@pinkparrot/qsafe-sig 0.0.4 → 0.0.5

package/dist/qsafe-sig.browser.min.js

@@ -3001,21 +3001,23 @@ var QsafeSigner = class _QsafeSigner {
     crypto.getRandomValues(seed);
     return seed;
   }
-  /** Checks that a signature buffer has a valid header and correct byte length.
-      * - Zero crypto — safe to call as a fast pre-filter. @param {Uint8Array} signature */
-  static checkFormat(signature) {
-    const h = QsafeHelper.parseHeader(signature);
-    if (h) return signature.length === HEADER_SIZE + ED25519_SIG_SIZE + h.desc.sigSize;
-    else return false;
+  /** Parses a signature header and resolves its protocol version and variant.
+   * - Returns null if the header is invalid or references an unknown version/variant.
+   * @param {Uint8Array} headerOrSignature */
+  static parseHeader(headerOrSignature) {
+    return QsafeHelper.parseHeader(headerOrSignature);
   }
   /** Verifies a hybrid signature. Lazy-loads the required WASM variant if not already cached.
-   * - Works with any protocol version whose descriptors are registered above.
-   * @param {Uint8Array} message
-   * @param {Uint8Array} signature  - from sign()
-   * @param {Uint8Array} publicKey  - from loadMasterKey() */
+     * - Works with any protocol version whose descriptors are registered above.
+  * - Do not parallelize calls to verify(), async is justified by the lazy WASM loading. To parallelize, please use workers
+     * @param {Uint8Array} message
+     * @param {Uint8Array} signature  - from sign()
+     * @param {Uint8Array} publicKey  - from loadMasterKey() */
   async verify(message, signature, publicKey) {
     const h = QsafeHelper.parseHeader(signature);
-    if (!h || !_QsafeSigner.checkFormat(signature)) return false;
+    if (!h) return false;
+    if (signature.length !== HEADER_SIZE + ED25519_SIG_SIZE + h.desc.sigSize) return false;
+    if (publicKey.length !== ED25519_PUB_SIZE + h.desc.pubKeySize) return false;
     const sigReader = new BinaryReader(signature);
     sigReader.read(HEADER_SIZE);
     const edSig = sigReader.read(ED25519_SIG_SIZE);

package/index.mjs

@@ -67,22 +67,22 @@ export class QsafeSigner {
         return seed;
     }
 
-	/** Checks that a signature buffer has a valid header and correct byte length.
-     * - Zero crypto — safe to call as a fast pre-filter. @param {Uint8Array} signature */
-    static checkFormat(signature) {
-        const h = QsafeHelper.parseHeader(signature);
-        if (h) return signature.length === HEADER_SIZE + ED25519_SIG_SIZE + h.desc.sigSize;
-        else return false;
-    }
+	/** Parses a signature header and resolves its protocol version and variant.
+	 * - Returns null if the header is invalid or references an unknown version/variant.
+	 * @param {Uint8Array} headerOrSignature */
+	static parseHeader(headerOrSignature) { return QsafeHelper.parseHeader(headerOrSignature); }
 
     /** Verifies a hybrid signature. Lazy-loads the required WASM variant if not already cached.
      * - Works with any protocol version whose descriptors are registered above.
+	 * - Do not parallelize calls to verify(), async is justified by the lazy WASM loading. To parallelize, please use workers
      * @param {Uint8Array} message
      * @param {Uint8Array} signature  - from sign()
      * @param {Uint8Array} publicKey  - from loadMasterKey() */
     async verify(message, signature, publicKey) {
         const h = QsafeHelper.parseHeader(signature);
-        if (!h || !QsafeSigner.checkFormat(signature)) return false;
+		if (!h) return false; // invalid header or unknown version/variant
+		if (signature.length !== HEADER_SIZE + ED25519_SIG_SIZE + h.desc.sigSize) return false;
+		if (publicKey.length !== ED25519_PUB_SIZE + h.desc.pubKeySize) return false;
 
         const sigReader = new BinaryReader(signature);
         sigReader.read(HEADER_SIZE); // skip header already parsed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pinkparrot/qsafe-sig",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "author": "PinkParrot",
   "license": "GPL-3.0",
   "description": "Combination of pre quantum and post quantum signature, designed for a smooth migration.",