@novasamatech/statement-store 0.8.12 → 0.9.0

package/dist/crypto.js

@@ -1,8 +1,9 @@
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { deriveSlotAccountPublicKey as deriveSlotPublicKey, ensureSubstrateSlotSr25519Ready, signSlotAccountSecret as signSlotSecret, verifySlotAccountSignature as verifySlotSignature, } from '@novasamatech/substrate-slot-sr25519-wasm';
 import { entropyToMiniSecret } from '@polkadot-labs/hdkd-helpers';
 import { HDKD as sr25519HDKD, secretFromSeed as sr25519SecretFromSeed } from '@scure/sr25519';
-import { Bytes, str, u64 } from 'scale-ts';
+import { str, u64 } from 'scale-ts';
 import { substrateSr25519PublicKey, substrateSr25519Sign, substrateSr25519Verify } from './substrateSr25519.js';
 export { ensureSubstrateSlotSr25519Ready };
 export { ensureSubstrateSr25519Ready } from './substrateSr25519.js';

package/dist/model/session.d.ts

@@ -1,5 +1,5 @@
 import type { Branded } from '../types.js';
 import type { SessionAccount } from './sessionAccount.js';
 export type SessionId = Branded<Uint8Array, 'SessionId'>;
-export declare const SessionIdCodec: import("scale-ts").Codec<Uint8Array<ArrayBufferLike>>;
+export declare const SessionIdCodec: import("@novasamatech/scale").BytesCodec<number>;
 export declare function createSessionId(sharedSecret: Uint8Array, accountA: SessionAccount, accountB: SessionAccount): SessionId;

package/dist/model/session.js

@@ -1,5 +1,5 @@
+import { Bytes } from '@novasamatech/scale';
 import { mergeUint8 } from 'polkadot-api/utils';
-import { Bytes } from 'scale-ts';
 import { khash, stringToBytes } from '../crypto.js';
 export const SessionIdCodec = Bytes(32);
 export function createSessionId(sharedSecret, accountA, accountB) {

package/dist/model/sessionAccount.js

@@ -1,4 +1,5 @@
-import { Bytes, Option, Struct, str } from 'scale-ts';
+import { Bytes } from '@novasamatech/scale';
+import { Option, Struct, str } from 'scale-ts';
 import { BrandedBytesCodec } from '../crypto.js';
 export const AccountIdCodec = BrandedBytesCodec(32);
 export function createAccountId(value) {

package/dist/session/encyption.js

@@ -1,24 +1,24 @@
-import { gcm } from '@noble/ciphers/aes.js';
+import { chacha20poly1305 } from '@noble/ciphers/chacha.js';
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { randomBytes } from '@noble/hashes/utils.js';
 import { Result, fromThrowable } from 'neverthrow';
 import { mergeUint8 } from 'polkadot-api/utils';
 export function createEncryption(sharedSecret) {
-    const salt = new Uint8Array(); // secure enough since P256 random keys provide enough entropy
+    const salt = new Uint8Array(); // secure enough since the X25519 shared secret provides full entropy
     const info = new Uint8Array(); // no need to introduce any context
-    const aesKey = hkdf(sha256, sharedSecret, salt, info, 32);
+    const aeadKey = hkdf(sha256, sharedSecret, salt, info, 32);
     return {
         encrypt: fromThrowable(cipherText => {
             const nonce = randomBytes(12);
-            const aes = gcm(aesKey, nonce);
-            return mergeUint8([nonce, aes.encrypt(cipherText)]);
+            const aead = chacha20poly1305(aeadKey, nonce);
+            return mergeUint8([nonce, aead.encrypt(cipherText)]);
         }),
         decrypt: fromThrowable(encryptedMessage => {
             const nonce = encryptedMessage.slice(0, 12);
             const cipherText = encryptedMessage.slice(12);
-            const aes = gcm(aesKey, nonce);
-            return aes.decrypt(cipherText);
+            const aead = chacha20poly1305(aeadKey, nonce);
+            return aead.decrypt(cipherText);
         }),
     };
 }

package/dist/session/encyption.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/session/encyption.spec.js

@@ -0,0 +1,43 @@
+import { chacha20poly1305 } from '@noble/ciphers/chacha.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { randomBytes } from '@noble/hashes/utils.js';
+import { describe, expect, it } from 'vitest';
+import { createEncryption } from './encyption.js';
+const deriveAeadKey = (sharedSecret) => hkdf(sha256, sharedSecret, new Uint8Array(), new Uint8Array(), 32);
+describe('statement-store message encryption', () => {
+    it('round-trips a message', () => {
+        const sharedSecret = randomBytes(32);
+        const encryption = createEncryption(sharedSecret);
+        const plaintext = new TextEncoder().encode('hello statement');
+        const encrypted = encryption.encrypt(plaintext)._unsafeUnwrap();
+        const decrypted = encryption.decrypt(encrypted)._unsafeUnwrap();
+        expect(decrypted).toEqual(plaintext);
+    });
+    it('produces ChaCha20-Poly1305 ciphertext decryptable by an external ChaCha20-Poly1305 reader', () => {
+        const sharedSecret = randomBytes(32);
+        const plaintext = new TextEncoder().encode('cross-decrypt me');
+        const encrypted = createEncryption(sharedSecret).encrypt(plaintext)._unsafeUnwrap();
+        const nonce = encrypted.slice(0, 12);
+        const body = encrypted.slice(12);
+        const aeadKey = deriveAeadKey(sharedSecret);
+        const decrypted = chacha20poly1305(aeadKey, nonce).decrypt(body);
+        expect(decrypted).toEqual(plaintext);
+    });
+    it('decrypts a ChaCha20-Poly1305 ciphertext built externally (nonce || ct || tag framing)', () => {
+        const sharedSecret = randomBytes(32);
+        const plaintext = new TextEncoder().encode('external chacha');
+        const aeadKey = deriveAeadKey(sharedSecret);
+        const nonce = randomBytes(12);
+        const body = chacha20poly1305(aeadKey, nonce).encrypt(plaintext);
+        const wire = new Uint8Array([...nonce, ...body]);
+        const decrypted = createEncryption(sharedSecret).decrypt(wire)._unsafeUnwrap();
+        expect(decrypted).toEqual(plaintext);
+    });
+    it('fails to decrypt with a different shared secret', () => {
+        const plaintext = new TextEncoder().encode('secret');
+        const encrypted = createEncryption(randomBytes(32)).encrypt(plaintext)._unsafeUnwrap();
+        const result = createEncryption(randomBytes(32)).decrypt(encrypted);
+        expect(result.isErr()).toBe(true);
+    });
+});

package/dist/session/scale/statementData.js

@@ -1,4 +1,5 @@
-import { Bytes, Enum, Struct, Vector, enhanceCodec, str, u8 } from 'scale-ts';
+import { Bytes } from '@novasamatech/scale';
+import { Enum, Struct, Vector, enhanceCodec, str, u8 } from 'scale-ts';
 export const ResponseCode = enhanceCodec(u8, error => {
     switch (error) {
         case 'success':

package/dist/session/session.spec.js

@@ -1,6 +1,7 @@
+import { Bytes } from '@novasamatech/scale';
 import { createExpiryFromDuration } from '@novasamatech/sdk-statement';
 import { ResultAsync, err, errAsync, ok, okAsync } from 'neverthrow';
-import { Bytes, Struct, str } from 'scale-ts';
+import { Struct, str } from 'scale-ts';
 import { describe, expect, it, vi } from 'vitest';
 import { createInMemoryStatementStore } from '../adapter/inMemory.js';
 import { AccountFullError, ExpiryTooLowError } from '../adapter/types.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/statement-store",
   "type": "module",
-  "version": "0.8.12",
+  "version": "0.9.0",
   "description": "Statement store integration",
   "license": "Apache-2.0",
   "repository": {
@@ -25,9 +25,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@novasamatech/scale": "0.8.12",
+    "@novasamatech/scale": "0.9.0",
     "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/substrate-slot-sr25519-wasm": "0.8.12",
+    "@novasamatech/substrate-slot-sr25519-wasm": "0.9.0",
     "@polkadot-api/substrate-bindings": "^0.20.3",
     "@polkadot-api/substrate-client": "^0.7.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.31",