@did-btcr2/cli 0.25.2 → 0.27.0

package/src/keystore/envelope.ts

@@ -1,7 +1,7 @@
 import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
-import { argon2id } from '@noble/hashes/argon2.js';
 import { randomBytes, utf8ToBytes } from '@noble/hashes/utils.js';
 import { base64urlnopad } from '@scure/base';
+import { argon2Sync } from 'node:crypto';
 import { KeyStoreError } from './error.js';
 
 /** Current keystore secret-envelope format version. */
@@ -81,6 +81,22 @@ function headerAad(header: EnvelopeHeader): Uint8Array {
   return utf8ToBytes(JSON.stringify(header));
 }
 
+/**
+ * Runs argon2id over a password with the native argon2 of Node.js (ADR 126).
+ * The output is the same as the output of `argon2id` from `@noble/hashes`, which
+ * sealed the envelopes of cli 0.25 and earlier. A test holds the two equal.
+ */
+export function argon2idKey(password: Uint8Array, salt: Uint8Array, params: ArgonParams): Uint8Array {
+  return argon2Sync('argon2id', {
+    message     : password,
+    nonce       : salt,
+    parallelism : params.p,
+    tagLength   : params.dkLen,
+    memory      : params.m,
+    passes      : params.t,
+  });
+}
+
 /**
  * Stretches a passphrase into the symmetric key. The transient UTF-8 copy of
  * the passphrase is zeroized here; the caller is responsible for zeroizing the
@@ -89,7 +105,7 @@ function headerAad(header: EnvelopeHeader): Uint8Array {
 function deriveKey(passphrase: string, salt: Uint8Array, params: ArgonParams): Uint8Array {
   const password = utf8ToBytes(passphrase);
   try {
-    return argon2id(password, salt, { t: params.t, m: params.m, p: params.p, dkLen: params.dkLen });
+    return argon2idKey(password, salt, params);
   } finally {
     password.fill(0);
   }

package/src/keystore/file-key-store.ts

@@ -456,8 +456,7 @@ export class FileKeyStore implements KeyValueStore<KeyIdentifier, KeyEntry> {
         } else if (this.#verifier !== undefined && passphrase !== undefined) {
           // A verifier exists: it pre-existed, was established concurrently while we
           // sealed, or was rotated by a concurrent change-passphrase. If it was
-          // rotated out from under our seal, abort with a clear message; otherwise
-          // assert our passphrase still opens it before persisting the key.
+          // rotated out from under our seal, abort with a clear message.
           if (verifierAtSeal !== undefined && !sameEnvelope(this.#verifier, verifierAtSeal)) {
             throw new KeyStoreError(
               `The keystore passphrase at ${this.#path} changed concurrently; re-run the command.`,
@@ -465,7 +464,11 @@ export class FileKeyStore implements KeyValueStore<KeyIdentifier, KeyEntry> {
               { path: this.#path },
             );
           }
-          this.#assertPassphrase(passphrase);
+          // #sealPassphrase already checked the passphrase against verifierAtSeal,
+          // and the verifier on disk is the same envelope. A second argon2id call
+          // in the lock gives the same result, so only a verifier from a concurrent
+          // establishment gets a check here (ADR 126).
+          if (verifierAtSeal === undefined) this.#assertPassphrase(passphrase);
         }
       }
       this.#cache.set(id, {

package/src/types.ts

@@ -146,5 +146,4 @@ export interface GlobalOptions {
   btcSignalDiscovery? : string;
   keystore?           : string;
   passphraseFile?     : string;
-  signingKey?         : string;
 }