@majikah/majik-key 0.1.8 → 0.1.9

package/README.md

@@ -926,7 +926,7 @@ Made with 💙 by [@thezelijah](https://github.com/jedlsf)
 
 - **Developer**: Josef Elijah Fabian
 - **GitHub**: [https://github.com/jedlsf](https://github.com/jedlsf)
-- **Project Repository**: [https://github.com/jedlsf/majik-key](https://github.com/jedlsf/majik-key)
+- **Project Repository**: [https://github.com/Majikah/majik-key](https://github.com/Majikah/majik-key)
 
 ---
 

package/dist/core/crypto/crypto-provider.d.ts

@@ -17,27 +17,22 @@ export declare function aesGcmEncrypt(keyBytes: Uint8Array, iv: Uint8Array, plai
 export declare function aesGcmDecrypt(keyBytes: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array): Uint8Array | null;
 /**
  * Derive a 32-byte AES key from a user passphrase using Argon2id.
- *
- * Use this for all NEW account creation and any re-encryption operations.
- * Works in browser, Node.js, Electron, and Chrome Extension environments.
+ * WASM-accelerated via hash-wasm when available, falls back to @noble/hashes.
  *
  * @param passphrase - The user's passphrase (plaintext string)
  * @param salt       - Per-identity random salt (32 bytes recommended)
  * @returns          - 32-byte key suitable for AES-256-GCM
  */
-export declare function deriveKeyFromPassphraseArgon2(passphrase: string, salt: Uint8Array): Uint8Array;
+export declare function deriveKeyFromPassphraseArgon2(passphrase: string, salt: Uint8Array): Promise<Uint8Array>;
 /**
  * Derive a 32-byte AES key from a BIP-39 mnemonic using Argon2id.
- *
- * Used for encrypting and decrypting mnemonic backup exports.
- * Lower memory parameters than the passphrase KDF because the mnemonic
- * itself provides 128-bit entropy — brute-force is infeasible regardless.
+ * WASM-accelerated via hash-wasm when available, falls back to @noble/hashes.
  *
  * @param mnemonic - The 12-word BIP-39 mnemonic (plaintext string)
  * @param salt     - Domain-separator salt (can be a fixed constant)
  * @returns        - 32-byte key suitable for AES-256-GCM
  */
-export declare function deriveKeyFromMnemonicArgon2(mnemonic: string, salt: Uint8Array): Uint8Array;
+export declare function deriveKeyFromMnemonicArgon2(mnemonic: string, salt: Uint8Array): Promise<Uint8Array>;
 /**
  * @deprecated KDF v1. Kept for reading existing accounts created before the
  * Argon2id migration. Do NOT use this for new key derivation or re-encryption.

package/dist/core/crypto/crypto-provider.js

@@ -1,3 +1,4 @@
+// crypto-provider.ts from @majikah/majik-key
 import * as ed25519 from "@stablelib/ed25519";
 import ed2curve from "ed2curve";
 import { AES } from "@stablelib/aes";
@@ -6,7 +7,7 @@ import { deriveKey } from "@stablelib/pbkdf2";
 import { hash, SHA256 } from "@stablelib/sha256";
 import * as x25519 from "@stablelib/x25519";
 import { arrayToBase64 } from "../utils";
-import { argon2id } from "@noble/hashes/argon2.js";
+import { argon2id as nobleArgon2id } from "@noble/hashes/argon2.js";
 import { ARGON2_PARAMS } from "./constants";
 import { ml_kem768 } from "@noble/post-quantum/ml-kem.js";
 export const IV_LENGTH = 12;
@@ -51,35 +52,97 @@ export function aesGcmDecrypt(keyBytes, iv, ciphertext) {
     const gcm = new GCM(aes);
     return gcm.open(iv, ciphertext);
 }
+// ─── WASM-first Argon2id with @noble/hashes fallback ─────────────────────────
+/**
+ * null  = not yet probed
+ * true  = hash-wasm loaded and verified
+ * false = hash-wasm unavailable or broken — use noble fallback
+ */
+let _wasmAvailable = null;
+async function _probeWasm() {
+    try {
+        const { argon2id } = await import("hash-wasm");
+        // Cheap smoke-test: tiny params, just proves the WASM module loads & runs
+        await argon2id({
+            password: new Uint8Array(4),
+            salt: new Uint8Array(8),
+            memorySize: 8,
+            iterations: 1,
+            parallelism: 1,
+            hashLength: 4,
+            outputType: "binary",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function _argon2idWasm(input, salt, params) {
+    const { argon2id } = await import("hash-wasm");
+    return argon2id({
+        password: input,
+        salt,
+        memorySize: params.m, // KB — same unit as noble's m ✓
+        iterations: params.t, // hash-wasm calls it iterations, not t
+        parallelism: params.p, // hash-wasm calls it parallelism, not p
+        hashLength: params.dkLen, // hash-wasm calls it hashLength, not dkLen
+        outputType: "binary",
+    });
+}
+function _argon2idNoble(input, salt, params) {
+    return nobleArgon2id(input, salt, params);
+}
+/**
+ * Internal: WASM-first argon2id with automatic noble fallback.
+ * Probes WASM once per session and caches the result.
+ * Falls back silently on any failure — output is always identical.
+ */
+async function _argon2id(input, salt, params) {
+    // First call: probe WASM availability
+    if (_wasmAvailable === null) {
+        _wasmAvailable = await _probeWasm();
+        if (!_wasmAvailable) {
+            console.warn("[majikah/crypto] hash-wasm unavailable, using @noble/hashes argon2id fallback");
+        }
+    }
+    if (_wasmAvailable) {
+        try {
+            return await _argon2idWasm(input, salt, params);
+        }
+        catch (err) {
+            // WASM loaded but failed at runtime (e.g. OOM, corrupted module)
+            // Flip flag so we stop trying for the rest of this session
+            _wasmAvailable = false;
+            console.warn("[majikah/crypto] hash-wasm runtime failure, falling back to @noble/hashes", err);
+        }
+    }
+    return _argon2idNoble(input, salt, params);
+}
 // ─── KDF v2: Argon2id (current) ───────────────────────────────────────────────
 /**
  * Derive a 32-byte AES key from a user passphrase using Argon2id.
- *
- * Use this for all NEW account creation and any re-encryption operations.
- * Works in browser, Node.js, Electron, and Chrome Extension environments.
+ * WASM-accelerated via hash-wasm when available, falls back to @noble/hashes.
  *
  * @param passphrase - The user's passphrase (plaintext string)
  * @param salt       - Per-identity random salt (32 bytes recommended)
  * @returns          - 32-byte key suitable for AES-256-GCM
  */
-export function deriveKeyFromPassphraseArgon2(passphrase, salt) {
+export async function deriveKeyFromPassphraseArgon2(passphrase, salt) {
     const pw = new TextEncoder().encode(passphrase);
-    return argon2id(pw, salt, ARGON2_PARAMS.PASSPHRASE);
+    return _argon2id(pw, salt, ARGON2_PARAMS.PASSPHRASE);
 }
 /**
  * Derive a 32-byte AES key from a BIP-39 mnemonic using Argon2id.
- *
- * Used for encrypting and decrypting mnemonic backup exports.
- * Lower memory parameters than the passphrase KDF because the mnemonic
- * itself provides 128-bit entropy — brute-force is infeasible regardless.
+ * WASM-accelerated via hash-wasm when available, falls back to @noble/hashes.
  *
  * @param mnemonic - The 12-word BIP-39 mnemonic (plaintext string)
  * @param salt     - Domain-separator salt (can be a fixed constant)
  * @returns        - 32-byte key suitable for AES-256-GCM
  */
-export function deriveKeyFromMnemonicArgon2(mnemonic, salt) {
+export async function deriveKeyFromMnemonicArgon2(mnemonic, salt) {
     const m = new TextEncoder().encode(mnemonic);
-    return argon2id(m, salt, ARGON2_PARAMS.MNEMONIC);
+    return _argon2id(m, salt, ARGON2_PARAMS.MNEMONIC);
 }
 // ─── KDF v1: PBKDF2-SHA256 (legacy — do not use for new operations) ───────────
 /**

package/dist/core/crypto/encryption-engine.js

@@ -1,3 +1,4 @@
+// encryption-engine.ts from @majikah/majik-key
 import { mnemonicToSeedSync } from "@scure/bip39";
 import * as ed25519 from "@stablelib/ed25519";
 import ed2curve from "ed2curve";
@@ -11,29 +12,6 @@ export class EncryptionEngine {
     /* ================================
      * Identity
      * ================================ */
-    // /**
-    //  * Generates a random long-term identity keypair (X25519 only).
-    //  * ML-KEM keys are not generated here since random identities
-    //  * cannot be deterministically recovered from a mnemonic.
-    //  */
-    // static async generateIdentity(): Promise<EncryptionIdentity> {
-    //   try {
-    //     const ed = ed25519.generateKeyPair();
-    //     const skCurve = ed2curve.convertSecretKey(ed.secretKey);
-    //     const pkCurve = ed2curve.convertPublicKey(ed.publicKey);
-    //     if (!skCurve || !pkCurve) {
-    //       throw new CryptoError("Failed to convert Ed25519 keys to Curve25519");
-    //     }
-    //     const pkBytes = new Uint8Array(pkCurve as Uint8Array);
-    //     const skBytes = new Uint8Array(skCurve as Uint8Array);
-    //     const publicKey = { type: "public", raw: pkBytes } as any;
-    //     const privateKey = { type: "private", raw: skBytes } as any;
-    //     const fingerprint = fingerprintFromPublicRaw(pkBytes);
-    //     return { publicKey, privateKey, fingerprint };
-    //   } catch (err) {
-    //     throw new CryptoError("Failed to generate identity", err);
-    //   }
-    // }
     /**
      * Derive a complete identity from a BIP-39 mnemonic.
      *

package/dist/majik-key.js

@@ -542,7 +542,7 @@ export class MajikKey {
     }
     // ── PRIVATE: Encryption/Decryption ───────────────────────────────────────────
     static async _encryptPrivateKey(buffer, passphrase, salt) {
-        const keyBytes = deriveKeyFromPassphraseArgon2(passphrase, salt);
+        const keyBytes = await deriveKeyFromPassphraseArgon2(passphrase, salt);
         const iv = generateRandomBytes(IV_LENGTH);
         const ciphertext = aesGcmEncrypt(keyBytes, iv, new Uint8Array(buffer));
         return {
@@ -556,14 +556,14 @@ export class MajikKey {
      * computation → two independently encrypted blobs.
      */
     static async _encryptMlKemSecretKey(mlKemSecretKey, passphrase, salt) {
-        const keyBytes = deriveKeyFromPassphraseArgon2(passphrase, salt);
+        const keyBytes = await deriveKeyFromPassphraseArgon2(passphrase, salt);
         const iv = generateRandomBytes(IV_LENGTH); // different IV from X25519 blob
         const ciphertext = aesGcmEncrypt(keyBytes, iv, mlKemSecretKey);
         return concatUint8Arrays(iv, ciphertext).buffer;
     }
     static async _decryptPrivateKey(buffer, passphrase, salt, kdfVersion = KDF_VERSION.PBKDF2) {
         const keyBytes = kdfVersion === KDF_VERSION.ARGON2ID
-            ? deriveKeyFromPassphraseArgon2(passphrase, salt)
+            ? await deriveKeyFromPassphraseArgon2(passphrase, salt)
             : deriveKeyFromPassphrase(passphrase, salt);
         const full = new Uint8Array(buffer);
         const iv = full.slice(0, IV_LENGTH);
@@ -575,7 +575,7 @@ export class MajikKey {
     }
     static async _decryptMlKemSecretKey(buffer, passphrase, salt) {
         // ML-KEM keys are only ever written by Argon2id (v2) code
-        const keyBytes = deriveKeyFromPassphraseArgon2(passphrase, salt);
+        const keyBytes = await deriveKeyFromPassphraseArgon2(passphrase, salt);
         const full = new Uint8Array(buffer);
         const iv = full.slice(0, IV_LENGTH);
         const ciphertext = full.slice(IV_LENGTH);
@@ -590,7 +590,7 @@ export class MajikKey {
         const ciphertext = base64ToArrayBuffer(ciphertextBase64);
         const mnemonicSalt = new TextEncoder().encode(MAJIK_MNEMONIC_SALT);
         if (backupKdfVersion === KDF_VERSION.ARGON2ID) {
-            const keyBytes = deriveKeyFromMnemonicArgon2(mnemonic, mnemonicSalt);
+            const keyBytes = await deriveKeyFromMnemonicArgon2(mnemonic, mnemonicSalt);
             const plain = aesGcmDecrypt(keyBytes, iv, new Uint8Array(ciphertext));
             if (!plain)
                 throw new MajikKeyError("Failed to decrypt backup — invalid mnemonic or corrupted data");
@@ -629,7 +629,7 @@ export class MajikKey {
                 throw new MajikKeyError("Cannot export public key");
         }
         const mnemonicSalt = new TextEncoder().encode(MAJIK_MNEMONIC_SALT);
-        const keyBytes = deriveKeyFromMnemonicArgon2(mnemonic, mnemonicSalt);
+        const keyBytes = await deriveKeyFromMnemonicArgon2(mnemonic, mnemonicSalt);
         const iv = generateRandomBytes(IV_LENGTH);
         const ciphertext = aesGcmEncrypt(keyBytes, iv, new Uint8Array(privRawBuf));
         return utf8ToBase64(JSON.stringify({

package/package.json

@@ -2,7 +2,7 @@
   "name": "@majikah/majik-key",
   "type": "module",
   "description": "A post-quantum ready seed phrase account library for the Majikah ecosystem. Manages deterministic X25519 and ML-KEM-768 identities with Argon2id protection and seamless legacy account migration.",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "license": "Apache-2.0",
   "author": "Zelijah",
   "main": "./dist/index.js",
@@ -57,7 +57,8 @@
     "@stablelib/sha256": "^2.0.1",
     "@stablelib/x25519": "^2.0.1",
     "@thezelijah/majik-user": "^1.0.3",
-    "ed2curve": "^0.3.0"
+    "ed2curve": "^0.3.0",
+    "hash-wasm": "^4.12.0"
   },
   "devDependencies": {
     "@types/ed2curve": "^0.2.4"