@phantom/indexed-db-stamper 1.0.2 → 1.0.3

package/dist/index.d.ts

@@ -13,8 +13,13 @@ type IndexedDbStamperConfig = {
  * IndexedDB-based key manager that stores cryptographic keys securely in IndexedDB
  * and performs signing operations without ever exposing private key material.
  *
+ * Algorithm selection:
+ * - Prefers Ed25519 for maximum security and performance
+ * - Automatically falls back to ECDSA P-256 (secp256r1) on browsers that don't support Ed25519
+ *   (e.g., older Android WebViews before Chrome 113)
+ *
  * Security model:
- * - Generates non-extractable Ed25519 keypairs using Web Crypto API
+ * - Generates non-extractable keypairs using Web Crypto API
  * - Stores keys entirely within Web Crypto API secure context
  * - Private keys NEVER exist in JavaScript memory
  * - Provides signing methods without exposing private keys
@@ -33,9 +38,11 @@ declare class IndexedDbStamper implements StamperWithKeyManagement {
     salt?: string;
     constructor(config?: IndexedDbStamperConfig);
     /**
-     * Initialize the stamper by opening IndexedDB and retrieving or generating keys
+     * Initialize the stamper by opening IndexedDB and retrieving or generating keys.
+     * Automatically selects the best supported algorithm.
      */
     init(): Promise<StamperKeyInfo>;
+    private getSupportedAlgorithm;
     /**
      * Get the public key information
      */

package/dist/index.js

@@ -34,16 +34,26 @@ __export(src_exports, {
 });
 module.exports = __toCommonJS(src_exports);
 var import_base64url = require("@phantom/base64url");
+var import_constants = require("@phantom/constants");
 var import_bs58 = __toESM(require("bs58"));
 var import_sdk_types = require("@phantom/sdk-types");
+var WEB_CRYPTO_ALGORITHM_CONFIGS = {
+  [import_constants.DEFAULT_AUTHENTICATOR_ALGORITHM]: {
+    generateParams: { name: "Ed25519" },
+    signParams: { name: "Ed25519" }
+  },
+  [import_sdk_types.Algorithm.secp256r1]: {
+    generateParams: { name: "ECDSA", namedCurve: "P-256" },
+    signParams: { name: "ECDSA", hash: "SHA-256" }
+  }
+};
 var IndexedDbStamper = class {
   // Optional for PKI, required for OIDC
   constructor(config = {}) {
     this.db = null;
     this.activeKeyPairRecord = null;
     this.pendingKeyPairRecord = null;
-    this.algorithm = import_sdk_types.Algorithm.ed25519;
-    // Use Ed25519 for maximum security and performance
+    this.algorithm = import_constants.DEFAULT_AUTHENTICATOR_ALGORITHM;
     // The type of stamper, can be changed at any time
     this.type = "PKI";
     if (typeof window === "undefined" || !window.indexedDB) {
@@ -57,17 +67,34 @@ var IndexedDbStamper = class {
     this.salt = config.salt;
   }
   /**
-   * Initialize the stamper by opening IndexedDB and retrieving or generating keys
+   * Initialize the stamper by opening IndexedDB and retrieving or generating keys.
+   * Automatically selects the best supported algorithm.
    */
   async init() {
     await this.openDB();
     this.activeKeyPairRecord = await this.loadActiveKeyPairRecord();
-    if (!this.activeKeyPairRecord) {
+    if (this.activeKeyPairRecord) {
+      this.algorithm = this.activeKeyPairRecord.keyPair.privateKey.algorithm.name === "Ed25519" ? import_sdk_types.Algorithm.ed25519 : import_sdk_types.Algorithm.secp256r1;
+    } else {
+      this.algorithm = await this.getSupportedAlgorithm();
       this.activeKeyPairRecord = await this.generateAndStoreNewKeyPair("active");
     }
     this.pendingKeyPairRecord = await this.loadPendingKeyPairRecord();
     return this.activeKeyPairRecord.keyInfo;
   }
+  async getSupportedAlgorithm() {
+    for (const [algorithm, params] of Object.entries(WEB_CRYPTO_ALGORITHM_CONFIGS)) {
+      try {
+        await crypto.subtle.generateKey(params.generateParams, false, ["sign", "verify"]);
+        return algorithm;
+      } catch {
+        continue;
+      }
+    }
+    throw new Error(
+      "Your browser does not support the encryption needed for secure authentication. Please use a different browser or upgrade to a supported browser."
+    );
+  }
   /**
    * Get the public key information
    */
@@ -95,10 +122,7 @@ var IndexedDbStamper = class {
     }
     const dataBytes = new Uint8Array(data);
     const signature = await crypto.subtle.sign(
-      {
-        name: this.algorithm,
-        hash: "SHA-256"
-      },
+      WEB_CRYPTO_ALGORITHM_CONFIGS[this.algorithm].signParams,
       this.activeKeyPairRecord.keyPair.privateKey,
       dataBytes
     );
@@ -210,9 +234,7 @@ var IndexedDbStamper = class {
   }
   async generateAndStoreNewKeyPair(type) {
     const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "Ed25519"
-      },
+      WEB_CRYPTO_ALGORITHM_CONFIGS[this.algorithm].generateParams,
       false,
       // non-extractable - private key can never be exported
       ["sign", "verify"]

package/dist/index.mjs

@@ -1,15 +1,25 @@
 // src/index.ts
 import { base64urlEncode } from "@phantom/base64url";
+import { DEFAULT_AUTHENTICATOR_ALGORITHM } from "@phantom/constants";
 import bs58 from "bs58";
 import { Algorithm } from "@phantom/sdk-types";
+var WEB_CRYPTO_ALGORITHM_CONFIGS = {
+  [DEFAULT_AUTHENTICATOR_ALGORITHM]: {
+    generateParams: { name: "Ed25519" },
+    signParams: { name: "Ed25519" }
+  },
+  [Algorithm.secp256r1]: {
+    generateParams: { name: "ECDSA", namedCurve: "P-256" },
+    signParams: { name: "ECDSA", hash: "SHA-256" }
+  }
+};
 var IndexedDbStamper = class {
   // Optional for PKI, required for OIDC
   constructor(config = {}) {
     this.db = null;
     this.activeKeyPairRecord = null;
     this.pendingKeyPairRecord = null;
-    this.algorithm = Algorithm.ed25519;
-    // Use Ed25519 for maximum security and performance
+    this.algorithm = DEFAULT_AUTHENTICATOR_ALGORITHM;
     // The type of stamper, can be changed at any time
     this.type = "PKI";
     if (typeof window === "undefined" || !window.indexedDB) {
@@ -23,17 +33,34 @@ var IndexedDbStamper = class {
     this.salt = config.salt;
   }
   /**
-   * Initialize the stamper by opening IndexedDB and retrieving or generating keys
+   * Initialize the stamper by opening IndexedDB and retrieving or generating keys.
+   * Automatically selects the best supported algorithm.
    */
   async init() {
     await this.openDB();
     this.activeKeyPairRecord = await this.loadActiveKeyPairRecord();
-    if (!this.activeKeyPairRecord) {
+    if (this.activeKeyPairRecord) {
+      this.algorithm = this.activeKeyPairRecord.keyPair.privateKey.algorithm.name === "Ed25519" ? Algorithm.ed25519 : Algorithm.secp256r1;
+    } else {
+      this.algorithm = await this.getSupportedAlgorithm();
       this.activeKeyPairRecord = await this.generateAndStoreNewKeyPair("active");
     }
     this.pendingKeyPairRecord = await this.loadPendingKeyPairRecord();
     return this.activeKeyPairRecord.keyInfo;
   }
+  async getSupportedAlgorithm() {
+    for (const [algorithm, params] of Object.entries(WEB_CRYPTO_ALGORITHM_CONFIGS)) {
+      try {
+        await crypto.subtle.generateKey(params.generateParams, false, ["sign", "verify"]);
+        return algorithm;
+      } catch {
+        continue;
+      }
+    }
+    throw new Error(
+      "Your browser does not support the encryption needed for secure authentication. Please use a different browser or upgrade to a supported browser."
+    );
+  }
   /**
    * Get the public key information
    */
@@ -61,10 +88,7 @@ var IndexedDbStamper = class {
     }
     const dataBytes = new Uint8Array(data);
     const signature = await crypto.subtle.sign(
-      {
-        name: this.algorithm,
-        hash: "SHA-256"
-      },
+      WEB_CRYPTO_ALGORITHM_CONFIGS[this.algorithm].signParams,
       this.activeKeyPairRecord.keyPair.privateKey,
       dataBytes
     );
@@ -176,9 +200,7 @@ var IndexedDbStamper = class {
   }
   async generateAndStoreNewKeyPair(type) {
     const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "Ed25519"
-      },
+      WEB_CRYPTO_ALGORITHM_CONFIGS[this.algorithm].generateParams,
       false,
       // non-extractable - private key can never be exported
       ["sign", "verify"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phantom/indexed-db-stamper",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "IndexedDB stamper for Phantom Wallet SDK with non-extractable key storage",
   "repository": {
     "type": "git",
@@ -44,10 +44,11 @@
     "typescript": "^5.0.4"
   },
   "dependencies": {
-    "@phantom/base64url": "^1.0.2",
-    "@phantom/crypto": "^1.0.2",
-    "@phantom/embedded-provider-core": "^1.0.2",
-    "@phantom/sdk-types": "^1.0.2",
+    "@phantom/base64url": "^1.0.3",
+    "@phantom/constants": "^1.0.3",
+    "@phantom/crypto": "^1.0.3",
+    "@phantom/embedded-provider-core": "^1.0.3",
+    "@phantom/sdk-types": "^1.0.3",
     "bs58": "^6.0.0",
     "buffer": "^6.0.3"
   },