@smartledger/bsv 7.0.2 → 7.2.0

package/lib/ordinals/inscription.js

@@ -23,47 +23,118 @@ var ORD = Buffer.from('ord', 'utf8')
 function scriptClass () { return bsv.Script }
 function op () { return bsv.Opcode }
 
+/** Describe a rejected value for an error message, without dumping its contents. */
+function typeName (v) {
+  if (v === null) return 'null'
+  if (v === undefined) return 'undefined'
+  if (Array.isArray(v)) return 'an array'
+  var t = typeof v
+  return (t === 'object' ? 'an ' : 'a ') + t
+}
+
+/**
+ * Coerce a caller-supplied field to bytes.
+ *
+ * Only strings and Buffers are accepted. Everything else is rejected rather than run
+ * through `String(v)`: an inscription is permanent, and stringifying an object writes
+ * the literal text `[object Object]` to the chain, which is never what the caller meant.
+ */
+function toBuf (v, name) {
+  if (Buffer.isBuffer(v)) return v
+  if (typeof v === 'string') return Buffer.from(v, 'utf8')
+  throw new Error(name + ' must be a string or Buffer, got ' + typeName(v))
+}
+
+/** Fields callers reach for when they mean `content`; named back to them on error. */
+var CONTENT_ALIASES = ['data', 'body', 'payload', 'text', 'message']
+
 /** Resolve a base locking script from a Script, an Address, or an address string. */
 function resolveLock (params) {
   var Script = scriptClass()
-  if (params.lock) {
-    if (params.lock instanceof Script) return params.lock
-    if (Buffer.isBuffer(params.lock)) return Script.fromBuffer(params.lock)
-    if (typeof params.lock === 'string') return Script.fromHex(params.lock)
-    throw new Error('lock must be a Script, Buffer, or hex string')
+  var hasLock = params.lock != null
+  var hasAddress = params.address != null
+
+  // `lock` used to win silently. Two different owners in one call is a mistake worth
+  // surfacing, not resolving by precedence.
+  if (hasLock && hasAddress) {
+    throw new Error('buildInscription accepts `lock` or `address`, not both — they name ' +
+      'different owners and one would be silently ignored')
+  }
+
+  if (hasLock) {
+    var lock
+    if (params.lock instanceof Script) lock = params.lock
+    else if (Buffer.isBuffer(params.lock)) lock = Script.fromBuffer(params.lock)
+    else if (typeof params.lock === 'string') lock = Script.fromHex(params.lock)
+    else throw new Error('lock must be a Script, Buffer, or hex string, got ' + typeName(params.lock))
+
+    // An empty base lock leaves nothing but the inert envelope, and the envelope is
+    // skipped at execution — so whatever the spender pushes is the final stack and the
+    // ordinal is anyone-can-spend. Only a caller appending the envelope to a lock it
+    // supplies itself (as ordlock.js does) legitimately wants this.
+    if (!lock.chunks.length && !params.allowEmptyLock) {
+      throw new Error('lock is empty: the inscription would carry no locking script at ' +
+        'all and the ordinal would be spendable by anyone. Pass a real lock, or ' +
+        '{ allowEmptyLock: true } if you are appending this envelope to your own script')
+    }
+    return lock
   }
-  if (params.address) {
+
+  if (hasAddress) {
     var addr = (params.address instanceof bsv.Address)
       ? params.address
       : bsv.Address.fromString(String(params.address))
     return Script.buildPublicKeyHashOut(addr)
   }
-  throw new Error('buildInscription requires an address or a lock script')
-}
 
-function toBuf (v, enc) {
-  if (Buffer.isBuffer(v)) return v
-  if (v == null) return Buffer.alloc(0)
-  return Buffer.from(String(v), enc || 'utf8')
+  throw new Error('buildInscription requires an address or a lock script')
 }
 
 /**
  * Build a 1Sat Ordinals inscription locking script: a base lock followed by the
  * inert `OP_FALSE OP_IF ... OP_ENDIF` envelope carrying the content.
  *
+ * `content` is required. An inscription with no body is a well-formed script that
+ * inscribes nothing, so omitting it throws rather than silently producing one; pass an
+ * explicit `''` if an empty payload is genuinely what you want.
+ *
  * @param {object} params
- * @param {string|Buffer} params.contentType  e.g. 'text/plain', 'image/png'
- * @param {string|Buffer} params.content       the inscription body
- * @param {Script|Buffer|string} [params.lock] base locking script (overrides address)
- * @param {Address|string} [params.address]    P2PKH owner (used if no `lock`)
+ * @param {string|Buffer} params.content        the inscription body (required)
+ * @param {string|Buffer} [params.contentType]  e.g. 'text/plain', 'image/png'.
+ *   Defaults to 'text/plain' for string content; required for Buffer content, which
+ *   carries no hint about what it is.
+ * @param {Script|Buffer|string} [params.lock]  base locking script (mutually exclusive
+ *   with `address`)
+ * @param {Address|string} [params.address]     P2PKH owner (mutually exclusive with `lock`)
+ * @param {boolean} [params.allowEmptyLock]     permit an empty base lock; see resolveLock
  * @returns {Script} the full inscription locking script
  */
 function buildInscription (params) {
   params = params || {}
   var Opcode = op()
   var lock = resolveLock(params)
-  var contentType = toBuf(params.contentType || 'text/plain')
-  var content = toBuf(params.content)
+
+  if (params.content == null) {
+    var alias = CONTENT_ALIASES.filter(function (k) { return params[k] != null })[0]
+    throw new Error('buildInscription requires `content`' +
+      (alias ? ' — received `' + alias + '`, which is not read' : '') +
+      '. Omitting it would inscribe an empty payload; pass content: \'\' if that is intended')
+  }
+  var content = toBuf(params.content, 'content')
+
+  var contentType
+  if (params.contentType == null) {
+    // A Buffer is opaque — defaulting it to text/plain mislabels binary content on a
+    // permanent record, so make the caller declare it.
+    if (Buffer.isBuffer(params.content)) {
+      throw new Error('contentType is required when content is a Buffer (e.g. ' +
+        "'image/png', 'application/octet-stream') — it cannot be inferred from bytes")
+    }
+    contentType = Buffer.from('text/plain', 'utf8')
+  } else {
+    contentType = toBuf(params.contentType, 'contentType')
+    if (!contentType.length) throw new Error('contentType must not be empty')
+  }
 
   // Clone the base lock so we never mutate the caller's Script.
   var s = scriptClass().fromBuffer(lock.toBuffer())
@@ -84,6 +155,14 @@ function chunkIsOp (chunk, opcodenum) {
 
 /**
  * Parse a 1Sat Ordinals inscription out of a locking script.
+ *
+ * The 1Sat spec allows the locking script to be *prepended or appended* to the
+ * envelope ("A locking script (typically P2PKH) is then prepended/appended to the
+ * inscription script, optionally separated by OP_CODESEPARATOR"). `lock` is therefore
+ * the whole script minus the envelope, in script order — not merely what precedes it.
+ * A separating OP_CODESEPARATOR is kept, because it is genuinely part of the script
+ * that runs and affects the sighash.
+ *
  * @param {Script|Buffer|string} script
  * @returns {null|{ contentType: string, content: Buffer, contentText: string, lock: Script }}
  *   null if the script carries no inscription envelope.
@@ -108,16 +187,13 @@ function parseInscription (script) {
   }
   if (start === -1) return null
 
-  // Everything before the envelope is the base lock.
-  var lock = new Script()
-  for (var k = 0; k < start; k++) lock.chunks.push(chunks[k])
-
   // Walk fields after "ord" until OP_ENDIF: OP_1 => content-type, OP_0 => body.
   var contentType = Buffer.alloc(0)
   var content = Buffer.alloc(0)
+  var end = chunks.length // index of OP_ENDIF, or past the end if the envelope is unterminated
   for (var j = start + 3; j < chunks.length; j++) {
     var c = chunks[j]
-    if (chunkIsOp(c, Opcode.OP_ENDIF)) break
+    if (chunkIsOp(c, Opcode.OP_ENDIF)) { end = j; break }
     if (chunkIsOp(c, Opcode.OP_1) && chunks[j + 1] && chunks[j + 1].buf) {
       contentType = chunks[j + 1].buf; j++
     } else if (chunkIsOp(c, Opcode.OP_0) && chunks[j + 1] && chunks[j + 1].buf) {
@@ -125,6 +201,13 @@ function parseInscription (script) {
     }
   }
 
+  // The lock is everything outside the envelope. Taking only what precedes it dropped
+  // the lock entirely for the spec-legal appended form, reporting an owned ordinal as
+  // having no locking script at all.
+  var lock = new Script()
+  for (var k = 0; k < start; k++) lock.chunks.push(chunks[k])
+  for (var m = end + 1; m < chunks.length; m++) lock.chunks.push(chunks[m])
+
   return {
     contentType: contentType.toString('utf8'),
     content: content,
@@ -140,11 +223,18 @@ function isInscription (script) {
 
 /**
  * Build the 1-satoshi Transaction.Output carrying an inscription.
+ * @param {object} params           as buildInscription, plus:
+ * @param {number} [params.satoshis]  defaults to 1 (the 1Sat Ordinals convention)
  * @returns {Transaction.Output}
  */
 function createInscriptionOutput (params) {
   params = params || {}
   var satoshis = params.satoshis != null ? params.satoshis : 1
+  // Output rejects negatives and fractions, but 0 and the string '1' slipped through:
+  // a 0-sat output carries no ordinal at all.
+  if (typeof satoshis !== 'number' || !Number.isInteger(satoshis) || satoshis < 1) {
+    throw new Error('satoshis must be a positive integer (1 for a standard 1Sat ordinal)')
+  }
   return new bsv.Transaction.Output({
     script: buildInscription(params),
     satoshis: satoshis

package/lib/ordinals/ordlock.js

@@ -182,6 +182,7 @@ function buildOrdLock (params) {
   if (params.inscription) {
     var env = inscription.buildInscription({
       lock: new Script(), // envelope only; the covenant above is the real lock
+      allowEmptyLock: true, // ...which is why the empty-lock guard does not apply here
       contentType: params.inscription.contentType,
       content: params.inscription.content
     })

package/lib/util/id.js

@@ -0,0 +1,48 @@
+'use strict'
+
+var Random = require('../crypto/random')
+
+/**
+ * RFC 4122 version 4 UUID, drawn from the CSPRNG.
+ *
+ * The engine's built-in PRNG is not an acceptable source here: V8 implements it
+ * with xorshift128+, whose internal state is recoverable from a handful of
+ * outputs, so one emitted identifier can expose every later id from the same
+ * process.
+ *
+ * @returns {String} e.g. '1b4e28ba-2fa1-4d9b-b6f7-1e3c9a8d5c02'
+ */
+function uuid4 () {
+  var bytes = Random.getRandomBuffer(16)
+
+  bytes[6] = (bytes[6] & 0x0f) | 0x40 // version 4
+  bytes[8] = (bytes[8] & 0x3f) | 0x80 // variant 10x
+
+  var hex = bytes.toString('hex')
+  return [
+    hex.substring(0, 8),
+    hex.substring(8, 12),
+    hex.substring(12, 16),
+    hex.substring(16, 20),
+    hex.substring(20, 32)
+  ].join('-')
+}
+
+/**
+ * Opaque identifier of `length` hex characters, drawn from the CSPRNG.
+ * Entropy is 4 bits per character, so callers choose `length` to bound
+ * collision probability across the population of ids they expect to mint.
+ *
+ * @param {Number} length - number of hex characters
+ * @returns {String}
+ */
+function randomHex (length) {
+  return Random.getRandomBuffer(Math.ceil(length / 2))
+    .toString('hex')
+    .substring(0, length)
+}
+
+module.exports = {
+  uuid4: uuid4,
+  randomHex: randomHex
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.0.2",
+  "version": "7.2.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",

package/test/build/esm_wrapper.js

@@ -16,23 +16,30 @@ var fs = require('fs')
 var path = require('path')
 var execFileSync = require('child_process').execFileSync
 var spawnSync = require('child_process').spawnSync
-var gen = require('../../scripts/gen-esm-wrapper')
 
 var ROOT = path.resolve(__dirname, '../..')
 var MJS = path.join(ROOT, 'index.mjs')
 
+// scripts/ is dev tooling and is not published, so the two checks that
+// regenerate index.mjs can only run from a checkout. The ESM import checks below
+// run everywhere, including against an installed copy. Presence is tested rather
+// than try/catch'd so a broken generator still fails loudly in the repo.
+var GEN = path.join(ROOT, 'scripts', 'gen-esm-wrapper.js')
+var gen = fs.existsSync(GEN) ? require(GEN) : null
+var itFromCheckout = gen ? it : it.skip
+
 function runEsm (body) {
   return execFileSync(process.execPath, ['--input-type=module', '-e', body],
     { cwd: ROOT, stdio: 'pipe' })
 }
 
 describe('ESM wrapper (index.mjs)', function () {
-  it('is in sync with the CJS surface (no drift)', function () {
+  itFromCheckout('is in sync with the CJS surface (no drift)', function () {
     var onDisk = fs.readFileSync(MJS, 'utf8')
     onDisk.should.equal(gen.generate())
   })
 
-  it('exports every non-accessor top-level member as a named binding', function () {
+  itFromCheckout('exports every non-accessor top-level member as a named binding', function () {
     var bsv = require('../..')
     var names = gen.exportableNames(bsv)
     names.length.should.be.above(100)

package/test/crypto/ecdsa.js

@@ -117,6 +117,79 @@ describe('ECDSA', function () {
     })
   })
 
+  describe('nonce reuse', function () {
+    // Signing two different messages under one nonce reveals the private key.
+    var N = point.getN()
+    var h1 = Hash.sha256(Buffer.from('pay alice 1 coin'))
+    var h2 = Hash.sha256(Buffer.from('pay bob 2 coins'))
+
+    var freshSigner = function () {
+      return ECDSA().set({
+        privkey: new Privkey(BN.fromBuffer(Buffer.from(
+          'fee0a1f7afebf9d2a5a80c0c98a31c709681cce195cbcd06342b517970c0be1e', 'hex')))
+      })
+    }
+
+    it('does not reuse k when one instance signs two different messages', function () {
+      var e = freshSigner()
+      var sig1 = e.set({ hashbuf: h1 }).sign().sig
+      var k1 = e.k
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+      var k2 = e.k;
+      (k1.cmp(k2) === 0).should.equal(false)
+      sig1.r.eq(sig2.r).should.equal(false)
+    })
+
+    it('does not reuse k across signRandomK calls on one instance', function () {
+      var e = freshSigner()
+      var sig1 = e.set({ hashbuf: h1 }).signRandomK().sig
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+      sig1.r.eq(sig2.r).should.equal(false)
+    })
+
+    it('does not leak the private key from two signatures by one instance', function () {
+      var e = freshSigner()
+      var d = e.privkey.bn
+      var sig1 = e.set({ hashbuf: h1 }).sign().sig
+      var sig2 = e.set({ hashbuf: h2 }).sign().sig
+
+      // toLowS may have flipped either s, so try every sign combination.
+      var red = BN.red(N)
+      var inv = function (x) { return x.toRed(red).redInvm().fromRed() }
+      var mul = function (a, b) { return a.toRed(red).redMul(b.toRed(red)).fromRed() }
+      var e1 = BN.fromBuffer(h1)
+      var e2 = BN.fromBuffer(h2)
+      var recovered = false
+      ;[1, -1].forEach(function (f1) {
+        ;[1, -1].forEach(function (f2) {
+          var S1 = f1 === 1 ? sig1.s : N.sub(sig1.s)
+          var S2 = f2 === 1 ? sig2.s : N.sub(sig2.s)
+          var diff = S1.sub(S2).umod(N)
+          if (diff.isZero()) return
+          var k = mul(e1.sub(e2).umod(N), inv(diff))
+          var guess = mul(S1.mul(k).umod(N).sub(e1).umod(N), inv(sig1.r))
+          if (guess.toString(16) === d.toString(16)) recovered = true
+        })
+      })
+      recovered.should.equal(false)
+    })
+
+    it('still honours an explicitly supplied k for a single signature', function () {
+      var k = new BN('114860389168127852803919605627759231199925249596762615988727970217268189974335', 10)
+      var a = freshSigner().set({ hashbuf: h1, k: k })
+      var b = freshSigner().set({ hashbuf: h1, k: k })
+      a.sign().sig.r.eq(b.sign().sig.r).should.equal(true)
+      a.k.eq(k).should.equal(true)
+    })
+
+    it('signs the same message deterministically across instances', function () {
+      var a = freshSigner().set({ hashbuf: h1 }).sign().sig
+      var b = freshSigner().set({ hashbuf: h1 }).sign().sig
+      a.r.eq(b.r).should.equal(true)
+      a.s.eq(b.s).should.equal(true)
+    })
+  })
+
   describe('#toPublicKey', function () {
     it('should calculate the correct public key', function () {
       ecdsa.k = new BN('114860389168127852803919605627759231199925249596762615988727970217268189974335', 10)

package/test/crypto/security.js

@@ -69,6 +69,52 @@ describe('SmartLedger Security Patches', function () {
       // change which key/message the signature is valid for.
       canonical.r.cmp(highS.r).should.equal(0)
     })
+
+    it('toCanonical() returns a new signature and leaves the original alone', function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      var n = Point.getN()
+      var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
+      var highS = new Signature({ r: sig.r, s: n.sub(lowS) })
+      var before = highS.s.toString()
+
+      var canonical = highS.toCanonical()
+      canonical.should.not.equal(highS)
+      highS.s.toString().should.equal(before)
+    })
+  })
+
+  describe('applySecurityPatches', function () {
+    var highSig = function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      var n = Point.getN()
+      var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
+      return new Signature({ r: sig.r, s: n.sub(lowS) })
+    }
+
+    it('accepts a canonical signature and returns it for chaining', function () {
+      var sig = ECDSA.sign(hash, privateKey)
+      sig.applySecurityPatches().should.equal(sig)
+    })
+
+    it('rejects a non-canonical (high-S) signature rather than rewriting it', function () {
+      // Rewriting s to n-s cannot protect against malleability: the rewritten
+      // signature verifies exactly as the original, so silently normalizing only
+      // hides from the caller that the signature was malleated.
+      var highS = highSig()
+      var before = highS.s.toString()
+
+      expect(function () { highS.applySecurityPatches() }).to.throw(/non-canonical/)
+      highS.s.toString().should.equal(before)
+    })
+
+    it('rejects zero and out-of-range components', function () {
+      expect(function () {
+        new Signature({ r: new BN(0), s: new BN(1) }).applySecurityPatches()
+      }).to.throw(/zero r or s/)
+      expect(function () {
+        new Signature({ r: new BN(1), s: Point.getN() }).applySecurityPatches()
+      }).to.throw(/out of range/)
+    })
   })
 
   describe('SmartVerify Enhanced Validation', function () {
@@ -77,12 +123,15 @@ describe('SmartLedger Security Patches', function () {
       SmartVerify.smartVerify(hash, sig, publicKey).should.equal(true)
     })
 
-    it('accepts a malleated (high-S) signature as valid but canonicalizes it', function () {
+    it('rejects a malleated (high-S) signature', function () {
       var sig = ECDSA.sign(hash, privateKey)
       var n = Point.getN()
       var lowS = sig.s.lte(n.shrn(1)) ? sig.s : n.sub(sig.s)
       var highS = new Signature({ r: sig.r, s: n.sub(lowS) })
-      SmartVerify.smartVerify(hash, highS, publicKey).should.equal(true)
+      SmartVerify.isCanonical(highS).should.equal(false)
+      SmartVerify.smartVerify(hash, highS, publicKey).should.equal(false)
+      // ...while the canonical form of the same signature still verifies.
+      SmartVerify.smartVerify(hash, new Signature({ r: sig.r, s: lowS }), publicKey).should.equal(true)
     })
 
     it('throws on an invalid (non-32-byte) message hash', function () {

package/test/crypto/signature.js

@@ -2,9 +2,13 @@
 
 var _ = require('../../lib/util/_')
 var should = require('chai').should()
+var expect = require('chai').expect
 var bsv = require('../..')
 var BN = bsv.crypto.BN
 var Signature = bsv.crypto.Signature
+var ECDSA = bsv.crypto.ECDSA
+var Hash = bsv.crypto.Hash
+var PrivateKey = bsv.PrivateKey
 var JSUtil = bsv.util.js
 var Interpreter = bsv.Script.Interpreter
 
@@ -189,6 +193,83 @@ describe('Signature', function () {
       var parsed = Signature.parseDER(sig, false)
       should.exist(parsed)
     })
+
+    it('reports sneg for a padded s', function () {
+      // 02 21 00ab.. — s carries the pad that clears its high bit.
+      var sighex = '304502203e4516da7253cf068effec6b95c41221c0cf3a8e6ccb8cbf1725b562e9afde2c' +
+        '022100ab1e3da73d67e32045a20e0b999e049978ea8d6ee5480d485fcf2ce0d03b2ef0'
+      var parsed = Signature.parseDER(Buffer.from(sighex, 'hex'))
+      parsed.sbuf[0].should.equal(0x00)
+      parsed.sneg.should.equal(true)
+      parsed.rneg.should.equal(false)
+    })
+  })
+
+  describe('#parseDER canonicality', function () {
+    // A non-canonical INTEGER is a second encoding of the same number, i.e. a
+    // malleable signature. Strict (the default, used by fromDER/fromString and
+    // so by credential/proof verification) rejects them; non-strict must keep
+    // accepting them, because signatures already on chain are not canonical and
+    // fromTxFormat has to parse them.
+    var cases = [
+      { name: 'r negative (high bit set, unpadded)', hex: '3006' + '0201ff' + '020101', err: /Value of r is negative/ },
+      { name: 's negative (high bit set, unpadded)', hex: '3006' + '020101' + '0201ff', err: /Value of s is negative/ },
+      { name: 'r excessively padded', hex: '3007' + '02020011' + '020101', err: /Value of r is excessively padded/ },
+      { name: 's excessively padded', hex: '3007' + '020101' + '02020011', err: /Value of s is excessively padded/ },
+      { name: 'r zero-length', hex: '3005' + '0200' + '020101', err: /Length of r is zero/ },
+      { name: 's zero-length', hex: '3005' + '020101' + '0200', err: /Length of s is zero/ }
+    ]
+
+    cases.forEach(function (c) {
+      it('strict rejects ' + c.name, function () {
+        expect(function () {
+          Signature.parseDER(Buffer.from(c.hex, 'hex'))
+        }).to.throw(c.err)
+      })
+
+      it('non-strict still accepts ' + c.name + ' (chain compatibility)', function () {
+        should.exist(Signature.parseDER(Buffer.from(c.hex, 'hex'), false))
+      })
+    })
+
+    it('strict accepts a minimally padded integer', function () {
+      // 0x00ff is canonical: the pad is required to clear the high bit.
+      should.exist(Signature.parseDER(Buffer.from('3008020200ff020200ff', 'hex')))
+    })
+
+    it('strict accepts a canonical zero integer', function () {
+      should.exist(Signature.parseDER(Buffer.from('3006020100020100', 'hex')))
+    })
+
+    it('rejects a malleated re-encoding while the original still verifies', function () {
+      var privkey = new PrivateKey()
+      var hashbuf = Hash.sha256(Buffer.from('der canonicality'))
+      var sig = ECDSA.sign(hashbuf, privkey)
+      var der = sig.toDER()
+
+      ECDSA.verify(hashbuf, Signature.fromDER(der), privkey.toPublicKey()).should.equal(true)
+
+      // Re-encode r with one pad byte more than DER allows: same r, different
+      // bytes. The extra zero goes on top of the canonical encoding, so this is
+      // excess padding whether or not r needed a pad to begin with.
+      var canonical = function (nbuf) {
+        return (nbuf[0] & 0x80) ? Buffer.concat([Buffer.from([0x00]), nbuf]) : nbuf
+      }
+      var padded = Buffer.concat([Buffer.from([0x00]), canonical(sig.r.toBuffer())])
+      var sEnc = canonical(sig.s.toBuffer())
+      var body = Buffer.concat([
+        Buffer.from([0x02, padded.length]), padded,
+        Buffer.from([0x02, sEnc.length]), sEnc
+      ])
+      var malleated = Buffer.concat([Buffer.from([0x30, body.length]), body])
+
+      malleated.toString('hex').should.not.equal(der.toString('hex'))
+      expect(function () {
+        Signature.fromDER(malleated)
+      }).to.throw(/excessively padded/)
+      // The same bytes remain parseable on the non-strict (chain) path.
+      Signature.parseDER(malleated, false).r.eq(sig.r).should.equal(true)
+    })
   })
 
   describe('#toDER', function () {

package/test/ltp/ids.js

@@ -0,0 +1,74 @@
+'use strict'
+
+/* global describe, it */
+
+require('chai').should()
+var expect = require('chai').expect
+
+var bsv = require('../../index.js')
+
+var UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/
+
+// A token id is covered by the credential's signature, keys the registry's
+// registration/revocation maps, and feeds proof material — so it must be
+// unpredictable, not merely distinct.
+describe('LTP identifiers', function () {
+  var generators = [
+    { name: 'Right._generateUUID', fn: function () { return bsv.LTP.Right._generateUUID() }, format: UUID_V4 },
+    { name: 'Obligation._generateUUID', fn: function () { return bsv.LTP.Obligation._generateUUID() }, format: UUID_V4 },
+    { name: 'Registry._generateRegistryId', fn: function () { return bsv.LTP.Registry._generateRegistryId() }, format: /^reg_[0-9a-f]{16}$/ },
+    { name: 'Registry._generateAuditId', fn: function () { return bsv.LTP.Registry._generateAuditId() }, format: /^audit_[0-9a-f]{32}$/ },
+    { name: 'Claim._generateBatchId', fn: function () { return bsv.LTP.Claim._generateBatchId() }, format: /^[0-9a-f]{16}$/ }
+  ]
+
+  var withFrozenMathRandom = function (fn) {
+    var original = Math.random
+    Math.random = function () { return 0.5 }
+    try { return fn() } finally { Math.random = original }
+  }
+
+  generators.forEach(function (g) {
+    describe(g.name, function () {
+      it('keeps its documented format', function () {
+        g.fn().should.match(g.format)
+      })
+
+      it('does not repeat', function () {
+        var seen = {}
+        for (var i = 0; i < 500; i++) {
+          var id = g.fn()
+          expect(seen[id], 'duplicate id: ' + id).to.equal(undefined)
+          seen[id] = true
+        }
+      })
+
+      it('does not draw from the engine PRNG', function () {
+        withFrozenMathRandom(function () {
+          var seen = {}
+          for (var i = 0; i < 100; i++) {
+            var id = g.fn()
+            expect(seen[id], 'id is predictable from the engine PRNG: ' + id).to.equal(undefined)
+            seen[id] = true
+          }
+        })
+      })
+    })
+  })
+
+  it('issues unpredictable ids on real tokens', function () {
+    var type = Object.values(bsv.LTP.Right.RightTypes)[0]
+    var ids = {}
+    for (var i = 0; i < 25; i++) {
+      var token = bsv.LTP.Right.create(
+        type,
+        'did:example:issuer',
+        'did:example:subject',
+        { description: 'test right' }
+      )
+      token.id.should.match(/^urn:uuid:/)
+      token.id.replace('urn:uuid:', '').should.match(UUID_V4)
+      expect(ids[token.id], 'duplicate token id').to.equal(undefined)
+      ids[token.id] = true
+    }
+  })
+})