@sideband/secure-relay 0.2.1 → 0.2.2

package/README.md

@@ -12,7 +12,7 @@ Implements authenticated handshake, key derivation, and message encryption for s
 - **TOFU identity pinning** — Trust-on-first-use with key change detection
 - **Replay protection** — Bitmap-based sequence window
 
-## Non-Goals
+## Non-goals
 
 This package intentionally does NOT:
 
@@ -21,6 +21,23 @@ This package intentionally does NOT:
 - Persist identity keys or TOFU pins
 - Implement relay authentication or tokens
 
+## Threat model
+
+This package protects the **payload** of messages between a browser client and a daemon via an untrusted relay. Specifically:
+
+- The relay cannot read or tamper with message content (authenticated encryption).
+- A MITM cannot impersonate the daemon without its Ed25519 private key (signature verification on handshake).
+- Replayed messages are rejected within the sequence window.
+
+It does **not** protect against:
+
+- Compromise of the daemon's identity key (store it securely; if lost, all clients see a TOFU mismatch).
+- Traffic analysis (message sizes and timing are visible to the relay).
+- Key storage security — this package has no opinion on where keys live; that's the caller's responsibility.
+- Denial of service from a malicious relay (the relay can drop or delay messages).
+
+This implementation has not undergone a formal third-party security audit. Use accordingly.
+
 ## Install
 
 ```bash
@@ -78,7 +95,7 @@ const encrypted = encryptClientToDaemon(daemonSession, plaintext);
 const decrypted = decryptClientToDaemon(clientSession, encrypted);
 ```
 
-## TOFU Security
+## TOFU security
 
 Identity keys use trust-on-first-use (TOFU) pinning:
 
@@ -86,7 +103,7 @@ Identity keys use trust-on-first-use (TOFU) pinning:
 - Never accept key changes silently — `identity_key_changed` indicates potential MITM
 - On mismatch, present both fingerprints and require explicit user approval
 
-### Detecting Identity Key Changes
+### Detecting identity key changes
 
 Compare the daemon's current identity key against your stored pin before handshake:
 
@@ -123,7 +140,7 @@ if (!pinnedKey) {
 }
 ```
 
-## Error Handling
+## Error handling
 
 All errors throw `SbrpError` with a specific `code`:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sideband/secure-relay",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Secure Relay Protocol (SBRP): E2EE handshake, session encryption, and TOFU identity pinning for relay-mediated communication.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,9 +45,9 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@noble/ciphers": "^1.2.1",
-    "@noble/curves": "^1.8.1",
-    "@noble/hashes": "^1.7.1"
+    "@noble/ciphers": "^2.1.1",
+    "@noble/curves": "^2.0.1",
+    "@noble/hashes": "^2.0.1"
   },
   "files": [
     "dist",

package/src/crypto.ts

@@ -7,12 +7,12 @@
  * and @noble/hashes for SHA-256/HKDF.
  */
 
-import { chacha20poly1305 } from "@noble/ciphers/chacha";
-import { ed25519 } from "@noble/curves/ed25519";
-import { x25519 } from "@noble/curves/ed25519";
-import { hkdf } from "@noble/hashes/hkdf";
-import { sha256 } from "@noble/hashes/sha256";
-import { concatBytes, randomBytes } from "@noble/hashes/utils";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { x25519 } from "@noble/curves/ed25519.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { concatBytes, randomBytes } from "@noble/hashes/utils.js";
 import {
   AUTH_TAG_LENGTH,
   DIRECTION_CLIENT_TO_DAEMON,
@@ -36,14 +36,14 @@ const textEncoder = new TextEncoder();
 
 /** Generate a new Ed25519 identity keypair */
 export function generateIdentityKeyPair(): IdentityKeyPair {
-  const privateKey = ed25519.utils.randomPrivateKey();
+  const privateKey = ed25519.utils.randomSecretKey();
   const publicKey = ed25519.getPublicKey(privateKey);
   return { publicKey, privateKey };
 }
 
 /** Generate a new X25519 ephemeral keypair */
 export function generateEphemeralKeyPair(): EphemeralKeyPair {
-  const privateKey = x25519.utils.randomPrivateKey();
+  const privateKey = x25519.utils.randomSecretKey();
   const publicKey = x25519.getPublicKey(privateKey);
   return { publicKey, privateKey };
 }
@@ -137,7 +137,7 @@ export function deriveSessionKeys(
     sha256,
     sharedSecret,
     transcriptHash,
-    SBRP_SESSION_KEYS_INFO,
+    textEncoder.encode(SBRP_SESSION_KEYS_INFO),
     SESSION_KEYS_LENGTH,
   );