@majikah/majik-key 0.1.2 → 0.1.4

package/README.md

@@ -98,7 +98,7 @@ Every identity now generates a dual-key system derived deterministically from a
 
 ### 2. Argon2id Key Derivation
 We have transitioned to **Argon2id** (KDF v2) for encrypting private keys at rest.
-* **Memory-Hard:** Configured with 128 MB of memory, 4 iterations, and 4 parallelism factors.
+* **Memory-Hard:** Configured with 64 MB of memory, 3 iterations, and 4 parallelism factors.
 * **Brute-Force Resistant:** Engineered to defeat GPU and ASIC-based cracking attempts that easily bypass older PBKDF2 implementations.
 
 ### 3. Seamless Auto-Migration
@@ -137,7 +137,7 @@ A Majik Key is a seed phrase account that:
 
 ### Security & Post-Quantum Readiness
 - **Post-Quantum Ready**: Implements **ML-KEM-768 (FIPS-203)** for key encapsulation, ensuring identities are secure against future quantum computing threats.
-- **Argon2id Key Derivation**: Uses memory-hard **Argon2id** (KDF v2) for passphrase encryption (128 MB / 4 iterations / 4 parallelism), providing industry-leading resistance to GPU/ASIC brute-force attacks.
+- **Argon2id Key Derivation**: Uses memory-hard **Argon2id** (KDF v2) for passphrase encryption (64 MB / 3 iterations / 4 parallelism), providing industry-leading resistance to GPU/ASIC brute-force attacks.
 - **Seamless Auto-Migration**: Automatically detects and upgrades legacy v1 (PBKDF2) accounts to v2 (Argon2id) during import, re-deriving missing ML-KEM keys deterministically from the seed.
 - **AES-GCM Authenticated Encryption**: Industry-standard encryption for private keys at rest with unique, per-identity salts and random IVs.
 - **Locked/Unlocked States**: Private keys are only decrypted into memory when explicitly unlocked and are purged immediately upon calling `.lock()`.
@@ -833,7 +833,7 @@ async function createMessageIdentity() {
 3. **PQ Readiness**: For all new communication protocols, ensure you are utilizing the mlKemPublicKey.
 
 Security Summary
-- **Primary KDF**: Argon2id (128MB / 4t / 4p).
+- **Primary KDF**: Argon2id (64 / 3t / 4p).
 
 - **Legacy KDF**: PBKDF2-SHA256 (250,000 iterations).
 
@@ -893,7 +893,7 @@ Secure messaging platform using Majik Keys
 
 [Read more about Majik Message here](https://majikah.solutions/products/majik-message)
 
-[![Majik Message Thumbnail](https://gydzizwxtftlmsdaiouw.supabase.co/storage/v1/object/public/bucket-majikah-public/main/Majikah_MajikMessage_SocialCard.webp)](https://message.majikah.solutions)
+[![Majik Message Thumbnail](https://github.com/user-attachments/assets/d433c6b8-1841-4fa1-a6da-b348029d1dbe)](https://message.majikah.solutions)
 
 > Click the image to try Majik Message live.
 

package/dist/core/crypto/constants.d.ts

@@ -41,8 +41,8 @@ export type KDF_VERSION = (typeof KDF_VERSION)[keyof typeof KDF_VERSION];
  */
 export declare const ARGON2_PARAMS: {
     readonly PASSPHRASE: {
-        readonly m: 131072;
-        readonly t: 4;
+        readonly m: 65536;
+        readonly t: 3;
         readonly p: 4;
         readonly dkLen: 32;
     };

package/dist/core/crypto/constants.js

@@ -37,8 +37,8 @@ export const KDF_VERSION = {
  */
 export const ARGON2_PARAMS = {
     PASSPHRASE: {
-        m: 131072, // memory in KB (128 MB)
-        t: 4, // time cost (passes)
+        m: 65536, // memory in KB (128 MB)
+        t: 3, // time cost (passes)
         p: 4, // parallelism (lanes)
         dkLen: 32, // output length in bytes (256-bit AES key)
     },

package/dist/core/crypto/encryption-engine.d.ts

@@ -6,7 +6,7 @@ export interface EncryptionIdentity {
         raw: Uint8Array;
     };
     fingerprint: string;
-    mlKemPublicKey?: Uint8Array;
+    mlKemPublicKey: Uint8Array;
     mlKemSecretKey?: Uint8Array;
 }
 /**
@@ -15,12 +15,6 @@ export interface EncryptionIdentity {
  * Core cryptographic engine.
  */
 export declare class EncryptionEngine {
-    /**
-     * Generates a random long-term identity keypair (X25519 only).
-     * ML-KEM keys are not generated here since random identities
-     * cannot be deterministically recovered from a mnemonic.
-     */
-    static generateIdentity(): Promise<EncryptionIdentity>;
     /**
      * Derive a complete identity from a BIP-39 mnemonic.
      *

package/dist/core/crypto/encryption-engine.js

@@ -11,33 +11,29 @@ export class EncryptionEngine {
     /* ================================
      * Identity
      * ================================ */
-    /* ================================
-     * Identity
-     * ================================ */
-    /**
-     * Generates a random long-term identity keypair (X25519 only).
-     * ML-KEM keys are not generated here since random identities
-     * cannot be deterministically recovered from a mnemonic.
-     */
-    static async generateIdentity() {
-        try {
-            const ed = ed25519.generateKeyPair();
-            const skCurve = ed2curve.convertSecretKey(ed.secretKey);
-            const pkCurve = ed2curve.convertPublicKey(ed.publicKey);
-            if (!skCurve || !pkCurve) {
-                throw new CryptoError("Failed to convert Ed25519 keys to Curve25519");
-            }
-            const pkBytes = new Uint8Array(pkCurve);
-            const skBytes = new Uint8Array(skCurve);
-            const publicKey = { type: "public", raw: pkBytes };
-            const privateKey = { type: "private", raw: skBytes };
-            const fingerprint = fingerprintFromPublicRaw(pkBytes);
-            return { publicKey, privateKey, fingerprint };
-        }
-        catch (err) {
-            throw new CryptoError("Failed to generate identity", err);
-        }
-    }
+    // /**
+    //  * Generates a random long-term identity keypair (X25519 only).
+    //  * ML-KEM keys are not generated here since random identities
+    //  * cannot be deterministically recovered from a mnemonic.
+    //  */
+    // static async generateIdentity(): Promise<EncryptionIdentity> {
+    //   try {
+    //     const ed = ed25519.generateKeyPair();
+    //     const skCurve = ed2curve.convertSecretKey(ed.secretKey);
+    //     const pkCurve = ed2curve.convertPublicKey(ed.publicKey);
+    //     if (!skCurve || !pkCurve) {
+    //       throw new CryptoError("Failed to convert Ed25519 keys to Curve25519");
+    //     }
+    //     const pkBytes = new Uint8Array(pkCurve as Uint8Array);
+    //     const skBytes = new Uint8Array(skCurve as Uint8Array);
+    //     const publicKey = { type: "public", raw: pkBytes } as any;
+    //     const privateKey = { type: "private", raw: skBytes } as any;
+    //     const fingerprint = fingerprintFromPublicRaw(pkBytes);
+    //     return { publicKey, privateKey, fingerprint };
+    //   } catch (err) {
+    //     throw new CryptoError("Failed to generate identity", err);
+    //   }
+    // }
     /**
      * Derive a complete identity from a BIP-39 mnemonic.
      *

package/dist/core/database/system/identity.d.ts

@@ -4,11 +4,11 @@ export interface MajikMessageIdentityJSON {
     id: string;
     user_id: string;
     public_key: string;
+    ml_key: string;
     phash: string;
     label: string;
     timestamp: string;
     restricted: boolean;
-    kdfVersion?: number;
 }
 /**
  * MajikMessageIdentity
@@ -18,6 +18,7 @@ export declare class MajikMessageIdentity {
     private readonly _id;
     private readonly _userId;
     private readonly _publicKey;
+    private readonly _mlKey;
     private readonly _phash;
     private _label;
     private readonly _timestamp;

package/dist/core/database/system/identity.js

@@ -27,6 +27,7 @@ export class MajikMessageIdentity {
     _id;
     _userId;
     _publicKey;
+    _mlKey;
     _phash;
     _label;
     _timestamp;
@@ -38,6 +39,7 @@ export class MajikMessageIdentity {
         assertString(params.id, "id");
         assertString(params.userId, "user_id");
         assertString(params.publicKey, "public_key");
+        assertString(params.mlKey, "ml_key");
         assertString(params.phash, "phash");
         assertString(params.label, "label");
         assertISODate(params.timestamp, "timestamp");
@@ -45,6 +47,7 @@ export class MajikMessageIdentity {
         this._id = params.id;
         this._userId = params.userId;
         this._publicKey = params.publicKey;
+        this._mlKey = params.mlKey;
         this._phash = params.phash;
         this._label = params.label;
         this._timestamp = params.timestamp;
@@ -68,11 +71,12 @@ export class MajikMessageIdentity {
         assertString(label, "label");
         const timestamp = new Date().toISOString();
         const publicKey = account.publicKeyBase64;
-        const phash = sha256(`${user.id}:${publicKey}:${account.id}`);
+        const phash = sha256(`${user.id}:${publicKey}:${account.id}:${account.mlKey}`);
         return new MajikMessageIdentity({
             id: account.id,
             userId: user.id,
             publicKey: publicKey,
+            mlKey: account.mlKey,
             phash,
             label,
             timestamp,
@@ -127,7 +131,7 @@ export class MajikMessageIdentity {
      * Detects tampering of id/public_key
      */
     validateIntegrity() {
-        const expected = sha256(`${this._userId}:${this._publicKey}:${this._id}`);
+        const expected = sha256(`${this._userId}:${this._publicKey}:${this._id}:${this._mlKey}`);
         return expected === this._phash;
     }
     /**
@@ -136,7 +140,7 @@ export class MajikMessageIdentity {
     matches(userId, publicKey) {
         assertString(userId, "userId");
         assertString(publicKey, "publicKey");
-        const hash = sha256(`${userId}:${publicKey}:${this._id}`);
+        const hash = sha256(`${userId}:${publicKey}:${this._id}:${this._mlKey}`);
         return hash === this._phash;
     }
     // ─────────────────────────────
@@ -147,6 +151,7 @@ export class MajikMessageIdentity {
             id: this._id,
             user_id: this._userId,
             public_key: this._publicKey,
+            ml_key: this._mlKey,
             phash: this._phash,
             label: this._label,
             timestamp: this._timestamp,
@@ -160,6 +165,7 @@ export class MajikMessageIdentity {
             id: obj.id,
             userId: obj.user_id,
             publicKey: obj.public_key,
+            mlKey: obj.ml_key,
             phash: obj.phash,
             label: obj.label,
             timestamp: obj.timestamp,

package/dist/core/majik-contact.d.ts

@@ -2,6 +2,7 @@ import { MajikMessageIdentityJSON } from "./database/system/identity";
 import { ISODateString } from "./types";
 export type SerializedMajikContact = Omit<MajikContactData, "publicKey"> & {
     publicKeyBase64: string;
+    mlKey: string;
 };
 export interface MajikContactMeta {
     label?: string;
@@ -16,6 +17,7 @@ export interface MajikContactData {
         raw: Uint8Array;
     };
     fingerprint: string;
+    mlKey: string;
     meta?: MajikContactMeta;
     majikah_registered?: boolean;
 }
@@ -24,6 +26,7 @@ export interface MajikContactCard {
     publicKey: string;
     fingerprint: string;
     label: string;
+    mlKey: string;
 }
 export declare class MajikContactError extends Error {
     cause?: unknown;
@@ -35,12 +38,13 @@ export declare class MajikContact {
         raw: Uint8Array;
     };
     readonly fingerprint: string;
+    readonly mlKey: string;
     meta: MajikContactMeta;
     private majikah_registered?;
     constructor(data: MajikContactData);
     static create(id: string, publicKey: CryptoKey | {
         raw: Uint8Array;
-    }, fingerprint: string, meta?: Partial<MajikContactMeta>): MajikContact;
+    }, mlKey: string, fingerprint: string, meta?: Partial<MajikContactMeta>): MajikContact;
     private assertId;
     private assertPublicKey;
     private assertFingerprint;

package/dist/core/majik-contact.js

@@ -1,6 +1,3 @@
-/* -------------------------------
- * Types
- * ------------------------------- */
 import { arrayBufferToBase64, base64ToArrayBuffer } from "./utils";
 /* -------------------------------
  * Errors
@@ -20,6 +17,7 @@ export class MajikContact {
     id;
     publicKey;
     fingerprint;
+    mlKey;
     meta;
     majikah_registered;
     constructor(data) {
@@ -29,6 +27,7 @@ export class MajikContact {
         this.id = data.id;
         this.publicKey = data.publicKey;
         this.fingerprint = data.fingerprint;
+        this.mlKey = data.mlKey;
         this.meta = {
             label: data.meta?.label || "",
             notes: data.meta?.notes || "",
@@ -37,12 +36,13 @@ export class MajikContact {
             updatedAt: data.meta?.updatedAt || new Date().toISOString(),
         };
     }
-    static create(id, publicKey, fingerprint, meta) {
+    static create(id, publicKey, mlKey, fingerprint, meta) {
         return new MajikContact({
             id,
             publicKey,
             fingerprint,
             meta,
+            mlKey,
         });
     }
     assertId(id) {
@@ -145,6 +145,7 @@ export class MajikContact {
             meta: { ...this.meta },
             publicKeyBase64: await this.getPublicKeyBase64(),
             majikah_registered: this.majikah_registered,
+            mlKey: this.mlKey,
         };
     }
     /**
@@ -159,6 +160,7 @@ export class MajikContact {
                 meta: serialized.meta,
                 publicKey: { raw: publicKeyRaw },
                 majikah_registered: serialized.majikah_registered,
+                mlKey: serialized.mlKey,
             });
         }
         catch (err) {
@@ -182,6 +184,7 @@ export class MajikContact {
                     blocked: identityJSON.restricted,
                 },
                 majikah_registered: true,
+                mlKey: identityJSON.ml_key,
             };
             return new MajikContact(contactData);
         }

package/dist/majik-key.d.ts

@@ -38,7 +38,7 @@ export interface MajikKeyIdentity {
     encryptedPrivateKey: ArrayBuffer;
     salt: string;
     kdfVersion: KDF_VERSION;
-    mlKemPublicKey?: Uint8Array;
+    mlKemPublicKey: Uint8Array;
     mlKemSecretKey?: Uint8Array;
 }
 export interface SerializedIdentity {
@@ -62,7 +62,7 @@ export interface MajikKeyConstructorOptions {
     label?: string;
     timestamp?: Date;
     kdfVersion?: KDF_VERSION;
-    mlKemPublicKey?: Uint8Array;
+    mlKemPublicKey: Uint8Array;
     mlKemSecretKey?: Uint8Array;
     encryptedMlKemSecretKey?: ArrayBuffer;
     encryptedMlKemSecretKeyBase64?: string;
@@ -83,7 +83,7 @@ export declare class MajikKey {
     private _salt;
     private _label;
     private _kdfVersion;
-    private _mlKemPublicKey?;
+    private _mlKemPublicKey;
     private _mlKemSecretKey?;
     private _encryptedMlKemSecretKey?;
     private _encryptedMlKemSecretKeyBase64?;

package/dist/majik-key.js

@@ -25,7 +25,7 @@ import { generateMnemonic } from "@scure/bip39";
 import { aesGcmDecrypt, aesGcmEncrypt, deriveKeyFromPassphraseArgon2, deriveKeyFromMnemonicArgon2, deriveKeyFromPassphrase, generateRandomBytes, IV_LENGTH, } from "./core/crypto/crypto-provider";
 import { EncryptionEngine } from "./core/crypto/encryption-engine";
 import { MajikContact } from "./core/majik-contact";
-import { arrayBufferToBase64, arrayToBase64, base64ToArrayBuffer, concatUint8Arrays, utf8ToBase64, base64ToUtf8, seedStringToArray, seedArrayToString, } from "./core/utils";
+import { arrayBufferToBase64, arrayToBase64, base64ToArrayBuffer, concatUint8Arrays, utf8ToBase64, base64ToUtf8, seedStringToArray, seedArrayToString, base64ToUint8Array, } from "./core/utils";
 import { wordlist } from "@scure/bip39/wordlists/english";
 import { KDF_VERSION, KEY_ALGO, MAJIK_MNEMONIC_SALT, } from "./core/crypto/constants";
 import { MajikKeyValidator } from "./core/validator";
@@ -171,10 +171,7 @@ export class MajikKey {
             const anyParsed = parsed;
             const publicKeyBuffer = base64ToArrayBuffer(validated.publicKey);
             const encryptedPrivateKeyBuffer = base64ToArrayBuffer(validated.encryptedPrivateKey);
-            let mlKemPublicKey;
-            if (anyParsed.mlKemPublicKey) {
-                mlKemPublicKey = new Uint8Array(base64ToArrayBuffer(anyParsed.mlKemPublicKey));
-            }
+            const mlKemPublicKey = base64ToUint8Array(anyParsed.mlKemPublicKey);
             let encryptedMlKemSecretKey;
             let encryptedMlKemSecretKeyBase64;
             if (anyParsed.encryptedMlKemSecretKey) {
@@ -397,11 +394,13 @@ export class MajikKey {
         }
     }
     toContact() {
+        const mlKeyBase64 = arrayToBase64(this._mlKemPublicKey);
         return new MajikContact({
             id: this._id,
             publicKey: this._publicKey,
             fingerprint: this._fingerprint,
             meta: { label: this._label },
+            mlKey: mlKeyBase64,
         });
     }
     toKeyIdentity() {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-key",
   "type": "module",
   "description": "A post-quantum ready seed phrase account library for the Majikah ecosystem. Manages deterministic X25519 and ML-KEM-768 identities with Argon2id protection and seamless legacy account migration.",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",