@smartledger/bsv 7.0.1 → 7.1.0

package/CHANGELOG.md

@@ -7,6 +7,166 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.1.0] - 2026-07-17
+
+Six security fixes from an audit of the crypto core. Four change verification
+behaviour; see **Breaking** at the end of this section before upgrading.
+
+### Fixed (security)
+
+- **Strict DER parsing now actually enforces canonical INTEGERs.**
+  `parseDER(buf, strict)` defaults `strict` to `true`, but strictness only ever
+  checked the length byte — the integers themselves were never validated, so
+  `fromDER`/`fromString` accepted excessively padded values (`02 21 00 <r>` where
+  `r`'s high bit is clear), unpadded high-bit values (parsed unsigned, i.e. as a
+  different number than DER says), and zero-length values. Each is a second
+  encoding of the same signature, so a valid credential signature could be
+  re-encoded into different bytes that still verify. This reaches application
+  code: `LTP.Proof` verification, LTP and GDAF credential JWS verification, and
+  `SmartVerify` all parse via `fromDER` on the default (strict) path. Strict now
+  requires each INTEGER to be non-empty, high-bit-clear, and minimally padded.
+
+  **Consensus behaviour is unchanged.** The non-strict path is untouched, and
+  `fromTxFormat` — the only caller that passes `strict = false`, and the one that
+  parses signatures off the chain — still accepts every non-canonical encoding it
+  did before, as its own regression tests now assert. Script-level canonicality
+  continues to be enforced by `isTxDER` under the interpreter's flags, matching
+  bitcoind.
+
+  **Breaking** for callers that hand non-canonical DER to `fromDER`/`fromString`
+  and expect it to parse; they should pass `strict = false` explicitly (via
+  `parseDER`) if they are parsing chain data.
+
+- **`parseDER` reported `sneg` from the wrong byte.** `buf[2 + 2 + rlength + 2 + 2]`
+  reads `sbuf[2]` rather than `sbuf[0]`, so the flag was wrong for any signature
+  whose `s` carries a pad byte (the `r` case one line up reads `rbuf[0]`
+  correctly). Latent — nothing internal consumes `sneg` — but it is part of the
+  returned object and was therefore wrong for external callers.
+
+- **LTP identifiers are now drawn from the CSPRNG instead of `Math.random()`.**
+  `Right._generateUUID` and `Obligation._generateUUID` minted the `id` of signed
+  W3C Verifiable Credentials from `Math.random()`. That id is covered by the
+  credential's signature, is the primary key of the registry's registration and
+  revocation maps, and is an input to proof material (`LTP.Proof` derives a
+  witness from `sha256(nonce + token.id + predicate)`) — so it must be
+  unpredictable, not merely distinct. V8 implements `Math.random` with
+  xorshift128+, whose internal state is recoverable from a handful of outputs;
+  each UUID consumed 31 sequential draws, so a single issued token id leaked
+  enough state to predict every later id from that process, including ids issued
+  to other subjects. With the engine PRNG frozen, the old generator emitted the
+  fixed string `88888888-8888-4888-8888-888888888888`.
+
+  `Registry._generateRegistryId`, `Registry._generateAuditId` and
+  `Claim._generateBatchId` had the same defect via `Date.now() + Math.random()`
+  (the surrounding `sha256` added no entropy).
+
+  All five now route through a new `lib/util/id.js` (`uuid4`, `randomHex`) backed
+  by `bsv.crypto.Random`, matching what `GDAF`'s attestation signer already did.
+  **Output formats are unchanged** (`urn:uuid:` v4, `reg_` + 16 hex, `audit_` +
+  12 hex, 16 hex), so stored identifiers and consumers are unaffected. The
+  `// Non-security: identifier collision avoidance only` comments at these sites
+  asserted the opposite of the truth and are gone.
+
+- **`Registry._generateAuditId` widened from 48 to 128 bits.** Audit entries are
+  minted per action and retained for years, and a collision silently overwrites a
+  record in a `Map`-keyed store; at 48 bits a log passed a ~50% chance of a
+  collision around 16M entries. The per-registry ids above stay at 64 bits — they
+  are minted once each, so the birthday bound never comes into play.
+
+  **Format change:** `audit_` + 32 hex characters, was `audit_` + 12. The ids are
+  opaque and are not parsed anywhere in the package, and existing stored ids keep
+  working as map keys.
+
+- **`Signature.prototype.applySecurityPatches()` now rejects a non-canonical
+  signature instead of silently rewriting it.** It replaced a high-S `s` with
+  `n - s` under an "anti-malleability" comment. That cannot protect against
+  malleability: ECDSA accepts `s` and `n - s` equally, so the rewritten signature
+  verifies exactly as the original did, and the only effect was to hide from the
+  caller that they had been handed a malleated signature. It now throws on
+  `s > n/2` (alongside the existing zero and out-of-range checks) and no longer
+  mutates. `toCanonical()` remains the way to deliberately normalize a signature,
+  and is unchanged — it returns a new Signature and never mutates the original.
+
+  The method had no callers anywhere in the package, and its docstring's claim
+  that it is "called during crypto operations" was false; that claim is gone.
+
+  **Breaking** for callers relying on it to normalize in place.
+
+- **`ECDSA` no longer reuses a nonce when one instance signs twice.** `k` persisted
+  on the instance across `sign()` calls (`set()` deliberately carried it, and
+  `_findSignature` only derived a nonce when `!this.k`), so the documented
+  build-an-instance-and-`set()` idiom signed a second message with the *same* `k`:
+
+  ```js
+  const e = ECDSA().set({ privkey })
+  e.set({ hashbuf: h1 }).sign()   // k derived and cached
+  e.set({ hashbuf: h2 }).sign()   // same k, same r
+  ```
+
+  Two signatures over different messages under one nonce reveal the private key by
+  elementary algebra; this was verified with a repro that recovers the signer's WIF
+  from the two signatures. `signRandomK()` was worse — it assigned `this.k`, so any
+  later `sign()` on that instance silently reused the random nonce. `k` now carries
+  a freshness bit: every assignment path (`ecdsa.k = ...`, `set({k})`, `randomK()`,
+  `deterministicK()`) marks it fresh, and a signature consumes it, so the next
+  `sign()` derives a new RFC 6979 nonce instead of reusing a spent one. No internal
+  call site was affected — each constructs a fresh `ECDSA` per signature — so this
+  changes no signature this library previously produced. Backward compatible: an
+  explicitly supplied `k` is still honoured for one signature (RFC 6979 test
+  vectors included), and signing the same message still yields the same signature.
+  Inherited from upstream bsv.
+
+- **`SmartVerify.smartVerify()` now rejects malleated (high-S) signatures instead
+  of accepting them.** The function canonicalized `s` and then verified the
+  *rewritten* signature — but ECDSA accepts `s` and `n-s` equally, so the
+  canonicalization was a no-op that made every high-S signature return `true`. A
+  caller using the hardened module as a low-S gate (its stated contract: "valid
+  **and** canonical", its header: "malleability protection") received no protection
+  while believing otherwise. It now returns `false` for `s > n/2`, matching the
+  neighbouring `isCanonical()`. `canonicalize()` is unchanged — it is honestly
+  named and still rewrites.
+
+  **Breaking:** code relying on `smartVerify` to accept and silently normalize
+  high-S signatures must canonicalize first (`SmartVerify.canonicalize(sig)`) or
+  use `ECDSA.verify`, which is unchanged and still accepts either form. The test
+  asserting the old behaviour ("accepts a malleated (high-S) signature as valid but
+  canonicalizes it") encoded the bug as intent and has been inverted.
+
+### Fixed
+
+- **`npm test` now runs against an installed copy of the package.**
+  `test/build/esm_wrapper.js` required `scripts/gen-esm-wrapper`, which is dev
+  tooling and is not published. Since `.mocharc.json` globs `test/**/*.js`, that
+  one unresolvable require aborted the whole run before a single test executed —
+  so the suite the package deliberately ships was dead on arrival in the tarball.
+  The two checks that regenerate and diff `index.mjs` can only run from a
+  checkout and now skip when the generator is absent; the ESM import checks, which
+  are the ones meaningful to a consumer, run everywhere. Verified by packing,
+  installing and running the suite from the tarball: 4463 passing, 2 pending.
+
+## [7.0.2] - 2026-07-16
+
+### Fixed
+
+A codebase-wide audit for the same silent-argument class as the 7.0.1
+`Mnemonic.fromRandom` bug found three more confirmed foot-guns, each verified
+with a repro and now gated by a regression test:
+
+- **`HDPrivateKey.fromRandom(network)` silently ignored the network** and always
+  returned a mainnet key. `fromRandom('testnet')` produced an `xprv` (livenet)
+  instead of a `tprv` (testnet), with no error — so a testnet wallet was
+  generated on mainnet. It now forwards the network to the constructor (which
+  already routes it to random generation). `fromRandom()` default is unchanged.
+- **`Base58Check.fromString` returned a plain `Base58`** (no checksum) instead of
+  a `Base58Check`, so `Base58Check.encode(...)` → `fromString` → `toString`
+  silently round-tripped to a *different, unchecksummed* string. It now returns a
+  `Base58Check`.
+- **Bitcore ECIES dropped its `opts` when called without `new`** — `ECIES({ noKey:
+  true })` (the factory idiom used throughout the suite) silently ignored
+  `noKey`/`shortTag`, changing the wire format (e.g. leaking the 33-byte sender
+  pubkey). The no-`new` path now forwards `opts`. (The default `bsv.ECIES`
+  electrum variant was already correct.)
+
 ## [7.0.1] - 2026-07-16
 
 ### Fixed (security)

package/README.md

@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js` |
-| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.0.1/bsv.bundle.js` |
+| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js` |
+| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.0.1/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.0.1/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.0.1/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.0.1/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.0.1/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.0.1/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.0.1/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.0.1/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.0.1/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.0.1/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.1.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.1.0/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.0.1/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.1.0/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.0.1/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.0.1/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.0.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.1.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.1.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.1.0/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.2MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.5MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.0.1/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@7.0.1/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@7.1.0/...` URLs.
 
 ## 🔐 Security