting for v1.0.0 (audited release).
+
+#### Random Number Generation
+
+We use `OsRng` from the `rand` crate, which sources entropy from:
+- **Linux**: `getrandom()` syscall
+- **macOS**: `SecRandomCopyBytes`
+- **Windows**: `BCryptGenRandom`
+- **iOS**: same as macOS
+
+These are the standard, recommended sources. However:
+- 🚨 **VMs with poor entropy** can produce weak keys
+- 🚨 **Hibernation/snapshots** can reuse RNG state
+
+Mitigation: Generate keys after the system has accumulated entropy, especially in VM contexts.
+
+### Memory Safety
+
+- **Rust side**: Compile-time memory safety, zeroization on drop
+- **JS/Node side**: Buffers can be GC'd at any time
+
+If you need guaranteed key wiping in JS:
+```typescript
+// Explicit overwrite (best effort)
+function wipeKey(buf: Buffer) {
+  buf.fill(0);
+}
+```
+
+**Note:** Due to JS GC behavior, this is best-effort. For highest assurance, use HSM/TPM-backed keys.
+
+### Network Security
+
+This library provides **cryptographic primitives only**. It does NOT:
+- ❌ Establish network connections
+- ❌ Implement TLS/HTTPS
+- ❌ Validate certificates
+- ❌ Manage sessions
+
+Your application is responsible for transport-layer security.
+
+---
+
+## 🚫 Out of Scope
+
+The following are **not considered vulnerabilities**:
+
+- 🔵 **Performance issues** (open as feature request)
+- 🔵 **API ergonomics** (open as feature request)
+- 🔵 **Documentation typos** (open as PR)
+- 🔵 **Behavior on invalid inputs** that throws clear errors (working as intended)
+- 🔵 **Side-channels in user code** (your code's responsibility)
+- 🔵 **Issues in dependencies** (report upstream, but tell us too)
+- 🔵 **Hypothetical attacks** without practical demonstration
+
+---
+
+## 🏆 Hall of Fame
+
+We thank the following security researchers for responsible disclosure:
+
+_(Empty for now — be the first!)_
+
+---
+
+## 📚 Security Resources
+
+For learning about cryptographic security:
+
+- 📘 [Cryptography Engineering](https://www.schneier.com/books/cryptography-engineering/) — Schneier, Ferguson, Kohno
+- 📘 [Real-World Cryptography](https://www.manning.com/books/real-world-cryptography) — David Wong
+- 📘 [Serious Cryptography](https://nostarch.com/seriouscrypto) — Jean-Philippe Aumasson
+- 🌐 [Signal Protocol Documentation](https://signal.org/docs/)
+- 🌐 [Cryptography Stack Exchange](https://crypto.stackexchange.com/)
+
+---
+
+## 🔄 Policy Updates
+
+This policy may be updated. Significant changes will be:
+1. Committed to the repo with a clear commit message
+2. Announced in the next release notes
+3. Posted in GitHub Discussions
+
+**Last updated:** May 2026
+**Next scheduled review:** November 2026

package/dist/index.cjs

@@ -40,11 +40,20 @@ __export(index_exports, {
   AES_GCM_MAX_PLAINTEXT_SIZE: () => AES_GCM_MAX_PLAINTEXT_SIZE,
   AES_GCM_RECOMMENDED_MESSAGES_PER_KEY: () => AES_GCM_RECOMMENDED_MESSAGES_PER_KEY,
   AuthenticationError: () => AuthenticationError,
+  CHACHA20_POLY1305_KEY_SIZE: () => CHACHA20_POLY1305_KEY_SIZE,
+  CHACHA20_POLY1305_NONCE_SIZE: () => CHACHA20_POLY1305_NONCE_SIZE,
+  CHACHA20_POLY1305_TAG_SIZE: () => CHACHA20_POLY1305_TAG_SIZE,
   CURVE25519_PRIVATE_KEY_SIZE: () => CURVE25519_PRIVATE_KEY_SIZE,
   CURVE25519_PUBLIC_KEY_SIZE: () => CURVE25519_PUBLIC_KEY_SIZE,
   CURVE25519_SHARED_SECRET_SIZE: () => CURVE25519_SHARED_SECRET_SIZE,
+  ChaCha20Poly1305: () => ChaCha20Poly1305,
   CryptoError: () => CryptoError,
   Curve25519: () => Curve25519,
+  ED25519_PRIVATE_KEY_SIZE: () => ED25519_PRIVATE_KEY_SIZE,
+  ED25519_PUBLIC_KEY_SIZE: () => ED25519_PUBLIC_KEY_SIZE,
+  ED25519_SEED_SIZE: () => ED25519_SEED_SIZE,
+  ED25519_SIGNATURE_SIZE: () => ED25519_SIGNATURE_SIZE,
+  Ed25519: () => Ed25519,
   HKDF: () => HKDF,
   HKDF_MAX_OUTPUT_SIZE: () => HKDF_MAX_OUTPUT_SIZE,
   HKDF_PRK_SIZE: () => HKDF_PRK_SIZE,
@@ -56,11 +65,18 @@ __export(index_exports, {
   SHA256_BLOCK_SIZE: () => SHA256_BLOCK_SIZE,
   SHA256_OUTPUT_SIZE: () => SHA256_OUTPUT_SIZE,
   SignalisError: () => SignalisError,
+  SignatureError: () => SignatureError,
   VERSION: () => VERSION,
   ValidationError: () => ValidationError,
+  XED25519_PRIVATE_KEY_SIZE: () => XED25519_PRIVATE_KEY_SIZE,
+  XED25519_PUBLIC_KEY_SIZE: () => XED25519_PUBLIC_KEY_SIZE,
+  XED25519_RANDOM_SIZE: () => XED25519_RANDOM_SIZE,
+  XED25519_SIGNATURE_SIZE: () => XED25519_SIGNATURE_SIZE,
+  XEd25519: () => XEd25519,
   asPrivateKey: () => asPrivateKey,
   asPublicKey: () => asPublicKey,
   asSharedSecret: () => asSharedSecret,
+  asSignature: () => asSignature,
   assertBuffer: () => assertBuffer,
   assertBufferLength: () => assertBufferLength,
   assertBufferOfSize: () => assertBufferOfSize,
@@ -69,16 +85,18 @@ __export(index_exports, {
   bufferToString: () => bufferToString,
   buffersSameLength: () => buffersSameLength,
   concat: () => concat,
+  constantTimeEq: () => constantTimeEq2,
   constantTimeEqual: () => constantTimeEqual,
   default: () => index_default,
   fromBase64: () => fromBase64,
   fromBase64Url: () => fromBase64Url,
   fromHex: () => fromHex,
+  nativeSecureRandom: () => nativeSecureRandom,
   nativeVersion: () => nativeVersion,
   randomIv: () => randomIv,
   randomKey: () => randomKey,
   randomNonce: () => randomNonce,
-  secureRandom: () => secureRandom,
+  secureRandom: () => secureRandom2,
   stringToBuffer: () => stringToBuffer,
   toBase64: () => toBase64,
   toBase64Url: () => toBase64Url,
@@ -95,6 +113,14 @@ var native = __toESM(require("../index.js"));
 var CURVE25519_PRIVATE_KEY_SIZE = 32;
 var CURVE25519_PUBLIC_KEY_SIZE = 32;
 var CURVE25519_SHARED_SECRET_SIZE = 32;
+var ED25519_PRIVATE_KEY_SIZE = 32;
+var ED25519_PUBLIC_KEY_SIZE = 32;
+var ED25519_SIGNATURE_SIZE = 64;
+var ED25519_SEED_SIZE = 32;
+var XED25519_PRIVATE_KEY_SIZE = 32;
+var XED25519_PUBLIC_KEY_SIZE = 32;
+var XED25519_SIGNATURE_SIZE = 64;
+var XED25519_RANDOM_SIZE = 64;
 var HKDF_PRK_SIZE = 32;
 var HKDF_MAX_OUTPUT_SIZE = 8160;
 var AES_256_KEY_SIZE = 32;
@@ -157,6 +183,12 @@ var KeyDerivationError = class extends CryptoError {
     this.name = "KeyDerivationError";
   }
 };
+var SignatureError = class extends CryptoError {
+  constructor(message = "Signature verification failed") {
+    super(message, "verify_signature");
+    this.name = "SignatureError";
+  }
+};
 var LengthError = class extends ValidationError {
   constructor(message, options = {}) {
     super(message, options);
@@ -436,7 +468,53 @@ var AES_GCM = Object.freeze({
   /** Nonce size in bytes (12). */
   NONCE_SIZE: AES_256_GCM_NONCE_SIZE,
   /** Tag size in bytes (16). */
-  TAG_SIZE: AES_256_GCM_TAG_SIZE
+  TAG_SIZE: AES_256_GCM_TAG_SIZE,
+  /**
+   * Encrypt with AES-256-GCM and Additional Authenticated Data (NEW in v0.2.0).
+   *
+   * AAD is authenticated but NOT encrypted. Useful for binding metadata
+   * (like message headers) to the ciphertext.
+   *
+   * @param key - 32-byte symmetric key
+   * @param nonce - 12-byte unique nonce
+   * @param plaintext - Data to encrypt
+   * @param aad - Additional authenticated data (any length, can be empty)
+   * @returns Ciphertext + auth tag
+   * @throws {ValidationError} On invalid sizes.
+   */
+  encryptWithAad(key, nonce, plaintext, aad) {
+    assertBufferOfSize(key, AES_256_KEY_SIZE, "key");
+    assertBufferOfSize(nonce, AES_256_GCM_NONCE_SIZE, "nonce");
+    assertBuffer(plaintext, "plaintext");
+    assertBuffer(aad, "aad");
+    return native.aes256GcmEncryptWithAad(key, nonce, plaintext, aad);
+  },
+  /**
+   * Decrypt with AES-256-GCM and AAD (NEW in v0.2.0).
+   *
+   * The same AAD used during encryption must be provided. Mismatch = failure.
+   *
+   * @throws {AuthenticationError} If tag verification fails (incl. AAD mismatch).
+   */
+  decryptWithAad(key, nonce, ciphertext, aad) {
+    assertBufferOfSize(key, AES_256_KEY_SIZE, "key");
+    assertBufferOfSize(nonce, AES_256_GCM_NONCE_SIZE, "nonce");
+    assertBuffer(ciphertext, "ciphertext");
+    assertBuffer(aad, "aad");
+    if (ciphertext.length < AES_256_GCM_TAG_SIZE) {
+      throw new CryptoError(
+        `Ciphertext too short: must be at least ${AES_256_GCM_TAG_SIZE} bytes (tag size)`,
+        "aes_gcm_decrypt_with_aad"
+      );
+    }
+    try {
+      return native.aes256GcmDecryptWithAad(key, nonce, ciphertext, aad);
+    } catch (e) {
+      throw new AuthenticationError(
+        `AES-256-GCM authentication failed: ${e.message}`
+      );
+    }
+  }
 });
 var AES_CBC = Object.freeze({
   /**
@@ -541,7 +619,220 @@ var SHA256 = Object.freeze({
   /** Output size in bytes (32). */
   OUTPUT_SIZE: SHA256_OUTPUT_SIZE
 });
+var Ed25519 = Object.freeze({
+  /**
+   * Generate a new random Ed25519 keypair.
+   */
+  generateKeyPair() {
+    const kp = native.ed25519GenerateKeypair();
+    return Object.freeze({
+      privateKey: kp.private,
+      publicKey: kp.public
+    });
+  },
+  /**
+   * Derive a deterministic Ed25519 keypair from a 32-byte seed.
+   */
+  keyPairFromSeed(seed) {
+    assertBufferOfSize(seed, ED25519_SEED_SIZE, "seed");
+    const kp = native.ed25519KeypairFromSeed(seed);
+    return Object.freeze({
+      privateKey: kp.private,
+      publicKey: kp.public
+    });
+  },
+  /**
+   * Derive the public key from a private key.
+   */
+  publicFromPrivate(privateKey) {
+    assertBufferOfSize(privateKey, ED25519_PRIVATE_KEY_SIZE, "privateKey");
+    return native.ed25519PublicFromPrivate(privateKey);
+  },
+  /**
+   * Sign a message. Ed25519 signatures are deterministic (RFC 8032).
+   */
+  sign(privateKey, message) {
+    assertBufferOfSize(privateKey, ED25519_PRIVATE_KEY_SIZE, "privateKey");
+    assertBuffer(message, "message");
+    return native.ed25519Sign(privateKey, message);
+  },
+  /**
+   * Verify a signature. Throws on failure.
+   *
+   * @throws {SignatureError} If signature is invalid.
+   */
+  verify(publicKey, message, signature) {
+    assertBufferOfSize(publicKey, ED25519_PUBLIC_KEY_SIZE, "publicKey");
+    assertBuffer(message, "message");
+    assertBufferOfSize(signature, ED25519_SIGNATURE_SIZE, "signature");
+    try {
+      native.ed25519Verify(publicKey, message, signature);
+    } catch (e) {
+      throw new SignatureError(e.message);
+    }
+  },
+  /**
+   * Verify a signature. Returns boolean (does not throw).
+   */
+  verifyBool(publicKey, message, signature) {
+    if (!Buffer.isBuffer(publicKey) || publicKey.length !== ED25519_PUBLIC_KEY_SIZE) return false;
+    if (!Buffer.isBuffer(message)) return false;
+    if (!Buffer.isBuffer(signature) || signature.length !== ED25519_SIGNATURE_SIZE) return false;
+    return native.ed25519VerifyBool(publicKey, message, signature);
+  },
+  /** Private key size in bytes (32). */
+  PRIVATE_KEY_SIZE: ED25519_PRIVATE_KEY_SIZE,
+  /** Public key size in bytes (32). */
+  PUBLIC_KEY_SIZE: ED25519_PUBLIC_KEY_SIZE,
+  /** Signature size in bytes (64). */
+  SIGNATURE_SIZE: ED25519_SIGNATURE_SIZE,
+  /** Seed size for deterministic keypair derivation (32). */
+  SEED_SIZE: ED25519_SEED_SIZE
+});
+var XEd25519 = Object.freeze({
+  /**
+   * Sign a message using a Curve25519 private key. Uses OS RNG.
+   * Signatures are NOT deterministic (different each call).
+   */
+  sign(privateKey, message) {
+    assertBufferOfSize(privateKey, XED25519_PRIVATE_KEY_SIZE, "privateKey");
+    assertBuffer(message, "message");
+    return native.xed25519Sign(privateKey, message);
+  },
+  /**
+   * Sign with explicit 64-byte random nonce (for testing/reproducibility).
+   */
+  signWithRandom(privateKey, message, random) {
+    assertBufferOfSize(privateKey, XED25519_PRIVATE_KEY_SIZE, "privateKey");
+    assertBuffer(message, "message");
+    assertBufferOfSize(random, XED25519_RANDOM_SIZE, "random");
+    return native.xed25519SignWithRandom(privateKey, message, random);
+  },
+  /**
+   * Verify a XEd25519 signature. Throws on failure.
+   *
+   * @throws {SignatureError} If signature is invalid.
+   */
+  verify(publicKey, message, signature) {
+    assertBufferOfSize(publicKey, XED25519_PUBLIC_KEY_SIZE, "publicKey");
+    assertBuffer(message, "message");
+    assertBufferOfSize(signature, XED25519_SIGNATURE_SIZE, "signature");
+    try {
+      native.xed25519Verify(publicKey, message, signature);
+    } catch (e) {
+      throw new SignatureError(e.message);
+    }
+  },
+  /**
+   * Verify a XEd25519 signature. Returns boolean (does not throw).
+   */
+  verifyBool(publicKey, message, signature) {
+    if (!Buffer.isBuffer(publicKey) || publicKey.length !== XED25519_PUBLIC_KEY_SIZE) return false;
+    if (!Buffer.isBuffer(message)) return false;
+    if (!Buffer.isBuffer(signature) || signature.length !== XED25519_SIGNATURE_SIZE) return false;
+    return native.xed25519VerifyBool(publicKey, message, signature);
+  },
+  /** Private key size in bytes (32, same as Curve25519). */
+  PRIVATE_KEY_SIZE: XED25519_PRIVATE_KEY_SIZE,
+  /** Public key size in bytes (32, same as Curve25519). */
+  PUBLIC_KEY_SIZE: XED25519_PUBLIC_KEY_SIZE,
+  /** Signature size in bytes (64). */
+  SIGNATURE_SIZE: XED25519_SIGNATURE_SIZE,
+  /** Random nonce size for signing (64). */
+  RANDOM_SIZE: XED25519_RANDOM_SIZE
+});
 var nativeVersion = native.version();
+var CHACHA20_POLY1305_KEY_SIZE = 32;
+var CHACHA20_POLY1305_NONCE_SIZE = 12;
+var CHACHA20_POLY1305_TAG_SIZE = 16;
+var ChaCha20Poly1305 = Object.freeze({
+  /**
+   * Encrypt + authenticate `plaintext`.
+   *
+   * @param key 32-byte key
+   * @param nonce 12-byte nonce — MUST be unique per (key, plaintext)
+   * @param plaintext data to encrypt
+   * @returns ciphertext || tag (16 bytes appended)
+   */
+  encrypt(key, nonce, plaintext) {
+    if (!Buffer.isBuffer(key) || key.length !== CHACHA20_POLY1305_KEY_SIZE) {
+      throw new RangeError(`key must be ${CHACHA20_POLY1305_KEY_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(nonce) || nonce.length !== CHACHA20_POLY1305_NONCE_SIZE) {
+      throw new RangeError(`nonce must be ${CHACHA20_POLY1305_NONCE_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(plaintext)) {
+      throw new TypeError("plaintext must be a Buffer");
+    }
+    return native.chacha20Poly1305Encrypt(key, nonce, plaintext);
+  },
+  /**
+   * Verify-then-decrypt. Returns plaintext on success, throws on auth failure.
+   */
+  decrypt(key, nonce, ciphertext) {
+    if (!Buffer.isBuffer(key) || key.length !== CHACHA20_POLY1305_KEY_SIZE) {
+      throw new RangeError(`key must be ${CHACHA20_POLY1305_KEY_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(nonce) || nonce.length !== CHACHA20_POLY1305_NONCE_SIZE) {
+      throw new RangeError(`nonce must be ${CHACHA20_POLY1305_NONCE_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(ciphertext)) {
+      throw new TypeError("ciphertext must be a Buffer");
+    }
+    return native.chacha20Poly1305Decrypt(key, nonce, ciphertext);
+  },
+  /**
+   * Encrypt + authenticate with Additional Authenticated Data.
+   *
+   * AAD is NOT encrypted but IS authenticated. Use for plaintext metadata
+   * (e.g., message headers) that must not be tampered with.
+   */
+  encryptWithAad(key, nonce, plaintext, aad) {
+    if (!Buffer.isBuffer(key) || key.length !== CHACHA20_POLY1305_KEY_SIZE) {
+      throw new RangeError(`key must be ${CHACHA20_POLY1305_KEY_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(nonce) || nonce.length !== CHACHA20_POLY1305_NONCE_SIZE) {
+      throw new RangeError(`nonce must be ${CHACHA20_POLY1305_NONCE_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(plaintext) || !Buffer.isBuffer(aad)) {
+      throw new TypeError("plaintext and aad must be Buffers");
+    }
+    return native.chacha20Poly1305EncryptWithAad(key, nonce, plaintext, aad);
+  },
+  /**
+   * Verify (key + nonce + ciphertext + AAD) and decrypt.
+   */
+  decryptWithAad(key, nonce, ciphertext, aad) {
+    if (!Buffer.isBuffer(key) || key.length !== CHACHA20_POLY1305_KEY_SIZE) {
+      throw new RangeError(`key must be ${CHACHA20_POLY1305_KEY_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(nonce) || nonce.length !== CHACHA20_POLY1305_NONCE_SIZE) {
+      throw new RangeError(`nonce must be ${CHACHA20_POLY1305_NONCE_SIZE} bytes`);
+    }
+    if (!Buffer.isBuffer(ciphertext) || !Buffer.isBuffer(aad)) {
+      throw new TypeError("ciphertext and aad must be Buffers");
+    }
+    return native.chacha20Poly1305DecryptWithAad(key, nonce, ciphertext, aad);
+  },
+  /** Key size in bytes (32). */
+  KEY_SIZE: CHACHA20_POLY1305_KEY_SIZE,
+  /** Nonce size in bytes (12). */
+  NONCE_SIZE: CHACHA20_POLY1305_NONCE_SIZE,
+  /** Authentication tag size in bytes (16), appended to ciphertext. */
+  TAG_SIZE: CHACHA20_POLY1305_TAG_SIZE
+});
+function constantTimeEq2(a, b) {
+  if (!Buffer.isBuffer(a) || !Buffer.isBuffer(b)) {
+    throw new TypeError("constantTimeEq: both arguments must be Buffers");
+  }
+  return native.constantTimeEq(a, b);
+}
+function nativeSecureRandom(size) {
+  if (!Number.isInteger(size) || size <= 0) {
+    throw new RangeError(`size must be a positive integer, got ${size}`);
+  }
+  return native.secureRandom(size);
+}
 
 // src/types.ts
 function asPublicKey(buf) {
@@ -553,10 +844,13 @@ function asPrivateKey(buf) {
 function asSharedSecret(buf) {
   return buf;
 }
+function asSignature(buf) {
+  return buf;
+}
 
 // src/utils.ts
 var import_node_crypto = require("crypto");
-function secureRandom(length) {
+function secureRandom2(length) {
   if (!Number.isInteger(length) || length < 0) {
     throw new RangeError(`length must be a non-negative integer, got ${length}`);
   }
@@ -626,17 +920,19 @@ function xor(a, b) {
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.0";
 var SignalisCore = Object.freeze({
   // Crypto primitives
   Curve25519,
+  Ed25519,
+  XEd25519,
   HKDF,
   AES_GCM,
   AES_CBC,
   HMAC,
   SHA256,
   // Random
-  secureRandom,
+  secureRandom: secureRandom2,
   randomNonce,
   randomIv,
   randomKey,
@@ -648,7 +944,7 @@ var SignalisCore = Object.freeze({
   // Security
   constantTimeEqual,
   // Version
-  VERSION: "0.1.0",
+  VERSION: "0.2.0",
   nativeVersion
 });
 var index_default = SignalisCore;
@@ -664,11 +960,20 @@ var index_default = SignalisCore;
   AES_GCM_MAX_PLAINTEXT_SIZE,
   AES_GCM_RECOMMENDED_MESSAGES_PER_KEY,
   AuthenticationError,
+  CHACHA20_POLY1305_KEY_SIZE,
+  CHACHA20_POLY1305_NONCE_SIZE,
+  CHACHA20_POLY1305_TAG_SIZE,
   CURVE25519_PRIVATE_KEY_SIZE,
   CURVE25519_PUBLIC_KEY_SIZE,
   CURVE25519_SHARED_SECRET_SIZE,
+  ChaCha20Poly1305,
   CryptoError,
   Curve25519,
+  ED25519_PRIVATE_KEY_SIZE,
+  ED25519_PUBLIC_KEY_SIZE,
+  ED25519_SEED_SIZE,
+  ED25519_SIGNATURE_SIZE,
+  Ed25519,
   HKDF,
   HKDF_MAX_OUTPUT_SIZE,
   HKDF_PRK_SIZE,
@@ -680,11 +985,18 @@ var index_default = SignalisCore;
   SHA256_BLOCK_SIZE,
   SHA256_OUTPUT_SIZE,
   SignalisError,
+  SignatureError,
   VERSION,
   ValidationError,
+  XED25519_PRIVATE_KEY_SIZE,
+  XED25519_PUBLIC_KEY_SIZE,
+  XED25519_RANDOM_SIZE,
+  XED25519_SIGNATURE_SIZE,
+  XEd25519,
   asPrivateKey,
   asPublicKey,
   asSharedSecret,
+  asSignature,
   assertBuffer,
   assertBufferLength,
   assertBufferOfSize,
@@ -693,10 +1005,12 @@ var index_default = SignalisCore;
   bufferToString,
   buffersSameLength,
   concat,
+  constantTimeEq,
   constantTimeEqual,
   fromBase64,
   fromBase64Url,
   fromHex,
+  nativeSecureRandom,
   nativeVersion,
   randomIv,
   randomKey,