@smartledger/bsv 5.1.0 → 5.2.0

package/lib/ecies/electrum-ecies.js

@@ -1,15 +1,24 @@
 'use strict'
 
+// Electrum BIE1 ECIES, backed by the audited @noble suite. Wire format unchanged
+// and byte-compatible with prior versions (locked by the golden known-answer
+// vector in test/ecies/electrum-ecies.js).
+
 var bsv = require('../../')
 
 var PublicKey = bsv.PublicKey
 var PrivateKey = bsv.PrivateKey
-var Hash = bsv.crypto.Hash
 var $ = bsv.util.preconditions
 var bitcoreECIES = require('./bitcore-ecies')
 var errors = require('./errors')
-var aesjs = require('aes-js')
-var CBC = aesjs.ModeOfOperation.cbc
+
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+var { sha512, sha256 } = require('@noble/hashes/sha2.js')
+var { hmac } = require('@noble/hashes/hmac.js')
+var { cbc } = require('@noble/ciphers/aes.js')
+
+function buf (u8) { return Buffer.from(u8.buffer, u8.byteOffset, u8.byteLength) }
+function sha256hmac (data, key) { return buf(hmac(sha256, key, data)) }
 
 var AESCBC = function AESCBC () {}
 
@@ -19,10 +28,7 @@ AESCBC.encrypt = function (messagebuf, keybuf, ivbuf) {
   $.checkArgument(ivbuf)
   $.checkArgument(keybuf.length === 16, 'keybuf length must be 16')
   $.checkArgument(ivbuf.length === 16, 'ivbuf length must be 16')
-  messagebuf = aesjs.padding.pkcs7.pad(messagebuf)
-  var aesCbc = new CBC(keybuf, ivbuf)
-  var encryptedBytes = aesCbc.encrypt(messagebuf)
-  return Buffer.from(encryptedBytes)
+  return buf(cbc(Uint8Array.from(keybuf), Uint8Array.from(ivbuf)).encrypt(Uint8Array.from(messagebuf)))
 }
 
 AESCBC.decrypt = function (encbuf, keybuf, ivbuf) {
@@ -31,35 +37,14 @@ AESCBC.decrypt = function (encbuf, keybuf, ivbuf) {
   $.checkArgument(ivbuf)
   $.checkArgument(keybuf.length === 16, 'keybuf length must be 16')
   $.checkArgument(ivbuf.length === 16, 'ivbuf length must be 16')
-  var aesCbc = new CBC(keybuf, ivbuf)
-  var decryptedBytes = aesCbc.decrypt(encbuf)
-  return Buffer.from(aesjs.padding.pkcs7.strip(decryptedBytes))
+  return buf(cbc(Uint8Array.from(keybuf), Uint8Array.from(ivbuf)).decrypt(Uint8Array.from(encbuf)))
 }
 
-// Electrum BIE1 ECIES
-// Difference from Original Bitcore ECIES:
-//  BIE1:
-//      1.Secret S is compressed P(33 bytes), while Bitcore's Secret is Px(32 bytes). See ivkEkM.
-//      2.use AES-128-CBC instead of AES-256-CBC.
-//      3.IV is retrived from first 16 bytes of Hashed Secret Buffer. See iv
-//      4.key Encryption(kE) is retrived from 17-32 bytes of Hashed Secret Buffer, instead of 1-32 bytes. See kE
-//      5.a magic word 'BIE1' is used to identify message type.
-//      6.ephemeral key is introduced, so you can encrypt messages only with public key.
-//      7.HMAC is whole message.
-//  Notice:
-//      Electrum does not support shortTag nor noKey
-//      Do NOT use those 2 options if you are to send a message to Electrum
-//      Encrypted message is NOT recoverable if you use ephemeral key
-//  Security:
-//
-
-// Default algorithm is set to BIE1, however original Bitcore ECIES is still preserved.
 var ECIES = function ECIES (opts, algorithm = 'BIE1') {
   if (algorithm !== 'BIE1') throw new errors.UnsupportAlgorithm(algorithm)
   if (!(this instanceof ECIES)) {
     return new ECIES(opts, algorithm)
   }
-  // use ephemeral key if privateKey is not set.
   this._privateKey = new bsv.PrivateKey()
   this.opts = opts || {}
   this.opts.ephemeralKey = true
@@ -67,19 +52,15 @@ var ECIES = function ECIES (opts, algorithm = 'BIE1') {
 
 ECIES.prototype.privateKey = function (privateKey) {
   $.checkArgument(PrivateKey.isValid(privateKey), 'no private key provided')
-
   this._privateKey = PrivateKey(privateKey.toHex()) || null
   this.opts.ephemeralKey = false
-
   return this
 }
 
 ECIES.prototype.publicKey = function (publicKey) {
   $.checkArgument(PublicKey.isValid(publicKey), 'no public key provided')
-
   this._publicKey = PublicKey(publicKey.toString()) || null
   if (this._publicKey != null) this.opts.fixedPublicKey = true
-
   return this
 }
 
@@ -97,31 +78,21 @@ var defineProperty = function (name, getter) {
 }
 
 defineProperty('Rbuf', function () {
-  return this._privateKey.publicKey.toDER(true)
+  var priv = this._privateKey.bn.toBuffer({ size: 32 })
+  return buf(secp256k1.getPublicKey(Uint8Array.from(priv), true))
 })
 
 defineProperty('ivkEkM', function () {
-  var r = this._privateKey.bn
-  var KB = this._publicKey.point
-  var P = KB.mul(r)
-  var S = PublicKey(P)
-  var Sbuf = S.toBuffer()
-  return Hash.sha512(Sbuf)
+  var priv = this._privateKey.bn.toBuffer({ size: 32 })
+  var pub = this._publicKey.toDER()
+  var Sbuf = secp256k1.getSharedSecret(Uint8Array.from(priv), Uint8Array.from(pub), true)
+  return buf(sha512(Sbuf))
 })
 
-defineProperty('iv', function () {
-  return this.ivkEkM.slice(0, 16)
-})
-
-defineProperty('kE', function () {
-  return this.ivkEkM.slice(16, 32)
-})
+defineProperty('iv', function () { return this.ivkEkM.slice(0, 16) })
+defineProperty('kE', function () { return this.ivkEkM.slice(16, 32) })
+defineProperty('kM', function () { return this.ivkEkM.slice(32, 64) })
 
-defineProperty('kM', function () {
-  return this.ivkEkM.slice(32, 64)
-})
-
-// Encrypts the message (String or Buffer).
 ECIES.prototype.encrypt = function (message) {
   if (!Buffer.isBuffer(message)) message = Buffer.from(message)
   var ciphertext = AESCBC.encrypt(message, this.kE, this.iv)
@@ -132,48 +103,37 @@ ECIES.prototype.encrypt = function (message) {
   } else {
     encbuf = Buffer.concat([BIE1, this.Rbuf, ciphertext])
   }
-  var hmac = Hash.sha256hmac(encbuf, this.kM)
-  if (this.opts.shortTag) hmac = hmac.slice(0, 4)
-  return Buffer.concat([encbuf, hmac])
+  var tag = sha256hmac(encbuf, this.kM)
+  if (this.opts.shortTag) tag = tag.slice(0, 4)
+  return Buffer.concat([encbuf, tag])
 }
 
 ECIES.prototype.decrypt = function (encbuf) {
   $.checkArgument(Buffer.isBuffer(encbuf), 'ciphetext must be a buffer')
-  var tagLength = 32
+  var tagLength = this.opts.shortTag ? 4 : 32
   var offset = 4
-  if (this.opts.shortTag) {
-    tagLength = 4
-  }
   var magic = encbuf.slice(0, 4)
   if (!magic.equals(Buffer.from('BIE1'))) {
     throw new errors.DecryptionError('Invalid Magic')
   }
   if (!this.opts.noKey) {
-    var pub
-    // BIE1 use compressed public key, length is always 33.
-    pub = encbuf.slice(4, 37)
+    var pub = encbuf.slice(4, 37)
     if (this.opts.fixedPublicKey) console.log('Notice: Overriding PublicKey in message. Consider use "noKey" option if you are not sending message to electrum and do not want to use ephemeral key')
     else this._publicKey = PublicKey.fromDER(pub)
     offset = 37
   }
 
   var ciphertext = encbuf.slice(offset, encbuf.length - tagLength)
-  var hmac = encbuf.slice(encbuf.length - tagLength, encbuf.length)
+  var tag = encbuf.slice(encbuf.length - tagLength, encbuf.length)
 
-  var hmac2 = Hash.sha256hmac(encbuf.slice(0, encbuf.length - tagLength), this.kM)
-  if (this.opts.shortTag) hmac2 = hmac2.slice(0, 4)
+  var tag2 = sha256hmac(encbuf.slice(0, encbuf.length - tagLength), this.kM)
+  if (this.opts.shortTag) tag2 = tag2.slice(0, 4)
 
-  // Constant-time tag comparison. Buffer.equals() short-circuits on the first
-  // differing byte, which leaks how many leading bytes matched and enables a
-  // forgery oracle on the MAC; compare every byte unconditionally instead
-  // (mirrors the loop in bitcore-ecies.js).
-  if (hmac.length !== hmac2.length) {
+  if (tag.length !== tag2.length) {
     throw new errors.DecryptionError('Invalid checksum')
   }
   var equal = 0
-  for (var i = 0; i < hmac2.length; i++) {
-    equal |= (hmac[i] ^ hmac2[i])
-  }
+  for (var i = 0; i < tag2.length; i++) equal |= (tag[i] ^ tag2[i])
   if (equal !== 0) {
     throw new errors.DecryptionError('Invalid checksum')
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "5.1.0",
+  "version": "5.2.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -191,6 +191,9 @@
     "request": "browser-request"
   },
   "dependencies": {
+    "@noble/ciphers": "2.2.0",
+    "@noble/curves": "2.2.0",
+    "@noble/hashes": "2.2.0",
     "aes-js": "^3.1.2",
     "bn.js": "=4.11.9",
     "bs58": "=4.0.1",