@smartledger/bsv 8.0.1 → 8.2.0

package/lib/gdaf/zk-prover.js

@@ -8,18 +8,26 @@ var $ = require('../util/preconditions')
 
 /**
  * ZKProver
- * 
- * Zero-Knowledge Proof system for selective disclosure of credential fields.
- * Implements Merkle tree-based proofs and commitment schemes for privacy-preserving
- * credential verification.
- * 
- * Features:
- * - Selective field disclosure
- * - Merkle inclusion proofs
- * - Commitment schemes with salt
- * - Range proofs for numerical values
- * - Proof of age without revealing birthdate
- * - Hash-based privacy preservation
+ *
+ * Selective disclosure of credential fields, built on a salted Merkle tree and hash
+ * commitments.
+ *
+ * NOT ZERO-KNOWLEDGE, despite the name this module has carried. There is no
+ * zero-knowledge machinery here — no Bulletproofs, no pairing, no circuit. What it
+ * provides is:
+ *
+ * - Selective field disclosure that genuinely withholds the undisclosed fields. Each
+ *   leaf carries its own salt and only the disclosed leaves' salts travel in the proof,
+ *   so an undisclosed leaf hash is a commitment under a secret the verifier never sees.
+ * - Merkle inclusion proofs binding disclosed fields to a credential root.
+ * - Hash commitments for ranges and ages. These can only be verified by OPENING them,
+ *   which reveals the committed value to the verifier. A real age proof would not; this
+ *   cannot do that, and callers who need it need a different primitive.
+ *
+ * The range and age verifiers previously returned a boolean the prover wrote about
+ * itself, so any object of the right shape verified. They now require the opening and
+ * check the commitment. Keep that distinction in mind before describing anything built
+ * on this module as zero-knowledge to a reviewer.
  */
 
 /**
@@ -43,29 +51,46 @@ function ZKProver(options) {
  * @returns {Object} Merkle tree data
  */
 ZKProver.createMerkleTree = function(credential, salt) {
-  salt = salt || Random.getRandomBuffer(32).toString('hex')
-  
   $.checkArgument(credential && typeof credential === 'object', 'Invalid credential')
-  
+
   // Extract all fields from credential
   var fields = ZKProver._extractFields(credential)
-  
-  // Create leaf hashes
-  var leaves = fields.map(function(field) {
-    var fieldData = field.path + ':' + JSON.stringify(field.value) + ':' + salt
+
+  // PER-LEAF salts. A single salt shared by every leaf defeats selective disclosure
+  // entirely: the proof has to carry the salt so the verifier can recompute the
+  // disclosed leaves, and with that one value an attacker can hash candidate
+  // (path, value) pairs against the sibling hashes on the Merkle path and read back
+  // exactly the fields the holder withheld. Confirmed against a synthetic credential —
+  // disclosing only `credentialSubject.name` leaked `id`, `partyAffiliation` and
+  // `eligible`, the last two by brute-forcing their shared parent node.
+  //
+  // With a salt per leaf, only the disclosed leaves' salts travel in the proof, so an
+  // undisclosed leaf hash is a commitment under a secret the verifier never sees.
+  //
+  // `salt` is accepted only to derive DETERMINISTIC per-leaf salts, so a caller that
+  // needs reproducible trees still gets them without sharing one value across leaves.
+  var master = salt || Random.getRandomBuffer(32).toString('hex')
+
+  var leaves = fields.map(function(field, index) {
+    var leafSalt = Hash.sha256(
+      Buffer.from(master + ':' + index + ':' + field.path, 'utf8')
+    ).toString('hex')
+    var fieldData = field.path + ':' + JSON.stringify(field.value) + ':' + leafSalt
     return {
       path: field.path,
       value: field.value,
       hash: Hash.sha256(Buffer.from(fieldData, 'utf8')).toString('hex'),
-      salt: salt
+      salt: leafSalt
     }
   })
-  
+
   // Build Merkle tree
   var tree = ZKProver._buildMerkleTree(leaves.map(l => l.hash))
-  
+
   return {
-    salt: salt,
+    // The MASTER salt. Never put this in a proof — it re-derives every leaf salt and
+    // reopens the whole credential. generateSelectiveProof() ships per-leaf salts.
+    salt: master,
     leaves: leaves,
     tree: tree,
     root: tree[tree.length - 1][0]
@@ -122,11 +147,16 @@ ZKProver.generateSelectiveProof = function(credential, disclosePaths, salt) {
       return {
         path: leaf.path,
         value: leaf.value,
-        hash: leaf.hash
+        hash: leaf.hash,
+        // The salt for THIS leaf only. Shipping one salt for the whole credential let
+        // a verifier — or anyone the proof is shown to — brute-force the withheld
+        // fields off the Merkle path.
+        salt: leaf.salt
       }
     }),
-    merkleProofs: merkleProofs,
-    salt: salt
+    merkleProofs: merkleProofs
+    // NOTE: the master salt is deliberately absent. It re-derives every leaf salt,
+    // including the undisclosed ones, which would reopen the whole credential.
   }
 }
 
@@ -157,8 +187,13 @@ ZKProver.verifySelectiveProof = function(proof, expectedRoot) {
         continue
       }
       
-      // Verify field hash
-      var fieldData = field.path + ':' + JSON.stringify(field.value) + ':' + proof.salt
+      // Verify field hash, using the salt carried with THIS field. Reading a
+      // credential-wide `proof.salt` is what the leak fix removed.
+      if (typeof field.salt !== 'string' || !field.salt) {
+        result.errors.push('Missing per-field salt for: ' + field.path)
+        continue
+      }
+      var fieldData = field.path + ':' + JSON.stringify(field.value) + ':' + field.salt
       var computedHash = Hash.sha256(Buffer.from(fieldData, 'utf8')).toString('hex')
       
       if (computedHash !== field.hash) {
@@ -235,7 +270,10 @@ ZKProver.generateAgeProof = function(birthDate, minimumAge, salt) {
     meetsRequirement: true,
     birthDateCommitment: commitment,
     ageProofHash: ageProofHash,
-    challengeResponse: ZKProver._generateAgeChallenge(birthDate, minimumAge, salt)
+    challengeResponse: ZKProver._generateAgeChallenge(birthDate, minimumAge, salt),
+    // As with the range proof: the commitment can only be checked by opening it, and
+    // opening it reveals the birth date. Returned alongside the proof, never inside it.
+    opening: { birthDate: birthDateString, salt: salt }
   }
 }
 
@@ -245,7 +283,7 @@ ZKProver.generateAgeProof = function(birthDate, minimumAge, salt) {
  * @param {Number} requiredAge - Required minimum age
  * @returns {Boolean} True if proof is valid
  */
-ZKProver.verifyAgeProof = function(proof, requiredAge) {
+ZKProver.verifyAgeProof = function(proof, requiredAge, opening) {
   try {
     $.checkArgument(proof && typeof proof === 'object', 'Invalid proof')
     $.checkArgument(typeof requiredAge === 'number', 'Required age must be number')
@@ -258,15 +296,40 @@ ZKProver.verifyAgeProof = function(proof, requiredAge) {
     if (proof.minimumAge !== requiredAge) {
       return false
     }
-    
-    if (!proof.meetsRequirement) {
+
+    // Same defect as verifyRangeProof, and the same fix. This used to accept
+    // `proof.meetsRequirement` — the prover's own claim — and then check only that
+    // `challengeResponse` was a non-empty string, which any forged proof satisfies.
+    // `birthDateCommitment` was never opened.
+    //
+    // The commitment is over the birth date, so verifying it requires the birth date.
+    // That reveals it, which is precisely what an age proof is supposed to avoid — the
+    // honest reading is that this construction cannot do what its name promises, and a
+    // caller who needs real age proofs needs a different primitive.
+    if (!opening || typeof opening !== 'object') {
       return false
     }
-    
-    // Verify challenge response (simplified)
-    // In production, this would use more sophisticated ZK techniques
-    return proof.challengeResponse && proof.challengeResponse.length > 0
-    
+    var birthDate = opening.birthDate
+    if (typeof birthDate === 'string') birthDate = new Date(birthDate)
+    if (!(birthDate instanceof Date) || isNaN(birthDate.getTime())) {
+      return false
+    }
+    if (typeof opening.salt !== 'string') {
+      return false
+    }
+
+    var birthDateString = birthDate.toISOString().split('T')[0]
+    var commitment = Hash.sha256(
+      Buffer.from(birthDateString + ':' + opening.salt, 'utf8')
+    ).toString('hex')
+    if (commitment !== proof.birthDateCommitment) {
+      return false
+    }
+
+    // Recompute the age rather than trusting `meetsRequirement`.
+    var ageInYears = Math.floor((Date.now() - birthDate.getTime()) / (365.25 * 24 * 60 * 60 * 1000))
+    return ageInYears >= requiredAge
+
   } catch (error) {
     return false
   }
@@ -291,7 +354,8 @@ ZKProver.generateRangeProof = function(value, min, max, salt) {
   // Create commitment to value
   var commitment = Hash.sha256(Buffer.from(value.toString() + ':' + salt, 'utf8')).toString('hex')
   
-  // Generate proof components (simplified Bulletproof-style)
+  // Generate proof components. NOT a Bulletproof — this is a hash commitment plus a
+  // hash over the parameters. It says nothing without the opening returned below.
   var proofData = {
     min: min,
     max: max,
@@ -309,7 +373,13 @@ ZKProver.generateRangeProof = function(value, min, max, salt) {
     range: { min: min, max: max },
     valueCommitment: commitment,
     proofHash: proofHash,
-    inRange: true
+    inRange: true,
+    // The OPENING. verifyRangeProof() cannot check the commitment without it, so the
+    // holder must pass it to the verifier out of band. It is returned here rather than
+    // embedded in the proof precisely because handing it over reveals the value — that
+    // disclosure is the cost of a commitment scheme, and hiding it inside the proof
+    // would make every proof self-opening.
+    opening: { value: value, salt: salt }
   }
 }
 
@@ -320,20 +390,47 @@ ZKProver.generateRangeProof = function(value, min, max, salt) {
  * @param {Number} max - Expected maximum
  * @returns {Boolean} True if proof is valid
  */
-ZKProver.verifyRangeProof = function(proof, min, max) {
+ZKProver.verifyRangeProof = function(proof, min, max, opening) {
   try {
     $.checkArgument(proof && typeof proof === 'object', 'Invalid proof')
-    
+
     if (proof.type !== 'RangeProof') {
       return false
     }
-    
-    if (proof.range.min !== min || proof.range.max !== max) {
+
+    if (!proof.range || proof.range.min !== min || proof.range.max !== max) {
       return false
     }
-    
-    return proof.inRange === true
-    
+
+    // WITHOUT AN OPENING, NOTHING HAS BEEN PROVEN. This used to end at
+    // `return proof.inRange === true` — a boolean the prover writes about itself, never
+    // checked against `valueCommitment`. Any object of the right shape verified:
+    //
+    //   { type: 'RangeProof', range: { min: 18, max: 120 },
+    //     valueCommitment: '00…', proofHash: 'de…', inRange: true }   -> true
+    //
+    // These are hash commitments, not zero-knowledge proofs: the commitment can only be
+    // checked by opening it, so the holder must supply { value, salt } out of band. That
+    // reveals the value to the verifier, which is the honest cost of this construction
+    // and the reason it must not be described as zero-knowledge.
+    if (!opening || typeof opening !== 'object') {
+      return false
+    }
+    if (typeof opening.value !== 'number' || typeof opening.salt !== 'string') {
+      return false
+    }
+
+    // The commitment must actually open to the claimed value...
+    var commitment = Hash.sha256(
+      Buffer.from(opening.value.toString() + ':' + opening.salt, 'utf8')
+    ).toString('hex')
+    if (commitment !== proof.valueCommitment) {
+      return false
+    }
+
+    // ...and that value must genuinely lie in the range, rather than the prover saying so.
+    return opening.value >= min && opening.value <= max
+
   } catch (error) {
     return false
   }

package/lib/script/interpreter.js

@@ -322,9 +322,28 @@ Interpreter.LOCKTIME_THRESHOLD_BN = new BN(Interpreter.LOCKTIME_THRESHOLD)
 Interpreter.useGenesisLimits = function (max) {
   max = max || 0x7fffffff
   Interpreter.MAX_SCRIPT_ELEMENT_SIZE = max
-  Interpreter.MAXIMUM_ELEMENT_SIZE = max
   Interpreter.MAX_OPS_PER_SCRIPT = max
   Interpreter.MAX_SCRIPT_SIZE = max
+
+  // MAXIMUM_ELEMENT_SIZE is deliberately NOT raised. It is CScriptNum's `max_length`,
+  // and since the limits became era-derived it serves only as the PRE-Genesis fallback
+  // for `maxScriptNumLength()` — post-Genesis is 750,000 and post-Chronicle 32,000,000,
+  // both reached through the era flags rather than this static.
+  //
+  // Raising it therefore could not enable post-Genesis arithmetic; it could only corrupt
+  // pre-Genesis validation, and it did. Measured, a 5-byte operand under
+  // P2SH,STRICTENC:
+  //
+  //   fresh process:            SCRIPT_ERR_SCRIPTNUM_OVERFLOW   (what the node says)
+  //   after useGenesisLimits(): ACCEPTED
+  //
+  // A false accept, in the direction that can cost money, produced by a process-wide
+  // side effect on unrelated code later in the same process. The node's own vectors
+  // agree: all 22 SCRIPTNUM_OVERFLOW rows are pre-Genesis, and raising this static turns
+  // 15 of them into false accepts.
+  //
+  // For post-Genesis arithmetic, pass the era — `Interpreter.mainnetFlags()`, or simply
+  // omit the flags argument, which now defaults to current mainnet.
   return Interpreter
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "8.0.1",
+  "version": "8.2.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -117,6 +117,7 @@
     "message/",
     "mnemonic/",
     "build/",
+    "tools/",
     "*-entry.js",
     "bsv.min.js",
     "bsv.bundle.js",
@@ -187,7 +188,7 @@
     "preimage",
     "secret-splitting",
     "did-resolution",
-    "zero-knowledge-proofs",
+    "selective-disclosure",
     "blockchain-anchoring",
     "attestation-framework",
     "nchain",

package/test/gdaf/canonicalization.js

@@ -0,0 +1,106 @@
+'use strict'
+
+/* global describe, it */
+
+// GDAF signs a hash of canonical JSON, so the canonicalization IS part of the signature
+// scheme. It was sorted-key JSON that rebuilt the object, which loses the sort: V8 orders
+// integer-like own properties numerically, ahead of string keys, whatever order they were
+// inserted in.
+//
+// Within this library that was deterministic — signing and verification agreed, and no
+// forgery followed. Across implementations it was a verification failure, which for
+// credentials that exist to be checked by other parties is the thing that matters.
+
+require('chai').should()
+var Signer = require('../../lib/gdaf/attestation-signer')
+
+describe('GDAF canonicalization', function () {
+  describe('RFC 8785 conformance', function () {
+    // The concrete divergence. JCS sorts by UTF-16 code unit, where '10' < '2'.
+    it('sorts integer-like keys lexicographically, not numerically', function () {
+      var o = {}
+      o['10'] = 'ten'
+      o['2'] = 'two'
+      Signer._canonicalizeJCS(o).should.equal('{"10":"ten","2":"two"}')
+    })
+
+    it('is what the legacy form got wrong, which is why both exist', function () {
+      var o = {}
+      o['10'] = 'ten'
+      o['2'] = 'two'
+      Signer._canonicalizeJSON(o).should.equal('{"2":"two","10":"ten"}')
+      Signer._canonicalizeJCS(o).should.not.equal(Signer._canonicalizeJSON(o))
+    })
+
+    it('sorts at every depth and leaves arrays in order', function () {
+      Signer._canonicalizeJCS({ z: { b: 1, a: 2 }, a: [3, { d: 1, c: 2 }] })
+        .should.equal('{"a":[3,{"c":2,"d":1}],"z":{"a":2,"b":1}}')
+    })
+
+    it('is insensitive to key insertion order', function () {
+      var x = {}; x.b = 1; x.a = 2
+      var y = {}; y.a = 2; y.b = 1
+      Signer._canonicalizeJCS(x).should.equal(Signer._canonicalizeJCS(y))
+    })
+
+    // These are the same IEEE-754 double, so collapsing them is correct rather than a
+    // weakness — JavaScript has one number type. Pinned so nobody "fixes" it.
+    it('treats 1847, 1847.0 and 1.847e3 as the one number they are', function () {
+      Signer._canonicalizeJCS({ a: 1847 }).should.equal('{"a":1847}')
+      Signer._canonicalizeJCS({ a: 1847.0 }).should.equal('{"a":1847}')
+      Signer._canonicalizeJCS({ a: 1.847e3 }).should.equal('{"a":1847}')
+    })
+
+    it('keeps a number distinct from its string form', function () {
+      Signer._canonicalizeJCS({ a: 1847 }).should.not.equal(Signer._canonicalizeJCS({ a: '1847' }))
+    })
+
+    // JSON.stringify would emit `null` here, silently signing a different document.
+    it('refuses non-finite numbers rather than emitting null', function () {
+      ;(function () { Signer._canonicalizeJCS({ a: NaN }) }).should.throw(/non-finite/)
+      ;(function () { Signer._canonicalizeJCS({ a: Infinity }) }).should.throw(/non-finite/)
+    })
+
+    it('emits unicode and non-BMP characters directly', function () {
+      Signer._canonicalizeJCS({ a: 'é' }).should.equal('{"a":"é"}')
+      Signer._canonicalizeJCS({ a: '😀' }).should.equal('{"a":"😀"}')
+    })
+
+    it('drops undefined members, which JSON cannot represent', function () {
+      Signer._canonicalizeJCS({ a: 1, b: undefined }).should.equal('{"a":1}')
+    })
+
+    it('nulls undefined array elements, as JSON.stringify does', function () {
+      Signer._canonicalizeJCS([1, undefined, 2]).should.equal('[1,null,2]')
+    })
+  })
+
+  describe('hashing and migration', function () {
+    var CRED = { id: 'urn:x', credentialSubject: { name: 'Alice', age: 41 } }
+
+    it('hashes with JCS by default', function () {
+      Signer._hashCredential(CRED).toString('hex')
+        .should.equal(Signer._hashCredential(CRED, Signer.CANONICALIZATION.JCS).toString('hex'))
+    })
+
+    // The migration path. A credential whose keys make the two forms differ must hash
+    // differently, or the legacy fallback in the verifier would be pointless.
+    it('gives a different hash under the legacy form when the forms diverge', function () {
+      var withIntKeys = { '10': 'ten', '2': 'two' }
+      Signer._hashCredential(withIntKeys, Signer.CANONICALIZATION.JCS).toString('hex')
+        .should.not.equal(
+          Signer._hashCredential(withIntKeys, Signer.CANONICALIZATION.LEGACY).toString('hex')
+        )
+    })
+
+    it('agrees between the forms when no integer-like keys are present', function () {
+      Signer._hashCredential(CRED, Signer.CANONICALIZATION.JCS).toString('hex')
+        .should.equal(Signer._hashCredential(CRED, Signer.CANONICALIZATION.LEGACY).toString('hex'))
+    })
+
+    it('exposes both forms by name', function () {
+      Signer.CANONICALIZATION.JCS.should.equal('jcs')
+      Signer.CANONICALIZATION.LEGACY.should.equal('legacy')
+    })
+  })
+})

package/test/gdaf/zk_prover.js

@@ -0,0 +1,204 @@
+'use strict'
+
+/* global describe, it */
+
+// This module had ZERO test coverage, and carried three defects that coverage would have
+// caught immediately. Each is pinned below as the attack that worked, not as a paraphrase
+// of the fix, so a regression reproduces the exploit rather than merely failing a check.
+//
+// It is also not zero-knowledge, and the tests say so where it matters: the range and age
+// commitments can only be verified by opening them, which reveals the committed value.
+
+require('chai').should()
+var bsv = require('../..')
+var ZK = require('../../lib/gdaf/zk-prover')
+var Hash = require('../../lib/crypto/hash')
+
+var CRED = {
+  id: 'urn:x',
+  credentialSubject: { name: 'Alice', partyAffiliation: 'DEM', eligible: true }
+}
+
+describe('ZKProver', function () {
+  describe('range proofs', function () {
+    // The original read `return proof.inRange === true` — a boolean the prover writes
+    // about itself. valueCommitment was never consulted, so this forgery verified.
+    it('rejects a forged proof that merely claims inRange', function () {
+      var forged = {
+        type: 'RangeProof',
+        range: { min: 18, max: 120 },
+        valueCommitment: '00'.repeat(32),
+        proofHash: 'de'.repeat(32),
+        inRange: true
+      }
+      ZK.verifyRangeProof(forged, 18, 120).should.equal(false)
+    })
+
+    it('rejects an honest proof presented without its opening', function () {
+      var proof = ZK.generateRangeProof(41, 18, 120)
+      ZK.verifyRangeProof(proof, 18, 120).should.equal(false)
+    })
+
+    it('accepts an honest proof with its opening', function () {
+      var proof = ZK.generateRangeProof(41, 18, 120)
+      ZK.verifyRangeProof(proof, 18, 120, proof.opening).should.equal(true)
+    })
+
+    // The commitment must actually bind the value: a lie about what was committed to
+    // has to fail even though the range and structure are right.
+    it('rejects an opening that does not match the commitment', function () {
+      var proof = ZK.generateRangeProof(41, 18, 120)
+      var lie = { value: 12, salt: proof.opening.salt }
+      ZK.verifyRangeProof(proof, 18, 120, lie).should.equal(false)
+    })
+
+    it('rejects a value outside the stated range even if the commitment opens', function () {
+      var proof = ZK.generateRangeProof(41, 18, 120)
+      ZK.verifyRangeProof(proof, 50, 120, proof.opening).should.equal(false)
+    })
+
+    it('returns a strict boolean', function () {
+      var proof = ZK.generateRangeProof(41, 18, 120)
+      ZK.verifyRangeProof(proof, 18, 120, proof.opening).should.be.a('boolean')
+      ZK.verifyRangeProof({}, 18, 120).should.be.a('boolean')
+    })
+  })
+
+  describe('age proofs', function () {
+    var BIRTH = new Date('1985-01-01T00:00:00Z')
+
+    it('rejects a forged proof that merely claims meetsRequirement', function () {
+      var forged = {
+        type: 'AgeProof',
+        minimumAge: 18,
+        meetsRequirement: true,
+        birthDateCommitment: '00'.repeat(32),
+        challengeResponse: 'anything-non-empty'
+      }
+      ZK.verifyAgeProof(forged, 18).should.equal(false)
+    })
+
+    it('rejects an honest proof presented without its opening', function () {
+      var proof = ZK.generateAgeProof(BIRTH, 18)
+      ZK.verifyAgeProof(proof, 18).should.equal(false)
+    })
+
+    it('accepts an honest proof with its opening', function () {
+      var proof = ZK.generateAgeProof(BIRTH, 18)
+      ZK.verifyAgeProof(proof, 18, proof.opening).should.equal(true)
+    })
+
+    it('rejects an opening that does not match the commitment', function () {
+      var proof = ZK.generateAgeProof(BIRTH, 18)
+      ZK.verifyAgeProof(proof, 18, { birthDate: '2015-01-01', salt: proof.opening.salt })
+        .should.equal(false)
+    })
+  })
+
+  describe('selective disclosure', function () {
+    // THE LEAK. One salt covered every leaf and travelled in the proof, so the sibling
+    // hashes on the Merkle path could be brute-forced back into the withheld fields.
+    // Disclosing only the name recovered id, partyAffiliation and eligible.
+    it('does not leak the withheld fields to someone holding the proof', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+
+      // Everything an attacker gets: the proof's salts and the Merkle path.
+      var salts = proof.disclosedFields.map(function (f) { return f.salt })
+      var siblings = []
+      proof.merkleProofs.forEach(function (mp) {
+        mp.proof.forEach(function (n) { siblings.push(n.hash) })
+      })
+
+      function leaf (p, v, s) {
+        return Hash.sha256(Buffer.from(p + ':' + JSON.stringify(v) + ':' + s, 'utf8')).toString('hex')
+      }
+      function node (a, b) {
+        return Hash.sha256(Buffer.from(a + b, 'hex')).toString('hex')
+      }
+
+      var paths = ['id', 'credentialSubject.partyAffiliation', 'credentialSubject.eligible']
+      var values = ['urn:x', 'DEM', 'REP', 'IND', true, false]
+      var recovered = []
+
+      salts.forEach(function (s) {
+        // Direct leaf siblings.
+        paths.forEach(function (p) {
+          values.forEach(function (v) {
+            if (siblings.indexOf(leaf(p, v, s)) !== -1) recovered.push(p)
+          })
+        })
+        // Internal nodes: brute-force the pair beneath them.
+        paths.forEach(function (p1) {
+          values.forEach(function (v1) {
+            paths.forEach(function (p2) {
+              values.forEach(function (v2) {
+                if (siblings.indexOf(node(leaf(p1, v1, s), leaf(p2, v2, s))) !== -1) {
+                  recovered.push(p1, p2)
+                }
+              })
+            })
+          })
+        })
+      })
+
+      recovered.should.deep.equal([], 'recovered withheld fields: ' + recovered.join(', '))
+    })
+
+    it('never ships the master salt, which would reopen every leaf', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+      ;(proof.salt === undefined).should.equal(true)
+    })
+
+    // The generated salt used to be dropped on the floor: the proof returned the
+    // (undefined) `salt` ARGUMENT rather than the one createMerkleTree produced, so a
+    // proof made without an explicit salt could never verify.
+    it('verifies a proof generated without an explicit salt', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'])
+      var result = ZK.verifySelectiveProof(proof, proof.credentialRoot)
+      result.valid.should.equal(true, JSON.stringify(result.errors))
+    })
+
+    it('verifies a proof generated with an explicit salt', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+      ZK.verifySelectiveProof(proof, proof.credentialRoot).valid.should.equal(true)
+    })
+
+    it('rejects a tampered disclosed value', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+      proof.disclosedFields[0].value = 'Mallory'
+      ZK.verifySelectiveProof(proof, proof.credentialRoot).valid.should.equal(false)
+    })
+
+    it('rejects a proof checked against the wrong root', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+      ZK.verifySelectiveProof(proof, '00'.repeat(32)).valid.should.equal(false)
+    })
+
+    it('rejects a field whose salt has been stripped', function () {
+      var proof = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'aa'.repeat(16))
+      delete proof.disclosedFields[0].salt
+      ZK.verifySelectiveProof(proof, proof.credentialRoot).valid.should.equal(false)
+    })
+
+    // Deterministic trees are still available for callers that need them, without the
+    // single-salt weakness that made them dangerous.
+    it('is deterministic given the same master salt', function () {
+      var a = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'bb'.repeat(16))
+      var b = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'bb'.repeat(16))
+      a.credentialRoot.should.equal(b.credentialRoot)
+    })
+
+    it('gives different roots for different master salts', function () {
+      var a = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'bb'.repeat(16))
+      var b = ZK.generateSelectiveProof(CRED, ['credentialSubject.name'], 'cc'.repeat(16))
+      a.credentialRoot.should.not.equal(b.credentialRoot)
+    })
+  })
+
+  // The module is reachable from the public GDAF surface, so the fixes above are not
+  // internal-only.
+  it('is exposed on the GDAF instance', function () {
+    var g = new bsv.GDAF()
+    ;(typeof g.zkProver.verifyRangeProof).should.equal('function')
+  })
+})