@reallyme/crypto 0.1.1 → 0.1.4

package/README.md

@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 
 # @reallyme/crypto
 
-[![npm](https://img.shields.io/npm/v/@reallyme/crypto?label=npm)](https://www.npmjs.com/package/@reallyme/crypto)
+[![npm](https://img.shields.io/npm/v/@reallyme/crypto?label=npm&color=2563eb)](https://www.npmjs.com/package/@reallyme/crypto)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/reallyme/crypto/blob/main/LICENSE)
 
 ReallyMe Crypto provides a platform-agnostic cryptography API for TypeScript,

package/dist/cryptoFacade.js

@@ -165,6 +165,9 @@ export const ReallyMeCrypto = {
         }
     },
     deriveKeyPair(algorithm, secretKey) {
+        // Import an existing secret and reconstruct its public key. Do not use
+        // this as key generation from passwords or other low-entropy input; use
+        // generateKeyPair for new keys, or a protocol-approved KDF before import.
         if (algorithm === ED25519) {
             return ReallyMeEd25519.deriveKeyPair(secretKey);
         }
@@ -183,6 +186,10 @@ export const ReallyMeCrypto = {
             case "ML-DSA-65":
             case "ML-DSA-87":
                 return ReallyMeMlDsa.deriveKeyPair(algorithm, secretKey);
+            case "SLH-DSA-SHA2-128s":
+                // SLH-DSA deterministic derivation uses three FIPS seed components,
+                // so it deliberately does not fit this single-secret import shape.
+                throw new ReallyMeCryptoError("unsupported-algorithm");
             default:
                 throw new ReallyMeCryptoError("unsupported-algorithm");
         }

package/dist/ed25519.d.ts

@@ -16,7 +16,12 @@ export declare const ReallyMeEd25519: {
         publicKey: Uint8Array;
         secretKey: Uint8Array;
     };
-    /** Derives the Ed25519 keypair from a 32-byte seed. */
+    /**
+     * Reconstructs an Ed25519 keypair from stored 32-byte secret material.
+     *
+     * This is an import path, not password-based key generation. Use
+     * `generateKeyPair` for fresh keys.
+     */
     readonly deriveKeyPair: (secretKey: Uint8Array) => {
         publicKey: Uint8Array;
         secretKey: Uint8Array;

package/dist/ed25519.js

@@ -24,7 +24,12 @@ export const ReallyMeEd25519 = {
             secretKey,
         };
     },
-    /** Derives the Ed25519 keypair from a 32-byte seed. */
+    /**
+     * Reconstructs an Ed25519 keypair from stored 32-byte secret material.
+     *
+     * This is an import path, not password-based key generation. Use
+     * `generateKeyPair` for fresh keys.
+     */
     deriveKeyPair(secretKey) {
         return {
             publicKey: this.derivePublicKey(secretKey),

package/dist/mlDsa.js

@@ -67,6 +67,8 @@ export const ReallyMeMlDsa = {
         return readKeyPair(suite.generateKeyPair(), suite);
     },
     deriveKeyPair(algorithm, secretKey) {
+        // Import an existing FIPS 204 seed and reconstruct its public key. Do not
+        // feed passwords or other low-entropy material here.
         const suite = mlDsaSuite(algorithm);
         ensureBytes(secretKey, ML_DSA_SECRET_KEY_LENGTH);
         return readKeyPair(suite.deriveKeyPair(secretKey), suite);

package/dist/mlKem.js

@@ -71,6 +71,8 @@ export const ReallyMeMlKem = {
         return readKeyPair(suite.generateKeyPair(), suite);
     },
     deriveKeyPair(algorithm, secretKey) {
+        // Import an existing FIPS 203 seed-form secret and reconstruct its public
+        // key. Do not feed passwords or other low-entropy material here.
         const suite = mlKemSuite(algorithm);
         ensureBytes(secretKey, ML_KEM_SECRET_KEY_LENGTH);
         return readKeyPair(suite.deriveKeyPair(secretKey), suite);

package/dist/wasmProvider.d.ts

@@ -16,6 +16,7 @@ type HpkeOpenFn = (suite: number, recipientSecretKey: Uint8Array, encapsulatedKe
 type HpkeSealFn = (suite: number, recipientPublicKey: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
 type HpkeSealDerandFn = (suite: number, recipientPublicKey: Uint8Array, encapsulationRandomness: Uint8Array, info: Uint8Array, aad: Uint8Array, plaintext: Uint8Array) => unknown;
 type DeriveKeypairFn = (secretKey: Uint8Array) => unknown;
+type SlhDsaDeriveKeypairFn = (skSeed: Uint8Array, skPrf: Uint8Array, pkSeed: Uint8Array) => unknown;
 type EncapsulateFn = (publicKey: Uint8Array) => unknown;
 type EncapsulateDerandFn = (publicKey: Uint8Array, seed: Uint8Array) => unknown;
 type DecapsulateFn = (ciphertext: Uint8Array, secretKey: Uint8Array) => unknown;
@@ -73,7 +74,7 @@ export type ReallyMeWasmProvider = Readonly<{
     mlKem1024EncapsulateDerand: EncapsulateDerandFn;
     mlKem1024Decapsulate: DecapsulateFn;
     slhDsaSha2128sGenerateKeypair: GenerateKeypairFn;
-    slhDsaSha2128sDeriveKeypair: SignatureVerifyFn;
+    slhDsaSha2128sDeriveKeypair: SlhDsaDeriveKeypairFn;
     slhDsaSha2128sSign: SignatureSignFn;
     slhDsaSha2128sVerify: SignatureVerifyFn;
     rsaVerifyPkcs1v15: RsaPkcs1v15VerifyFn;

package/dist/wasmProvider.js

@@ -64,6 +64,10 @@ const function3 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second, third) => callable(first, second, third);
 };
+const deriveSlhDsaFunction3 = (module, name) => {
+    const callable = requireFunction(module, name);
+    return (skSeed, skPrf, pkSeed) => callable(skSeed, skPrf, pkSeed);
+};
 const function4 = (module, name) => {
     const callable = requireFunction(module, name);
     return (first, second, third, fourth) => callable(first, second, third, fourth);
@@ -148,7 +152,7 @@ export const installReallyMeWasmProvider = (module) => {
         mlKem1024EncapsulateDerand: function2(providerModule, "mlKem1024EncapsulateDerand"),
         mlKem1024Decapsulate: function2(providerModule, "mlKem1024Decapsulate"),
         slhDsaSha2128sGenerateKeypair: function0(providerModule, "slhDsaSha2128sGenerateKeypair"),
-        slhDsaSha2128sDeriveKeypair: function3(providerModule, "slhDsaSha2128sDeriveKeypair"),
+        slhDsaSha2128sDeriveKeypair: deriveSlhDsaFunction3(providerModule, "slhDsaSha2128sDeriveKeypair"),
         slhDsaSha2128sSign: function2(providerModule, "slhDsaSha2128sSign"),
         slhDsaSha2128sVerify: function3(providerModule, "slhDsaSha2128sVerify"),
         rsaVerifyPkcs1v15: rsaPkcs1v15VerifyFunction(providerModule, "rsaVerifyPkcs1v15"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reallyme/crypto",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "description": "ReallyMe crypto SDK for TypeScript/JavaScript with an explicit, pinned provider set.",
   "license": "Apache-2.0",
   "type": "module",