@learncard/sss-key-manager 0.1.13 → 0.1.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -17
- package/dist/sss-key-manager.cjs.development.js +4497 -2517
- package/dist/sss-key-manager.cjs.development.js.map +3 -3
- package/dist/sss-key-manager.cjs.production.min.js +56 -14
- package/dist/sss-key-manager.cjs.production.min.js.map +3 -3
- package/dist/sss-key-manager.esm.js +4497 -2517
- package/dist/sss-key-manager.esm.js.map +3 -3
- package/package.json +62 -52
- package/src/api-client.ts +257 -0
- package/src/atomic-operations.test.ts +327 -0
- package/src/atomic-operations.ts +275 -0
- package/src/auth-coordinator.test.ts +13 -0
- package/src/auth-coordinator.ts +12 -0
- package/src/critical-paths.test.ts +380 -0
- package/src/crypto.test.ts +214 -0
- package/src/crypto.ts +203 -0
- package/src/index.ts +146 -0
- package/src/key-manager.test.ts +330 -0
- package/src/key-manager.ts +323 -0
- package/src/passkey.test.ts +59 -0
- package/src/passkey.ts +222 -0
- package/src/qr-crypto.test.ts +122 -0
- package/src/qr-crypto.ts +206 -0
- package/src/qr-login-notify.test.ts +95 -0
- package/src/qr-login.test.ts +548 -0
- package/src/qr-login.ts +339 -0
- package/src/recovery-phrase.test.ts +287 -0
- package/src/recovery-phrase.ts +131 -0
- package/src/sss-strategy.test.ts +1956 -0
- package/src/sss-strategy.ts +1119 -0
- package/src/sss.test.ts +242 -0
- package/src/sss.ts +49 -0
- package/src/storage.test.ts +530 -0
- package/src/storage.ts +467 -0
- package/src/types.ts +200 -0
- package/LICENSE +0 -21
package/README.md
CHANGED
|
@@ -8,19 +8,19 @@ This package provides a secure, self-hosted alternative to Web3Auth Single Facto
|
|
|
8
8
|
|
|
9
9
|
## Features
|
|
10
10
|
|
|
11
|
-
-
|
|
12
|
-
-
|
|
13
|
-
-
|
|
14
|
-
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
-
|
|
11
|
+
- **Key Splitting**: Split ed25519 private keys into 3 shares with 2-of-3 threshold
|
|
12
|
+
- **Device Storage**: Encrypted local storage using AES-GCM with IndexedDB
|
|
13
|
+
- **Server Storage**: Encrypted auth share stored on server with envelope encryption
|
|
14
|
+
- **Recovery Methods**:
|
|
15
|
+
- Password-based (Argon2id KDF)
|
|
16
|
+
- Passkey/WebAuthn PRF (coming soon)
|
|
17
|
+
- Backup file export/import
|
|
18
|
+
- **Migration**: Seamless migration from Web3Auth SFA
|
|
19
19
|
|
|
20
20
|
## Installation
|
|
21
21
|
|
|
22
22
|
```bash
|
|
23
|
-
|
|
23
|
+
bun add @learncard/sss-key-manager
|
|
24
24
|
```
|
|
25
25
|
|
|
26
26
|
## Usage
|
|
@@ -115,19 +115,19 @@ const privateKey = await keyManager.recover({
|
|
|
115
115
|
|
|
116
116
|
## Security Model
|
|
117
117
|
|
|
118
|
-
-
|
|
119
|
-
-
|
|
120
|
-
-
|
|
121
|
-
-
|
|
118
|
+
- **Device Share**: Encrypted with non-extractable AES-GCM key stored in IndexedDB
|
|
119
|
+
- **Auth Share**: Server-side envelope encryption (DEK + KMS-encrypted DEK)
|
|
120
|
+
- **Recovery Share**: Password-based uses Argon2id KDF with secure parameters
|
|
121
|
+
- **Threshold**: Any 2 of 3 shares can reconstruct the key
|
|
122
122
|
|
|
123
123
|
## Auth Provider Support
|
|
124
124
|
|
|
125
125
|
The package is designed to work with any authentication provider:
|
|
126
126
|
|
|
127
|
-
-
|
|
128
|
-
-
|
|
129
|
-
-
|
|
130
|
-
-
|
|
127
|
+
- Firebase Authentication (default for production)
|
|
128
|
+
- SuperTokens (recommended for self-hosting/local dev)
|
|
129
|
+
- Keycloak (enterprise SSO)
|
|
130
|
+
- Any OIDC-compliant provider
|
|
131
131
|
|
|
132
132
|
## API Reference
|
|
133
133
|
|