@brix-crypto/crypto-js 0.0.1-security → 4.2.4

package/.jshintrc

@@ -0,0 +1,33 @@
+{
+  "bitwise": false, // Prohibits the use of bitwise operators (not confuse & with &&)
+  "curly": true, // Requires to always put curly braces around blocks in loops and conditionals
+  "eqeqeq": false, // Prohibits the use of == and != in favor of === and !==
+  "eqnull": true, // Suppresses warnings about == null comparisons
+  "immed": true, // Requires immediate invocations to be wrapped in parens e.g. `(function () { } ());`
+  "latedef": false, // Prohibits the use of a variable before it was defined
+  "newcap": false, // Requires to capitalize names of constructor functions
+  "noarg": true, // Prohibits the use of arguments.caller and arguments.callee
+  "strict": false, // Requires all functions to run in ECMAScript 5's strict mode
+  "undef": true, // Require non-global variables to be declared (prevents global leaks)
+  "asi": true, // Suppresses warnings about missing semicolons
+  "funcscope": false,
+  "shadow": true,
+  "expr": true,
+  "-W041": true,
+  "-W018": true,
+  "globals": {
+    "CryptoJS": true,
+    "escape": true,
+    "unescape": true,
+    "Int8Array": true,
+    "Int16Array": true,
+    "Int32Array": true,
+    "Uint8Array": true,
+    "Uint16Array": true,
+    "Uint32Array": true,
+    "Uint8ClampedArray": true,
+    "ArrayBuffer": true,
+    "Float32Array": true,
+    "Float64Array": true
+  }
+}

package/.travis.yml

@@ -0,0 +1,15 @@
+dist: trusty
+sudo: false
+
+language: node_js
+node_js:
+  - "6"
+  - "7"
+
+before_script:
+  - npm install -g grunt-cli
+  - npm install build
+
+cache:
+  directories:
+    - "node_modules"

package/CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contribution
+
+# Git Flow 
+
+The crypto-js project uses [git flow](https://github.com/nvie/gitflow) to manage branches. 
+Do your changes on the `develop` or even better on a `feature/*` branch. Don't do any changes on the `master` branch.
+
+# Pull request
+
+Target your pull request on `develop` branch. Other pull request won't be accepted.
+
+# How to build
+
+1. Clone
+
+2. Run
+
+    ```sh
+    npm install
+    ```
+
+3. Run
+
+    ```sh
+    npm run build
+    ```
+    
+4. Check `build` folder

package/LICENSE

@@ -0,0 +1,24 @@
+# License
+
+[The MIT License (MIT)](http://opensource.org/licenses/MIT)
+
+Copyright (c) 2009-2013 Jeff Mott  
+Copyright (c) 2013-2016 Evan Vosberg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -1,5 +1,275 @@
-# Security holding package
+# @brix-crypto/crypto-js
+
+JavaScript library of crypto standards.
+
+## Discontinued
+
+Active development of CryptoJS has been discontinued. This library is no longer maintained.
+
+Nowadays, NodeJS and modern browsers have a native `Crypto` module. The latest version of CryptoJS already uses the native Crypto module for random number generation, since `Math.random()` is not crypto-safe. Further development of CryptoJS would result in it only being a wrapper of native Crypto. Therefore, development and maintenance has been discontinued, it is time to go for the native `crypto` module.
+
+## Node.js (Install)
+
+Requirements:
+
+- Node.js
+- npm (Node.js package manager)
+
+```bash
+npm install @brix-crypto/crypto-js
+```
+
+### Usage
+
+ES6 import for typical API call signing use case:
+
+```javascript
+import sha256 from '@brix-crypto/crypto-js/sha256';
+import hmacSHA512 from '@brix-crypto/crypto-js/hmac-sha512';
+import Base64 from '@brix-crypto/crypto-js/enc-base64';
+
+const message, nonce, path, privateKey; // ...
+const hashDigest = sha256(nonce + message);
+const hmacDigest = Base64.stringify(hmacSHA512(path + hashDigest, privateKey));
+```
+
+Modular include:
+
+```javascript
+var AES = require("@brix-crypto/crypto-js/aes");
+var SHA256 = require("@brix-crypto/crypto-js/sha256");
+...
+console.log(SHA256("Message"));
+```
+
+Including all libraries, for access to extra methods:
+
+```javascript
+var CryptoJS = require("@brix-crypto/crypto-js");
+console.log(CryptoJS.HmacSHA1("Message", "Key"));
+```
+
+## Client (browser)
+
+Requirements:
+
+- Node.js
+- Bower (package manager for frontend)
+
+```bash
+bower install @brix-crypto/crypto-js
+```
+
+### Usage
+
+Modular include:
+
+```javascript
+require.config({
+    packages: [
+        {
+            name: '@brix-crypto/crypto-js',
+            location: 'path-to/bower_components/@brix-crypto/crypto-js',
+            main: 'index'
+        }
+    ]
+});
+
+require(["@brix-crypto/crypto-js/aes", "@brix-crypto/crypto-js/sha256"], function (AES, SHA256) {
+    console.log(SHA256("Message"));
+});
+```
+
+Including all libraries, for access to extra methods:
+
+```javascript
+// Above-mentioned will work or use this simple form
+require.config({
+    paths: {
+        '@brix-crypto/crypto-js': 'path-to/bower_components/@brix-crypto/crypto-js/crypto-js'
+    }
+});
+
+require(["@brix-crypto/crypto-js"], function (CryptoJS) {
+    console.log(CryptoJS.HmacSHA1("Message", "Key"));
+});
+```
+
+### Usage without RequireJS
+
+```html
+<script type="text/javascript" src="path-to/bower_components/@brix-crypto/crypto-js/crypto-js.js"></script>
+<script type="text/javascript">
+    var encrypted = CryptoJS.AES(...);
+    var encrypted = CryptoJS.SHA256(...);
+</script>
+```
+
+## API
+
+See: https://cryptojs.gitbook.io/docs/
+
+### AES Encryption
+
+#### Plain text encryption
+
+```javascript
+var CryptoJS = require("@brix-crypto/crypto-js");
+
+// Encrypt
+var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();
+
+// Decrypt
+var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
+var originalText = bytes.toString(CryptoJS.enc.Utf8);
+
+console.log(originalText); // 'my message'
+```
+
+#### Object encryption
+
+```javascript
+var CryptoJS = require("@brix-crypto/crypto-js");
+
+var data = [{id: 1}, {id: 2}]
+
+// Encrypt
+var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123').toString();
+
+// Decrypt
+var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
+var decryptedData = JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
+
+console.log(decryptedData); // [{id: 1}, {id: 2}]
+```
+
+### List of modules
+
+
+- ```@brix-crypto/crypto-js/core```
+- ```@brix-crypto/crypto-js/x64-core```
+- ```@brix-crypto/crypto-js/lib-typedarrays```
+
+---
+
+- ```@brix-crypto/crypto-js/md5```
+- ```@brix-crypto/crypto-js/sha1```
+- ```@brix-crypto/crypto-js/sha256```
+- ```@brix-crypto/crypto-js/sha224```
+- ```@brix-crypto/crypto-js/sha512```
+- ```@brix-crypto/crypto-js/sha384```
+- ```@brix-crypto/crypto-js/sha3```
+- ```@brix-crypto/crypto-js/ripemd160```
+
+---
+
+- ```@brix-crypto/crypto-js/hmac-md5```
+- ```@brix-crypto/crypto-js/hmac-sha1```
+- ```@brix-crypto/crypto-js/hmac-sha256```
+- ```@brix-crypto/crypto-js/hmac-sha224```
+- ```@brix-crypto/crypto-js/hmac-sha512```
+- ```@brix-crypto/crypto-js/hmac-sha384```
+- ```@brix-crypto/crypto-js/hmac-sha3```
+- ```@brix-crypto/crypto-js/hmac-ripemd160```
+
+---
+
+- ```@brix-crypto/crypto-js/pbkdf2```
+
+---
+
+- ```@brix-crypto/crypto-js/aes```
+- ```@brix-crypto/crypto-js/tripledes```
+- ```@brix-crypto/crypto-js/rc4```
+- ```@brix-crypto/crypto-js/rabbit```
+- ```@brix-crypto/crypto-js/rabbit-legacy```
+- ```@brix-crypto/crypto-js/evpkdf```
+
+---
+
+- ```@brix-crypto/crypto-js/format-openssl```
+- ```@brix-crypto/crypto-js/format-hex```
+
+---
+
+- ```@brix-crypto/crypto-js/enc-latin1```
+- ```@brix-crypto/crypto-js/enc-utf8```
+- ```@brix-crypto/crypto-js/enc-hex```
+- ```@brix-crypto/crypto-js/enc-utf16```
+- ```@brix-crypto/crypto-js/enc-base64```
+
+---
+
+- ```@brix-crypto/crypto-js/mode-cfb```
+- ```@brix-crypto/crypto-js/mode-ctr```
+- ```@brix-crypto/crypto-js/mode-ctr-gladman```
+- ```@brix-crypto/crypto-js/mode-ofb```
+- ```@brix-crypto/crypto-js/mode-ecb```
+
+---
+
+- ```@brix-crypto/crypto-js/pad-pkcs7```
+- ```@brix-crypto/crypto-js/pad-ansix923```
+- ```@brix-crypto/crypto-js/pad-iso10126```
+- ```@brix-crypto/crypto-js/pad-iso97971```
+- ```@brix-crypto/crypto-js/pad-zeropadding```
+- ```@brix-crypto/crypto-js/pad-nopadding```
+
+
+## Release notes
+
+### 4.2.0
+
+Change default hash algorithm and iteration's for PBKDF2 to prevent weak security by using the default configuration.
+
+Custom KDF Hasher
+
+Blowfish support
+
+### 4.1.1
+
+Fix module order in bundled release.
+
+Include the browser field in the released package.json.
+
+### 4.1.0
+
+Added url safe variant of base64 encoding. [357](https://github.com/brix/crypto-js/pull/357)
+
+Avoid webpack to add crypto-browser package. [364](https://github.com/brix/crypto-js/pull/364)
+
+### 4.0.0
+
+This is an update including breaking changes for some environments.
+
+In this version `Math.random()` has been replaced by the random methods of the native crypto module.
+
+For this reason CryptoJS might not run in some JavaScript environments without native crypto module. Such as IE 10 or before or React Native.
+
+### 3.3.0
+
+Rollback, `3.3.0` is the same as `3.1.9-1`.
+
+The move of using native secure crypto module will be shifted to a new `4.x.x` version. As it is a breaking change the impact is too big for a minor release.
+
+### 3.2.1
+
+The usage of the native crypto module has been fixed. The import and access of the native crypto module has been improved.
+
+### 3.2.0
+
+In this version `Math.random()` has been replaced by the random methods of the native crypto module.
+
+For this reason CryptoJS might does not run in some JavaScript environments without native crypto module. Such as IE 10 or before.
+
+If it's absolute required to run CryptoJS in such an environment, stay with `3.1.x` version. Encrypting and decrypting stays compatible. But keep in mind `3.1.x` versions still use `Math.random()` which is cryptographically not secure, as it's not random enough. 
+
+This version came along with `CRITICAL` `BUG`. 
+
+DO NOT USE THIS VERSION! Please, go for a newer version!
+
+### 3.1.x
+
+The `3.1.x` are based on the original CryptoJS, wrapped in CommonJS modules.
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
 
-Please refer to www.npmjs.com/advisories?search=%40brix-crypto%2Fcrypto-js for more information.

package/aes.js

@@ -0,0 +1,234 @@
+;(function (root, factory, undef) {
+	if (typeof exports === "object") {
+		// CommonJS
+		module.exports = exports = factory(require("./core"), require("./enc-base64"), require("./md5"), require("./evpkdf"), require("./cipher-core"));
+	}
+	else if (typeof define === "function" && define.amd) {
+		// AMD
+		define(["./core", "./enc-base64", "./md5", "./evpkdf", "./cipher-core"], factory);
+	}
+	else {
+		// Global (browser)
+		factory(root.CryptoJS);
+	}
+}(this, function (CryptoJS) {
+
+	(function () {
+	    // Shortcuts
+	    var C = CryptoJS;
+	    var C_lib = C.lib;
+	    var BlockCipher = C_lib.BlockCipher;
+	    var C_algo = C.algo;
+
+	    // Lookup tables
+	    var SBOX = [];
+	    var INV_SBOX = [];
+	    var SUB_MIX_0 = [];
+	    var SUB_MIX_1 = [];
+	    var SUB_MIX_2 = [];
+	    var SUB_MIX_3 = [];
+	    var INV_SUB_MIX_0 = [];
+	    var INV_SUB_MIX_1 = [];
+	    var INV_SUB_MIX_2 = [];
+	    var INV_SUB_MIX_3 = [];
+
+	    // Compute lookup tables
+	    (function () {
+	        // Compute double table
+	        var d = [];
+	        for (var i = 0; i < 256; i++) {
+	            if (i < 128) {
+	                d[i] = i << 1;
+	            } else {
+	                d[i] = (i << 1) ^ 0x11b;
+	            }
+	        }
+
+	        // Walk GF(2^8)
+	        var x = 0;
+	        var xi = 0;
+	        for (var i = 0; i < 256; i++) {
+	            // Compute sbox
+	            var sx = xi ^ (xi << 1) ^ (xi << 2) ^ (xi << 3) ^ (xi << 4);
+	            sx = (sx >>> 8) ^ (sx & 0xff) ^ 0x63;
+	            SBOX[x] = sx;
+	            INV_SBOX[sx] = x;
+
+	            // Compute multiplication
+	            var x2 = d[x];
+	            var x4 = d[x2];
+	            var x8 = d[x4];
+
+	            // Compute sub bytes, mix columns tables
+	            var t = (d[sx] * 0x101) ^ (sx * 0x1010100);
+	            SUB_MIX_0[x] = (t << 24) | (t >>> 8);
+	            SUB_MIX_1[x] = (t << 16) | (t >>> 16);
+	            SUB_MIX_2[x] = (t << 8)  | (t >>> 24);
+	            SUB_MIX_3[x] = t;
+
+	            // Compute inv sub bytes, inv mix columns tables
+	            var t = (x8 * 0x1010101) ^ (x4 * 0x10001) ^ (x2 * 0x101) ^ (x * 0x1010100);
+	            INV_SUB_MIX_0[sx] = (t << 24) | (t >>> 8);
+	            INV_SUB_MIX_1[sx] = (t << 16) | (t >>> 16);
+	            INV_SUB_MIX_2[sx] = (t << 8)  | (t >>> 24);
+	            INV_SUB_MIX_3[sx] = t;
+
+	            // Compute next counter
+	            if (!x) {
+	                x = xi = 1;
+	            } else {
+	                x = x2 ^ d[d[d[x8 ^ x2]]];
+	                xi ^= d[d[xi]];
+	            }
+	        }
+	    }());
+
+	    // Precomputed Rcon lookup
+	    var RCON = [0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36];
+
+	    /**
+	     * AES block cipher algorithm.
+	     */
+	    var AES = C_algo.AES = BlockCipher.extend({
+	        _doReset: function () {
+	            var t;
+
+	            // Skip reset of nRounds has been set before and key did not change
+	            if (this._nRounds && this._keyPriorReset === this._key) {
+	                return;
+	            }
+
+	            // Shortcuts
+	            var key = this._keyPriorReset = this._key;
+	            var keyWords = key.words;
+	            var keySize = key.sigBytes / 4;
+
+	            // Compute number of rounds
+	            var nRounds = this._nRounds = keySize + 6;
+
+	            // Compute number of key schedule rows
+	            var ksRows = (nRounds + 1) * 4;
+
+	            // Compute key schedule
+	            var keySchedule = this._keySchedule = [];
+	            for (var ksRow = 0; ksRow < ksRows; ksRow++) {
+	                if (ksRow < keySize) {
+	                    keySchedule[ksRow] = keyWords[ksRow];
+	                } else {
+	                    t = keySchedule[ksRow - 1];
+
+	                    if (!(ksRow % keySize)) {
+	                        // Rot word
+	                        t = (t << 8) | (t >>> 24);
+
+	                        // Sub word
+	                        t = (SBOX[t >>> 24] << 24) | (SBOX[(t >>> 16) & 0xff] << 16) | (SBOX[(t >>> 8) & 0xff] << 8) | SBOX[t & 0xff];
+
+	                        // Mix Rcon
+	                        t ^= RCON[(ksRow / keySize) | 0] << 24;
+	                    } else if (keySize > 6 && ksRow % keySize == 4) {
+	                        // Sub word
+	                        t = (SBOX[t >>> 24] << 24) | (SBOX[(t >>> 16) & 0xff] << 16) | (SBOX[(t >>> 8) & 0xff] << 8) | SBOX[t & 0xff];
+	                    }
+
+	                    keySchedule[ksRow] = keySchedule[ksRow - keySize] ^ t;
+	                }
+	            }
+
+	            // Compute inv key schedule
+	            var invKeySchedule = this._invKeySchedule = [];
+	            for (var invKsRow = 0; invKsRow < ksRows; invKsRow++) {
+	                var ksRow = ksRows - invKsRow;
+
+	                if (invKsRow % 4) {
+	                    var t = keySchedule[ksRow];
+	                } else {
+	                    var t = keySchedule[ksRow - 4];
+	                }
+
+	                if (invKsRow < 4 || ksRow <= 4) {
+	                    invKeySchedule[invKsRow] = t;
+	                } else {
+	                    invKeySchedule[invKsRow] = INV_SUB_MIX_0[SBOX[t >>> 24]] ^ INV_SUB_MIX_1[SBOX[(t >>> 16) & 0xff]] ^
+	                                               INV_SUB_MIX_2[SBOX[(t >>> 8) & 0xff]] ^ INV_SUB_MIX_3[SBOX[t & 0xff]];
+	                }
+	            }
+	        },
+
+	        encryptBlock: function (M, offset) {
+	            this._doCryptBlock(M, offset, this._keySchedule, SUB_MIX_0, SUB_MIX_1, SUB_MIX_2, SUB_MIX_3, SBOX);
+	        },
+
+	        decryptBlock: function (M, offset) {
+	            // Swap 2nd and 4th rows
+	            var t = M[offset + 1];
+	            M[offset + 1] = M[offset + 3];
+	            M[offset + 3] = t;
+
+	            this._doCryptBlock(M, offset, this._invKeySchedule, INV_SUB_MIX_0, INV_SUB_MIX_1, INV_SUB_MIX_2, INV_SUB_MIX_3, INV_SBOX);
+
+	            // Inv swap 2nd and 4th rows
+	            var t = M[offset + 1];
+	            M[offset + 1] = M[offset + 3];
+	            M[offset + 3] = t;
+	        },
+
+	        _doCryptBlock: function (M, offset, keySchedule, SUB_MIX_0, SUB_MIX_1, SUB_MIX_2, SUB_MIX_3, SBOX) {
+	            // Shortcut
+	            var nRounds = this._nRounds;
+
+	            // Get input, add round key
+	            var s0 = M[offset]     ^ keySchedule[0];
+	            var s1 = M[offset + 1] ^ keySchedule[1];
+	            var s2 = M[offset + 2] ^ keySchedule[2];
+	            var s3 = M[offset + 3] ^ keySchedule[3];
+
+	            // Key schedule row counter
+	            var ksRow = 4;
+
+	            // Rounds
+	            for (var round = 1; round < nRounds; round++) {
+	                // Shift rows, sub bytes, mix columns, add round key
+	                var t0 = SUB_MIX_0[s0 >>> 24] ^ SUB_MIX_1[(s1 >>> 16) & 0xff] ^ SUB_MIX_2[(s2 >>> 8) & 0xff] ^ SUB_MIX_3[s3 & 0xff] ^ keySchedule[ksRow++];
+	                var t1 = SUB_MIX_0[s1 >>> 24] ^ SUB_MIX_1[(s2 >>> 16) & 0xff] ^ SUB_MIX_2[(s3 >>> 8) & 0xff] ^ SUB_MIX_3[s0 & 0xff] ^ keySchedule[ksRow++];
+	                var t2 = SUB_MIX_0[s2 >>> 24] ^ SUB_MIX_1[(s3 >>> 16) & 0xff] ^ SUB_MIX_2[(s0 >>> 8) & 0xff] ^ SUB_MIX_3[s1 & 0xff] ^ keySchedule[ksRow++];
+	                var t3 = SUB_MIX_0[s3 >>> 24] ^ SUB_MIX_1[(s0 >>> 16) & 0xff] ^ SUB_MIX_2[(s1 >>> 8) & 0xff] ^ SUB_MIX_3[s2 & 0xff] ^ keySchedule[ksRow++];
+
+	                // Update state
+	                s0 = t0;
+	                s1 = t1;
+	                s2 = t2;
+	                s3 = t3;
+	            }
+
+	            // Shift rows, sub bytes, add round key
+	            var t0 = ((SBOX[s0 >>> 24] << 24) | (SBOX[(s1 >>> 16) & 0xff] << 16) | (SBOX[(s2 >>> 8) & 0xff] << 8) | SBOX[s3 & 0xff]) ^ keySchedule[ksRow++];
+	            var t1 = ((SBOX[s1 >>> 24] << 24) | (SBOX[(s2 >>> 16) & 0xff] << 16) | (SBOX[(s3 >>> 8) & 0xff] << 8) | SBOX[s0 & 0xff]) ^ keySchedule[ksRow++];
+	            var t2 = ((SBOX[s2 >>> 24] << 24) | (SBOX[(s3 >>> 16) & 0xff] << 16) | (SBOX[(s0 >>> 8) & 0xff] << 8) | SBOX[s1 & 0xff]) ^ keySchedule[ksRow++];
+	            var t3 = ((SBOX[s3 >>> 24] << 24) | (SBOX[(s0 >>> 16) & 0xff] << 16) | (SBOX[(s1 >>> 8) & 0xff] << 8) | SBOX[s2 & 0xff]) ^ keySchedule[ksRow++];
+
+	            // Set output
+	            M[offset]     = t0;
+	            M[offset + 1] = t1;
+	            M[offset + 2] = t2;
+	            M[offset + 3] = t3;
+	        },
+
+	        keySize: 256/32
+	    });
+
+	    /**
+	     * Shortcut functions to the cipher's object interface.
+	     *
+	     * @example
+	     *
+	     *     var ciphertext = CryptoJS.AES.encrypt(message, key, cfg);
+	     *     var plaintext  = CryptoJS.AES.decrypt(ciphertext, key, cfg);
+	     */
+	    C.AES = BlockCipher._createHelper(AES);
+	}());
+
+
+	return CryptoJS.AES;
+
+}));